Jump to content

MBAM won't run, antivirus sites blocked, but no malware found!


RRTT

Recommended Posts

  • Root Admin

Please run a new DDS scan and post that. I'll be back sometime tomorrow and we'll finish up. Do a scan with your AV now. Then tomorrow we'll put back ZA as well if you want.

You'll also want to change passwords when done as this is a password stealer. Do not do it on this machine just yet though.

Also try to run GMER now as shown.

Please download the following scanning tool. GMER

Open the zip file and copy the file gmer.exe to your Desktop.

  • Download the randomly named EXE and copy the file to your Desktop. Remember what its name is.
  • Double click on random named exe file and run it.
  • Do not make any changes. As soon as it's done and the COPY button is available click on the COPY button.
  • DO NOT Click on the SCAN button.
  • This will place the scan in your clipboard. Paste that into notepad or into your next reply post please.
  • Click OK and quit the GMER program.

Link to post
Share on other sites

DDS: attach.txt is attached, zipped

here's dds./txt

===========================

DDS (Ver_09-12-01.01) - NTFSx86

Run by Owner at 1:46:24.03 on Tue 01/12/2010

Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.256 [GMT -8:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\WINDOWS\System32\svchost.exe -k HPZ12

C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\VTTimer.exe

C:\WINDOWS\system32\VTtrayp.exe

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe

C:\Program Files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe

C:\Program Files\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe

C:\Program Files\Process Explorer\procexp.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No File

TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File

TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File

uRun: [sUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe

mRun: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE

mRun: [Reminder] %WINDIR%\Creator\Remind_XP.exe

mRun: [PostCopy] c:\windows\system32\belkin\f5u109\PostCopy.exe

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [VTTimer] VTTimer.exe

mRun: [VTTrayp] VTtrayp.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [soundMan] SOUNDMAN.EXE

mRun: [ANIWZCS2Service] c:\program files\ani\aniwzcs2 service\WZCSLDR2.exe

mRun: [Airlink101 Airlink101 WLAN Monitor] c:\program files\airlink101\airlink101 wlan monitor\WLANmon.exe

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

StartupFolder: c:\docume~1\owner\startm~1\programs\startup\proces~1.lnk - c:\program files\process explorer\procexp.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~2.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbwebconnector\QBWebConnector.exe

IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL

Trusted Zone: isqft.com\www

Trusted Zone: isqft.com\www

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=58813

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1261091594480

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0015-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_07-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL

Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks enterprise solutions 8.0\HelpAsyncPluggableProtocol.dll

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\intuit\quickbooks enterprise solutions 8.0\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

AppInit_DLLs: winmm.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\p5p1979t.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-11-16 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-11-16 96408]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-12-16 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-12-16 74480]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-11-16 735960]

R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-1-10 38224]

R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [2007-6-18 550272]

R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-12-16 7408]

S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\3.tmp --> c:\windows\system32\3.tmp [?]

=============== Created Last 30 ================

2010-01-12 02:19:39 0 d-----w- c:\windows\Internet Logs

2010-01-11 08:28:03 0 d-----w- C:\RootRepeal

2010-01-11 07:33:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-11 07:33:42 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-11 07:33:42 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-11 04:25:26 0 d-----w- c:\program files\TrendMicro

2010-01-11 01:49:49 0 d-sha-r- C:\cmdcons

2010-01-11 01:48:20 98816 ----a-w- c:\windows\sed.exe

2010-01-11 01:48:20 77312 ----a-w- c:\windows\MBR.exe

2010-01-11 01:48:20 261632 ----a-w- c:\windows\PEV.exe

2010-01-11 01:48:20 161792 ----a-w- c:\windows\SWREG.exe

2010-01-08 03:28:18 16736 ----a-w- c:\windows\system32\mucltui.dll.mui

2010-01-08 03:28:17 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-01-05 22:48:53 0 d-----w- c:\program files\common files\Wise Installation Wizard

