hjgrui... str.sys

[xtof]

Hi,

I've been infected by alureon-ch some days ago

I ran AVAST, Hijackthis, MBAM and install outpost.

It looks clean:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:05:50, on 15/07/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

C:\Program Files\VMware\VMware Workstation\hqtray.exe

C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe

C:\Program Files\DVICO\TViXNetShare\TViXNetShare.exe

C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe

C:\Program Files\Logitech\SetPoint\SetPoint.exe

C:\Program Files\Google\Update\GoogleUpdate.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\NVIDIA Corporation\Performance Drivers\nvPDsvc.exe

C:\Program Files\Fichiers communs\Logishrd\KHAL2\KHALMNPR.EXE

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\VMware\VMware Workstation\vmware-authd.exe

C:\Program Files\Fichiers communs\VMware\VMware Virtual Image Editing\vmount2.exe

C:\WINDOWS\system32\vmnat.exe

C:\WINDOWS\system32\vmnetdhcp.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\BOINC\boincmgr.exe

C:\Program Files\BOINC\boinc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe

O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Fichiers communs\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [securDisc] C:\Program Files\Nero\Nero8\InCD\NBHGui.exe

O4 - HKLM\..\Run: [inCD] C:\Program Files\Nero\Nero8\InCD\InCD.exe

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [EPSON Stylus Photo R300 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE /P30 "EPSON Stylus Photo R300 Series" /O6 "USB001" /M "Stylus Photo R300"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [vmware-tray] C:\Program Files\VMware\VMware Workstation\vmware-tray.exe

O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Workstation\hqtray.exe"

O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice

O4 - HKLM\..\Run: [OutpostFeedBack] "C:\Program Files\Agnitum\Outpost Firewall\feedback.exe" /dump:os_startup

O4 - HKCU\..\Run: [TViXNetShare] C:\Program Files\DVICO\TViXNetShare\TViXNetShare.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE LOCAL')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICE R

[Fatdcuk]

Hi ya and welcome toi the MBAM forums

Yes CLB/Alureon is still active and also their is new Rustock rootkit variant on board too.

1 rooter at a time so please open rootrepeal and run Hidden file scan only.

Locate the following line only in rootrepeal and highlight it,right click and select *wipe file*

Path: C:\WINDOWS\system32\drivers\hjgruijecoempv.sys

Status: Invisible to the Windows API!

Immediately close Rootrepeal and reboot!

Next run MBAM Quick scan, allow it to remove what it finds and reboot.

Please post back the MBAM scan log that was generated.

Thanks in advance

[xtof]

OK,

I did a complete exam (oups):

Malwarebytes' Anti-Malware 1.38

Version de la base de donn

[Fatdcuk]

Ok,

I will need to see 2 more logs before i can sound the all clear

STEP 01

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

http://www.forospyware.com/sUBs/ComboFix.exe' rel="external nofollow">

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Click
  Yes
  to allow ComboFix to continue scanning for malware.
  
  
• When the tool is finished, it will produce a report for you.
  
  
• Please post the
  C:\ComboFix.txt
  along with a
  new HijackThis log
  so we may continue cleaning the system.
  
  

[xtof]

Is there any problem with the running of combofix if I close my internet connection before stopping all protection software?

[xtof]

Is there any problem with the running of combofix if I close my internet connection before stopping all protection software?

Sorry, after carefully reading... I'll let it work as it wants.

[Fatdcuk]

There should'nt be...is it not running ?

[xtof]

Here we are:

ComboFix 09-07-14.08 - xtof 15/07/2009 17:53.1.2 - NTFSx86

Microsoft Windows XP Professionnel 5.1.2600.3.1252.33.1036.18.2047.1588 [GMT 2:00]

Running from: c:\documents and settings\xtof\Bureau\ComboFix.exe

AV: avast! antivirus 4.8.1335 [VPS 090714-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

FW: Outpost Firewall *disabled* {8A20CA2A-9E02-4A64-923B-0A38208EB7FD}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\recycler\S-1-5-21-436374069-2139871995-1801674531-1003

c:\windows\system32\hjgruiephwaitp.dat

c:\windows\system32\hjgruiptdotjin.dat

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_hjgruilopxseap

((((((((((((((((((((((((( Files Created from 2009-06-15 to 2009-07-15 )))))))))))))))))))))))))))))))

.

