New Variant of Dr Guard HELP

oplease · March 9, 2010

I was told that I probably have a new variant of Dr. Guard based on my posts here http://forums.malwarebytes.org/index.php?showtopic=42669

I started to follow the instructions to clean my system but quickly failed - I did the defogger thing, but after it said Finished! and I clicked OK it did not prompt me to reboot. I would have done the Defogger again, but it specifically says not to do it twice. So the instructions say to post the log. Here it is

defogger_disable by jpshortstuff (23.02.10.1)

Log created at 15:05 on 09/03/2010 (Compaq_Owner)

Checking for autostart values...

HKCU\~\Run values retrieved.

HKLM\~\Run values retrieved.

Checking for services/drivers...

Unable to read djrzlw.sys

-=E.O.F=-

oplease · March 9, 2010

I googled djrzlw.sys and there are zero results. How can that be a real thing if it's never been mentioned anywhere before?

kahdah · March 10, 2010

Hello oplease

Welcome to Malwarebytes.

=====================

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

netsvcs

%SYSTEMDRIVE%\*.exe

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

symmpi.sys

adp3132.sys

mv61xx.sys

/md5stop

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
It may take a minute to load and become available.
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED
Sections
IAT/EAT
Drives/Partition other than Systemdrive (typically only C:\ should be checked)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Click OK and quit the GMER program.
Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.
Post that log in your next reply.

oplease · March 12, 2010

Thanks for helping! It's been 2 days primarily because my computer keeps shutting itself down every 30 to 60 minutes. And the GMER scan took forever.

I did that OTL thing twice; both times it stopped at "Checking service: hkmsvc"

Here is the GMER scan log [i put in bold the 2 items near the end that were in red prior to the creation of the .txt] -

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-03-11 19:04:09

Windows 5.1.2600 Service Pack 3

Running: RootkitScanner.exe; Driver: C:\DOCUME~1\COMPAQ~1\LOCALS~1\Temp\ugldqpow.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0xAA4478CA]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateKey [0xAA447710]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0xAA447878]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0xAA44788C]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xAA447724]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xAA447750]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateKey [0xAA4477BE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwEnumerateValueKey [0xAA4477A8]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0xAA44790A]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0xAA4477EA]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenKey [0xAA4476FC]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0xAA447850]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0xAA447864]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0xAA4478DE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryKey [0xAA447826]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryMultipleValueKey [0xAA447792]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwQueryValueKey [0xAA44777C]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xAA44773A]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0xAA447812]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0xAA4477FE]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0xAA4478B6]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0xAA4478A2]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetValueKey [0xAA447766]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xAA447939]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnloadKey [0xAA4477D4]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0xAA447920]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0xAA4478F4]

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 82D04EA8

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

AttachedDevice \Driver\Tcpip \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

AttachedDevice \Driver\Tcpip \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort0 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort1 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdePort2 [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e [F82BFB3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xac]}

AttachedDevice \Driver\Tcpip \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

AttachedDevice \Driver\Tcpip \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

---- Processes - GMER 1.0.15 ----

Process C:\docume~1\compaq~1\locals~1\temp\t749cy2h .exe (*** hidden *** ) 1824

---- Services - GMER 1.0.15 ----

Service (*** hidden *** ) [bOOT] djrzlw <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Type 1

Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Start 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@ErrorControl 0

Reg HKLM\SYSTEM\CurrentControlSet\Services\djrzlw@Group Boot Bus Extender

Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Type 1

Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Start 0

Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@ErrorControl 0

Reg HKLM\SYSTEM\ControlSet002\Services\djrzlw@Group Boot Bus Extender

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----

oplease · March 12, 2010

There's also a Dr. Guard Folder. I can delete everything but drgext.dll . I used MBAM's File Assasin to delete that once. It required reboot to delete. It was gone upon reboot, but it was quickly re-installed along with the other 6 or so things in the Dr. Guard folder.

kahdah · March 12, 2010

Looking at your system now, one or more of the identified infections is a backdoor Trojan.

