Antimalware Doctor Uninstall

yymellen · May 12, 2010

My HP desktop has been infected with animalware doctor. I'm following your procedures as outlined in the stickie: I'm infected - What do I do now?

Computer is HP Intel Pentium 4 CPU 3.00GHz, 512 MB Ram running Windows XP professional v2002, SP 3.

Ran Malwarebytes after uploading latest updates. 2 files were quarantined and deleted in that pass (see attached log). It did not ask me to reboot, but I rebooted anyway. The bug was back instantly with the gotnewupdate000.exe file, the drwtsn32.exe files and the drwin files which I ended the processes on.

Dowloaded the DeFogger, DDS and GMER files from another computer onto a flashdrive.

Ran DeFogger on the infected computer from that flashdrive (not the desktop). After the "finished" message, the OK appeared, I clicked that, but did NOT get a message asking me to reboot the machine. I don't have an error message either. What I have on my desktop now is the little Defogger window that gives me the option to Disable or Re-enable. I've attached the defogger_disable log for you (it's on the flashdrive, not the desktop). I won't do anything else until I hear back from you guys.

Thanks for the assist.

Ellen

mbam_log_2010_05_11__22_09_31_.txt

kahdah · May 12, 2010

Hello yymellen

Welcome to Malwarebytes.

=====================

Please download OTH.scr to your desktop.
Download OTL to your desktop.
Double click the OTH file and select Kill All Processes, your desktop will go blank

Then select Start OTL OTL will now run
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

netsvcs

%SYSTEMDRIVE%\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

====================

Download the following GMER Rootkit Scanner from Here

Download the randomly named EXE file to your Desktop. Remember what its name is since it is randomly named.
Double click on the new random named exe file you downloaded and run it. If prompted about the Security Warning and Unknown Publisher go ahead and click on Run
It may take a minute to load and become available.
If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..
In the right panel, you will see several boxes that have been checked. Ensure the following are UNCHECKED
IAT/EAT
Drives/Partition other than Systemdrive (typically only C:\ should be checked)
Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop
**Caution** Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Click OK and quit the GMER program.
Note: On Firefox you need to go to Tools/Options/Main then under the Downloads section, click on Always ask me where to save files so that you can choose the name and where to save to, in this case your Desktop.
Post that log in your next reply.

yymellen · May 14, 2010

yymellen · May 14, 2010

I keep getting a connection error when I try to send the extras.txt info. Using my iTouch to send this reply while I rescan my desktop with malwarebytes. I do have Internet connectivity from the modem to other computers.

yymellen · May 14, 2010

I keep getting a connection error when I try to send the extras.txt info. Using my iTouch to send this reply while I rescan my desktop with malwarebytes. I do have Internet connectivity from the modem to other computers.

OTL Extras logfile created on: 5/13/2010 10:37:44 PM - Run 1

OTL by OldTimer - Version 3.2.4.1

kahdah · May 14, 2010

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

:OTL
DRV - (usrvrn) -- C:\WINDOWS\system32\drivers\usrvrn.sys ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
[2010/05/07 10:04:48 | 000,000,000 | ---D | M] (z) -- C:\Program Files\Mozilla Firefox\extensions\{1c22200b-3cee-5885-8326-2d596ddae153}
O4 - HKCU..\Run: [gotnewupdate000.exe] C:\Documents and Settings\Dan\Application Data\1BF4A59C73DC722884ECEDB2AC7AABC0\gotnewupdate000.exe (MS)
O4 - HKCU..\Run: [owxoisynt] C:\Documents and Settings\Dan\owxoisynt.exe ()
O32 - AutoRun File - [2002/09/11 03:02:32 | 000,000,045 | -HS- | M] () - H:\Autorun.inf -- [ FAT32 ]
O33 - MountPoints2\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\Shell\AutoRun\command - "" = D:\Setup_FlipShare.exe -- File not found
O33 - MountPoints2\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\Shell\Setup FlipShare\command - "" = D:\Setup_FlipShare.exe -- File not found
O33 - MountPoints2\{f9493833-7a90-11dd-b83c-806d6172696f}\Shell\AutoRun\command - "" = H:\Info.exe -- [2002/09/10 21:54:58 | 000,040,960 | -HS- | M] (XSS)
[2010/05/09 23:49:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Dan\Local Settings\Application Data\rkogceybs
[2010/05/13 22:26:28 | 000,054,016 | ---- | C] () -- C:\WINDOWS\System32\drivers\cprt.sys
[2010/05/10 05:37:45 | 000,606,015 | ---- | M] () -- C:\WINDOWS\System32\ifarmed.html
[2010/05/09 23:50:29 | 000,000,038 | ---- | M] () -- C:\WINDOWS\System32\online_{c7a06a9e-f685-458d-aa00-01ab6888121b}
[2010/05/09 23:50:23 | 000,000,038 | ---- | M] () -- C:\WINDOWS\System32\{c7a06a9e-f685-458d-aa00-01ab6888121b}
[2010/05/09 23:48:54 | 000,056,766 | ---- | M] () -- C:\WINDOWS\System32\owxoisynt.exe
[2010/05/09 23:48:51 | 000,050,990 | ---- | M] () -- C:\WINDOWS\System32\flqmiaxsdj.exe
[2010/04/12 18:59:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avG