2009-07-15 15:56 . 2009-07-15 15:56 60416 ----a-w- c:\temp\Perflib_Perfdata__755.dat

2009-07-15 12:22 . 2009-04-06 09:37 704384 ----a-w- c:\windows\system32\drivers\SandBox.sys

2009-07-15 12:22 . 2009-02-10 14:15 257432 ----a-w- c:\windows\system32\drivers\afwcore.sys

2009-07-15 12:20 . 2009-02-18 15:30 31128 ----a-w- c:\windows\system32\drivers\afw.sys

2009-07-15 12:20 . 2009-07-15 15:56 -------- d-----w- c:\temp\sdi

2009-07-15 12:20 . 2009-07-15 12:20 -------- d-----w- c:\program files\Agnitum

2009-07-15 12:20 . 2009-07-15 12:25 -------- d-----w- c:\temp\is-7S22E.tmp

2009-07-15 12:20 . 2009-07-15 12:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Agnitum

2009-07-15 12:20 . 2009-07-15 12:20 -------- d-----w- c:\temp\is-T5UUM.tmp

2009-07-13 05:49 . 2009-07-15 15:56 -------- d-----w- c:\temp\e4jA.tmp_dir8089

2009-07-11 12:35 . 2009-07-14 13:38 -------- d-----w- c:\temp\hsperfdata_xtof

2009-07-11 07:44 . 2009-07-11 17:19 -------- d-----w- c:\temp\_avast4_

2009-07-10 13:45 . 2009-07-10 13:45 71680 ----a-w- c:\windows\system32\drivers\bveeip.sys

2009-07-08 13:51 . 2009-07-15 12:19 -------- d-----w- c:\documents and settings\xtof\Application Data\vlc

2009-07-08 08:32 . 2009-07-08 08:32 -------- d-----w- c:\program files\xp-AntiSpy

2009-07-08 07:21 . 2008-04-13 07:34 29311 -c--a-w- c:\windows\system32\dllcache\watv01nt.sys

2009-07-08 07:20 . 2001-08-23 15:47 28672 -c--a-w- c:\windows\system32\dllcache\umaxu40.dll

2009-07-08 07:19 . 2001-08-17 18:10 28232 -c--a-w- c:\windows\system32\dllcache\tos4mo.sys

2009-07-08 07:18 . 2001-08-23 14:57 17024 -c--a-w- c:\windows\system32\dllcache\stcusb.sys

2009-07-08 07:17 . 2008-04-13 07:35 63547 -c--a-w- c:\windows\system32\dllcache\sla30nd5.sys

2009-07-08 07:16 . 2008-04-13 09:40 43904 -c--a-w- c:\windows\system32\dllcache\sbp2port.sys

2009-07-08 07:15 . 2001-08-23 15:18 899914 -c--a-w- c:\windows\system32\dllcache\r2mdkxga.sys

2009-07-08 07:14 . 2001-08-17 20:07 5504 -c--a-w- c:\windows\system32\dllcache\perc2hib.sys

2009-07-08 07:13 . 2001-08-23 15:46 123776 -c--a-w- c:\windows\system32\dllcache\nv3.dll

2009-07-08 07:12 . 2008-04-13 07:34 452736 -c--a-w- c:\windows\system32\dllcache\mtxparhm.sys

2009-07-08 07:11 . 2008-04-13 17:07 422528 -c--a-w- c:\windows\system32\dllcache\ltmdmntt.sys

2009-07-08 07:10 . 2008-04-14 12:00 81920 -c--a-w- c:\windows\system32\dllcache\ieencode.dll

2009-07-08 07:09 . 2001-08-17 19:28 67167 -c--a-w- c:\windows\system32\dllcache\hsf_bsc2.sys

2009-07-08 07:08 . 2008-04-13 07:35 34173 -c--a-w- c:\windows\system32\dllcache\forehe.sys

2009-07-08 07:07 . 2001-08-17 18:12 19594 -c--a-w- c:\windows\system32\dllcache\e100isa4.sys

2009-07-08 07:06 . 2001-08-23 15:47 44544 -c--a-w- c:\windows\system32\dllcache\cnusd.dll