If this computer is ever used for on-line banking, I suggest you do the following immediately:

1. Call all of your banks, credit card companies, financial institutions and inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

2. From a clean computer, change ALL your on-line passwords for email, for banks, financial accounts, PayPal, eBay, on-line companies, any on-line forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer because the attacker will get the new passwords and transaction information.

=============================

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

oplease · March 13, 2010

Okay, that produced a lot of progress. First, though, regarding the stuff you posted about passwords - does that apply to any thing on this computer ever, or only to things accessed during the infection?

ComboFix seems to have gotten rid of most things. regedit is enabled. System Restore now can be accessed, but there don't seem to be any restore points. After doing ComboFix I ran MBAM - it turned up one Trojan. I copied its info into the ComboFix document before rebooting, but it isn't there now. Here is the ComboFix log -

ComboFix 10-03-11.06 - Compaq_Owner 03/12/2010 16:08:03.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.115 [GMT -5:00]

Running from: c:\documents and settings\Compaq_Owner\My Documents\ComboFix.exe

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\COMPAQ~1\LOCALS~1\Temp\taskmgr.exe

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate

c:\documents and settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd

c:\documents and settings\Compaq_Owner\Application Data\Install.dat

c:\program files\Dr. Guard

c:\program files\Dr. Guard\drgext.dll

c:\program files\Helper

c:\recycler\S-1-5-21-499991695-2126121627-880281741-1003

c:\windows\system32\app_dll.dll

c:\windows\system32\ctfmon .exe

c:\windows\system32\logs

c:\windows\system32\logs\Settings.dat

c:\windows\system32\p9IYao.dll

c:\windows\system32\ps2.bat

c:\windows\system32\rundll32 .exe

c:\windows\system32\WORK.DAT

c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

c:\windows\viassary-hp.reg

D:\Autorun.inf

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\atapi.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

((((((((((((((((((((((((( Files Created from 2010-02-12 to 2010-03-12 )))))))))))))))))))))))))))))))

.

2010-03-08 01:56 . 2010-03-09 15:57 -------- d-sh--w- c:\documents and settings\NetworkService\UserData

2010-03-08 01:55 . 2010-03-08 01:57 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-03-07 04:14 . 2010-03-07 04:11 158208 ----a-w- c:\windows\wcatia.exe

2010-03-07 04:11 . 2010-03-07 04:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server

2010-02-26 19:27 . 2010-02-26 19:28 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-02-26 19:27 . 2010-02-26 19:27 -------- d-----w- c:\program files\DVDVideoSoft

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-12 21:23 . 2010-03-12 21:23 3649 ----a-w- c:\windows\viassary-hp.reg

2010-03-10 05:52 . 2006-12-27 18:35 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DivX

2010-03-10 05:46 . 2009-09-25 15:58 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\vlc

2010-03-09 21:10 . 2010-03-07 04:31 8908 ----a-w- c:\documents and settings\All Users\Application Data\fiosejgfse.dll

2010-03-09 13:47 . 2009-03-08 06:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-03-09 13:41 . 2010-03-09 13:41 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-03-07 15:34 . 2009-06-06 17:45 -------- d-----w- c:\program files\McAfee

2010-03-07 10:23 . 2005-03-13 06:48 -------- d-----w- c:\program files\QuickTime

2010-03-07 10:12 . 2005-03-13 06:48 -------- d-----w- c:\program files\iTunes

2010-03-07 04:31 . 2008-08-29 03:23 -------- d-----w- c:\program files\Windows Defender

2010-02-24 14:16 . 2009-10-06 06:28 181632 ------w- c:\windows\system32\MpSigStub.exe

2010-02-12 04:48 . 2006-08-03 23:25 -------- d-----w- c:\program files\Lx_cats

2010-01-28 14:20 . 2010-01-19 00:57 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks

