Jump to content

Massive Malware Infection

TrepidatioN
 Share

Recommended Posts

TrepidatioN

TrepidatioN

Posted
Posted

Hello,

I have a user that is infected with a variety of malware/viruses.

Symantec Endpoint is detecting the following to name only a few:

Backdoor.Tidserv.I!inf

Bloodhound.Exploit.289

Bloodhound.PDF!gen

Trojan.FakeAV

Oddly Malwarebytes doesn't detect any of these.

The user is experiencing terribly slow PC performance and his application windows are being deselected randomly. Rendering the PC useless.

I suspect the malwarebytes may be corrupt but I fear if I uninstall it use the clean utility and then attempt to reinstall it will fail due to the malware probably trying to block it.

Any advice would be greatly appreciated.

Hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:12:40 PM, on 4/26/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\rdpclip.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Symantec Shared\ccApp .exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SymCorpUI.exe

C:\WINDOWS\system32\logon.scr

C:\Program Files\Microsoft Office\OFFICE11\EXCEL.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\All Users\Application Data\peLkFog0.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://news.google.com/news?pz=1&ned=us

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = hughescompany.local

O17 - HKLM\Software\..\Telephony: DomainName = hughescompany.local

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = hughescompany.local

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Eraser Service (EraserSvc10923) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

--

End of file - 5802 bytes

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Hello TrepidatioN! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

  • The process of cleaning your system may take some time, so please be patient.
  • Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
  • Instructions that I give are for your system only!
  • If you don't know or can't understand something please ask.
  • Do not install any software or hardware, while work on.

Step 1:

Go into C:\Program Files\Malwarebytes' Anti-Malware and you will see a file called mbam.exe Right click on it and drop down to Rename change the name to firefox.com From mbam.exe to firefox.com . Please, restart your computer.

Step 2:

  • Launch Malwarebytes' Anti-Malware
  • Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  • Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Link to post
Share on other sites
TrepidatioN

TrepidatioN

Posted
  • Author
Posted

Hello Borislav,

I've followed your instructions but it still found nothing. I know it is infected because of symantec endpoint alerts, browser hijacking, and intermittent application window deselection.

Any other suggestions?

Thanks in advance.

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 4042

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

4/27/2010 10:11:06 AM

mbam-log-2010-04-27 (10-11-06).txt

Scan type: Quick scan

Objects scanned: 160071

Time elapsed: 31 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Step 1:

Download DDS and save it to your desktop from here or here or here.

Disable any script blocker, and then double click dds.scr to run the tool.

  • When done, DDS will open two (2) logs:
    1. DDS.txt
    2. Attach.txt

    [*]Save both reports to your desktop. Post them back to your topic.

Step 2:

Please download the following scanning tool. GMER

  • Open the zip file and copy the file
    gmer.exe
    to your Desktop.

  • Double click on
    gmer.exe
    and run it.

  • It may take a minute to load and become available.

  • Do not make any changes. Click on the
    SCAN
    button and DO NOT use the computer while it's scanning.

  • Once the scan is done click on the
    SAVE
    button and browse to your Desktop and save the file as
    GMER.LOG

  • Zip up the
    GMER.LOG
    file and save it as
    gmerlog.zip
    and attach it to your reply post.

  • DO NOT
    directly post this log into a reply. You
    MUST
    attach it as a
    .ZIP
    file.

  • Click OK and quit the GMER program.

In your next reply, please include these log(s) in this sequence:

  1. DDS log with Attach.txt
  2. GMER log

Link to post
Share on other sites
TrepidatioN

TrepidatioN

Posted
  • Author
Posted

Hello,

DDS:

DDS (Ver_10-03-17.01) - NTFSx86

Run by bill at 13:49:30.23 on Tue 04/27/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2078 [GMT -5:00]

AV: Symantec Endpoint Protection *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

svchost.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Symantec Shared\ccApp .exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Documents and Settings\All Users\Application Data\peLkFog0.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Documents and Settings\bill.HUGHES\Desktop\dds.pif

C:\Program Files\Internet Explorer\IEXPLORE.EXE

============== Pseudo HJT Report ===============

uStart Page = hxxp://news.google.com/news?pz=1&ned=us

uInternet Connection Wizard,ShellNext = wmplayer.exe //ICWLaunch

mWinlogon: Userinit=c:\windows\system32\Userinit.exe

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll

BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll

mRun: [<NO NAME>]