2010-01-05 21:22:03 164 ------w- c:\windows\avrack.ini

2010-01-05 18:33:08 0 d-----w- c:\program files\Realtek AC97

2010-01-04 22:11:36 0 d-----w- c:\program files\ESET

2010-01-04 09:39:00 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-01-04 08:21:57 77312 ----a-w- C:\mbr.exe

2010-01-04 06:11:10 0 ----a-w- c:\documents and settings\owner\defogger_reenable

2010-01-04 04:16:37 217088 ----a-w- c:\windows\system32\aIPH.dll

2010-01-04 04:08:26 692224 ----a-w- c:\windows\system32\ANIWZCS2.dll

2010-01-04 04:08:26 49152 ----a-w- c:\windows\system32\JJAKEn.dll

2010-01-04 04:08:26 49152 ----a-w- c:\windows\system32\AQCKGen.dll

2010-01-04 04:08:26 45115 ----a-w- c:\windows\system32\ANICtl.dll

2010-01-04 04:08:26 262144 ----a-w- c:\windows\system32\wnicapi.dll

2010-01-04 04:08:26 245760 ----a-w- c:\windows\system32\WlanApp.dll

2010-01-04 04:08:26 1327189 ----a-w- c:\windows\system32\odSupp_M.dll

2010-01-04 04:08:09 48128 ----a-w- c:\windows\system32\ANIO64.sys

2010-01-04 04:08:09 36864 ----a-w- c:\windows\system32\ANIOApi.dll

2010-01-04 04:08:09 28195 ----a-w- c:\windows\system32\ANIO.sys

2010-01-04 04:08:09 16997 ----a-w- c:\windows\system32\ANIO.VXD

2010-01-04 04:08:09 11904 ----a-w- c:\windows\system32\anio4.sys

2010-01-04 01:14:04 0 d-----w- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com

2010-01-04 01:13:51 0 d-----w- c:\program files\SUPERAntiSpyware

2010-01-04 01:13:51 0 d-----w- c:\docume~1\owner\applic~1\SUPERAntiSpyware.com

2010-01-04 01:00:53 578560 -c--a-w- c:\windows\system32\dllcache\user32.dll

2010-01-04 00:56:28 0 d-----w- c:\windows\ERUNT

2010-01-03 21:01:12 7 ----a-w- c:\windows\system32\ANIWZCSUSERNAME

2010-01-03 20:13:36 0 d--h--w- c:\windows\PIF

2010-01-03 20:01:06 0 d-----w- c:\program files\ANI

2010-01-03 20:00:56 0 d-----w- c:\program files\Airlink101

2010-01-02 22:31:42 0 d-----w- c:\docume~1\owner\applic~1\Malwarebytes

2010-01-02 22:31:34 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-01-02 21:56:17 0 d-----w- c:\program files\Process Explorer

2009-12-17 23:24:31 0 d--h--w- c:\windows\system32\GroupPolicy

2009-12-17 23:09:22 0 d-----w- c:\temp\produkey

2009-12-17 23:07:32 8086544 ----a-w- c:\temp\Firefox Setup 3.5.6.exe

2009-12-17 22:52:35 0 d-----w- c:\program files\CCleaner

2009-12-17 22:52:09 3326576 ----a-w- c:\temp\ccsetup226.exe

2009-12-17 22:49:36 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-12-17 21:30:59 0 d-----w- c:\program files\Windows Installer Clean Up

2009-12-17 21:30:43 359656 ----a-w- c:\temp\msicuu2.exe

2009-12-17 21:29:38 27386280 ----a-w- c:\temp\AdbeRdr920_en_US.exe

2009-12-17 21:22:34 0 d-----w- c:\windows\system32\appmgmt

==================== Find3M ====================

2009-11-16 17:06:50 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys

2009-11-16 17:03:36 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys

2009-11-16 16:56:12 116520 ----a-w- c:\windows\system32\drivers\eamon.sys

2009-10-29 07:46:59 832512 ------w- c:\windows\system32\wininet.dll

2009-10-29 07:46:52 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-10-29 07:46:50 17408 ----a-w- c:\windows\system32\corpol.dll

