rootkit cleanup

cardinal17 · September 20, 2009

malwarebytes 1.4.1 does not complete cleanup of rootkit.tdss

infection reappears after cleaning and reboot

mbam log (does not show removal - would have required reboot, done multiple time before)

Malwarebytes' Anti-Malware 1.41

Database version: 2830

Windows 5.1.2600 Service Pack 3

9/20/2009 10:17:27 AM

mbam-log-2009-09-20 (10-17-27).txt

Scan type: Quick Scan

Objects scanned: 103496

Time elapsed: 7 minute(s), 41 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

\\?\globalroot\Device\Ide\iaStor0\ohhrvmba\ohhrvmba\tdlwsp.dll (Rootkit.TDSS) -> Delete on reboot.

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

\\?\globalroot\Device\Ide\iaStor0\ohhrvmba\ohhrvmba\tdlwsp.dll (Rootkit.TDSS) -> Quarantined and deleted successfully.

HJT log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:23:50 AM, on 9/20/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\cisvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\Dad\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: HttpWatch Basic - {F1F69322-008F-4895-B2BF-AD194219825A} - C:\Program Files\HttpWatch\httpwatchsc.dll

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - C:\Program Files\HttpWatch\httpwatch.dll

O9 - Extra 'Tools' menuitem: HttpWatch Basic - {D103E85B-5D67-42c1-8C83-F01079DBAB26} - C:\Program Files\HttpWatch\httpwatch.dll

O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\vmware\vmware player\vsocklib.dll

O16 - DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab

O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/images/global/js/scanner/SysProExe.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} (NetCamPlayerWeb11gv2 Control) - http://192.168.1.120/NetCamPlayerWeb11gv2.cab

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe

O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Application Accelerator\iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe

--

End of file - 7064 bytes

any help appreciated..

sUBs · September 22, 2009

I shall require some extra logs from you.

=================================

Downloads and Reports Required:

=================================

Before scanning, make sure all other running programs are closed

There shouldn't be any scheduled antivirus scans running while the scan is being performed.

Do not use your computer for anything else during the scan.

====

DDS:

====

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

When done, DDS will open two (2) logs:
1. DDS.txt
2. Attach.txt
[*]Save both reports to your desktop.

=====

GMER:

=====

Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan...say NO.
In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and uncheck the Show all box.
Then click the Scan button & wait for it to finish.
Once done click on the [save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop

**Caution**

Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

===========================

How the logs should be furnished:

===========================

Copy/Paste the contents of 'DDS.txt' to be posted as text to your post

The other two logs ...

* attach.txt

* gmer.txt

... should be zipped/archived before attaching to the post

cardinal17 · September 22, 2009

DDS got errors when run - along the lines of 'not enough main memory to sort' (about 6 times)

DDS (Ver_09-07-30.01) - NTFSx86

Run by Dad at 10:47:36.73 on Tue 09/22/2009

Internet Explorer: 8.0.6001.18702

============== Running Processes ===============

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

mSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll

BHO: Java Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File

BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

BHO: HttpWatch Basic: {f1f69322-008f-4895-b2bf-ad194219825a} - c:\program files\httpwatch\httpwatchsc.dll

TB: {8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - No File

EB: HttpWatch Basic: {2b4c4770-27fd-4a09-b17d-33ca580965fb} - c:\program files\httpwatch\httpwatch.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [MSConfig] c:\windows\pchealth\helpctr\binaries\MSConfig.exe /auto

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

uPolicies-explorer: NoThemesTab = 0 (0x0)

uPolicies-explorer: ForceActiveDesktopOn = 0 (0x0)

uPolicies-system: NoColorChoice = 0 (0x0)

uPolicies-system: NoSizeChoice = 0 (0x0)

uPolicies-system: NoVisualStyleChoice = 0 (0x0)

uPolicies-system: NoDispSettingsPage = 0 (0x0)

uPolicies-system: NoDispAppearancePage = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL

IE: {D103E85B-5D67-42c1-8C83-F01079DBAB26} - {2B4C4770-27FD-4A09-B17D-33CA580965FB} - c:\program files\httpwatch\httpwatch.dll