2009-07-08 07:05 . 2001-08-23 15:46 96128 -c--a-w- c:\windows\system32\dllcache\ati.dll

2009-07-07 22:23 . 2009-07-07 22:23 -------- d-----w- c:\documents and settings\xtof\Application Data\Uniblue

2009-07-07 22:23 . 2009-07-15 15:56 -------- d-----w- c:\temp\is-IH9O1.tmp

2009-07-07 13:40 . 2009-07-07 13:40 -------- d--h--w- c:\windows\system32\GroupPolicy

2009-07-07 11:47 . 2009-07-07 11:47 -------- d-----w- c:\program files\Trend Micro

2009-07-07 10:50 . 2009-07-07 10:50 3561743 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-07-07 10:50 . 2009-07-07 10:50 -------- d-----w- c:\documents and settings\xtof\Application Data\Malwarebytes

2009-07-07 10:50 . 2009-06-17 09:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-07 10:50 . 2009-07-07 10:51 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-07 10:50 . 2009-07-07 10:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-07 10:50 . 2009-06-17 09:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-07 07:06 . 2009-07-07 07:06 -------- d-----w- c:\documents and settings\xtof\Application Data\GlarySoft

2009-07-07 06:43 . 2009-07-07 06:45 -------- d-----w- c:\windows\system32\NtmsData

2009-07-07 00:13 . 2009-07-07 00:13 -------- d-sh--w- c:\documents and settings\xtof\IECompatCache

2009-07-07 00:04 . 2009-07-07 00:04 -------- d-----w- c:\program files\CCleaner

2009-07-06 13:06 . 2009-07-06 13:06 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache

2009-07-06 12:54 . 2009-07-06 12:56 -------- d-----w- c:\program files\TagRename

2009-07-06 08:36 . 2002-01-05 03:37 344064 ----a-w- c:\windows\system32\msvcr70.dll

2009-07-04 22:03 . 2009-07-04 22:03 294912 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\ap_graphics_5.03_windows_intelx86.exe

2009-07-04 22:03 . 2009-07-04 22:03 471040 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\astropulse_5.03_windows_intelx86.exe

2009-07-01 08:06 . 2009-07-01 08:06 -------- d-----w- c:\documents and settings\xtof\Application Data\Hewlett-Packard

2009-07-01 08:05 . 2008-04-13 09:45 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-07-01 08:05 . 2008-04-13 09:45 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-07-01 08:03 . 2009-07-01 08:03 -------- d-----w- c:\program files\Fichiers communs\Hewlett-Packard

2009-07-01 08:03 . 2009-07-01 08:03 -------- d-----w- c:\program files\Hewlett-Packard

2009-07-01 07:33 . 2009-07-01 07:33 -------- d-----w- c:\documents and settings\All Users\Application Data\TomTom

2009-07-01 07:32 . 2009-07-01 07:32 -------- d-----w- c:\program files\TomTom International B.V

2009-07-01 07:32 . 2009-07-01 07:32 -------- d-----w- c:\program files\TomTom HOME 2

2009-06-26 06:50 . 2009-06-26 06:53 294912 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\ap_graphics_5.05_windows_intelx86.exe

2009-06-26 06:49 . 2009-06-26 06:50 479232 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\astropulse_5.05_windows_intelx86.exe

2009-06-25 12:17 . 2009-06-25 12:17 -------- d-----w- c:\documents and settings\xtof\Application Data\Sonic Foundry

2009-06-25 12:17 . 2009-06-25 12:17 -------- d-----w- c:\program files\Sonic Foundry

2009-06-25 12:17 . 2001-10-19 12:40 438608 ----a-w- c:\windows\system32\wmv8dmod.dll

2009-06-25 12:17 . 2001-10-19 12:40 665424 ----a-w- c:\windows\system32\wmv8dmoe.dll

2009-06-25 12:17 . 2001-10-19 12:40 1683792 ----a-w- c:\windows\system32\wmvcore2.dll

2009-06-25 12:17 . 2001-10-19 12:39 572752 ----a-w- c:\windows\system32\wmvdmoe.dll

2009-06-25 12:17 . 2009-06-25 12:17 -------- d-----w- c:\program files\Sonic Foundry Setup

