Jump to content

Unable to run MB, HijackThis, Combofix, etc.

Tech2Svc
 Share

Recommended Posts

Tech2Svc

Tech2Svc

Posted
Posted

I am unable to run and anti-malware scans on my PC. I was able to run RootRepeal scan and here is this log. Any help would be greatly appreciated.

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2009/07/15 18:26

Program Version: Version 1.3.2.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xEE49E000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF7CD5000 Size: 8192 File Visible: No Signed: -

Status: -

Name: MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys

Image Path: C:\WINDOWS\system32\drivers\MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys

Address: 0xEE730000 Size: 188416 File Visible: - Signed: -

Status: Hidden from the Windows API!

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xEE5D1000 Size: 49152 File Visible: No Signed: -

Status: -

Hidden/Locked Files

-------------------

Path: C:\WINDOWS\Prefetch\ROOTREPEAL.EXE-2768F0B0.pf

Status: Visible to the Windows API, but not on disk.

Path: C:\WINDOWS\system32\MSIVXcount

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\MSIVXsrfulbbjgtntjrgohklvmhjmbbltosyp.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\MSIVXwkmpqqaicgehrtpwkprjuhmwuholtsww.dll

Status: Invisible to the Windows API!

Path: C:\WINDOWS\system32\drivers\MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys

Status: Invisible to the Windows API!

Stealth Objects

-------------------

Object: Hidden Module [Name: MSIVXwkmpqqaicgehrtpwkprjuhmwuholtsww.dll]

Process: svchost.exe (PID: 832) Address: 0x00650000 Address: 57344

Hidden Services

-------------------

Service Name: MSIVXserv.sys

Image PathC:\WINDOWS\system32\drivers\MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys

==EOF==

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted

Hi and welcome to the MBAM forums :(

You have CLB/WinNT Alureon rootkit onboard which is causing the problem.

Lets kill it and get MBAM back into the melee :)

Have Rootrepeal *wipe* the following file only

Path: C:\WINDOWS\system32\drivers\MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys

Status: Invisible to the Windows API!

Immediately reboot and update MBAM.Run Quick scan and allow it to remove what it finds.

Reboot and please post back the MBAM quick scan log.

Link to post
Share on other sites
Tech2Svc

Tech2Svc

Posted
  • Author
Posted

Thanks Fatduk. Here is my MBAM log.

Malwarebytes' Anti-Malware 1.38

Database version: 2297

Windows 5.1.2600 Service Pack 3

7/15/2009 7:27:06 PM

mbam-log-2009-07-15 (19-26-54).txt

Scan type: Quick Scan

Objects scanned: 105623

Time elapsed: 24 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 19

Registry Values Infected: 0

Registry Data Items Infected: 9

Folders Infected: 3

Files Infected: 8

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> No action taken.

HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4d7b-9389-0f166788785a} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3dc201fb-e9c9-499c-a11f-23c360d7c3f8} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63d0ed2c-b45b-4458-8b3b-60c69bbbd83c} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98d9753d-d73b-42d5-8c85-4469cda897ab} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9ff05104-b030-46fc-94b8-81276e4e27df} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> No action taken.

HKEY_CURRENT_USER\SOFTWARE\VideoTools (Trojan.DNSChanger) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\VideoTools (Trojan.DNSChanger) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{b1a2a98e-2bdf-469c-a61b-ed108057985c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{b1a2a98e-2bdf-469c-a61b-ed108057985c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\Tcpip\Parameters\Interfaces\{b1a2a98e-2bdf-469c-a61b-ed108057985c}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.77,85.255.112.206 -> No action taken.

Folders Infected:

c:\documents and settings\Max\Application Data\FunWebProducts (Adware.MyWay) -> No action taken.

c:\documents and settings\Max\application data\funwebproducts\Data (Adware.MyWay) -> No action taken.

c:\documents and settings\Max\application data\funwebproducts\Data\Max (Adware.MyWay) -> No action taken.