2010-01-19 00:58 . 2010-01-19 00:58 144160 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\uninstall.exe

2010-01-19 00:57 . 2009-12-10 19:26 4187512 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll

2010-01-07 21:07 . 2009-03-08 06:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-07 21:07 . 2009-03-08 06:15 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-05 10:00 . 2004-08-04 04:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-01-05 10:00 . 2004-08-04 04:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-01-05 10:00 . 2004-08-04 04:00 17408 ------w- c:\windows\system32\corpol.dll

2009-12-31 16:50 . 2009-01-19 16:53 353792 ----a-w- c:\windows\system32\drivers\srv.sys

2009-12-16 18:43 . 2004-08-04 04:00 343040 ----a-w- c:\windows\system32\mspaint.exe

2009-12-14 21:03 . 2009-12-14 21:03 152576 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll

2009-12-14 21:02 . 2009-12-14 21:02 79488 ----a-w- c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-12-14 07:08 . 2009-01-19 16:53 33280 ----a-w- c:\windows\system32\csrsrv.dll

.

<pre>
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\McAfee.com\Agent\mcagent .exe
c:\program files\QuickTime\qttask   .exe
c:\program files\Windows Defender\msascui .exe
</pre>

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2005-03-13 06:43 . 2004-10-14 14:54 253952 c:\hp\drivers\hplsbwatcher\bak\lsburnwatcher.exe

2005-03-13 06:37 . 2003-02-11 12:02 61440 c:\hp\KBD\bak\KBD.EXE

2007-10-11 00:51 . 2007-10-11 00:51 39792 c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe

2008-10-15 05:04 . 2008-10-15 05:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

2005-03-13 06:41 . 2005-05-27 00:49 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2004-10-14 00:04 . 2004-10-14 00:04 278528 c:\program files\iTunes\bak\iTunesHelper.exe

2005-03-13 06:27 . 2005-03-13 06:27 32881 c:\program files\Java\j2re1.4.2_03\bin\bak\jusched.exe

2006-08-03 23:27 . 2005-02-21 11:21 192512 c:\program files\Lexmark 3300 Series\bak\lxccmon.exe

2006-08-03 23:31 . 2005-01-20 02:19 299008 c:\program files\Lexmark Fax Solutions\bak\fm3032.exe

2005-03-13 06:48 . 2005-03-13 06:48 98304 c:\program files\QuickTime\bak\qttask.exe

2005-03-13 06:49 . 2004-12-14 02:23 663552 c:\windows\CREATOR\bak\Remind_XP.exe

2004-04-14 13:43 . 2004-04-14 13:43 233472 c:\windows\SMINST\bak\RECGUARD.EXE

2008-02-14 08:27 . 2008-04-22 03:52 181 c:\windows\system\bak\hpsysdrv.DAT

2005-05-26 21:00 . 2008-02-08 07:45 185 c:\windows\system\hpsysdrv.DAT

2005-03-13 06:30 . 1998-05-07 09:04 52736 c:\windows\system\bak\hpsysdrv.exe

2004-08-04 04:00 . 2004-08-04 04:00 15360 c:\windows\system32\bak\ctfmon.exe

2004-08-04 04:00 . 2008-04-14 00:12 15360 c:\windows\system32\ctfmon.exe

2005-03-13 06:33 . 2004-11-02 08:59 126976 c:\windows\system32\bak\hkcmd.exe

2002-01-28 12:48 . 2002-01-28 12:48 885760 c:\windows\system32\bak\LXSUPMON.EXE

2005-03-13 06:37 . 2003-09-12 12:13 98304 c:\windows\system32\bak\ps2.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Anonymizer"="c:\program files\Anonymizer\Anonymizer Software\Anonymizer.exe" [N/A]

"Remote System Protection"="c:\windows\system32\p9iyao.dll" [N/A]