LSP: c:\program files\vmware\vmware player\vsocklib.dll

DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab

DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxp://support.dell.com/systemprofiler/SysPro.CAB

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/d/c/8/dc8362b3-f410-4e7d-b672-209d6bd8fcea/OGAControl.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/5/b/0/5b0d4654-aa20-495c-b89f-c1c34c691085/LegitCheckControl.cab

DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {4B48D5DF-9021-45F7-A240-60304302A215} - hxxp://download.microsoft.com/download/b/d/b/bdb4e4ee-63b2-45ff-9d84-33205bf43143/WebCleaner.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-1_3_1_02-win.cab

DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab

DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} - hxxp://192.168.1.120/NetCamPlayerWeb11gv2.cab

Notify: AtiExtEvent - Ati2evxx.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

================= FIREFOX ===================

FF - ProfilePath -

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

============= SERVICES / DRIVERS ===============

=============== Created Last 30 ================

==================== Find3M ====================

2008-08-14 21:13 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008081420080815\index.dat

============= FINISH: 10:49:58.84 ===============

other logs attached

Attach.zip

sUBs · September 22, 2009

DDS got errors when run - along the lines of 'not enough main memory to sort' (about 6 times)

That's okay. The rootkit is interfering with memory.

Please do this ...

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@ECHO OFF
DEL %0

Save this as peek.bat Choose to "Save type as - All Files"

It should look like this:

Double click on peek.bat & allow it to run

Post back to tell me what it says

cardinal17 · September 22, 2009

created, opened logit.txt

C:\WINDOWS\system32\drivers\tdlrk.sys existB

C:\WINDOWS\system32\tdlcmd.dll existB

C:\WINDOWS\system32\tdllog.dat existB

C:\WINDOWS\system32\tdlwsp.dll existB

C:\WINDOWS\system32\tdl.dat existB

C:\WINDOWS\system32\tdlwsp8.dll existB

sUBs · September 22, 2009

Hmm ... this gets interesting. The rootkit isn't showing itself. Let's try digging it out using some other means.

Let's try running some variations of the GMER scan.

-----------

Launch GMER and in the right panel, untick all except the following:

Modules
Processes
Libraries
Services
Show All

Then click the scan button & show me the log it produces.

------------

2nd GMER Scan

At the top of the GMER interface, click the [>>>] button to reveal the hidden tabs.

Select Registry

Then navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services

Highlight the Services button and click the Export button located on the upper right to save a log.

The log is huge and cannot be posted. You need to zip it and attach to the next reply.

cardinal17 · September 22, 2009

Attached - Gmer1.txt & Gmer2.txt (registry)

Gmer1.zip

sUBs · September 22, 2009

Service C:\WINDOWS\system32\svchost.exe (Generic Host Process for Win32 Services/Microsoft Corporation) [DISABLED] winmgmt

Winmgmt is an important service. You shouldnt have disabled it.

--------------

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Download & save ComboFix to your Desktop but don't run it yet

Open NOTEPAD and copy/paste the text in the quotebox below into it:

DRIVER::
Abel
b5f24
vnmcxjkipmpdripx
COLLECT::
C:\WINDOWS\system32\b5f24.sys
C:\Windows\system32\drivers\vnmcxjkipmpdripx.sys

Save this as "CFScript"

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt.

sUBs · September 22, 2009

An important bit which I forgot to mention. Make sure McAfee is totally disabled before running ComboFix.

cardinal17 · September 22, 2009

I didn't disable winmgmt

McAfee uninstalled at this point

downloaded ComboFix, created script, dragged onto app

got the 'open files security warning' clicked run

never got the CMD window showing 'preparing to run'

got a small gray box with a solid blue bar titled 'combofix'

sat for about 10 minutes, box went away, then got a msg 'windows cannot open nircmd.cfxxe' doesn't know program that created it

thought I'd lost control, so opened Task Manager (it took minutes to open) - system at 100%

no log file created

appreciate the help

sUBs · September 22, 2009

windows cannot open nircmd.cfxxe'

