Jump to content

Infected with a Trojan


Recommended Posts

Hi, I am working on my family's computer.

I ran MBAM and Avira AntiVirus to remove a trojan. I think it was Windows Defender.

But there are still effects. After cleaning the computer with the antivirus tools, its fine. But signs show back up later and I need to redo the scans. Mainly the problem is when I click on a google search item, a pop up will show up instead of actually going to the link.

Thank you for any help you can provide.

Jon

Included are the log files for Malwarebytes and HijackThis

mbam_log_2009_08_22__13_23_26_.txt

hijackthis.txt

Link to post
Share on other sites

  • Staff

Hi,

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  1. If you are using Firefox, make sure that your download settings are as follows:
    • Tools->Options->Main tab
    • Set to "Always ask me where to Save the files".

[*]During the download, rename Combofix to Combo-Fix as follows:

CF_download_FF.gif

CF_download_rename.gif

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    -----------------------------------------------------------


  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

If you still cannot get this to run, try booting into Safe Mode, and run it there.

To boot into Safe Mode, tap F8 after BIOS, and just before the Windows logo appears. A list of options will appear, select "Safe Mode."

If this doesn't work either, try the same method (above method), but name Combofix.exe to iexplore.exe instead, or winlogon.exe..

This because It also happens in some cases that malware blocks EVERY process except for what is in its own whitelist, so this whitelist also includes system important processes such as iexplore.exe, explorer.exe, winlogon.exe...

Link to post
Share on other sites

  • Staff

Hi,

Some notes first..

I notice from your log that there's more than 1 Antivirus installed. McAfee and Avira

Never install more than one Antivirus and Firewall! Rather than giving you extra protection, it will decrease the reliability of it seriously!

The reason for this is that if both products have their automatic (Real-Time) protection switched on, your system may lock up due to both software products attempting to access the same file at the same time.

Also because more than one Antivirus and Firewall installed are not compatible with eachother, it can cause system performance problems and a serious system slowdown.

So you have to make a decision here and keep the Antivirus you prefer and uninstall the other one.

Then reboot after uninstalling.

Also, I see you have Viewpoint installed...

Viewpoint Manager is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

I suggest you remove the program now. Go to Start > Settings > Control Panel > Add/Remove Programs and remove the following programs if present.


  • Viewpoint
  • Viewpoint Manager
  • Viewpoint Media Player

Then, * Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

Driver::

ahlsx

cwiv

ewdmaudn

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Ohykf"=-

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Link to post
Share on other sites

Here are the contents of the ComboFix:

ComboFix 09-08-25.05 - Frank Louie 08/26/2009 11:31.2.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1535 [GMT -4:00]

Running from: c:\documents and settings\Frank Louie\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\Frank Louie\Desktop\CFScript.txt

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_EWDMAUDN

-------\Service_ahlsx

-------\Service_cwiv

-------\Service_ewdmaudn

((((((((((((((((((((((((( Files Created from 2009-07-26 to 2009-08-26 )))))))))))))))))))))))))))))))

.

2009-08-16 20:33 . 2009-07-28 20:33 55656 ----a-w- c:\windows\system32\drivers\avgntflt.sys

2009-08-16 16:03 . 2009-08-16 16:03 -------- d-----w- c:\documents and settings\Frank Louie\Application Data\Malwarebytes

2009-08-16 15:55 . 2009-08-16 15:55 -------- d-----w- c:\program files\Trend Micro

2009-08-16 15:40 . 2009-08-16 15:40 -------- d-----w- c:\documents and settings\Administrator.DELL\Application Data\Malwarebytes

2009-08-16 15:18 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-08-16 15:18 . 2009-08-16 15:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-08-16 15:13 . 2009-08-16 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-08-16 15:13 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-08-16 14:57 . 2009-08-16 14:57 -------- d-----w- C:\Webroot

2009-08-13 23:17 . 2009-08-13 23:17 -------- d-sh--w- c:\documents and settings\Administrator.DELL\IETldCache

2009-08-13 02:45 . 2009-07-10 13:27 1315328 ------w- c:\windows\system32\dllcache\msoe.dll