2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-19 21:06:40 223232 ------w- c:\windows\system32\wksprt.exe

2009-10-19 21:06:38 46080 ------w- c:\windows\system32\TSWbPrxy.exe

2009-10-19 21:06:38 36864 ------w- c:\windows\system32\tsgQec.dll

2009-10-19 21:06:38 12800 ------w- c:\windows\system32\wksprtPS.dll

2009-10-19 21:06:38 1033728 ----a-w- c:\windows\system32\mstsc.exe

2009-10-19 21:06:36 2689024 ----a-w- c:\windows\system32\mstscax.dll

2009-10-19 21:06:34 44544 ------w- c:\windows\system32\MsRdpWebAccess.dll

2009-10-19 21:06:34 130560 ------w- c:\windows\system32\aaclient.dll

============= FINISH: 1:48:10.56 ===============

Attach.zip

Link to post
Share on other sites

GMER results:

==================

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-01-12 01:56:20

Windows 5.1.2600 Service Pack 3

Running: zxqqe56i.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\pxtdqpog.sys

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 60: copy of MBR

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)

AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

---- Threads - GMER 1.0.15 ----

Thread System [4:316] 85D16930

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

  • Root Admin

STEP 01

Please download the Norton Removal Tool to remove left over pieces of their software.

STEP 02

Fully remove all old versions of Adobe Acrobat Reader such as this one:

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe

Then update to the latest version of Adobe Acrobat Reader as you were probably infected by an infected PDF file.

STEP 03

Since you said you already removed the Sophos Anti-Rookit and the driver still shows as loading we'll have CF remove it.

Open notepad and copy/paste the text in the code box below into it:

Driver::
MEMSWEEP2
File::
c:\windows\system32\3.tmp
C:\mbr.exe
DirLook::
c:\temp\produkey

Save this as "CFScript.txt", and as Type: All Files (*.*)

in the same location as ComboFix.exe

***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

***************************************************

CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt please post that new log back on your next reply.

Now re-enable your Anti-Virus.

STEP 04

Your version of Java is old and needs to be removed and updated as it has compromised code.

Please go into your Control Panel, Add/Remove and uninstall

J2SE Runtime Environment 5.0 Update 2

J2SE Runtime Environment 5.0 Update 7

J2SE Runtime Environment 5.0 Update 8

Java™ 6 Update 5

You may want to remove and re-install Java™ 6 Update 17

and then get the latest update below once again.

  • Download the latest version of Java Runtime Environment (JRE) 17 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) - JRE 6 Update 17 -"
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u17 with JavaFX 1 License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser..
  • Then from your desktop double-click on jre-6u17-windows-i586-p.exe to install the newest version.

STEP 05

Uninstall the following old software and obtain the latest versions if you want or use them.

Adobe Flash Player ActiveX

Macromedia Flash Player 8

Then let me know how the computer is running and if you're still having any signs of infection.

Link to post
Share on other sites

  • Root Admin

You also have some errors that seem to indicate that you may need to reinstall some Microsoft Runtime files.

After you finish the other steps then take a look at the following.

You might want to review and consider reinstalling these. Then after a reboot go to the Windows update site and scan for updates.

Microsoft Visual C++ 2005 Redistributable Package (x86)

http://www.microsoft.com/downloads/details...;displaylang=en

Microsoft Visual C++ 2008 Redistributable Package (x86)

http://www.microsoft.com/downloads/details...;displaylang=en

Link to post
Share on other sites

Hmmm, I just ran TWO norton cleaners a couple days ago, the two listed here

http://uninstallers.blogspot.com/

[23] Norton/Symantec 2010

[29] Symantec ActiveX Control (which didn't act like it was cleaning Norton crap, but deleted a bunch of OTHER stuff, despite saying "removes vulnerable versions of the Active X control installed with some of Symantecs consumer products")

Will do all that in the morning.