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mPolicies-explorer: NoWelcomeScreen = 1 (0x1)

IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000

DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

============= SERVICES / DRIVERS ===============

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2010-3-28 108392]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2010-3-28 108392]

R2 k;k;c:\windows\system32\o.sys [2010-4-23 4736]

R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2010-3-28 2477304]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-4-5 102448]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100427.002\NAVENG.SYS [2010-4-27 84912]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100427.002\NAVEX15.SYS [2010-4-27 1324720]

============== File Associations ===============

.scr=AutoCADScriptFile

=============== Created Last 30 ================

2010-04-27 14:39:15 0 d--h--w- c:\windows\PIF

2010-04-27 04:41:15 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-27 04:41:13 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-27 04:41:12 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-25 20:23:56 66564 ----a-w- c:\docume~1\alluse~1\applic~1\peLkFog0.exe

2010-04-23 13:46:35 4736 ----a-w- c:\windows\system32\o.sys

2010-04-23 13:46:29 112 ----a-w- c:\docume~1\alluse~1\applic~1\sQ1j44BhD.dat

2010-04-22 12:59:32 0 d-----w- c:\program files\iolo

2010-04-22 12:58:17 74703 ----a-w- c:\windows\system32\mfc45.dll

2010-04-22 12:57:51 0 d-----w- c:\docume~1\bill~1.hug\applic~1\iolo

2010-04-22 12:57:51 0 d-----w- c:\docume~1\alluse~1\applic~1\iolo

2010-04-21 14:28:58 0 d-----w- C:\flats

2010-04-05 16:12:43 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF

2010-04-05 16:12:43 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT

2010-04-05 16:12:43 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL

2010-04-05 16:12:43 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS

2010-04-05 16:12:13 0 d-----w- c:\program files\Symantec

==================== Find3M ====================

2010-04-26 00:24:38 247808 ----a-w- c:\windows\system32\drivers\iaStor.sys

2010-04-23 13:45:42 37376 ----a-w- c:\windows\fonts\sHWMb.com

2010-04-21 14:29:14 3550592 ----a-w- c:\windows\system32\procexp.exe

============= FINISH: 13:50:39.41 ===============

Attach:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 7/20/2009 10:28:38 AM

System Uptime: 4/27/2010 9:37:10 AM (4 hours ago)

Motherboard: Dell Inc. | | 0DN075

Processor: Intel® Pentium® 4 CPU 3.00GHz | Microprocessor | 2992/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 74 GiB total, 38.369 GiB free.

D: is CDROM ()

H: is NetworkDisk (NTFS) - 249 GiB total, 68.417 GiB free.

S: is NetworkDisk (NTFS) - 249 GiB total, 68.417 GiB free.

T: is NetworkDisk (NTFS) - 249 GiB total, 68.417 GiB free.

V: is NetworkDisk (NTFS) - 249 GiB total, 68.417 GiB free.

W: is NetworkDisk (NTFS) - 129 GiB total, 54.523 GiB free.

Z: is NetworkDisk (NTFS) - 249 GiB total, 68.417 GiB free.

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}

Description: Broadcom NetXtreme Gigabit Ethernet

Device ID: PCI\VEN_14E4&DEV_1659&SUBSYS_165914E4&REV_21\4&31DB9AC9&0&00E4

Manufacturer: Broadcom

Name: Broadcom NetXtreme Gigabit Ethernet

PNP Device ID: PCI\VEN_14E4&DEV_1659&SUBSYS_165914E4&REV_21\4&31DB9AC9&0&00E4

Service: b57w2k

Class GUID:

Description: SM Bus Controller

Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_01DE1028&REV_01\3&172E68DD&0&FB

Manufacturer:

Name: SM Bus Controller

PNP Device ID: PCI\VEN_8086&DEV_27DA&SUBSYS_01DE1028&REV_01\3&172E68DD&0&FB

Service:

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

Adobe Acrobat 8 Standard

Adobe Flash Player 10 ActiveX

AutoCAD Mechanical 2010

AutoCAD Mechanical 2010 Language Pack - English

AutoCAD Mechanical 2010 Version 2

Broadcom Gigabit Integrated Controller

CCleaner

Compatibility Pack for the 2007 Office system

Crystal Reports XI R2 .Net 3.0 Runtime (03_05_2008)