"Dr. Guard"="c:\program files\Dr. Guard\drguard.exe" [N/A]

"WEK9EMDHI9"="c:\windows\wcatia.exe" [2010-03-07 158208]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-03-18 61952]

"SoundMan"="SOUNDMAN.EXE" [2005-04-06 90112]

"funk"="funk.exe" [N/A]

"LXCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll" [2005-01-10 69632]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-02-11 1218008]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

"Remote System Protection"="c:\windows\system32\p9iyao.dll" [N/A]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\

Compaq Organize.lnk - c:\program files\Hewlett-Packard\Compaq Organize\bin\displayAgent.exe [2005-3-13 36864]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2005-3-13 45056]

SpySubtract.lnk - c:\program files\InterMute\SpySubtract\sslaunch.exe [2005-3-13 73728]

Terminus Command Center.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6CommCenter.exe [2004-10-1 494100]

Terminus Services Manager.lnk - c:\program files\Electronic Fantasy World\Terminus 6\T6SvcsManager.exe [2004-10-1 483860]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager\appcertdlls]

AppSecDll REG_SZ c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=

"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [6/6/2009 12:50 PM 93320]

S0 djrzlw;djrzlw; [x]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [3/8/2009 1:15 AM 38224]

S3 tdisnap;tdisnap;\??\c:\windows\system32\tdisnap.sys --> c:\windows\system32\tdisnap.sys [?]

S3 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]

.

Contents of the 'Scheduled Tasks' folder

2005-07-22 c:\windows\Tasks\Easy Internet Sign-up.job

- c:\program files\Easy Internet signup\HPSdpApp.exe [2004-08-13 09:50]

2010-02-15 c:\windows\Tasks\McDefragTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22]

2010-03-01 c:\windows\Tasks\McQcTask.job

- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-06-06 16:22]

2010-03-12 c:\windows\Tasks\MP Scheduled Scan.job

- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 23:20]

2010-03-12 c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job

- c:\windows\wcatia.exe [2010-03-07 04:11]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop

uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = <local>

IE: Add To Compaq Organize... - c:\progra~1\HEWLET~1\COMPAQ~1\bin/module.main/favorites\ie_add_to.html

IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\1bz3acg5.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll

FF - plugin: c:\documents and settings\Compaq_Owner\Application Data\Move Networks\plugins\npqmp071505000011.dll

FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

.

- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639} - (no file)

AddRemove-05E21449-3BA3-42BF-BBDA-95205F4EA40A - c:\program files\WildTangent\Apps\GameChannel\Games\05E21449-3BA3-42BF-BBDA-95205F4EA40A\Uninstall.exe

AddRemove-26DC0ED6-93A7-43C1-8DC5-EC16079580F9 - c:\program files\WildTangent\Apps\GameChannel\Games\26DC0ED6-93A7-43C1-8DC5-EC16079580F9\Uninstall.exe

AddRemove-29FF6D07-4A15-41F1-9D5E-E0F3A58012C6 - c:\program files\WildTangent\Apps\GameChannel\Games\29FF6D07-4A15-41F1-9D5E-E0F3A58012C6\Uninstall.exe

AddRemove-3330A279-CC39-4A17-AE19-DA464B26AD9A - c:\program files\WildTangent\Apps\GameChannel\Games\3330A279-CC39-4A17-AE19-DA464B26AD9A\Uninstall.exe

AddRemove-66195170-D19D-46C5-8FB7-8A4630071ADC - c:\program files\WildTangent\Apps\GameChannel\Games\66195170-D19D-46C5-8FB7-8A4630071ADC\Uninstall.exe

AddRemove-75528D5F-DD82-402E-BA7C-045B7DC6A712 - c:\program files\WildTangent\Apps\GameChannel\Games\75528D5F-DD82-402E-BA7C-045B7DC6A712\Uninstall.exe

AddRemove-9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9 - c:\program files\WildTangent\Apps\GameChannel\Games\9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9\Uninstall.exe