Thanks, Ron!

Meanwhile, here's the result of a MBAM full scan, looks like stuff was only found in the restore points. I took no action on these yet:

=============================

Malwarebytes' Anti-Malware 1.44

Database version: 3546

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

1/12/2010 2:57:44 AM

mbam-log-2010-01-12 (02-57-32).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 187624

Time elapsed: 46 minute(s), 10 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 5

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP877\A0075553.sys (Malware.Trace) -> No action taken.

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP887\A0079361.sys (Malware.Trace) -> No action taken.

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP887\A0079429.sys (Malware.Trace) -> No action taken.

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP887\A0079457.sys (Malware.Trace) -> No action taken.

C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP891\A0079890.sys (Malware.Trace) -> No action taken.

Link to post
Share on other sites

I ran the Norton cleaner, uninsytalled Reader 9 & deleted all refs to reader 7 I knew about, reinstalled reader 9. Ran Combofix with CFScript.txt. Result:

============================

ComboFix 10-01-12.02 - Owner 01/12/2010 11:32:48.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.600 [GMT -8:00]

Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe

Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FILE ::

"C:\mbr.exe"

"c:\windows\system32\3.tmp"

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\mbr.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_MEMSWEEP2

-------\Service_MEMSWEEP2

((((((((((((((((((((((((( Files Created from 2009-12-12 to 2010-01-12 )))))))))))))))))))))))))))))))

.

2010-01-12 02:19 . 2010-01-12 02:19 -------- d-----w- c:\windows\Internet Logs

2010-01-11 08:28 . 2010-01-12 02:52 -------- d-----w- C:\RootRepeal

2010-01-11 07:33 . 2010-01-08 00:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-11 07:33 . 2010-01-11 07:33 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-11 07:33 . 2010-01-08 00:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-11 04:25 . 2010-01-11 04:25 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe

2010-01-11 04:25 . 2010-01-11 04:25 -------- d-----w- c:\program files\TrendMicro

2010-01-08 03:28 . 2009-08-07 03:23 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-01-06 03:29 . 2010-01-06 03:29 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET

2010-01-06 03:24 . 2010-01-12 18:58 52224 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll

2010-01-05 22:48 . 2010-01-05 22:48 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2010-01-05 18:33 . 2010-01-05 18:33 -------- d-----w- c:\program files\Realtek AC97

2010-01-04 22:11 . 2010-01-04 22:11 -------- d-----w- c:\program files\ESET

2010-01-04 22:11 . 2010-01-04 22:11 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2010-01-04 09:39 . 2010-01-04 09:39 552 ----a-w- c:\windows\system32\d3d8caps.dat

2010-01-04 04:16 . 2007-11-22 02:36 217088 ----a-w- c:\windows\system32\aIPH.dll

2010-01-04 04:08 . 2008-01-02 18:24 692224 ----a-w- c:\windows\system32\ANIWZCS2.dll

2010-01-04 04:08 . 2007-12-11 23:36 245760 ----a-w- c:\windows\system32\WlanApp.dll

2010-01-04 04:08 . 2007-10-09 03:13 262144 ----a-w- c:\windows\system32\wnicapi.dll

2010-01-04 04:08 . 2006-09-26 21:49 45115 ----a-w- c:\windows\system32\ANICtl.dll

2010-01-04 04:08 . 2005-10-27 16:55 49152 ----a-w- c:\windows\system32\JJAKEn.dll

2010-01-04 04:08 . 2005-10-20 02:19 49152 ----a-w- c:\windows\system32\AQCKGen.dll

2010-01-03 20:00 . 2010-01-04 04:15 -------- d-----w- c:\program files\Airlink101

2010-01-02 22:31 . 2010-01-11 07:33 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes

2010-01-02 22:31 . 2010-01-11 07:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-02 21:56 . 2010-01-02 21:57 -------- d-----w- c:\program files\Process Explorer

2009-12-17 23:24 . 2009-12-17 23:24 -------- d--h--w- c:\windows\system32\GroupPolicy