Dell Resource CD

HijackThis 2.0.2

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows XP (KB942288-v3)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

LiveUpdate 3.3 (Symantec Corporation)

Malwarebytes' Anti-Malware

Manufacturing Systems client

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft Office Basic Edition 2003

Microsoft Office PowerPoint Viewer 2007 (English)

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft WSE 3.0 Runtime

MSXML 6.0 Parser (KB933579)

NVIDIA Drivers

Security Update for Windows Internet Explorer 8 (KB969897)

Security Update for Windows Internet Explorer 8 (KB971961)

Security Update for Windows Internet Explorer 8 (KB972260)

Security Update for Windows Internet Explorer 8 (KB974455)

Security Update for Windows Internet Explorer 8 (KB978207)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB968816)

Security Update for Windows Media Player (KB973540)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB938464-v2)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951066)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB954459)

Security Update for Windows XP (KB954600)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB957097)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958687)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961371)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB968537)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB969897)

Security Update for Windows XP (KB969947)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971486)

Security Update for Windows XP (KB971557)

Security Update for Windows XP (KB971633)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973346)

Security Update for Windows XP (KB973354)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973525)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977165-v2)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978251)

Security Update for Windows XP (KB978262)

Security Update for Windows XP (KB978706)

SigmaTel Audio

SolidWorks viewer

Symantec Endpoint Protection

System Requirements Lab

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Windows Internet Explorer 8 (KB976662)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB955839)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VBA (2627.01)

WebFldrs XP

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Imaging Component

Windows Internet Explorer 8

Windows XP Service Pack 3

XML Paper Specification Shared Components Pack 1.0

==== Event Viewer Messages From Past Week ========

4/27/2010 12:24:20 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Symantec AntiVirus service.

4/26/2010 10:54:52 PM, error: TermServDevices [1111] - Driver Snagit 9 Printer required for printer Snagit 9 is unknown. Contact the administrator to install the driver before you log in again.

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At88.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At64.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At520.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At496.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At472.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At448.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At424.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At400.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At40.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At376.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At352.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At328.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At304.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At280.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At256.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At232.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At208.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At184.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At160.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At136.job command failed to start due to the following error: %%2147942402

4/25/2010 3:00:00 PM, error: Schedule [7901] - The At112.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At87.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At63.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At519.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At495.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At471.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At447.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At423.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At399.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At39.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At375.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At351.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At327.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At303.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At279.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At255.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At231.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At207.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At183.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At159.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At135.job command failed to start due to the following error: %%2147942402

4/25/2010 2:00:00 PM, error: Schedule [7901] - The At111.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At86.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At62.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At518.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At494.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At470.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At446.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At422.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At398.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At38.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At374.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At350.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At326.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At302.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At278.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At254.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At230.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At206.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At182.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At158.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At134.job command failed to start due to the following error: %%2147942402

4/25/2010 1:00:00 PM, error: Schedule [7901] - The At110.job command failed to start due to the following error: %%2147942402

4/21/2010 9:33:49 AM, error: Service Control Manager [7031] - The Windows Presentation Foundation Font Cache 3.0.0.0 service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.

4/21/2010 9:33:42 AM, error: Service Control Manager [7034] - The FLEXnet Licensing Service service terminated unexpectedly. It has done this 1 time(s).

==== End Of File ===========================

GMER would not run unfortunately. The first attempt produced an error causing the program to crash. The subsequent attempts caused windows to bluescreen due to iastor.sys

Any advice?

Thanks

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Step 1:

Please, uninstall the following applications:

  1. Adobe Acrobat 8 Standard

You can read, how to this in:

Step 2:

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  1. If you are using Firefox, make sure that your download settings are as follows:
    • Open Tools -> Options -> Main tab
    • Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

CF_download_FF.gif

CF_download_rename.gif

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    -----------------------------------------------------------


  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Please go to http://virustotal.com

Next to the "Browse" button, in to the blank field, please paste the following:

c:\documents and settings\All Users\Application Data\peLkFog0.exe

c:\windows\system32\o.sys

c:\windows\system32\mfc45.dll

c:\documents and settings\All Users\Application Data\sQ1j44BhD.dat

c:\windows\Fonts\sHWMb.com

c:\windows\system32\procexp.exe

c:\windows\system32\atl71.dll

Hit SEND FILE. Please be patient, it will take a while to get it scanned. Once all the scanners are done, post back with the results (copy & paste them here). You can paste them in txt fille and then attach it in your next reply here.