Trouble with some security programs is that despite Owners disabling them, they aren't truly disabled. Only the GUI interface gets silenced but the real meat of the security continues running silently in the background. Please run ComboFix from Safe Mode. If that fails, we shall need to temporarily uninstall McAfee.

cardinal17 · September 22, 2009

ComboFix 09-09-22.01 - Dad 09/22/2009 16:21.1.2 - NTFSx86 NETWORK

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.1171 [GMT -4:00]

Running from: c:\documents and settings\Dad\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dad\Desktop\CFScript.txt

file zipped: c:\windows\system32\b5f24.sys

.

PEV Error: PersonalFolder

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Dad\Application Data\Install.dat

c:\windows\Installer\20b55b8c.msi

c:\windows\run.log

c:\windows\system32\b5f24.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABEL

-------\Legacy_B5F24

-------\Service_Abel

-------\Service_b5f24

-------\Service_vnmcxjkipmpdripx

((((((((((((((((((((((((( Files Created from 2009-08-22 to 2009-09-22 )))))))))))))))))))))))))))))))

.

2009-12-15 08:17 . 2009-12-15 08:17 -------- d-----w- c:\windows\system32\XPSViewer

2009-12-15 08:16 . 2009-12-15 08:16 -------- d-----w- c:\program files\Reference Assemblies

2009-12-15 08:15 . 2008-07-06 12:06 89088 ------w- c:\windows\system32\dllcache\filterpipelineprintproc.dll

2009-12-15 08:15 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll

2009-12-15 08:15 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe

2009-12-15 08:15 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll

2009-12-15 08:15 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\dllcache\xpsshhdr.dll

2009-12-15 08:15 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll

2009-12-15 08:15 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\dllcache\xpssvcs.dll

2009-12-15 08:15 . 2009-12-15 08:16 -------- d-----w- C:\755532b08fbbb7a16e5aafc41fbd

2009-09-18 17:15 . 2009-09-18 17:15 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2009-09-18 16:24 . 2009-09-18 16:31 15 ----a-w- c:\documents and settings\Dad\settings.dat

2009-09-18 15:23 . 2009-09-18 15:23 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-09-18 02:27 . 2006-11-17 07:06 1495552 ----a-w- c:\windows\system32\epoPGPsdk.dll

2009-09-15 13:13 . 2009-09-15 13:14 -------- d-----w- c:\program files\Wireshark

2009-09-09 09:02 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-15 08:17 . 2008-10-30 03:56 -------- d-----w- c:\program files\MSBuild

2009-09-22 19:43 . 2004-07-29 19:06 288 ----a-w- c:\windows\system32\DVCStateBkp-{00000004-00000000-00000002-00001102-00000004-10031102}.dat

2009-09-22 19:43 . 2004-07-29 19:06 288 ----a-w- c:\windows\system32\DVCState-{00000004-00000000-00000002-00001102-00000004-10031102}.dat

2009-09-22 14:40 . 2005-08-15 03:42 -------- d-----w- c:\program files\Network Associates

2009-09-22 14:40 . 2005-08-15 03:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Network Associates

2009-09-18 19:27 . 2004-07-29 18:58 -------- d--h--w- c:\program files\InstallShield Installation Information

2009-09-18 19:18 . 2007-07-17 00:32 -------- d-----w- c:\program files\GoFTP

2009-09-18 18:34 . 2007-03-11 12:32 -------- d-----w- c:\documents and settings\All Users\Application Data\VMware

2009-09-18 18:31 . 2009-06-26 13:07 -------- d-----w- c:\program files\Password Safe

2009-09-18 17:38 . 2007-03-11 12:35 -------- d-----w- c:\documents and settings\LocalService\Application Data\VMware

2009-09-18 13:18 . 2009-01-17 14:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-09-18 03:16 . 2009-06-23 13:37 89084 ---ha-w- c:\windows\system32\mlfcache.dat