2009-06-24 04:42 . 2009-07-15 16:00 -------- d-----w- c:\temp\vmware-xtof

2009-06-23 12:14 . 2009-06-23 12:14 -------- d-----w- c:\program files\PowerISO

2009-06-23 12:09 . 2002-06-19 12:41 263680 ----a-w- c:\program files\aports.exe

2009-06-22 21:32 . 2004-03-29 14:23 90112 ----a-w- c:\windows\unvise32.exe

2009-06-22 21:31 . 2009-06-23 16:28 -------- d-----w- c:\program files\DAZ

2009-06-22 21:31 . 2009-06-22 21:31 -------- d-----w- c:\program files\Fichiers communs\DAZ

2009-06-22 15:57 . 2008-12-10 14:14 4411392 ----a-w- c:\program files\mplayerc.exe

2009-06-22 15:56 . 2009-06-22 15:56 -------- d-----w- c:\documents and settings\xtof\Application Data\Media Player Classic

2009-06-22 14:45 . 2009-06-25 11:54 -------- d-----w- c:\program files\HighGrow

2009-06-22 13:01 . 2009-06-22 13:01 -------- d-----w- c:\program files\Glary Utilities

2009-06-22 12:18 . 2009-06-22 12:18 406016 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setiathome_6.03_windows_intelx86.exe

2009-06-22 12:18 . 2009-06-22 12:18 267776 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setigraphics_6.03_windows_intelx86.exe

2009-06-22 09:02 . 2009-07-08 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet

2009-06-22 08:54 . 2009-06-22 08:54 -------- d-----w- c:\program files\Fichiers communs\Macrovision Shared

2009-06-21 12:04 . 2009-07-15 16:00 -------- d-----w- c:\documents and settings\xtof\Application Data\VMware

2009-06-21 12:01 . 2009-07-15 16:00 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware

2009-06-21 12:00 . 2007-05-01 20:51 16816 ----a-r- c:\windows\system32\drivers\vmnetadapter.sys

2009-06-21 12:00 . 2007-05-01 20:51 13104 ----a-r- c:\windows\system32\vnetinst.dll

2009-06-21 12:00 . 2007-05-01 20:51 121648 ----a-w- c:\windows\system32\vmnetdhcp.exe

2009-06-21 12:00 . 2007-05-01 20:52 25264 ----a-w- c:\windows\system32\drivers\vmnetuserif.sys

2009-06-21 12:00 . 2007-05-01 20:52 150320 ----a-w- c:\windows\system32\vmnat.exe

2009-06-21 12:00 . 2007-05-01 20:51 50992 ----a-r- c:\windows\system32\vmnetbridge.dll

2009-06-21 12:00 . 2007-05-01 20:51 28592 ----a-r- c:\windows\system32\drivers\vmnetbridge.sys

2009-06-21 12:00 . 2007-05-01 20:51 17712 ----a-r- c:\windows\system32\drivers\vmnet.sys

2009-06-21 12:00 . 2007-05-01 20:51 437040 ----a-w- c:\windows\system32\vnetlib.dll

2009-06-21 12:00 . 2007-05-01 20:52 21040 ----a-w- c:\windows\system32\drivers\VMkbd.sys

2009-06-21 11:59 . 2009-07-15 16:01 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware

2009-06-21 11:59 . 2009-06-21 11:59 -------- d-----w- c:\program files\VMware

2009-06-21 11:59 . 2009-06-21 11:59 -------- d-----w- c:\program files\Fichiers communs\VMware

2009-06-20 14:49 . 2009-06-20 14:49 -------- d-sh--w- c:\documents and settings\xtof\PrivacIE

2009-06-20 13:50 . 2009-06-20 13:50 -------- d-----w- c:\documents and settings\xtof\Local Settings\Application Data\TomTom

2009-06-20 13:50 . 2009-06-20 13:50 -------- d-----w- c:\documents and settings\xtof\Application Data\TomTom

2009-06-19 08:05 . 2009-06-19 08:05 -------- d-sh--w- c:\documents and settings\xtof\IETldCache

2009-06-19 07:07 . 2009-04-30 21:16 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-06-19 07:07 . 2009-04-30 21:16 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-06-19 07:07 . 2009-06-19 07:07 -------- d-----w- c:\windows\ie8updates

2009-06-19 07:06 . 2009-05-12 05:11 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-06-19 07:05 . 2009-06-19 07:06 -------- dc-h--w- c:\windows\ie8