Files Infected:

c:\documents and settings\Max\application data\funwebproducts\Data\Max\avatar.dat (Adware.MyWay) -> No action taken.

c:\documents and settings\Max\application data\funwebproducts\Data\Max\register.dat (Adware.MyWay) -> No action taken.

c:\documents and settings\Max\application data\funwebproducts\Data\Max\zbucks.dat (Adware.MyWay) -> No action taken.

c:\WINDOWS\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job (Trojan.FakeAlert) -> No action taken.

C:\WINDOWS\system32\MSIVXcount (Trojan.Agent) -> No action taken.

c:\WINDOWS\system32\MSIVXsrfulbbjgtntjrgohklvmhjmbbltosyp.dll (Trojan.Agent) -> No action taken.

c:\WINDOWS\system32\MSIVXwkmpqqaicgehrtpwkprjuhmwuholtsww.dll (Trojan.Agent) -> No action taken.

c:\WINDOWS\system32\drivers\MSIVXjptiqqpxblxbqbdurwewxnscdotfuwpk.sys (Trojan.Agent) -> No action taken.

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted

Hi ya, worked like a charm :(

Just spotted in your log you are using old MBAM database and also we now have 1.39 versions available.

Please update MBAM to 1.39 and update to our most current database.

Rerun QS and see if it chews out anything else :)

Please post back the MBAM scan log for that run :)

Link to post
Share on other sites
Tech2Svc

Tech2Svc

Posted
  • Author
Posted

Here it new log with updated database. It picked up 1 infection which was Avenger proigram on my desktop. I chose ignore.

Malwarebytes' Anti-Malware 1.39

Database version: 2436

Windows 5.1.2600 Service Pack 3

7/15/2009 8:31:02 PM

mbam-log-2009-07-15 (20-30-33).txt

Scan type: Quick Scan

Objects scanned: 105820

Time elapsed: 12 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites
Fatdcuk

Fatdcuk

Posted
Posted

I would like to see 2 more logs before we can hopefully sound the all clear :(

STEP 01

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:
You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.
Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

http://www.forospyware.com/sUBs/ComboFix.exe' rel="external nofollow">

Note:
The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.
Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.
Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

Link to post
Share on other sites
Tech2Svc

Tech2Svc

Posted
  • Author
Posted

Here is combofix log:

ComboFix 09-07-14.08 - Max 07/15/2009 21:03.1.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.707 [GMT -4:00]

Running from: c:\documents and settings\Max\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Outdated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Max\Favorites\Download programs.url

c:\documents and settings\Max\Favorites\Games.url

c:\documents and settings\Max\Favorites\Translator.url

c:\documents and settings\Max\Favorites\Videos.url

c:\documents and settings\Max\Start Menu\Programs\Download programs.url

c:\documents and settings\Max\Start Menu\Programs\Games.url

c:\documents and settings\Max\Start Menu\Programs\Translator.url

c:\documents and settings\Max\Start Menu\Programs\Videos.url

c:\program files\INSTALL.LOG

c:\windows\system32\w32apiw.dll

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MYWEBSEARCHSERVICE

-------\Service_MyWebSearchService

((((((((((((((((((((((((( Files Created from 2009-06-16 to 2009-07-16 )))))))))))))))))))))))))))))))

.

2009-07-16 00:15 . 2009-07-16 00:15 -------- d-sh--w- c:\documents and settings\Max\IETldCache

2009-07-16 00:12 . 2009-06-02 10:12 102912 -c----w- c:\windows\system32\dllcache\iecompat.dll

2009-07-16 00:12 . 2009-07-16 00:12 -------- d-----w- c:\windows\ie8updates

2009-07-16 00:11 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll

2009-07-16 00:11 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll

2009-07-16 00:08 . 2009-07-16 00:10 -------- dc-h--w- c:\windows\ie8

2009-07-15 23:31 . 2009-07-15 23:31 3775176 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-07-15 23:00 . 2009-07-15 23:00 -------- d-----w- c:\documents and settings\Max\Application Data\Malwarebytes

