Rootkit.TDSS

bdjr32 · December 11, 2009

I have been having issues with a browser redirector and loaded Malwarebyte to find that my laptop is infected with Rootkit.TDSS. I have attached an MBAM log, but get a "Upload failed. You are not permitted to upload this type of file" error when attaching the HJT log.

mbam_log_2009_12_11__06_12_17_.txt

bdjr32 · December 12, 2009

I have been having issues with a browser redirector and loaded Malwarebyte to find that my laptop is infected with Rootkit.TDSS. I have attached an MBAM log, but get a "Upload failed. You are not permitted to upload this type of file" error when attaching the HJT log.

Here is the HJT scan -

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:22:01 PM, on 12/11/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\system32\basfipm.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe

C:\Program Files\IBackup For Windows\IBackupWebM.exe

C:\Program Files\IBackup For Windows\IBWin Service_952.exe

C:\Program Files\Kaseya\Agent\AgentMon.exe

C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe

C:\Program Files\IBackup For Windows\IBackground_952.exe

C:\Program Files\Kaseya\Agent\KaUsrTsk.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\WinMessenger\WinMesgr.exe

C:\Program Files\JGsoft\EditPadLite\EditPadLite.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://remote.wessdel.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: HelperObject Class - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 7\SnagItBHO.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: AcroIEHelperStub - {18df081c-e8ad-4283-a596-fa578c2ebdc3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: IEToolbarBHO Class - {1A1DAC8C-074D-440F-8707-7009A672D7D1} - C:\Program Files\LinkedIn\IE Toolbar\3.0.4.1100\LinkedinIEToolbar.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 7\SnagItIEAddin.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O3 - Toolbar: LinkedIn Toolbar - {BB670D0B-5C46-40C7-B38B-40DD26987723} - C:\Program Files\LinkedIn\IE Toolbar\3.0.4.1100\LinkedinIEToolbar.dll

O4 - HKLM\..\Run: [solidWorks_CheckForUpdates] "C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" /scheduler

O4 - HKLM\..\Run: [iBWin Background process] "C:\Program Files\IBackup For Windows\IBackground_952.exe"

O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [Kaseya Agent Service Helper] "C:\Program Files\Kaseya\Agent\KaUsrTsk.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [MVS Splash] C:\Program Files\McAfee\Managed VirusScan\Agent\Splash.exe

O4 - HKLM\..\Run: [McAfee Managed Services Tray] "C:\Program Files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Startup: Post-it

screen317 · December 13, 2009

Hi and welcome to Malwarebytes.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

-screen317

bdjr32 · December 13, 2009

Hi and welcome to Malwarebytes.
Please visit this webpage for instructions for running ComboFix:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.
-screen317

Combofix log -

ComboFix 09-12-11.05 - bdorricott 12/12/2009 11:12:11.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.604 [GMT -8:00]

Running from: c:\documents and settings\BDorricott\Desktop\bob.exe

AV: Total Protection for Small Business *On-access scanning enabled* (Updated) {8C354827-2F54-4E28-90DC-AD391E77808C}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\drivers\fad.sys

c:\windows\system32\Settings

c:\windows\system32\Settings\Settings.ini

c:\windows\system32\tdlcmd.dll

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected

Restored copy from - Kitty ate it

.

((((((((((((((((((((((((( Files Created from 2009-11-12 to 2009-12-12 )))))))))))))))))))))))))))))))

.

2009-12-11 16:51 . 2009-12-11 16:51 -------- d-----w- c:\documents and settings\Bob Dorricott\My Pictures

2009-12-11 16:46 . 2009-12-11 16:46 -------- d-----w- c:\documents and settings\Administrator\Application Data\JGsoft

2009-12-11 15:15 . 2009-12-11 15:15 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2009-12-11 14:29 . 2009-12-11 14:29 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-12-11 14:25 . 2009-12-11 14:25 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2009-12-07 17:28 . 2009-12-07 17:28 -------- d-----w- c:\documents and settings\BDorricott\Application Data\Malwarebytes