:Files
C:\WINDOWS\Tasks\At*.job
C:\Documents and Settings\Dan\Application Data\1BF4A59C73DC722884ECEDB2AC7AABC0

:Commands
[emptytemp]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
It will produce a log for you on reboot, please post that log in your next reply.

================

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

yymellen · May 15, 2010

Here's the log from the OTL. Please note that upon reboot the dwwin files popped right back up in my task manager. I ended those processes. And while I typed up this reply a new tab opened up in Mozilla directing me to Walgreens.

All processes killed

========== OTL ==========

Service usrvrn stopped successfully!

Service usrvrn deleted successfully!

C:\WINDOWS\system32\drivers\usrvrn.sys moved successfully.

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!

C:\Program Files\Mozilla Firefox\extensions\{1c22200b-3cee-5885-8326-2d596ddae153}\components folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\{1c22200b-3cee-5885-8326-2d596ddae153}\chrome folder moved successfully.

C:\Program Files\Mozilla Firefox\extensions\{1c22200b-3cee-5885-8326-2d596ddae153} folder moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\gotnewupdate000.exe deleted successfully.

C:\Documents and Settings\Dan\Application Data\1BF4A59C73DC722884ECEDB2AC7AABC0\gotnewupdate000.exe moved successfully.

Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\owxoisynt deleted successfully.

C:\Documents and Settings\Dan\owxoisynt.exe moved successfully.

H:\Autorun.inf moved successfully.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\ not found.

File D:\Setup_FlipShare.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\ not found.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2f6fec14-dfba-11de-b0a5-000c6eba18e5}\ not found.

File D:\Setup_FlipShare.exe not found.

Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f9493833-7a90-11dd-b83c-806d6172696f}\ deleted successfully.

Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f9493833-7a90-11dd-b83c-806d6172696f}\ not found.

H:\Info.exe moved successfully.

C:\Documents and Settings\Dan\Local Settings\Application Data\rkogceybs folder moved successfully.

File C:\WINDOWS\System32\drivers\cprt.sys not found.

C:\WINDOWS\system32\ifarmed.html moved successfully.

C:\WINDOWS\system32\online_{c7a06a9e-f685-458d-aa00-01ab6888121b} moved successfully.

C:\WINDOWS\system32\{c7a06a9e-f685-458d-aa00-01ab6888121b} moved successfully.

C:\WINDOWS\system32\owxoisynt.exe moved successfully.

C:\WINDOWS\system32\flqmiaxsdj.exe moved successfully.

C:\Documents and Settings\All Users\Application Data\avG folder moved successfully.

========== FILES ==========

C:\WINDOWS\Tasks\At1.job moved successfully.

C:\WINDOWS\Tasks\At10.job moved successfully.

C:\WINDOWS\Tasks\At11.job moved successfully.

C:\WINDOWS\Tasks\At12.job moved successfully.

C:\WINDOWS\Tasks\At13.job moved successfully.

C:\WINDOWS\Tasks\At14.job moved successfully.

C:\WINDOWS\Tasks\At15.job moved successfully.

C:\WINDOWS\Tasks\At16.job moved successfully.

C:\WINDOWS\Tasks\At17.job moved successfully.

C:\WINDOWS\Tasks\At18.job moved successfully.

C:\WINDOWS\Tasks\At19.job moved successfully.

C:\WINDOWS\Tasks\At2.job moved successfully.

C:\WINDOWS\Tasks\At20.job moved successfully.

C:\WINDOWS\Tasks\At21.job moved successfully.

