Jump to content

Keeps coming back - hjt log - HELP!


Recommended Posts

Thought I had gotten rid of the worm32.netsky virus, after 2 weeks and being very cautious something is back. First noticed it when search engine searches starting redirecting to spyware pages. Btw, we have a Barracuda webfilter and luckily it is blocking these redirects for the most part. Please help!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 2:55:20 PM, on 1/11/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\Common Framework\FrameworkService.exe

C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\rundll32.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\McAfee\Common Framework\UdaterUI.exe

C:\Program Files\McAfee\Common Framework\McTray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {343d6617-5975-4035-b504-bf052b67a3f2} - radugipe.dll (file missing)

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\S-1-5-21-1202660629-1957994488-682003330-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')

O4 - HKUS\S-1-5-21-1202660629-1957994488-682003330-500\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User 'Administrator')

O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?

O4 - Global Startup: Adobe Acrobat Synchronizer.lnk = C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kma.com

O17 - HKLM\Software\..\Telephony: DomainName = kma.com

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kma.com

O20 - AppInit_DLLs: dadenuvi.dll

O21 - SSODL: kilibojoj - {d7b3a6e2-ef44-4d75-8eca-7fe6801ddb95} - (no file)

O21 - SSODL: dukekumam - {34a325d9-8b68-4984-8ee1-b39f609ddf19} - (no file)

O22 - SharedTaskScheduler: gahurihor - {d7b3a6e2-ef44-4d75-8eca-7fe6801ddb95} - (no file)

O22 - SharedTaskScheduler: kupuhivus - {34a325d9-8b68-4984-8ee1-b39f609ddf19} - (no file)

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe

O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe

O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O24 - Desktop Component 0: (no name) - file:///C:/DOCUME~1/tyoung/LOCALS~1/Temp/msohtmlclip1/01/clip_image001.jpg

--

End of file - 9125 bytes

Link to post
Share on other sites

Ok, removed these and running another scan with MB. These looked obvious to me. Please help, thanks in advance!!!

O21 - SSODL: kilibojoj - {d7b3a6e2-ef44-4d75-8eca-7fe6801ddb95} - (no file)

O21 - SSODL: dukekumam - {34a325d9-8b68-4984-8ee1-b39f609ddf19} - (no file)

O22 - SharedTaskScheduler: gahurihor - {d7b3a6e2-ef44-4d75-8eca-7fe6801ddb95} - (no file)

O22 - SharedTaskScheduler: kupuhivus - {34a325d9-8b68-4984-8ee1-b39f609ddf19} - (no file)

Link to post
Share on other sites

Combo fix log...

ComboFix 10-01-11.01 - tyoung 01/11/2010 17:15:08.1.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2014.1706 [GMT -6:00]

Running from: e:\antispyware_tools\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\Install.txt

c:\windows\system32\comres(3).dll

c:\windows\system32\Install.txt

c:\windows\Tasks\enhsvskj.job

c:\windows\Temp\tmp3.tmp

----- BITS: Possible infected sites -----

hxxp://kmaapps01:8530

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected

Restored copy from - Kitty ate it ;)

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_WINSTS

((((((((((((((((((((((((( Files Created from 2009-12-11 to 2010-01-11 )))))))))))))))))))))))))))))))

.

2010-01-11 20:26 . 2010-01-11 20:26 -------- d-----w- c:\documents and settings\tyoung\DoctorWeb

2010-01-11 18:58 . 2010-01-11 18:58 5115824 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-08 06:52 . 2010-01-08 06:53 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe

2010-01-07 17:37 . 2010-01-07 17:37 -------- d-----w- c:\documents and settings\tyoung\Application Data\PC Tools

2010-01-05 15:41 . 2010-01-05 15:41 -------- d-sh--w- c:\documents and settings\cory\IETldCache

2010-01-04 23:09 . 2010-01-04 23:09 -------- d-----w- c:\documents and settings\Administrator.KMADESKTOP046\DoctorWeb

2010-01-04 21:12 . 2010-01-11 18:58 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-04 21:04 . 2010-01-04 21:04 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE

2010-01-04 21:03 . 2010-01-04 21:03 8704 ----a-w- c:\windows\system32\sporder.dll

2010-01-04 21:03 . 2010-01-04 21:03 626688 ----a-w- c:\windows\system32\ntll.dll

2010-01-04 20:53 . 2010-01-04 20:53 -------- d-----w- c:\documents and settings\Administrator.KMADESKTOP046\Application Data\Malwarebytes

2010-01-04 20:48 . 2010-01-04 20:48 -------- d-----w- c:\documents and settings\Administrator.KMADESKTOP046\Local Settings\Application Data\Google