2009-09-18 02:29 . 2008-06-06 19:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater

2009-09-17 16:42 . 2005-08-29 03:07 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-09-16 15:27 . 2004-07-29 19:13 109440 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-09-16 15:20 . 2008-10-30 03:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2009-09-16 15:16 . 2008-10-30 03:57 -------- d-----w- c:\program files\Microsoft Works

2009-09-15 13:52 . 2009-01-15 15:23 -------- d-----w- c:\documents and settings\Dad\Application Data\Wireshark

2009-09-15 13:14 . 2006-01-11 11:21 -------- d-----w- c:\program files\WinPcap

2009-09-10 18:54 . 2009-01-17 14:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-10 18:53 . 2009-01-17 14:24 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-09-10 07:14 . 2008-02-01 00:53 -------- d-----w- c:\program files\Microsoft Silverlight

2009-08-19 16:48 . 2009-08-19 16:41 -------- d-----w- c:\documents and settings\Dad\Application Data\ArcSoft

2009-08-19 16:41 . 2009-08-19 16:41 -------- d-----w- c:\program files\JMicron

2009-08-19 16:40 . 2009-08-19 16:40 -------- d-----w- c:\program files\ArcSoft

2009-08-12 17:51 . 2009-08-12 17:51 -------- d-----w- c:\program files\MSN Messenger

2009-08-10 18:03 . 2009-08-10 18:02 -------- d-----w- c:\documents and settings\Dad\Application Data\MSN6

2009-08-10 18:02 . 2009-08-10 18:02 -------- d-----w- c:\documents and settings\All Users\Application Data\MSN6

2009-08-10 17:14 . 2009-08-10 17:13 -------- d-----w- c:\program files\SecurID Software Token

2009-08-06 13:56 . 2009-04-02 00:12 -------- d-----w- c:\program files\Cisco Systems

2009-08-06 12:38 . 2009-08-06 12:38 -------- d-----w- c:\program files\Common Files\Deterministic Networks

2009-08-05 10:22 . 2005-09-09 17:34 -------- d-----w- c:\program files\Common Files\Adobe

2009-08-05 09:01 . 2002-12-12 05:14 204800 ----a-w- c:\windows\system32\mswebdvd.dll

2009-07-17 19:01 . 2004-03-19 22:33 58880 ----a-w- c:\windows\system32\atl.dll

2009-07-14 03:43 . 2005-08-15 03:33 286208 ----a-w- c:\windows\system32\wmpdxm.dll

2009-07-03 17:09 . 2004-02-06 23:05 915456 ----a-w- c:\windows\system32\wininet.dll

2009-06-25 08:25 . 2004-03-30 01:48 730112 ----a-w- c:\windows\system32\lsasrv.dll

2009-06-25 08:25 . 2004-03-30 01:48 147456 ----a-w- c:\windows\system32\schannel.dll

2009-06-25 08:25 . 2004-03-19 22:44 54272 ----a-w- c:\windows\system32\wdigest.dll

2009-06-25 08:25 . 2004-03-19 22:42 56832 ----a-w- c:\windows\system32\secur32.dll

2009-06-25 08:25 . 2004-03-19 22:40 136192 ----a-w- c:\windows\system32\msv1_0.dll

2009-06-25 08:25 . 2004-03-19 22:38 301568 ----a-w- c:\windows\system32\kerberos.dll

2009-02-19 17:23 . 2009-02-21 05:23 44 ---h--w- c:\program files\0eaed41c.tmp

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-14 169984]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^McAfee Desktop Firewall Tray.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\McAfee Desktop Firewall Tray.lnk

backup=c:\windows\pss\McAfee Desktop Firewall Tray.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TotalMedia Backup Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\TotalMedia Backup Monitor.lnk

backup=c:\windows\pss\TotalMedia Backup Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk

backup=c:\windows\pss\VPN Client.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dad^Start Menu^Programs^Startup^Adobe Gamma.lnk]

path=c:\documents and settings\Dad\Start Menu\Programs\Startup\Adobe Gamma.lnk

backup=c:\windows\pss\Adobe Gamma.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dad^Start Menu^Programs^Startup^JMicron Button Manager.lnk]

path=c:\documents and settings\Dad\Start Menu\Programs\Startup\JMicron Button Manager.lnk

backup=c:\windows\pss\JMicron Button Manager.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Dad^Start Menu^Programs^Startup^Password Safe.lnk]

path=c:\documents and settings\Dad\Start Menu\Programs\Startup\Password Safe.lnk

backup=c:\windows\pss\Password Safe.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"wuauserv"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"WmiApSrv"=3 (0x3)