2009-07-15 23:00 . 2009-07-13 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-07-15 23:00 . 2009-07-15 23:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-07-15 23:00 . 2009-07-15 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-07-15 23:00 . 2009-07-13 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-07-15 22:08 . 2009-07-15 22:08 -------- d-----w- c:\program files\Trend Micro

2009-07-15 21:46 . 2009-07-15 21:46 -------- d-----w- c:\documents and settings\Administrator.OWNER-67029DB1C.000\Local Settings\Application Data\Mozilla

2009-07-06 05:05 . 2009-07-06 05:05 10134 ----a-r- c:\documents and settings\Max\Application Data\Microsoft\Installer\{CAE7D1D9-3794-4169-B4DD-964ADBC534EE}\ARPPRODUCTICON.exe

2009-07-05 18:30 . 2009-07-05 18:30 10134 ----a-r- c:\documents and settings\Max\Application Data\Microsoft\Installer\{4CCC7F68-A437-4559-A840-F5E010934951}\ARPPRODUCTICON.exe

2009-07-03 06:10 . 2009-07-03 06:36 160048 ----a-w- c:\windows\hpqins00.dat

2009-06-29 14:45 . 2009-06-29 14:46 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\HPAppData

2009-06-29 14:45 . 2009-06-29 14:45 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!

2009-06-29 14:45 . 2009-06-29 14:45 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\ATTTOOLBAR

2009-06-29 14:44 . 2009-06-29 14:44 -------- d-----w- c:\program files\VideoTools

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-07-16 00:34 . 2008-08-02 19:14 -------- d-----w- c:\program files\CCleaner

2009-07-15 14:51 . 2009-02-15 02:14 -------- d-----w- c:\documents and settings\All Users\Application Data\ATTToolbar

2009-07-14 18:55 . 2008-05-31 15:14 1 ----a-w- c:\documents and settings\Max\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys

2009-07-14 18:55 . 2008-05-31 15:13 -------- d-----w- c:\documents and settings\Max\Application Data\OpenOffice.org2

2009-07-08 21:00 . 2008-06-01 07:03 164378 ----a-w- c:\windows\hpoins21.dat

2009-06-02 01:12 . 2009-02-15 02:14 -------- d-----w- c:\documents and settings\Max\Application Data\ATTToolbar

2009-05-13 05:15 . 2004-08-04 12:00 915456 ----a-w- c:\windows\system32\wininet.dll

2009-05-07 15:32 . 2004-08-04 12:00 345600 ----a-w- c:\windows\system32\localspl.dll

2009-04-17 12:26 . 2004-08-04 12:00 1847168 ----a-w- c:\windows\system32\win32k.sys

2008-07-03 01:52 . 2008-08-14 19:57 134144 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{EEE6C35D-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgHelper.dll" [2008-07-06 173368]

[HKEY_CLASSES_ROOT\clsid\{eee6c35d-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook.1]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35F-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SweetIM_URLSearchHook.ToolbarURLSearchHook]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}]

2008-07-24 14:22 3790152 ----a-w- c:\documents and settings\Max\Local Settings\Application Data\CyberDefender\cdmyidd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE6C35C-6118-11DC-9C72-001320C79847}]

2008-07-06 16:44 1164600 ----a-w- c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}"= "c:\documents and settings\Max\Local Settings\Application Data\CyberDefender\cdmyidd.dll" [2008-07-24 3790152]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]

[HKEY_CLASSES_ROOT\clsid\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6}]

[HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{CD24EB02-9831-4838-99D0-726D411B1328}]

[HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{A26503FE-B3B8-4910-A9DC-9CBD25C6B8D6}"= "c:\documents and settings\Max\Local Settings\Application Data\CyberDefender\cdmyidd.dll" [2008-07-24 3790152]