2009-12-07 17:28 . 2009-12-04 00:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-07 17:28 . 2009-12-07 17:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-12-07 17:28 . 2009-12-04 00:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-07 17:28 . 2009-12-07 19:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-07 15:49 . 2009-12-07 15:49 -------- d-----w- c:\program files\Trend Micro

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-12 18:58 . 2008-07-10 23:17 -------- d-----w- c:\documents and settings\BDorricott\Application Data\IM

2009-12-12 02:55 . 2007-11-01 14:51 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-12-08 19:35 . 2006-03-03 14:55 -------- d-----w- c:\program files\Bullfighter

2009-12-01 21:07 . 2006-02-22 18:16 -------- d-----w- c:\documents and settings\BDorricott\Application Data\AdobeUM

2009-11-23 16:16 . 2007-06-23 23:06 -------- d-----w- c:\program files\DESI

2009-11-23 16:04 . 2006-04-09 16:07 -------- d-----w- c:\program files\McAfee

2009-11-20 00:42 . 2006-04-09 16:43 -------- d-----w- c:\program files\Spybot - Search & Destroy

2009-11-15 23:26 . 2009-11-05 19:28 -------- d-----w- c:\program files\Ace Utilities

2009-11-05 23:59 . 2009-11-05 19:26 -------- d-----w- c:\documents and settings\All Users\Application Data\NCH Swift Sound

2009-11-03 23:14 . 2009-11-03 23:14 -------- d-----w- c:\documents and settings\BDorricott\Application Data\LinkedIn

2009-11-03 23:14 . 2009-11-03 23:14 -------- d-----w- c:\program files\LinkedIn

2009-11-03 19:16 . 2009-11-03 19:16 -------- d-----w- c:\documents and settings\BDorricott\Application Data\McAfee

2009-11-03 19:15 . 2009-11-03 19:15 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2009-11-03 03:02 . 2009-08-11 01:38 664 ----a-w- c:\windows\system32\d3d9caps.dat

2009-10-23 22:22 . 2006-04-04 13:52 102664 ----a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT

2009-10-15 04:07 . 2006-02-11 20:32 -------- d-----w- c:\program files\Common Files\Adobe

2009-09-30 20:11 . 2009-11-03 19:17 288096 ----a-r- c:\documents and settings\BDorricott\Application Data\McAfee\Supportability\MVTLogs\Results\detect.dll

2009-08-06 19:14 . 2008-07-11 16:51 28488 -c--a-w- c:\program files\mozilla firefox\plugins\atgpcdec.dll

2009-08-06 19:14 . 2008-07-11 16:51 185232 ----a-w- c:\program files\mozilla firefox\plugins\atgpcext.dll

2008-07-11 16:52 . 2008-07-11 16:52 46408 -c--a-w- c:\program files\mozilla firefox\plugins\atmccli.dll

2008-07-11 16:52 . 2008-07-11 16:52 98712 -c--a-w- c:\program files\mozilla firefox\plugins\ieatgpc.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SolidWorks_CheckForUpdates"="c:\program files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe" [2007-09-10 6460696]

"IBWin Background process"="c:\program files\IBackup For Windows\IBackground_952.exe" [2008-07-18 34280]

"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 101136]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]

"Kaseya Agent Service Helper"="c:\program files\Kaseya\Agent\KaUsrTsk.exe" [2008-09-04 229376]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-06 413696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

"MVS Splash"="c:\program files\McAfee\Managed VirusScan\Agent\Splash.exe" [2009-09-14 468288]

"McAfee Managed Services Tray"="c:\program files\McAfee\Managed VirusScan\Agent\StartMyagtTry.exe" [2009-09-14 87360]

c:\documents and settings\BDorricott\Start Menu\Programs\Startup\

Post-itr Software Notes.lnk.disabled [2006-3-1 775]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]

WinMessenger.lnk - c:\program files\WinMessenger\WinMesgr.exe [2006-2-23 274136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"DisablePersonalDirChange"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]