2009-12-17 23:19 . 2009-12-17 23:19 -------- d-----w- c:\windows\system32\zh-TW

2009-12-17 23:09 . 2010-01-03 11:05 -------- d-----w- c:\temp\produkey

2009-12-17 23:07 . 2009-12-17 23:07 8086544 ----a-w- c:\temp\Firefox Setup 3.5.6.exe

2009-12-17 22:52 . 2009-12-17 22:52 -------- d-----w- c:\program files\CCleaner

2009-12-17 22:52 . 2009-12-17 22:52 3326576 ----a-w- c:\temp\ccsetup226.exe

2009-12-17 22:49 . 2009-12-17 22:49 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-12-17 22:48 . 2009-12-17 22:48 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll

2009-12-17 22:46 . 2009-12-17 22:46 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-17 21:31 . 2009-12-17 21:31 3584 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe

2009-12-17 21:30 . 2009-12-17 21:31 -------- d-----w- c:\program files\Windows Installer Clean Up

2009-12-17 21:30 . 2009-12-17 21:30 359656 ----a-w- c:\temp\msicuu2.exe

2009-12-17 21:29 . 2009-12-10 21:11 27386280 ----a-w- c:\temp\AdbeRdr920_en_US.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-12 19:22 . 2005-07-29 12:28 -------- d-----w- c:\program files\Common Files\Adobe

2010-01-12 18:58 . 2010-01-04 01:14 117760 ----a-w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

2010-01-11 16:48 . 2010-01-04 01:13 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-01-05 21:22 . 2005-07-29 12:28 -------- d-----w- c:\program files\AvRack

2010-01-04 04:17 . 2005-07-29 12:12 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-04 04:08 . 2010-01-03 20:01 -------- d-----w- c:\program files\ANI

2010-01-04 01:14 . 2010-01-04 01:14 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2010-01-04 01:13 . 2010-01-04 01:13 -------- d-----w- c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com

2009-12-17 22:50 . 2005-07-29 12:25 -------- d-----w- c:\program files\Common Files\AOL

2009-12-17 22:50 . 2005-07-29 12:25 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL

2009-12-17 22:48 . 2005-07-29 12:24 -------- d-----w- c:\program files\Java

2009-12-17 22:46 . 2005-07-29 12:15 -------- d-----w- c:\program files\Google

2009-12-17 21:30 . 2008-08-04 17:30 -------- d-----w- c:\program files\MSECache

2009-12-08 12:02 . 2009-12-08 12:02 -------- d-----w- c:\program files\Microsoft Silverlight

2009-12-04 01:47 . 2009-11-23 16:53 -------- d-----w- c:\documents and settings\Owner\Application Data\Costco Photo Organizer

2009-12-02 10:31 . 2009-02-11 22:29 869664 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\DownloadQB19\EPatch\qbpatch.exe

2009-11-30 16:39 . 2009-02-11 22:29 205576 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\IntuitSyncManagerPatch.exe

2009-11-30 16:39 . 2009-02-11 22:29 1087752 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\IntuitSyncManager.exe

2009-11-30 16:39 . 2009-08-12 07:44 852784 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\dblgen11.dll

2009-11-30 16:39 . 2009-08-12 07:44 2168112 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\iAnywhere.Data.SQLAnywhere.dll

2009-11-24 12:04 . 2009-11-24 12:04 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2

2009-11-23 17:00 . 2009-11-23 16:59 -------- d-----w- c:\documents and settings\Owner\Application Data\Printer Info Cache

2009-11-23 16:53 . 2009-11-23 16:53 -------- d-----w- c:\program files\Common Files\HP

2009-11-23 16:53 . 2009-11-23 16:53 -------- d-----w- c:\program files\Costco

2009-11-23 16:52 . 2009-11-23 16:49 -------- d-----w- c:\documents and settings\Owner\Application Data\Costco Photo Viewer US