2009-06-18 10:19 . 2009-06-18 10:19 -------- d--h--r- c:\documents and settings\xtof\Application Data\SecuROM

2009-06-17 12:54 . 2009-06-24 12:40 -------- d-----w- c:\documents and settings\All Users\Application Data\TrackMania

2009-06-17 12:52 . 2009-06-17 12:53 -------- d-----w- c:\program files\TmNationsForever

2009-06-16 15:07 . 2009-06-16 15:07 448600 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\libfftw3f-3-1-1a_upx.dll

2009-06-16 15:07 . 2009-06-16 15:07 389120 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cufft.dll

2009-06-16 15:07 . 2009-06-16 15:07 1445888 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\setiathome_6.08_windows_intelx86__cuda.exe

2009-06-16 15:07 . 2009-06-16 15:07 192512 ----a-w- c:\documents and settings\All Users\Application Data\BOINC\projects\setiathome.berkeley.edu\cudart.dll

2009-06-16 14:42 . 2009-07-15 14:49 -------- d-----w- c:\documents and settings\All Users\Application Data\BOINC

2009-06-16 14:42 . 2009-06-16 14:43 -------- d-----w- c:\program files\BOINC

2009-06-16 14:41 . 2009-06-22 12:42 -------- d-----w- c:\windows\Downloaded Installations

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-15 12:36 . 2008-04-14 12:00 14336 ----a-w- c:\windows\system32\svchost.exe

2009-07-15 05:22 . 2009-05-07 16:06 1 ----a-w- c:\documents and settings\xtof\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys

2009-07-15 05:15 . 2009-04-23 16:36 -------- d-----w- c:\program files\Mozilla Thunderbird

2009-07-14 13:38 . 2009-04-23 16:41 -------- d-----w- c:\documents and settings\xtof\Application Data\Azureus

2009-07-14 08:19 . 2009-04-23 16:34 -------- d-----w- c:\documents and settings\xtof\Application Data\XnView

2009-07-14 07:27 . 2009-05-10 05:54 -------- d-----w- c:\documents and settings\xtof\Application Data\dvdcss

2009-07-14 06:49 . 2009-05-07 09:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-07-06 08:46 . 2009-04-26 14:18 37472 ---ha-w- c:\windows\Fonts\infoview.fon

2009-07-01 07:31 . 2009-04-23 15:55 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-06-23 06:24 . 2008-04-14 12:00 72698 ----a-w- c:\windows\system32\perfc00C.dat

2009-06-23 06:24 . 2008-04-14 12:00 461332 ----a-w- c:\windows\system32\perfh00C.dat

2009-06-22 16:01 . 2009-04-26 14:34 -------- d-----w- c:\documents and settings\xtof\Application Data\DivX

2009-06-22 13:59 . 2009-04-23 16:23 -------- d-----w- c:\documents and settings\All Users\Application Data\TechSmith

2009-06-22 13:59 . 2009-04-23 16:23 -------- d-----w- c:\program files\TechSmith

2009-06-22 13:58 . 2009-04-23 15:41 -------- d-----w- c:\program files\Fichiers communs\Wise Installation Wizard

2009-06-22 13:41 . 2009-04-23 16:13 34256 ----a-w- c:\documents and settings\xtof\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-06-22 12:48 . 2009-04-23 16:34 -------- d-----w- c:\program files\XnView

2009-06-22 08:58 . 2009-04-26 14:16 -------- d-----w- c:\program files\Fichiers communs\Adobe

2009-06-17 14:09 . 2009-04-23 16:16 -------- d-----w- c:\program files\Java

2009-06-17 13:30 . 2009-05-31 11:25 -------- d-----w- c:\program files\Ubisoft

2009-06-16 14:40 . 2008-04-14 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:40 . 2008-04-14 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-15 08:19 . 2009-06-15 08:19 -------- d-----w- c:\program files\JRE

2009-06-15 08:19 . 2009-04-23 16:16 -------- d-----w- c:\program files\OpenOffice.org 3

2009-06-11 22:11 . 2009-06-11 22:11 10684866 ----a-w- c:\documents and settings\xtof\Application Data\Azureus\plugins\azump\mplayer.exe