Link to post
Share on other sites
TrepidatioN

TrepidatioN

Posted
  • Author
Posted

c:\documents and settings\All Users\Application Data\peLkFog0.exe

File 346SvTHf.bak received on 2010.04.28 06:48:36 (UTC)

Current status: finished

Result: 18/40 (45.00%)

Compact

Print results

Antivirus Version Last Update Result

a-squared 4.5.0.50 2010.04.28 Trojan.Win32.Powp!IK

AhnLab-V3 5.0.0.2 2010.04.28 -

AntiVir 8.2.1.224 2010.04.27 TR/Dldr.Stration.Gen

Antiy-AVL 2.0.3.7 2010.04.27 -

Authentium 5.2.0.5 2010.04.28 -

Avast 4.8.1351.0 2010.04.27 Win32:Malware-gen

Avast5 5.0.332.0 2010.04.27 Win32:Malware-gen

AVG 9.0.0.787 2010.04.27 Dropper.Generic2.DJP

BitDefender 7.2 2010.04.28 -

CAT-QuickHeal 10.00 2010.04.28 -

ClamAV 0.96.0.3-git 2010.04.28 -

Comodo 4696 2010.04.28 TrojWare.Win32.Trojan.Agent.Gen

DrWeb 5.0.2.03300 2010.04.28 -

eSafe 7.0.17.0 2010.04.26 -

eTrust-Vet 35.2.7454 2010.04.27 -

F-Prot 4.5.1.85 2010.04.27 -

F-Secure 9.0.15370.0 2010.04.28 Suspicious:W32/Malware!Gemini

Fortinet 4.0.14.0 2010.04.27 -

GData 21 2010.04.28 Win32:Malware-gen

Ikarus T3.1.1.80.0 2010.04.28 Trojan.Win32.Powp

Jiangmin 13.0.900 2010.04.28 Trojan/Powp.f

Kaspersky 7.0.0.125 2010.04.28 Trojan.Win32.Powp.afb

McAfee 5.400.0.1158 2010.04.28 Generic.dx!sei

McAfee-GW-Edition 6.8.5 2010.04.27 Trojan.Dldr.Stration.Gen

Microsoft 1.5703 2010.04.28 VirTool:Win32/CeeInject.gen!J

NOD32 5066 2010.04.27 -

Norman 6.04.11 2010.04.27 -

nProtect 2010-04-28.01 2010.04.28 -

Panda 10.0.2.7 2010.04.27 -

PCTools 7.0.3.5 2010.04.28 -

Prevx 3.0 2010.04.28 -

Rising 22.45.02.03 2010.04.28 Trojan.Win32.Generic.52012B3C

Sophos 4.53.0 2010.04.28 Sus/UnkPack-C

Sunbelt 6230 2010.04.28 Trojan.Win32.Generic!BT

Symantec 20091.2.0.41 2010.04.28 -

TheHacker 6.5.2.0.272 2010.04.28 -

TrendMicro 9.120.0.1004 2010.04.28 -

VBA32 3.12.12.4 2010.04.27 SScope.Injector.MY

ViRobot 2010.4.27.2295 2010.04.27 -

VirusBuster 5.0.27.0 2010.04.27 -

Additional information

File size: 66564 bytes

MD5 : c29433f88d015dc86f3a799f9604df33

SHA1 : 7284eedcfd2653914fa6328fc6fad43143471d2a

SHA256: 3f69d90cab1973f19d120787e2f95314b67f02d94dff4b7294e250cbcd85b881

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x2CD0

timedatestamp.....: 0x4BD4D546 (Mon Apr 26 01:50:30 2010)

machinetype.......: 0x14C (Intel I386)

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x1D10 0x1E00 5.92 71c068cfa08f02c11cb8c9cab12f5b2f

.rdata 0x3000 0x1A6 0x200 3.90 d677d94d5fbd63e20284a04ceb3b5e5c

.data 0x4000 0xDD98 0xDE00 7.96 d4f7bd306f0cca2fa9afa11426a6c76d

.rsrc 0x12000 0x10 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b

( 2 imports )