2009-11-21 15:51 . 2004-08-04 12:00 471552 ----a-w- c:\windows\AppPatch\aclayers.dll

2009-11-17 12:03 . 2009-11-17 12:03 -------- d-----w- c:\program files\Windows Media Connect 2

2009-11-16 17:06 . 2009-11-16 17:06 96408 ----a-w- c:\windows\system32\drivers\epfwtdir.sys

2009-11-16 17:03 . 2009-11-16 17:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys

2009-11-16 16:56 . 2009-11-16 16:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys

2009-11-06 09:01 . 2009-08-12 07:44 787760 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\dblgen10.dll

2009-11-06 09:01 . 2009-08-12 07:44 763184 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\dblib10.dll

2009-11-06 09:01 . 2009-08-12 07:44 570672 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\mlhttps10.dll

2009-11-06 09:01 . 2009-08-12 07:44 496944 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\mlrsa10.dll

2009-11-06 09:01 . 2009-08-12 07:44 423216 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\dbmlsync.exe

2009-11-06 09:01 . 2009-08-12 07:44 398640 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\dbcon10.dll

2009-11-06 09:01 . 2009-08-12 07:44 296240 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\mlsock10.dll

2009-11-06 09:01 . 2009-08-12 07:44 263472 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\mlcrsa10.dll

2009-11-06 09:01 . 2009-08-12 07:44 1152304 ----a-w- c:\documents and settings\All Users\Application Data\Intuit\QuickBooks Enterprise Solutions 9.0\Components\SyncMgr\OCD\Sybase10\dbtool10.dll

2009-10-29 07:46 . 2004-08-04 12:00 832512 ------w- c:\windows\system32\wininet.dll

2009-10-29 07:46 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2009-10-29 07:46 . 2004-08-04 12:00 17408 ----a-w- c:\windows\system32\corpol.dll

2009-10-21 05:38 . 2004-08-04 12:00 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38 . 2004-08-04 12:00 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 12:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-19 21:06 . 2009-10-19 21:06 223232 ------w- c:\windows\system32\wksprt.exe

2009-10-19 21:06 . 2009-10-19 21:06 46080 ------w- c:\windows\system32\TSWbPrxy.exe

2009-10-19 21:06 . 2009-10-19 21:06 12800 ------w- c:\windows\system32\wksprtPS.dll

2009-10-19 21:06 . 2008-09-04 18:11 36864 ------w- c:\windows\system32\tsgQec.dll

2009-10-19 21:06 . 2004-08-26 18:00 1033728 ----a-w- c:\windows\system32\mstsc.exe

2009-10-19 21:06 . 2004-08-26 18:00 2689024 ----a-w- c:\windows\system32\mstscax.dll

2009-10-19 21:06 . 2009-10-19 21:06 44544 ------w- c:\windows\system32\MsRdpWebAccess.dll

2009-10-19 21:06 . 2008-09-04 18:08 130560 ------w- c:\windows\system32\aaclient.dll

2001-12-04 00:09 . 2008-08-28 18:35 90112 ----a-w- c:\program files\internet explorer\plugins\DjVuControl.dll

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\temp\produkey ----

2009-12-17 23:09 . 2009-11-21 21:11 16196 ----a-w- c:\temp\produkey\ProduKey.chm

2009-12-17 23:09 . 2009-11-21 21:11 12052 ----a-w- c:\temp\produkey\readme.txt

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-11 2002160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-03-15 966656]

"PostCopy"="c:\windows\system32\Belkin\F5U109\PostCopy.exe" [2001-07-26 20480]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-12-17 149280]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]

"VTTimer"="VTTimer.exe" [2005-03-08 53248]

"VTTrayp"="VTtrayp.exe" [2005-03-12 147456]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2005-07-29 98304]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-09-09 623880]

"SoundMan"="SOUNDMAN.EXE" [2005-05-13 67584]

"ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2007-01-19 49152]

"Airlink101 Airlink101 WLAN Monitor"="c:\program files\Airlink101\Airlink101 WLAN Monitor\WLANmon.exe" [2007-12-01 1949696]