2009-08-06 14:44 . 2009-08-06 14:44 -------- d-sh--w- c:\documents and settings\Default User\IETldCache

2009-08-06 14:43 . 2009-08-06 14:43 -------- d-----w- c:\windows\system32\XPSViewer

2009-08-06 14:43 . 2009-08-06 14:43 -------- d-----w- c:\program files\MSBuild

2009-08-06 14:43 . 2009-08-06 14:43 -------- d-----w- c:\program files\Reference Assemblies

2009-08-06 14:42 . 2009-08-06 14:43 -------- d-----w- C:\462fe9817550cb4b8ce830d0d09c57

2009-08-06 14:42 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-08-06 14:42 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-08-06 14:42 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-08-06 14:42 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-08-06 14:42 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll

2009-08-06 14:42 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-08-06 14:42 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-08-06 14:38 . 2009-08-06 14:38 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2009-08-05 09:01 . 2009-08-05 09:01 204800 ------w- c:\windows\system32\dllcache\mswebdvd.dll

2009-08-03 03:51 . 2009-08-03 03:51 -------- d-----w- c:\documents and settings\Frank Louie\Local Settings\Application Data\AbacastDistributedOnDemand

2009-08-03 03:51 . 2009-08-03 03:51 -------- d-----w- c:\documents and settings\Frank Louie\Local Settings\Application Data\Abacast

2009-07-31 14:51 . 2009-07-31 14:51 -------- d-----w- c:\program files\Common Files\SupportSoft

2009-07-31 14:51 . 2009-07-31 14:51 -------- d-----w- c:\windows\DSL

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-08-26 15:48 . 2007-01-14 01:13 -------- d-----w- c:\program files\RSSoft

2009-08-22 19:07 . 2008-09-06 00:41 -------- d-----w- c:\documents and settings\LocalService\Application Data\SACore

2009-08-16 21:07 . 2004-10-15 15:49 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-08-16 21:07 . 2004-10-15 15:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-08-16 15:47 . 2006-12-20 15:19 41416 ----a-w- c:\documents and settings\Administrator.DELL\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-15 20:18 . 2003-10-21 22:29 -------- d-----w- c:\program files\America Online 7.0

2009-08-14 10:42 . 2007-04-09 23:21 -------- d-----w- c:\program files\epson

2009-08-13 23:32 . 2004-12-11 18:00 -------- d-----w- c:\program files\mIRC

2009-08-13 23:31 . 2003-10-16 12:16 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-08-13 23:30 . 2003-10-25 19:13 -------- d-----w- c:\program files\AIM

2009-08-13 23:30 . 2004-10-15 19:36 -------- d-----w- c:\documents and settings\Frank Louie\Application Data\Aim

2009-08-13 23:28 . 2005-10-15 23:35 -------- d-----w- c:\program files\Common Files\AOL

2009-08-13 23:28 . 2004-05-02 17:22 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL

2009-08-13 13:38 . 2006-08-25 02:57 -------- d-----w- c:\program files\McAfee

2009-08-06 19:55 . 2003-10-21 22:08 41416 ----a-w- c:\documents and settings\Frank Louie\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-05 09:01 . 2003-11-29 04:12 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-17 19:01 . 2002-08-29 10:00 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 00:38 . 2009-07-13 21:57 29536 ------w- c:\windows\hpoins03.dat

2009-07-13 14:08 . 2004-08-04 07:56 286720 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-09 23:40 . 2004-11-26 15:10 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-07-03 17:09 . 2004-08-24 01:32 915456 ------w- c:\windows\system32\wininet.dll

2009-06-16 14:36 . 2002-08-29 10:00 81920 ----a-w- c:\windows\system32\fontsub.dll

2009-06-16 14:36 . 2002-08-29 10:00 119808 ----a-w- c:\windows\system32\t2embed.dll

2009-06-12 12:31 . 2002-08-29 10:00 76288 ----a-w- c:\windows\system32\telnet.exe

2009-06-10 14:13 . 2002-08-29 10:00 84992 ----a-w- c:\windows\system32\avifil32.dll

2009-06-10 13:19 . 2002-08-29 10:00 2066432 ----a-w- c:\windows\system32\mstscax.dll