2009-06-10 09:05 . 2009-06-10 09:05 828160 ----a-w- c:\windows\boinc.scr

2009-06-06 12:24 . 2009-06-06 12:24 -------- d-----w- c:\program files\DVICO

2009-06-03 19:10 . 2008-04-14 12:00 1297408 ----a-w- c:\windows\system32\quartz.dll

2009-06-03 12:03 . 2009-04-23 16:26 -------- d-----w- c:\program files\DivX

2009-06-03 12:03 . 2009-04-23 16:26 -------- d-----w- c:\program files\Fichiers communs\DivX Shared

2009-06-03 11:41 . 2009-06-03 11:41 28108 ----a-w- c:\windows\system32\UNRAR.DLL

2009-06-03 11:41 . 2009-06-03 11:41 25088 ----a-w- c:\windows\system32\UNACE.DLL

2009-06-02 06:29 . 2009-06-02 06:28 -------- d-----w- c:\program files\EPSON

2009-05-31 11:32 . 2009-05-31 11:31 -------- d-----w- c:\program files\Microsoft Encarta

2009-05-31 11:29 . 2009-05-31 11:29 107888 ----a-w- c:\windows\system32\CmdLineExt.dll

2009-05-29 14:02 . 2009-05-29 14:01 -------- d-----w- c:\program files\Ant Movie Catalog

2009-05-19 10:11 . 2009-05-19 10:11 -------- d-----w- c:\documents and settings\xtof\Application Data\Logitech

2009-05-19 10:11 . 2009-05-19 10:11 -------- d-----w- c:\documents and settings\All Users\Application Data\LogiShrd

2009-05-19 10:11 . 2009-05-19 10:11 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf

2009-05-19 10:11 . 2009-05-19 10:11 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf

2009-05-19 10:10 . 2009-05-19 10:10 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf

2009-05-19 10:10 . 2009-05-19 10:10 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

2009-05-19 10:10 . 2009-05-19 10:10 -------- d-----w- c:\program files\Fichiers communs\Logishrd

2009-05-19 10:10 . 2009-05-19 10:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Logitech

2009-05-19 10:10 . 2009-05-19 10:10 -------- d-----w- c:\program files\Logitech

2009-05-14 13:20 . 2009-05-16 11:32 2645832 ----a-w- c:\documents and settings\xtof\Application Data\Mozilla\Firefox\Profiles\tcg2jiyb.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\maconfsetup.exe

2009-05-14 12:56 . 2009-05-16 11:32 402800 ----a-w- c:\documents and settings\xtof\Application Data\Mozilla\Firefox\Profiles\tcg2jiyb.default\extensions\{bb628310-0ab7-11db-9cd8-0800200c9a66}\plugins\nphardwaredetection.dll

2009-05-13 05:04 . 2008-04-14 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-07 15:33 . 2008-04-14 12:00 348672 ----a-w- c:\windows\system32\localspl.dll

2009-05-05 14:50 . 2009-04-23 15:30 86331 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx0c.dll

2009-05-01 21:02 . 2009-05-01 21:02 823296 ----a-w- c:\windows\system32\divx_xx07.dll

2009-05-01 21:02 . 2009-05-01 21:02 815104 ----a-w- c:\windows\system32\divx_xx0a.dll

2009-05-01 21:02 . 2009-05-01 21:02 811008 ----a-w- c:\windows\system32\divx_xx16.dll

2009-05-01 21:02 . 2009-05-01 21:02 802816 ----a-w- c:\windows\system32\divx_xx11.dll

2009-05-01 21:02 . 2009-05-01 21:02 685056 ----a-w- c:\windows\system32\DivX.dll

2009-04-24 16:31 . 2009-04-24 16:31 22328 ----a-w- c:\windows\system32\drivers\PnkBstrK.sys

2009-04-24 16:31 . 2009-04-24 16:31 22328 ----a-w- c:\documents and settings\xtof\Application Data\PnkBstrK.sys

2009-04-24 16:31 . 2009-04-24 16:31 22328 ----a-w- c:\documents and settings\xtof\Application Data\PnkBstrK.sys

2009-04-24 16:31 . 2009-04-24 16:31 103736 ----a-w- c:\windows\system32\PnkBstrB.exe

2009-04-24 16:31 . 2009-04-24 16:31 66872 ----a-w- c:\windows\system32\PnkBstrA.exe