"Wmi"=3 (0x3)

"WmdmPmSN"=3 (0x3)

"WMDM PMSP Service"=2 (0x2)

"winmgmt"=2 (0x2)

"WebClient"=2 (0x2)

"w32time"=2 (0x2)

"VSS"=3 (0x3)

"VMware NAT Service"=2 (0x2)

"VMnetDHCP"=2 (0x2)

"VMAuthdService"=2 (0x2)

"usnjsvc"=3 (0x3)

"UPS"=3 (0x3)

"ufad-ws60"=3 (0x3)

"TrkWks"=2 (0x2)

"Themes"=2 (0x2)

"TermService"=3 (0x3)

"Tenable Nessus"=2 (0x2)

"TapiSrv"=3 (0x3)

"SwPrv"=3 (0x3)

"Spooler"=2 (0x2)

"Schedule"=2 (0x2)

"RSVP"=3 (0x3)

"RemoteRegistry"=2 (0x2)

"RDSessMgr"=3 (0x3)

"RasMan"=3 (0x3)

"RasAuto"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"NtmsSvc"=3 (0x3)

"MSDTC"=3 (0x3)

"mnmsrvc"=3 (0x3)

"McTaskManager"=2 (0x2)

"McShield"=2 (0x2)

"McAfeeFramework"=2 (0x2)

"lxcd_device"=3 (0x3)

"ImapiService"=3 (0x3)

"idsvc"=3 (0x3)

"HidServ"=2 (0x2)

"helpsvc"=2 (0x2)

"gusvc"=2 (0x2)

"gupdate1c98c8448629ce6"=2 (0x2)

"FireSvc"=2 (0x2)

"Fax"=2 (0x2)

"CVPND"=2 (0x2)

"CiscoVpnInstallService"=2 (0x2)

"Bonjour Service"=2 (0x2)

"BITS"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

"Adobe LM Service"=3 (0x3)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"LXCDCATS"=rundll32 \3\LXCDtime.dll,_RunDLLEntry@16

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\SkillSoft\\jre\\bin\\javaw.exe"=

"c:\\WINDOWS\\SYSTEM32\\lxcdcoms.exe"=

"c:\\WINDOWS\\SYSTEM32\\SPOOL\\DRIVERS\\W32X86\\3\\lxcdPSWX.EXE"=

"c:\\Program Files\\ViaVoice\\Bin\\engine.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\audmig.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\speechbar.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\smart.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\userwiz.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\ewiz.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\vocabexp.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\msaadmn.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\navcentral.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\voicepad.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\vtperdic.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\ViaVoice\\Bin\\whatcanisay.exe"=

"c:\\Program Files\\VMware\\VMware Player\\vmware-authd.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"135:TCP"= 135:TCP:TCP Port 135