2009-06-10 06:14 . 2002-08-29 10:00 132096 ----a-w- c:\windows\system32\wkssvc.dll

2009-06-03 19:09 . 2003-11-29 04:12 1291264 ----a-w- c:\windows\system32\quartz.dll

2009-01-28 14:57 . 2009-01-28 14:57 27976 ----a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2009-01-28 14:57 . 2009-01-28 14:57 126360 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2009-01-28 14:57 . 2009-01-28 14:58 46408 ----a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

2009-01-28 14:58 . 2009-01-28 14:58 98712 ----a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

2006-02-27 17:01 . 2006-02-20 15:49 80 --sh--r- c:\windows\SYSTEM32\DEE45C7B6C.dll

2006-05-20 20:14 . 2006-05-10 00:03 88 --sh--r- c:\windows\SYSTEM32\FB6DB8620D.sys

2006-05-20 20:15 . 2005-10-01 16:28 3350 --sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{10b01aa8-7ac2-40d5-add0-6216c87bf2ec}"= "c:\program files\Washington_Nationals\tbWash.dll" [2006-12-14 1186840]

[HKEY_CLASSES_ROOT\clsid\{10b01aa8-7ac2-40d5-add0-6216c87bf2ec}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{10b01aa8-7ac2-40d5-add0-6216c87bf2ec}"= "c:\program files\Washington_Nationals\tbWash.dll" [2006-12-14 1186840]

[HKEY_CLASSES_ROOT\clsid\{10b01aa8-7ac2-40d5-add0-6216c87bf2ec}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{10B01AA8-7AC2-40D5-ADD0-6216C87BF2EC}"= "c:\program files\Washington_Nationals\tbWash.dll" [2006-12-14 1186840]

[HKEY_CLASSES_ROOT\clsid\{10b01aa8-7ac2-40d5-add0-6216c87bf2ec}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AbacastDistributedOnDemand:11"="c:\documents and settings\Frank Louie\Local Settings\Application Data\AbacastDistributedOnDemand\Node\11\AbacastDistributedOnDemand.exe" [2009-04-15 54712]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"dla"="c:\windows\system32\dla\tfswctrl.exe" [2003-08-06 114741]

"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]

"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]

"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-17 69632]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2005-10-18 278528]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-30 155648]

"Red Swoosh"="c:\program files\RSSoft\RedSwoosh.exe" [2006-08-14 61325]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-04-13 185784]

"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]

"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-06-06 936960]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-09 645328]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]

"VerizonServicepoint.exe"="c:\program files\Verizon\VSP\VerizonServicepoint.exe" [2007-11-16 2065648]

"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-08-04 49152]

"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 241664]

"DwlClient"="c:\program files\Common Files\Dell\EUSW\Support.exe" [2004-05-28 323584]

"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]

"nwiz"="nwiz.exe" - c:\windows\SYSTEM32\nwiz.exe [2003-07-28 323584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-10-30 155648]

c:\documents and settings\Frank Louie\Start Menu\Programs\Startup\

PowerReg Scheduler V3.exe [2003-11-10 225280]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-6-28 724992]

VPN Client.lnk - c:\windows\Installer\{D25122BC-A60E-4663-B602-B01718F12044}\Icon3E5562ED7.ico [2007-7-16 6144]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\McAfee\\MBK\\McAfeeDataBackup.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"c:\\Documents and Settings\\Frank Louie\\Local Settings\\Application Data\\Abacast\\Abaclient.exe"=

"c:\\Program Files\\Malwarebytes' Anti-Malware\\mmbam.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6112:TCP"= 6112:TCP:starcraft.exe

"9420:TCP"= 9420:TCP:Red Swoosh

"5000:UDP"= 5000:UDP:Red Swoosh

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/5/2008 8:33 PM 210216]

S3 hamachi_oem;PlayLinc Adapter;c:\windows\SYSTEM32\DRIVERS\gan_adapter.sys [10/19/2006 11:11 AM 10664]

S3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\SYSTEM32\dllhost.exe [8/29/2002 6:00 AM 5120]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-05-15 c:\windows\Tasks\McDefragTask.job