2009-04-24 16:31 . 2009-04-24 16:31 669184 ----a-w- c:\windows\system32\pbsvc.exe

2009-04-23 16:26 . 2009-04-23 16:26 410984 ----a-w- c:\windows\system32\deploytk.dll

2009-04-23 16:25 . 2009-04-23 16:25 152576 ----a-w- c:\documents and settings\xtof\Application Data\Sun\Java\jre1.6.0_13\lzma.dll

2009-04-23 16:12 . 2009-04-23 16:12 0 ----a-w- c:\windows\nsreg.dat

2009-04-23 16:00 . 2009-04-23 16:00 21035 ----a-w- c:\windows\system32\drivers\AegisP.sys

2009-04-23 15:28 . 2009-04-23 15:28 21892 ----a-w- c:\windows\system32\emptyregdb.dat

2009-04-19 19:50 . 2008-04-14 12:00 1847296 ----a-w- c:\windows\system32\win32k.sys

2000-05-24 19:43 . 2009-05-07 16:20 37888 ----a-w- c:\program files\DAMN_NFOViewer.exe

2009-06-13 12:02 . 2009-04-23 16:12 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll

2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TViXNetShare"="c:\program files\DVICO\TViXNetShare\TViXNetShare.exe" [2008-06-25 883200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-01-15 13680640]

"JMB36X IDE Setup"="c:\windows\JM\JMInsIDE.exe" [2006-10-30 36864]

"36X Raid Configurer"="c:\windows\system32\JMRaidSetup.exe" [2006-11-16 1953792]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"NeroFilterCheck"="c:\program files\Fichiers communs\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"SecurDisc"="c:\program files\Nero\Nero8\InCD\NBHGui.exe" [2007-09-20 2044712]

"InCD"="c:\program files\Nero\Nero8\InCD\InCD.exe" [2007-09-20 1077032]

"EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I2F1.EXE" [2003-06-04 99840]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-23 148888]

"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2007-05-01 68400]

"VMware hqtray"="c:\program files\VMware\VMware Workstation\hqtray.exe" [2007-05-01 56112]

"AdobeCS4ServiceManager"="c:\program files\Fichiers communs\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]

"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2009-04-28 2374464]

"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall\feedback.exe" [2009-04-28 428032]

"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-01-15 1657376]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-04-17 16143872]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2008-12-18 76304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Menu D

[Fatdcuk]

Hi ya,

No need to now as ComboFix has done its business.

Both ComboFix and HJT logs are showing clear now

How is the computer,any more issue's as is str.sys no longer being found etc

[xtof]

Thanks a lot:

The logical disk manager is fixed.

Everything looks OK except still having this file in C:\WINDOWS\system32\drivers: bveeip.sys modified the same day than srt.sys and no info at all about it.

What do you think about it, is it the secont rootkit you was talking?

Anyway thanks again it's very instructive.

[Fatdcuk]

Yeah that is the 2nd part of Rustock rootkit but the Rootrepeal logs was'nt showing it as active.

I will get MBAM updated in the next 12hours to attack and delete this orphaned file

I will reply in this topic when the update is available.

[xtof]

OK, I will waiting for you...

thanks again,

[Fatdcuk]

Hi,

Please update MBAM and run quickscan.Allow it to remove what it finds and reboot.

Please rerun MBAM quick scan to confirm str.sys is no longer being detected.

Thanks in advance

[xtof]

Hi,

Sorry for my english, str.sys was removed successfully with the first MBAM scan. I was worrying about bveeip.sys, I can't find any info about it. It's still here but can be deleted manually without any problem. I may be affected by some parano

[Fatdcuk]

Hi and no problem.

Here's a quick way of checking any suspect file, get the benefit of 40 odd second opinions

http://www.virustotal.com

If you can maunally remove it then would suggest if it is malware then it is no longer active or a problem.

See what VT has to say about the file,if any of them flag it then just delete it manually

With that both your ComboFix and HJT logs were good to go so will conclude this help session as finished.

Here's some handy reading tho Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

We hope our application has helped you eradicate this malicious Malware.

If your current anti-virus solution let this infection through please consider purchasing the PRO version of Malwarebytes' Anti-Malware for additional protection against these types of malware.

Safe surfing