"{EEE6C35B-6118-11DC-9C72-001320C79847}"= "c:\program files\SweetIM\Toolbars\Internet Explorer\mgToolbarIE.dll" [2008-07-06 1164600]

[HKEY_CLASSES_ROOT\clsid\{a26503fe-b3b8-4910-a9dc-9cbd25c6b8d6}]

[HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar.1]

[HKEY_CLASSES_ROOT\TypeLib\{CD24EB02-9831-4838-99D0-726D411B1328}]

[HKEY_CLASSES_ROOT\Cdmyidd.SecurityToolbar]

[HKEY_CLASSES_ROOT\clsid\{eee6c35b-6118-11dc-9c72-001320c79847}]

[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE.3]

[HKEY_CLASSES_ROOT\TypeLib\{EEE6C35E-6118-11DC-9C72-001320C79847}]

[HKEY_CLASSES_ROOT\SWEETIE.SWEETIE]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HostManager"="c:\program files\Common Files\AOL\1212268447\ee\AOLSoftware.exe" [2008-06-24 41824]

"ISW.exe"="c:\program files\AT&T\Internet Security Wizard\ISW.exe" [2007-05-03 2061816]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk

backup=c:\windows\pss\Kodak EasyShare software.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk

backup=c:\windows\pss\KODAK Software Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"Viewpoint Manager Service"=2 (0x2)

"MyWebSearchService"=2 (0x2)

"gusvc"=2 (0x2)

"AOL ACS"=2 (0x2)

"iPod Service"=3 (0x3)

"idsvc"=3 (0x3)

"IDriverT"=3 (0x3)

"Bonjour Service"=2 (0x2)

"avg8wd"=2 (0x2)

"avg8emc"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

"aawservice"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=

"c:\\Program Files\\Common Files\\aol\\1212268447\\ee\\aolsoftware.exe"=

"c:\\Program Files\\AOL 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=

"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=

"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

"c:\\Program Files\\AOL 9.1\\waol.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpiscnapp.exe"=

"c:\\Program Files\\Hp\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\ATT-HSI\\McciBrowser.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]

S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/16/2008 9:06 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-07-12 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-07-12 c:\windows\Tasks\Uniblue SpeedUpMyPC Nag.job

- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [2008-08-14 16:25]

2008-08-14 c:\windows\Tasks\Uniblue SpeedUpMyPC.job

- c:\program files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe [2008-08-14 16:25]

.

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultUrl = hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZKxdm021YYUS&fl=0&ptb=4lWr8HxE9PNGMkSPCU7DYg&ind=2008060500&url=http://www.ask.com/web&q={searchTerms}&l=zk&o=sb

uStart Page = hxxp://www.att.net/

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

IE: &AOL Toolbar Search - c:\documents and settings\All Users\Application Data\AOL\ieToolbar\resources\en-US\local\search.html

IE: &Search

Trusted Zone: motive.com\patttbc.att

DPF: ImageUploader - hxxp://www.assetval.com/app/ImageUploader.CAB

DPF: {6FD482A3-7B57-438B-B040-52CAA30147EE} - hxxp://rmlsfl.mlxchange.com/4.3.05.62/Control/MLSClientUtils.cab

DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://rmlsfl.mlxchange.com/5.0.04.41/Control/IRCSharc.cab

FF - ProfilePath - c:\documents and settings\Max\Application Data\Mozilla\Firefox\Profiles\s2zfvtyl.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=

FF - component: c:\documents and settings\Max\Application Data\Mozilla\Firefox\Profiles\s2zfvtyl.default\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}\components\WinampPlayer.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1368.5602\npCIDetect13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-07-15 21:10

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(360)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\aol\acs\AOLacsd.exe

c:\program files\Common Files\Motive\McciCMService.exe

c:\windows\system32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-07-16 21:13 - machine was rebooted

ComboFix-quarantined-files.txt 2009-07-16 01:13

Pre-Run: 55,094,837,248 bytes free

Post-Run: 57,690,214,400 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.