- c:\windows\system32\defrag.exe [2002-08-29 00:12]

2009-08-01 c:\windows\Tasks\McQcTask.job

- c:\program files\mcafee\mqc\QcConsol.exe [2006-08-25 15:53]

2005-03-31 c:\windows\Tasks\WebReg 20050330194315.job

- c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqwrg.exe [2003-07-07 05:43]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = 127.0.0.1

uSearchURL,(Default) = about:blank

IE: &AIM Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm

IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: Backward &Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cac&hed Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Si&milar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: WebConnect Pro 5.1.11 - hxxp://162.123.16.101:2081/WebConnectDU.cab

DPF: WebConnect Pro 6.5.3 - hxxps://wc.westernreserve.com:2080/WebConnectDU.cab

FF - ProfilePath - c:\documents and settings\Frank Louie\Application Data\Mozilla\Firefox\Profiles\gkkmlhxe.Default User\

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - plugin: c:\documents and settings\Frank Louie\Application Data\Mozilla\Firefox\Profiles\gkkmlhxe.Default User\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000004.dll

FF - plugin: c:\documents and settings\Frank Louie\Application Data\Mozilla\plugins\npAbacast.dll

FF - plugin: c:\documents and settings\Frank Louie\Application Data\Mozilla\plugins\NPAbacheck.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava11.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava12.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava13.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava14.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJava32.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPJPI142.dll

FF - plugin: c:\program files\Java\j2re1.4.2\bin\NPOJI610.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPinfotl.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava11.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava12.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJava32.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPJPI141_02.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMGWRAP.DLL

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPOJI610.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll

FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll

---- FIREFOX POLICIES ----

FF - user.js: dom.disable_open_during_load - true // Popupblocker control handled by McAfee Privacy Service

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-08-26 11:42

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-736544953-381208167-1900030871-1008\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(748)

c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(472)

c:\windows\system32\WININET.dll

c:\program files\McAfee\SiteAdvisor\saHook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\SYSTEM32\LexBceS.exe

c:\windows\SYSTEM32\Lexpps.exe

c:\program files\Cisco Systems\VPN Client\cvpnd.exe

c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\program files\Common Files\McAfee\MNA\McNASvc.exe

c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe

c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

c:\program files\Dell\Support\Alert\bin\NotifyAlert.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\McAfee\MSK\msksrver.exe

c:\windows\SYSTEM32\nvsvc32.exe

c:\windows\SYSTEM32\wdfmgr.exe

c:\windows\wanmpsvc.exe

c:\program files\Webroot\Spy Sweeper\SpySweeper.exe

c:\program files\iPod\bin\iPodService.exe

c:\windows\SYSTEM32\wscntfy.exe

c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe

c:\program files\McAfee\MPF\MpfSrv.exe

.

**************************************************************************

.

Completion time: 2009-08-26 11:56 - machine was rebooted

ComboFix-quarantined-files.txt 2009-08-26 15:55

ComboFix2.txt 2009-08-26 14:26

Pre-Run: 10,377,424,896 bytes free

Post-Run: 10,324,869,120 bytes free

322 --- E O F --- 2009-08-26 07:00

I attached the file just in case:

ComboFix.txt

Link to post
Share on other sites

  • Staff

Hi,

This looks OK again.

* Go to start > run and copy and paste next command in the field:

"c:\documents and settings\Frank Louie\Desktop\Combo-Fix.exe" /u

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

Link to post
Share on other sites

  • Staff

Hi,

The script removed some orphaned malicious services and an malicious orphaned registry key. We could actually do this manually as well, but it was easier/faster with the script (just a matter of copy and paste and drag) :D

Glad I could help. :)

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

Link to post
Share on other sites

Ahh, thanks again for all your responses and help. Those links are really helpful and .

One last thing, if I were to take in interest in helping people with their malware problems such as you do, could you point me in a direction to learn how to do it well and efficiently?

I'm a recent graduate in Computer Science and have a background in programming but I'm still a noob when it comes to this stuff but going through this I felt it would be great to be able to give back and help out the community.

Link to post
Share on other sites

  • Staff

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.