> kernel32.dll: HeapAlloc, GetProcessHeap, GetProcAddress, GetModuleHandleA, ExitProcess

> user32.dll: InvalidateRect, OpenClipboard, EmptyClipboard, CloseClipboard, SetClipboardData, GetClientRect, LockWindowUpdate, GetDC

( 0 exports )

TrID : File type identification

Win32 Executable Generic (42.3%)

Win32 Dynamic Link Library (generic) (37.6%)

Generic Win/DOS Executable (9.9%)

DOS Executable Generic (9.9%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

Symantec reputation: Suspicious.Insight http://www.symantec.com/security_response/...-021223-0550-99

ssdeep: 1536:Ls07Wk/QgG3M8+ZiI8W+VgV1TJaASOvt1FsqyTiWqpMFID:A0NQbQiI6q1T8AlnFsdTSiU

sigcheck: publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

Prevx Info: http://info.prevx.com/aboutprogramtext.asp...7EF9E00C8F21669

PEiD : -

RDS : NSRL Reference Data Set

c:\windows\system32\mfc45.dll

File DF2CAF0CCF20C52723E101CA35B1930086D6CABB.dll received on 2010.03.28 17:09:30 (UTC)

Current status: finished

Result: 6/42 (14.29%)

Compact

Print results

Antivirus Version Last Update Result

a-squared 4.5.0.50 2010.03.28 -

AhnLab-V3 5.0.0.2 2010.03.27 -

AntiVir 7.10.5.241 2010.03.26 -

Antiy-AVL 2.0.3.7 2010.03.26 -

Authentium 5.2.0.5 2010.03.28 W32/Damaged_File.B.gen!Eldorado

Avast 4.8.1351.0 2010.03.28 -

Avast5 5.0.332.0 2010.03.28 -

AVG 9.0.0.787 2010.03.28 -

BitDefender 7.2 2010.03.28 -

CAT-QuickHeal 10.00 2010.03.27 -

ClamAV 0.96.0.0-git 2010.03.28 -

Comodo 4417 2010.03.28 UnclassifiedMalware

DrWeb 5.0.1.12222 2010.03.28 -

eSafe 7.0.17.0 2010.03.28 -

eTrust-Vet 35.2.7391 2010.03.26 -

F-Prot 4.5.1.85 2010.03.27 W32/Damaged_File.B.gen!Eldorado

F-Secure 9.0.15370.0 2010.03.28 -

Fortinet 4.0.14.0 2010.03.27 -

GData 19 2010.03.28 -

Ikarus T3.1.1.80.0 2010.03.28 -

Jiangmin 13.0.900 2010.03.28 -

K7AntiVirus 7.10.1004 2010.03.22 -

Kaspersky 7.0.0.125 2010.03.28 -

McAfee 5933 2010.03.27 potentially unwanted program Corrupt-EP

McAfee+Artemis 5933 2010.03.27 potentially unwanted program Corrupt-EP

McAfee-GW-Edition 6.8.5 2010.03.27 -

Microsoft 1.5605 2010.03.28 -

NOD32 4980 2010.03.28 -

Norman 6.04.10 2010.03.28 -

nProtect 2009.1.8.0 2010.03.28 -

Panda 10.0.2.2 2010.03.28 -

PCTools 7.0.3.5 2010.03.28 -

Prevx 3.0 2010.03.28 -

Rising 22.40.06.04 2010.03.28 -

Sophos 4.52.0 2010.03.28 -

Sunbelt 6101 2010.03.26 -

Symantec 20091.2.0.41 2010.03.28 -

TheHacker 6.5.2.0.246 2010.03.28 W32/Behav-Heuristic-CorruptFile-EP

TrendMicro 9.120.0.1004 2010.03.28 -

VBA32 3.12.12.2 2010.03.27 -

ViRobot 2010.3.27.2248 2010.03.27 -

VirusBuster 5.0.27.0 2010.03.27 -

Additional information

File size: 74703 bytes

MD5 : 417947a05249710306f26f1850756529

SHA1 : c786864f3ef236677e3b97eedaba76b203e046d4

SHA256: 64eeb3ccde302109c7445ac0ac152a63cdbe55e361aef337369b5befb8a89d91

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x932B8

timedatestamp.....: 0x2A425E19 (Sat Jun 20 00:22:17 1992)

machinetype.......: 0x14C (Intel I386)