"5000:TCP"= 5000:TCP:TCP Port 5000

"5001:TCP"= 5001:TCP:*:Disabled:TCP Port 5001

"5002:TCP"= 5002:TCP:*:Disabled:TCP Port 5002

"5003:TCP"= 5003:TCP:*:Disabled:TCP Port 5003

"5004:TCP"= 5004:TCP:*:Disabled:TCP Port 5004

"5005:TCP"= 5005:TCP:*:Disabled:TCP Port 5005

"5006:TCP"= 5006:TCP:*:Disabled:TCP Port 5006

"5007:TCP"= 5007:TCP:*:Disabled:TCP Port 5007

"5008:TCP"= 5008:TCP:*:Disabled:TCP Port 5008

"5009:TCP"= 5009:TCP:*:Disabled:TCP Port 5009

"5010:TCP"= 5010:TCP:*:Disabled:TCP Port 5010

"5011:TCP"= 5011:TCP:*:Disabled:TCP Port 5011

"5012:TCP"= 5012:TCP:*:Disabled:TCP Port 5012

"5013:TCP"= 5013:TCP:*:Disabled:TCP Port 5013

"5014:TCP"= 5014:TCP:*:Disabled:TCP Port 5014

"5015:TCP"= 5015:TCP:*:Disabled:TCP Port 5015

"5016:TCP"= 5016:TCP:*:Disabled:TCP Port 5016

"5017:TCP"= 5017:TCP:*:Disabled:TCP Port 5017

"5018:TCP"= 5018:TCP:*:Disabled:TCP Port 5018

"5019:TCP"= 5019:TCP:*:Disabled:TCP Port 5019

"5020:TCP"= 5020:TCP:*:Disabled:TCP Port 5020

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

R2 vmci;VMware vmci;c:\windows\SYSTEM32\DRIVERS\vmci.sys [9/18/2008 11:06 PM 54960]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [8/1/2008 8:59 AM 31592]

S3 NPF;NetGroup Packet Filter Driver;c:\windows\SYSTEM32\DRIVERS\npf.sys [12/23/2008 11:35 AM 50704]

S3 PsSdk41;PsSdk41;c:\windows\SYSTEM32\DRIVERS\pssdk41.sys [2/13/2009 7:50 AM 36928]

S3 vpnva;Cisco AnyConnect VPN Virtual Miniport Adapter for Windows;c:\windows\system32\DRIVERS\vpnva.sys --> c:\windows\system32\DRIVERS\vpnva.sys [?]

S4 CiscoVpnInstallService;Cisco Systems, Inc. Installer service;c:\docume~1\Dad\LOCALS~1\Temp\INSTAL~1.EXE --> c:\docume~1\Dad\LOCALS~1\Temp\INSTAL~1.EXE [?]

S4 gupdate1c98c8448629ce6;Google Update Service (gupdate1c98c8448629ce6);c:\program files\Google\Update\GoogleUpdate.exe [2/11/2009 4:06 PM 133104]

S4 Tenable Nessus;Tenable Nessus;c:\program files\Tenable\Nessus\nessusd.exe [7/31/2008 5:16 PM 13312]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]

"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

.

Contents of the 'Scheduled Tasks' folder

2009-09-15 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-09-18 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-06 12:11]

2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 20:06]

2009-09-18 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-11 20:06]

2009-09-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2777565657-1593043325-674389114-1006Core.job

- c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:17]

2009-09-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2777565657-1593043325-674389114-1006UA.job

- c:\documents and settings\Dad\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-05 00:17]

2005-08-16 c:\windows\Tasks\ISP signup reminder 1.job

- c:\windows\System32\OOBE\OOBEBALN.EXE [2004-03-19 00:12]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway

uInternet Settings,ProxyOverride = *.local

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000

LSP: c:\program files\VMware\VMware Player\vsocklib.dll

DPF: 55963676-2F5E-4BAF-AC28-CF26AA587566 - vpnweb.cab

DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://download.ewido.net/ewidoOnlineScan.cab

DPF: {D7208880-9B7A-43E1-AABB-8C888A5704F9} - hxxp://192.168.1.120/NetCamPlayerWeb11gv2.cab

FF - ProfilePath - c:\documents and settings\Dad\Application Data\Mozilla\Firefox\Profiles\rgvkdjc2.default\

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

AddRemove-{45EBDA59-D33B-433A-956E-B2F236468B56} - c:\progra~1\MUSICM~1\MUSICM~2\unmatch.exe

AddRemove-{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA} - c:\program files\InstallShield Installation Information\{F38ADCA4-AF7C-4C73-9021-6F1EA15D15EA}\Setup.exeUNINSTALL

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-22 16:46

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]

"ThreadingModel"="Apartment"