AddRemove-A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4 - c:\program files\WildTangent\Apps\GameChannel\Games\A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4\Uninstall.exe

AddRemove-BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF - c:\program files\WildTangent\Apps\GameChannel\Games\BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF\Uninstall.exe

AddRemove-C43D84CD-EBFC-48D3-A330-7868C8AD415A - c:\program files\WildTangent\Apps\GameChannel\Games\C43D84CD-EBFC-48D3-A330-7868C8AD415A\Uninstall.exe

AddRemove-DE87FA96-7840-420C-86F9-33F3B7B3CED1 - c:\program files\WildTangent\Apps\GameChannel\Games\DE87FA96-7840-420C-86F9-33F3B7B3CED1\Uninstall.exe

AddRemove-Dr. Guard - c:\program files\Dr. Guard\Uninstall.exe

AddRemove-Elecard Codec SDK G4 1.0.1.80507 Eval - c:\program files\Elecard\Elecard Codec SDK G4 Eval\Uninstall.exe

AddRemove-FA7F5211-C629-4711-BD82-7DFFB08CB518 - c:\program files\WildTangent\Apps\GameChannel\Games\FA7F5211-C629-4711-BD82-7DFFB08CB518\Uninstall.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-03-12 16:22

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCCCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCCtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(600)

c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll

- - - - - - - > 'explorer.exe'(3776)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\LEXBCES.EXE

c:\windows\system32\LEXPPS.EXE

c:\program files\Java\jre6\bin\jqs.exe

c:\progra~1\McAfee\MSC\mcmscsvc.exe

c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe

c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

c:\progra~1\McAfee\VIRUSS~1\mcshield.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\McAfee\MPF\MPFSrv.exe

c:\windows\system32\wdfmgr.exe

c:\progra~1\mcafee.com\agent\mcagent.exe

c:\windows\system32\wscntfy.exe

c:\windows\SOUNDMAN.EXE

.

**************************************************************************

.

Completion time: 2010-03-12 16:32:20 - machine was rebooted

ComboFix-quarantined-files.txt 2010-03-12 21:32

Pre-Run: 17,536,528,384 bytes free

Post-Run: 18,155,044,864 bytes free

- - End Of File - - 323FC4F82285D5F915262C6C0A6D02EB

oplease · March 13, 2010

ComboFix also produced this in a Folder named Qoobx, a text document named ComboFix-quarantined-files

2010-03-12 21:31:12 . 2010-03-12 21:31:12 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-FA7F5211-C629-4711-BD82-7DFFB08CB518.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 2,214 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Elecard Codec SDK G4 1.0.1.80507 Eval.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 778 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Dr. Guard.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 938 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-DE87FA96-7840-420C-86F9-33F3B7B3CED1.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 948 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-C43D84CD-EBFC-48D3-A330-7868C8AD415A.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 960 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-BFAF1EEC-E987-415B-BCB8-80CDB0BC6CDF.reg.dat

2010-03-12 21:31:12 . 2010-03-12 21:31:12 964 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-A2E85A38-C2D9-4EDF-AFDA-F76BCBFEBBC4.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 956 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-9D7E7CDA-051E-4B0D-8CEE-58F41F449CF9.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-75528D5F-DD82-402E-BA7C-045B7DC6A712.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 942 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-66195170-D19D-46C5-8FB7-8A4630071ADC.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 934 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-3330A279-CC39-4A17-AE19-DA464B26AD9A.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 944 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-29FF6D07-4A15-41F1-9D5E-E0F3A58012C6.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 930 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-26DC0ED6-93A7-43C1-8DC5-EC16079580F9.reg.dat

2010-03-12 21:31:11 . 2010-03-12 21:31:11 936 ----a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-05E21449-3BA3-42BF-BBDA-95205F4EA40A.reg.dat