2004-09-07 22:08 110592 ----a-w- c:\program files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Acrobat Assistant.lnk.disabled]

backup=c:\windows\pss\Acrobat Assistant.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^CBeyond Secure Backup & Fileshare.lnk.disabled]

backup=c:\windows\pss\CBeyond Secure Backup & Fileshare.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Mirra.lnk.disabled]

backup=c:\windows\pss\Mirra.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkvMon.exe.lnk.disabled]

backup=c:\windows\pss\NkvMon.exe.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk.disabled]

backup=c:\windows\pss\Service Manager.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinMessenger StartUp.lnk.disabled]

backup=c:\windows\pss\WinMessenger StartUp.lnk.disabledCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk.disabled]

backup=c:\windows\pss\WinZip Quick Pick.lnk.disabledCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

2008-04-14 12:42 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"SWAGENT"=2 (0x2)

"McShield"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe"

"Dell QuickSet"=c:\program files\Dell\QuickSet\quickset.exe

"dla"=c:\windows\system32\dla\tfswctrl.exe

"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe"

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

"Kaseya Agent Service Helper"=c:\program files\Kaseya\Agent\KaUsrTsk.exe

"masqform.exe"=c:\program files\PureEdge\Viewer 6.5\masqform.exe -RunOnce

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime

"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe"

"Synchronization Manager"=%SystemRoot%\system32\mobsync.exe /logon

"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" /r

"Apoint"="c:\program files\Apoint\Apoint.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"=

"c:\\Program Files\\Adobe\\Adobe Contribute CS3\\Contribute.exe"=

"c:\\Program Files\\McAfee\\Managed VirusScan\\Agent\\myAgtSvc.exe"=

"c:\\Program Files\\IBackup For Windows\\ibackup_ssl_sch_952.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\rFactor\\rFactor Dedicated.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"59152:UDP"= 59152:UDP:SonicWALL Anti-Virus Compliance Port 59152

"59153:UDP"= 59153:UDP:SonicWALL Anti-Virus Compliance Port 59153

R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [9/16/2006 2:25 PM 91136]

R2 EngineServer;EngineServer;c:\program files\McAfee\Managed VirusScan\VScan\EngineServer.exe [11/3/2009 11:49 AM 14144]

R2 IBackupWeb;IBackupWeb;c:\program files\IBackup For Windows\IBackupWebM.exe [7/22/2008 12:52 PM 46568]

R2 MLPTDR_P;MLPTDR_P;c:\windows\system32\MLPTDR_P.SYS [7/8/2003 5:52 AM 20032]

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2/11/2006 12:17 PM 87936]

S1 32bc5b09;32bc5b09;c:\windows\system32\drivers\32bc5b09.sys --> c:\windows\system32\drivers\32bc5b09.sys [?]

S3 Crystal Query Server;Crystal Query Server;c:\program files\Seagate Software\Query Server\querysrv.exe [11/8/1998 8:00 AM 375296]

S3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [9/16/2006 2:23 PM 23180]

S3 SSLDrv;SSL-VPN NetExtender Adapter;c:\windows\system32\drivers\SSLDrv.sys [4/25/2007 1:31 PM 19640]

S3 WLRAWMp50x86;WLRAWMp50x86 NDIS Protocol Driver;c:\windows\system32\Drivers\WLRAWMp50x86.sys --> c:\windows\system32\Drivers\WLRAWMp50x86.sys [?]

S3 WLRAWSp50x86;WLRAWSp50x86 NDIS Protocol Driver;c:\windows\system32\Drivers\WLRAWSp50x86.sys --> c:\windows\system32\Drivers\WLRAWSp50x86.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{AEB9D4A0-199B-4dfa-A18D-E2DD5D989EDF}]

2004-08-24 19:37 134872 ----a-w- c:\program files\WinMessenger\Setup\Setup.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://remote.wessdel.com/

uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en

uInternet Settings,ProxyOverride = *.local

IE: &Google Search - c:\program files\Google\GoogleToolbar1.dll/cmsearch.html

IE: &Translate English Word - c:\program files\Google\GoogleToolbar1.dll/cmwordtrans.html