( 8 sections )

name viradd virsiz rawdsiz ntrpy md5

CODE 0x1000 0x924F0 0x92600 6.54 7a15fe1d4b49cb81c32c63fbdb7f6a37

DATA 0x94000 0x103C 0x1200 0.00 d41d8cd98f00b204e9800998ecf8427e

BSS 0x96000 0x1488 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.idata 0x98000 0x25A4 0x2600 0.00 d41d8cd98f00b204e9800998ecf8427e

.tls 0x9B000 0x8 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rdata 0x9C000 0x18 0x200 0.00 d41d8cd98f00b204e9800998ecf8427e

.reloc 0x9D000 0x8714 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e

.rsrc 0xA6000 0x13E00 0x13E00 0.00 d41d8cd98f00b204e9800998ecf8427e

( 0 imports )

( 0 exports )

TrID : File type identification

Win16/32 Executable Delphi generic (34.0%)

Generic Win/DOS Executable (32.9%)

DOS Executable Generic (32.8%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.1%)

ssdeep: 1536:WcqtK7S9K2JVpIrWSnToU9IGJBTBqsYgOU8xOjLcj4UKsKNum:+1KCVFScU9LJ14sYeAOjLdUKs

KEm

sigcheck: publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

PEiD : -

RDS : NSRL Reference Data Set

-

c:\windows\Fonts\sHWMb.com

File a.exe received on 2010.04.23 12:35:57 (UTC)

Current status: finished

Result: 9/40 (22.50%)

Compact

Print results

Antivirus Version Last Update Result

a-squared 4.5.0.50 2010.04.23 -

AhnLab-V3 5.0.0.2 2010.04.23 -

AntiVir 8.2.1.220 2010.04.23 -

Antiy-AVL 2.0.3.7 2010.04.23 -

Authentium 5.2.0.5 2010.04.23 -

Avast 4.8.1351.0 2010.04.23 -

Avast5 5.0.332.0 2010.04.23 -

AVG 9.0.0.787 2010.04.23 -

BitDefender 7.2 2010.04.23 Gen:Win32.ProcessHijack.cqW@a8II8Jn

CAT-QuickHeal 10.00 2010.04.23 -

ClamAV 0.96.0.3-git 2010.04.23 -

Comodo 4669 2010.04.23 -

DrWeb 5.0.2.03300 2010.04.23 Win32.HLLC.Asdas.7

eSafe 7.0.17.0 2010.04.22 -

eTrust-Vet 35.2.7445 2010.04.23 -

F-Prot 4.5.1.85 2010.04.23 -

F-Secure 9.0.15370.0 2010.04.23 Gen:Win32.ProcessHijack.cqW@a8II8Jn

Fortinet 4.0.14.0 2010.04.21 -

GData 21 2010.04.23 Gen:Win32.ProcessHijack.cqW@a8II8Jn

Ikarus T3.1.1.80.0 2010.04.23 -

Jiangmin 13.0.900 2010.04.23 -

Kaspersky 7.0.0.125 2010.04.23 -

McAfee 5.400.0.1158 2010.04.23 -

McAfee-GW-Edition 6.8.5 2010.04.23 -

Microsoft 1.5703 2010.04.23 TrojanDownloader:Win32/Unruy.H

NOD32 5052 2010.04.23 a variant of Win32/TrojanDownloader.Unruy.BN

Norman 6.04.11 2010.04.23 -

nProtect 2010-04-23.01 2010.04.23 Gen:Win32.ProcessHijack.cqW@a8II8Jn

Panda 10.0.2.7 2010.04.22 -

PCTools 7.0.3.5 2010.04.23 -

Prevx 3.0 2010.04.23 High Risk Cloaked Malware

Rising 22.44.04.03 2010.04.23 -

Sophos 4.53.0 2010.04.23 -

Sunbelt 6212 2010.04.23 -

Symantec 20091.2.0.41 2010.04.23 -

TheHacker 6.5.2.0.267 2010.04.22 -

TrendMicro 9.120.0.1004 2010.04.23 -

VBA32 3.12.12.4 2010.04.23 SScope.Injector.MY

ViRobot 2010.4.23.2291 2010.04.23 -

VirusBuster 5.0.27.0 2010.04.23 -

Additional information

File size: 37376 bytes

MD5 : e85826969e3131db0550f4ef1e2f2091

SHA1 : fe5e77761580af728b8ce87c30b532197ad33b33

SHA256: 8f45cfb872d4435f05cfa2ad5fc4ab169b950adddf24a5fcdaf3086dfdbee56a

PEInfo: PE Structure information

( base data )

entrypointaddress.: 0x35C0

timedatestamp.....: 0x4BD07149 (Thu Apr 22 17:54:49 2010)

machinetype.......: 0x14C (Intel I386)