2010-01-04 17:43 . 2010-01-04 17:43 -------- d-----w- c:\documents and settings\Administrator.KMADESKTOP046\Local Settings\Application Data\Adobe

2010-01-04 17:39 . 2010-01-04 17:39 -------- d-----w- c:\documents and settings\Administrator.KMADESKTOP046\Local Settings\Application Data\Apple Computer

2010-01-04 17:37 . 2010-01-04 17:37 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-01-04 14:38 . 2010-01-04 14:38 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Google

2010-01-04 14:11 . 2010-01-04 14:11 -------- d-----w- c:\program files\Trend Micro

2010-01-04 13:51 . 2010-01-04 13:51 201030 ----a-w- C:\lspfix.zip

2010-01-04 13:50 . 2010-01-04 13:50 401720 ----a-w- C:\HijackThis.exe

2010-01-04 13:42 . 2010-01-04 13:42 2672312 ----a-w- C:\esetsmartinstaller_enu.exe

2009-12-30 22:53 . 2001-08-18 04:36 5632 ----a-w- c:\windows\system32\ptpusb.dll

2009-12-30 22:53 . 2008-04-14 11:42 159232 ----a-w- c:\windows\system32\ptpusd.dll

2009-12-30 22:53 . 2008-04-14 06:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys

2009-12-30 22:53 . 2008-04-14 06:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys

2009-12-24 13:21 . 2010-01-11 17:32 -------- d-----w- C:\QUARANTINE

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-11 22:58 . 2009-06-11 22:39 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2010-01-11 17:32 . 2009-06-11 19:50 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2010-01-11 15:24 . 2009-10-16 16:09 -------- d-----w- c:\documents and settings\tyoung\Application Data\Apple Computer

2010-01-07 22:07 . 2010-01-05 15:45 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 22:07 . 2010-01-05 15:45 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-05 22:23 . 2010-01-05 21:55 -------- d-----w- c:\program files\SUPERAntiSpyware

2010-01-05 21:55 . 2010-01-05 21:55 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2010-01-05 18:41 . 2010-01-05 18:41 -------- d-----w- c:\program files\ESET

2010-01-05 17:16 . 2010-01-05 17:16 -------- d-----w- c:\documents and settings\tyoung\Application Data\Malwarebytes

2010-01-05 15:45 . 2010-01-05 15:45 -------- d-----w- c:\documents and settings\cory\Application Data\Malwarebytes

2010-01-04 23:00 . 2010-01-04 23:00 696832 ----a-w- c:\windows\isRS-000.tmp

2010-01-04 17:38 . 2009-10-19 14:36 -------- d-----w- c:\documents and settings\All Users\Application Data\FLEXnet

2009-12-30 22:53 . 2009-10-16 16:03 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2009-12-17 18:39 . 2009-10-16 19:05 19 ----a-w- c:\windows\system32\ADE.dat

2009-10-19 16:14 . 2009-10-16 15:59 69624 ----a-w- c:\documents and settings\tyoung\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-10-16 15:33 . 2009-10-16 15:33 172032 ----a-w- c:\windows\system32\SSCE5332.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-21 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-05-01 843776]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-12-04 8523776]

"nwiz"="nwiz.exe" [2007-12-04 1626112]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-12-04 81920]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]

"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2006-10-23 620152]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Acrobat Speed Launcher.lnk - c:\windows\Installer\{AC76BA86-1033-0000-BA7E-000000000003}\_SC_Acrobat.exe [2009-10-19 295606]

Adobe Acrobat Synchronizer.lnk - c:\program files\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe [2006-10-22 734872]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceStartMenuLogOff"= 1 (0x1)

"NoWelcomeScreen"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSetActiveDesktop"= 1 (0x1)

"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 atiide;atiide;c:\windows\system32\drivers\atiide.sys [6/11/2009 3:55 PM 3456]

S0 kskvxqe;kskvxqe; [x]

S3 ndisdrv;ndisdrv;\??\c:\windows\system32\ndisdrv.sys --> c:\windows\system32\ndisdrv.sys [?]

.

.

------- Supplementary Scan -------

.

uInternet Settings,ProxyOverride = *.local

IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-11 17:23

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,00,d5,65,32,6e,4a,bf,43,b4,45,db,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,00,d5,65,32,6e,4a,bf,43,b4,45,db,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(700)

c:\program files\Bonjour\mdnsNSP.dll

- - - - - - - > 'explorer.exe'(3012)

c:\windows\system32\WININET.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\IEFRAME.dll

c:\windows\system32\mshtml.dll

c:\windows\system32\msls31.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe

c:\program files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2010-01-11 17:27:45 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-11 23:27

Pre-Run: 63,843,475,456 bytes free

Post-Run: 64,326,705,152 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 839DC4A2D845025132EAF205AD5ACA49

Link to post
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.