2010-03-12 21:30:47 . 2010-03-12 21:30:48 173 ----a-w- C:\Qoobox\Quarantine\Registry_backups\ShellExecuteHooks-{FA010552-4A27-4cb1-A1BB-3E2D697F1639}.reg.dat

2010-03-12 21:22:05 . 2004-05-01 02:01:14 53 ----a-w- C:\Qoobox\Quarantine\D\Autorun.inf.vir

2010-03-12 21:16:36 . 2010-03-12 21:16:36 774 ----a-w- C:\Qoobox\Quarantine\Registry_backups\Legacy_6TO4.reg.dat

2010-03-12 21:16:24 . 2010-03-12 21:16:24 7,572 ----a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg

2010-03-12 21:02:21 . 2008-04-13 18:40:30 96,512 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir

2010-03-12 20:56:47 . 2010-03-12 21:06:45 153 ----a-w- C:\Qoobox\Quarantine\catchme.log

2010-03-12 20:39:03 . 2010-03-12 21:06:38 260 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job.vir

2010-03-10 03:14:27 . 2010-03-10 03:14:28 39,936 ----a-w- C:\Qoobox\Quarantine\C\Program Files\Dr. Guard\drgext.dll.vir

2010-03-07 04:19:52 . 2010-03-07 04:19:52 94,208 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\app_dll.dll.vir

2010-03-07 04:16:17 . 2010-03-07 04:16:17 1 ----a-w- C:\Qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\Macromedia\SwUpdate\Flags.dtd.vir

2010-03-07 04:11:59 . 2010-03-07 04:11:59 20,000 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\p9iyao.dll.vir

2010-01-01 20:39:00 . 2010-01-01 20:39:12 6,429 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\WORK.DAT.vir

2009-01-19 16:53:17 . 2008-04-13 18:40:30 96,512 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir_

2007-08-15 02:42:18 . 2007-08-15 02:42:18 0 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\Logs\Settings.dat.vir

2006-10-25 22:06:25 . 2006-10-25 22:06:25 0 -c--a-w- C:\Qoobox\Quarantine\C\Documents and Settings\Compaq_Owner\Application Data\Install.dat.vir

2005-03-13 06:51:17 . 2010-03-12 17:46:43 3,649 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\viassary-hp.reg.vir

2005-03-13 06:37:46 . 2003-09-12 12:13:20 98,304 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ps2.bat.vir

2004-08-04 04:00:00 . 2008-04-14 00:12:16 15,360 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\ctfmon .exe.vir

2004-08-04 04:00:00 . 2008-04-14 00:12:33 33,280 ----a-w- C:\Qoobox\Quarantine\C\WINDOWS\system32\rundll32 .exe.vir

oplease · March 13, 2010

I did another MBAM scan and there was again 1 Trojan. This is the info

C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

kahdah · March 13, 2010

1. Open notepad and copy/paste the text in the codebox below into it:

http://forums.malwarebytes.org/index.php?showtopic=42816&st=0entry213720

KILLALL::

Driver::
djrzlw
tdisnap

RenV::
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\McAfee.com\Agent\mcagent .exe
c:\program files\QuickTime\qttask   .exe
c:\program files\Windows Defender\msascui .exe


Collect::
c:\documents and settings\All Users\Application Data\fiosejgfse.dll
c:\windows\wcatia.exe
c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll

Folder::
c:\hp\drivers\hplsbwatcher\bak
c:\hp\KBD\bak
c:\program files\Adobe\Reader 8.0\Reader\bak
c:\program files\Common Files\Real\Update_OB\bak
c:\program files\iTunes\bak
c:\program files\Java\j2re1.4.2_03\bin\bak
c:\program files\Lexmark 3300 Series\bak
c:\program files\Lexmark Fax Solutions\bak
c:\program files\QuickTime\bak
c:\windows\CREATOR\bak
c:\windows\SMINST\bak
c:\windows\system\bak
c:\windows\system32\bak

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Remote System Protection"=-
"Dr. Guard"=-
"WEK9EMDHI9"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"funk"=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Remote System Protection"=-

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.