IE: Backward Links - c:\program files\Google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\Google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Linked&In Search - c:\program files\LinkedIn\IE Toolbar\3.0.4.1100\LinkedinIEToolbar.dll/ContextMenu.htm

IE: Similar Pages - c:\program files\Google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate Page into English - c:\program files\Google\GoogleToolbar1.dll/cmtrans.html

Trusted Zone: digsigtrust.com \secure

Trusted Zone: internet

Trusted Zone: mcafee.com

Trusted Zone: //about.htm/

Trusted Zone: //exclude.htm/

Trusted Zone: //LanguageSelection.htm/

Trusted Zone: //Message.htm/

Trusted Zone: //MyAgttryCmd.htm/

Trusted Zone: //MyAgttryNag.htm/

Trusted Zone: //MyNotification.htm/

Trusted Zone: //NOCLessUpdate.htm/

Trusted Zone: //quarantine.htm/

Trusted Zone: //scannow.htm/

Trusted Zone: //strings.vbs/

Trusted Zone: //template.htm/

Trusted Zone: //Update.htm/

Trusted Zone: //virfound.htm/

Trusted Zone: mcafee.com\*

Trusted Zone: mcafeeasap.com\betavscan

Trusted Zone: mcafeeasap.com\vs

Trusted Zone: mcafeeasap.com\www

Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

DPF: {6EEFD7B1-B26C-440D-B55A-1EC677189F30} - hxxps://sslvpn.demo.sonicwall.com/NELX.cab

DPF: {79D6214F-CFCE-480F-9901-27950E78F1E6} - hxxps://sslvpn.demo.sonicwall.com/MLWebCacheCleaner.cab

DPF: {897520CD-B1C8-4745-B46D-B03CF8701BB8} - hxxp://www.jigsaw.com/cab/app/JigsawContactFinder.CAB

FF - ProfilePath - c:\documents and settings\BDorricott\Application Data\Mozilla\Firefox\Profiles\sd39vq7k.default\

FF - prefs.js: browser.startup.homepage - hxxp://my.yahoo.com/

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npatgpc.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

.

------- File Associations -------

.

txtfile="c:\program files\JGsoft\EditPadLite\EditPadLite.exe" "%1"

.

- - - - ORPHANS REMOVED - - - -

WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)

SafeBoot-svcWRSSSDK

AddRemove-MVS - c:\progra~1\McAfee\MANAGE~1\Agent\myinx

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-12 11:19

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1340)

c:\windows\system32\Ati2evxx.dll

c:\program files\Intel\Wireless\Bin\LgNotify.dll

.

Completion time: 2009-12-12 11:22:45

ComboFix-quarantined-files.txt 2009-12-12 19:22

Pre-Run: 54,050,889,728 bytes free

Post-Run: 54,082,494,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /NoExecute=AlwaysOff /fastdetect

- - End Of File - - 97C1A146908A1E1D75659DA2A70DD385

HJT Log -

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 9:07:05 AM, on 12/13/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\spoolsv.exe

c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe

C:\WINDOWS\system32\basfipm.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\Managed VirusScan\VScan\EngineServer.exe

C:\Program Files\IBackup For Windows\IBackupWebM.exe

C:\Program Files\IBackup For Windows\IBWin Service_952.exe

C:\Program Files\Kaseya\Agent\AgentMon.exe

C:\PROGRA~1\McAfee\MANAGE~1\VScan\McShield.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtSvc.exe

C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\swAgent.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe

C:\Program Files\Common Files\SolidWorks Installation Manager\Scheduler\sldIMScheduler.exe

C:\Program Files\IBackup For Windows\IBackground_952.exe

C:\Program Files\Kaseya\Agent\KaUsrTsk.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\McAfee\Managed VirusScan\Agent\myAgtTry.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\WinMessenger\WinMesgr.exe

C:\Program Files\JGsoft\EditPadLite\EditPadLite.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\SoftwareDistribution\Download\537f7f3c99b7f8fe5cfa88875bf5d825\update\update.exe