( 4 sections )

name viradd virsiz rawdsiz ntrpy md5

.text 0x1000 0x25F0 0x2600 6.09 8b9093afc5d90dc0928a1942baca3a06

.rdata 0x4000 0x132 0x200 2.86 c654d702be3b2c9ff9ca9fa5df77e4a2

.data 0x5000 0x6360 0x6400 7.73 1236df7c5ba5523499c2012579a3d569

.rsrc 0xC000 0x10 0x200 0.00 bf619eac0cdf3f68d496ea9344137e8b

( 2 imports )

> kernel32.dll: GetProcAddress, GetModuleHandleA, ExitProcess, GetLastError

> user32.dll: CloseClipboard, GetClipboardData, OpenClipboard, GetActiveWindow

( 0 exports )

TrID : File type identification

Win32 Executable Generic (42.3%)

Win32 Dynamic Link Library (generic) (37.6%)

Generic Win/DOS Executable (9.9%)

DOS Executable Generic (9.9%)

Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)

Symantec reputation: Suspicious.Insight http://www.symantec.com/security_response/...-021223-0550-99

ssdeep: 768:wci80wSxv8OZqv9wskUaaOLyH8aW/698y:bi80rEOAv9w1UaUJUe

sigcheck: publisher....: n/a

copyright....: n/a

product......: n/a

description..: n/a

original name: n/a

internal name: n/a

file version.: n/a

comments.....: n/a

signers......: -

signing date.: -

verified.....: Unsigned

Prevx Info: http://info.prevx.com/aboutprogramtext.asp...BD5B6004F94EA68

PEiD : -

RDS : NSRL Reference Data Set

-

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Thank you!

Open Notepad and copy and paste the text in the code box below into it:

http://forums.malwarebytes.org/index.php?showtopic=48458

KillAll::

Suspect::[8]
c:\documents and settings\All Users\Application Data\peLkFog0.exe
c:\windows\system32\mfc45.dll
c:\windows\Fonts\sHWMb.com
c:\documents and settings\All Users\Application Data\sQ1j44BhD.dat

AtJob::

Save the file to your desktop and name it CFScript.txt

Then drag the CFScript.txt into the ComboFix.exe as shown in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. It may ask to reboot. Post the contents of Combofix.txt in your next reply.

Note: These instructions and script were created specifically for this user. If you are not this user, do NOT follow these instructions or use this script as it could damage the workings of your system.

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

  1. Please visit this website: Submit Malware Sample
  2. Against the inscription: "Link to topic where this file was requested:", insert links pointing to this topic in our forum.
  3. Against the inscription: "Browse to the file you want to submit:", click on the Choose... button.
  4. Navigate to the following file: C:\Qoobox\Quarantine\[8]-Submit_date_time.zip (date_time will be replaced with the date and time when this file was created)
  5. Against the inscription: "Leave any comments, further information about this file, or contact information:" should be written as follows:
    Sent at the request of Borislav.
  6. Once you're ready, click the Send File button.

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

  • Launch Malwarebytes' Anti-Malware
  • Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
  • Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Link to post
Share on other sites
Maniac

Maniac

Posted
Posted

Step 1:

Please delete your copy of ComboFix.

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

  1. If you are using Firefox, make sure that your download settings are as follows:
    • Open Tools -> Options -> Main tab
    • Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

CF_download_FF.gif

CF_download_rename.gif

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    -----------------------------------------------------------


  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

Step 2:

Please try to follow my instructions for GMER in Safe Mode:

http://www.microsoft.com/resources/documen...e.mspx?mfr=true

In your next reply, please include these log(s) in this sequence:

  1. ComboFix log
  2. GMER log

Link to post
Share on other sites
  • Root Admin
AdvancedSetup

AdvancedSetup

Posted
  • Root Admin
Posted

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.