===========

Note::

If Combofix fails to upload anything please do the following:

Go to Start > My Computer > C:\

Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip

Click Here to upload the submit.zip please.

oplease · March 15, 2010

1. It didn't automatically upload the file, so I manually uploaded it to bleepingcomputer as instructed. Now I'm letting you know, as instructed at bleepingcomputer after the upload.

2. Here is the log -

ComboFix 10-03-11.06 - Compaq_Owner 03/15/2010 14:02:18.2.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.503.301 [GMT -4:00]

Running from: c:\documents and settings\Compaq_Owner\My Documents\ComboFix.exe

Command switches used :: c:\documents and settings\Compaq_Owner\My Documents\CFScript.txt

AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}

FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

file zipped: c:\documents and settings\All Users\Application Data\fiosejgfse.dll

file zipped: c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\fiosejgfse.dll

c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server\mlthnj.dll

c:\hp\drivers\hplsbwatcher\bak

c:\hp\drivers\hplsbwatcher\bak\lsburnwatcher.exe

c:\hp\KBD\bak

c:\hp\KBD\bak\KBD.EXE

c:\program files\Adobe\Reader 8.0\Reader\bak

c:\program files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe

c:\program files\Common Files\Real\Update_OB\bak

c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

c:\program files\iTunes\bak

c:\program files\iTunes\bak\iTunesHelper.exe

c:\program files\Java\j2re1.4.2_03\bin\bak

c:\program files\Java\j2re1.4.2_03\bin\bak\jusched.exe

c:\program files\Lexmark 3300 Series\bak

c:\program files\Lexmark 3300 Series\bak\lxccmon.exe

c:\program files\Lexmark Fax Solutions\bak

c:\program files\Lexmark Fax Solutions\bak\fm3032.exe

c:\program files\QuickTime\bak

c:\program files\QuickTime\bak\qttask.exe

c:\windows\CREATOR\bak

c:\windows\CREATOR\bak\Remind_XP.exe

c:\windows\SMINST\bak

c:\windows\SMINST\bak\RECGUARD.EXE

c:\windows\system\bak

c:\windows\system\bak\hpsysdrv.DAT

c:\windows\system\bak\hpsysdrv.exe

c:\windows\system32\bak

c:\windows\system32\bak\ctfmon.exe

c:\windows\system32\bak\hkcmd.exe

c:\windows\system32\bak\LXSUPMON.EXE

c:\windows\system32\bak\ps2.exe

c:\windows\viassary-hp.reg

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_DJRZLW

-------\Legacy_TDISNAP

-------\Service_djrzlw

-------\Service_tdisnap

((((((((((((((((((((((((( Files Created from 2010-02-15 to 2010-03-15 )))))))))))))))))))))))))))))))

.

2010-03-08 01:56 . 2010-03-09 15:57 -------- d-sh--w- c:\documents and settings\NetworkService\UserData

2010-03-08 01:55 . 2010-03-08 01:57 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-03-07 04:11 . 2010-03-15 18:11 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Windows Server

2010-02-26 19:27 . 2010-02-26 19:28 -------- d-----w- c:\program files\Common Files\DVDVideoSoft

2010-02-26 19:27 . 2010-02-26 19:27 -------- d-----w- c:\program files\DVDVideoSoft

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-03-15 18:02 . 2008-08-29 03:23 -------- d-----w- c:\program files\Windows Defender

2010-03-15 18:02 . 2005-03-13 06:48 -------- d-----w- c:\program files\QuickTime

2010-03-15 18:02 . 2005-03-13 06:48 -------- d-----w- c:\program files\iTunes

2010-03-14 14:53 . 2006-08-03 23:25 -------- d-----w- c:\program files\Lx_cats

2010-03-13 14:44 . 2009-09-25 15:58 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\vlc