"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-11-16 2054360]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\Owner\Start Menu\Programs\Startup\

Process Explorer.lnk - c:\program files\Process Explorer\procexp.exe [2010-1-2 3550592]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2009-1-15 984352]

QuickBooks Web Connector.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBWebConnector\QBWebConnector.exe [2008-11-13 300328]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\BigFix.lnk

backup=c:\windows\pss\BigFix.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

2004-11-03 21:03 125528 ----a-w- c:\program files\Common Files\AOL\1122639952\EE\AOLHostManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ------w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

2004-11-03 03:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]

2004-11-15 22:04 135168 ----a-w- c:\program files\Digital Media Reader\shwiconEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]

2005-03-08 10:33 53248 ----a-w- c:\windows\system32\VTTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTrayp]

2005-03-12 00:33 147456 ----a-w- c:\windows\system32\VTTrayp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Common Files\\AOL\\1122639952\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [11/16/2009 9:06 AM 96408]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]

R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [11/16/2009 9:04 AM 735960]

R3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [6/18/2007 1:25 PM 550272]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

Trusted Zone: isqft.com\www

Trusted Zone: isqft.com\www

Handler: intu-help-qb2 - {84D77A00-41B5-4b8b-8ADF-86486D72E749} - c:\program files\Intuit\QuickBooks Enterprise Solutions 8.0\HelpAsyncPluggableProtocol.dll

FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\p5p1979t.default\

FF - prefs.js: browser.search.selectedEngine - Google

FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-12 11:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3860)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\mshtml.dll

c:\windows\system32\WPDShServiceObj.dll

c:\program files\Common Files\aolshare\aolshcpy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS

c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\windows\SOUNDMAN.EXE

.

**************************************************************************

.

Completion time: 2010-01-12 11:46:54 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-12 19:46

Pre-Run: 117,296,119,808 bytes free

Post-Run: 117,222,281,216 bytes free

- - End Of File - - 405FB1E1372AC5FE76F9E16FEDFB2486

=====================================

continuing to delete old stuff & update as you suggested

Link to post
Share on other sites

NOD32 updated and ran overnight, only finding one signature, related to an anti-malware program I have on the desktop.

I've uninstalled /reinstalled Java & Flash, installed the two versions of Visual C++.

Succeeded with Windows updates, including MSIE8, EXCEPT that the .NET Framework 1.1 Service Pack 1 Security Update failed.

Apparently this update has been failing since at least early November; it's probably not a result of malware (but I don't know if this failure contributed to this infection).

I've found procedures on the web to fix this, but will wait and see if you want to give specific instructions.

So, apart from that (and I would like to clean up some more) I see no problems with the computer right now.

One comment, wondering if this experience might show a way to improve MBAM or other tools:

I may have missed it, but I don't see that any of the scans you had me run identified a problem with either ghf.old or with

Hidden: registry item \HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi9

although together, these two items prevented MBAM from running, and had other ill effects.

One of these items I found using Trend Micro's housecall, the other was found by Sophos' anti-rootkit tool. Neither tool found both items, and neither was emphatic about the problem.

Are there better ways to ID this infection when it's on a computer? Can MBAM or the other standbys be revised to resist &/or ID this malware?

Both Housecall and the Sophos tool said these were suggestive of KATES malware. You called it Daonol. I guess there are different flavors in this class, but they are all related.

Here is some info about the class of malware.

http://forum.avira.com/wbb/index.php?page=...p;postID=879857

The above site suggests using "KatesKiller" from Kaspersky (-as of last November. I don't know if it's still reliable.)

Have any comments on efficient ways to ID this infection? It seems to be going around, and getting more serious.

(Obviously I will impress again on my friend the need to keep everything updated to reduce the chances of infection, but once one is infected...)

Two more questions:

The web discussions suggest this malware is primarily aimed at getting FTP passwords in order to infect more web sites, which I suspect is not a problem on this specific computer. What are the chances that other passwords were logged and relayed back to HQ? Or maybe taken from the FF or MSIE password caches? It's possible my friend used this computer for banking etc

And, do you recommend script blockers like NoScript for FF? (I don't know what's recommended for MSIE.) I've been trying NoScript for a few days and so far it has been a pain, maybe it'll be better when I'm used to it; but for people with little tech savvy, like my parents, it does not seem at all feasible.

Thanks!

Richard

Link to post
Share on other sites

  • Root Admin

Often updates from the MS Update site can fail for one reason or another. I'd try to manually download and run the update myself before venturing off to more detailed fixes.

http://www.microsoft.com/downloads/details...;displaylang=en

Once it is installed (assuming it works) make sure to go back to the Windows update site and check again for updates.

As for this infection we actually do already target it as long as we can catch it before it catches us. Using the paid version with real time protection should have been able to detect and prevent it. As for naming well I see no end in site for that. None of the AV or AM vendors agree on names or variants so most write their own names and do their own tracking.

As for NoScript, I really like it and I use it all the time. Yes it does take getting used to but using the bottom right icon you can easily see the sites that are trying to run and you can choose to allow them or not. If a site just will not run right and you've done what you can then you can report it to NoScript support and they're pretty quick about responding as well. I also use AdBlockPlus with NoScript and that really keeps most things at bay.

Please remove Combofix now. Click on START - RUN and type in Combofix.exe /uninstall and click OK and it should remove itself.

Great, all looks good now. If there is anything else left over from scanning you can go ahead and remove it now.

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Remove all but the most recent Restore Point on Windows XP

You should
Create a New Restore Point
to prevent possible reinfection from an old one.

Some of the malware you picked up could have been saved in System Restore.

Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.

Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to
"roll-back"
to a clean working state.

The easiest and safest way to do this is

:
  • Go to
    Start
    >
    Programs
    >
    Accessories
    >
    System Tools
    and click "
    System Restore
    ".

  • If the shortcut is missing you can also click on
    START
    >
    RUN
    > and type in
    %SystemRoot%\system32\restore\rstrui.exe
    and click OK

  • Choose the radio button marked "
    Create a Restore Point
    " on the first screen then click "
    Next
    ".

  • Give the new Restore Point a name, then click "
    Create
    ".

  • The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

  • Then use the
    Disk Cleanup
    to remove all but the most recently created Restore Point.

  • Go to
    Start
    >
    Run
    and type:
    Cleanmgr.exe

  • Select the drive where Windows is installed and click "
    Ok
    ". Disk Cleanup will scan your files for several minutes, then open.

  • Click the "
    More Options
    " tab, then click the "
    Clean up
    " button under System Restore.

  • Click Ok. You will be prompted with "
    Are you sure you want to delete all but the most recent restore point?
    "

  • Click
    Yes
    , then click Ok.

  • Click
    Yes
    again when prompted with "
    Are you sure you want to perform these actions?
    "

  • Disk Cleanup will remove the files and close automatically.

  • On the
    Disk Cleanup
    tab, if the
    System Restore: Obsolete Data Stores
    entry is available remove them also.

  • These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.

selectdrivecleanup.pngselectdrivecleanup1.png

Additional information

Microsoft KB article: How to turn off and turn on System Restore in Windows XP

Bert Kinney's site: All about Windows System Restore

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster

Download it from here

Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol

Download it from here

Here you can find information about how WinPatrol works here

Install FireTrust SiteHound

You can find information and download it from here

Install hpHosts

Download it from here

hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,

tracking and malicious websites. This prevents your computer from connecting to these untrusted sites

by redirecting them to 127.0.0.1 which is your own local computer.

hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Secunia Software Inspector

F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.

http://www.update.microsoft.com

Note 1: If you are running Windows XP SP2, you should upgrade to SP3.

Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.

The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

I recommend Online Armor Free

A little outdated but good reading on how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructions

Also don't forget that we offer FREE assistance with General PC questions and repair here PC Help

If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.