C:\WINDOWS\Tasks\At22.job moved successfully.

C:\WINDOWS\Tasks\At23.job moved successfully.

C:\WINDOWS\Tasks\At24.job moved successfully.

C:\WINDOWS\Tasks\At3.job moved successfully.

C:\WINDOWS\Tasks\At4.job moved successfully.

C:\WINDOWS\Tasks\At5.job moved successfully.

C:\WINDOWS\Tasks\At6.job moved successfully.

C:\WINDOWS\Tasks\At7.job moved successfully.

C:\WINDOWS\Tasks\At8.job moved successfully.

C:\WINDOWS\Tasks\At9.job moved successfully.

C:\Documents and Settings\Dan\Application Data\1BF4A59C73DC722884ECEDB2AC7AABC0 folder moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Dan

->Temp folder emptied: 158065307 bytes

->Temporary Internet Files folder emptied: 6826426 bytes

->Java cache emptied: 0 bytes

->FireFox cache emptied: 36956894 bytes

->Apple Safari cache emptied: 4838542 bytes

->Flash cache emptied: 920 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 33170 bytes

->Flash cache emptied: 0 bytes

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 11361099 bytes

->Flash cache emptied: 1369 bytes

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 5498938 bytes

->Java cache emptied: 301858 bytes

->Flash cache emptied: 22489 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 2162283 bytes

%systemroot%\System32 .tmp files removed: 2577 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 56126306 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 10951420 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 324494 bytes

RecycleBin emptied: 2937 bytes

Total Files Cleaned = 280.00 mb

OTL by OldTimer - Version 3.2.4.1 log created on 05142010_201721

Files\Folders moved on Reboot...

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\NL4MCAS5\ads[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\NL4MCAS5\kronomy_com[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\NL4MCAS5\statstracker[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EER003Q9\ads[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\EER003Q9\ads[2].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\24MVCJ26\new-eclipse-trailer-unleashed-oprah-352902[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0COC54YD\landing_bottom[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0COC54YD\new[1].htm moved successfully.

C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\0COC54YD\right_bar[1].htm moved successfully.

Registry entries deleted on Reboot...

yymellen · May 15, 2010

The McAffee icon does not load on my system tray anymore (since the bug) so I don't know how to disable it.

I have Malwarebytes on my desktop as well as IOBit Security 360.

When I right-click on those icons I get the same options (no disable):

Open

Scan with IOBit360

Run as...

Scan for Threats (with an icon that looks like a blue McAffee Shield)

Scan with Malwarebytes' Antimalware

Send to ...

Cut

Copy

Create Shortcut

Delete

Rename

Properties

I won't run that ComboFix until you let me know if I can skip the disable step.

Also, I haven't run the GMER program yet either (from your first post) since I wasn't successful with the OTH step.

By the way, you're a big help. Thanks for being there!

kahdah · May 15, 2010

You are welcome.

I am going to temporarily disable all of those services from running.

We will reenable them when we are past the combofix part.

Please go to Start>Run type in Notepad.

Copy what is in the code box below into the open Notepad window.

Change the "Save As Type" to "All Files". Save it as fixthis.bat on your Desktop.

@Echo off

sc config McShield start=disabled
sc config McTaskManager start=disabled
sc config McAfeeFramework start=disabled
sc config mfehidk start=disabled
sc config mfeavfk start=disabled
sc config mfeapfk start=disabled
sc config mfetdik start=disabled
sc config mfebopk start=disabled
sc config mferkdk start=disabled
sc config IS360service start=disabled

Then please double click on fixthis.bat a window will open and close quickly.This is normal.

After that run please try combofix again if it still tells you about the protection then you can safely proceed.

yymellen · May 16, 2010

You are welcome.
I am going to temporarily disable all of those services from running.
We will reenable them when we are past the combofix part.

ran the fixthis then started combofix.

Got this message:

ComboFix has detected the following real time scanner to be active:

antivirus: McAfee VirusScan Enterprise...

please disable these scanners before clicking ok.

Now what?

kahdah · May 16, 2010

Please reboot the machine and see if it still says that.

If it does please temporarily uninstall those programs.

yymellen · May 16, 2010

Please reboot the machine and see if it still says that.
If it does please temporarily uninstall those programs.

Posting ComboFixLog here and as an attachment

ComboFix 10-05-16.01 - Dan 05/16/2010 14:40:12.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.306 [GMT -5:00]

Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Dan\Start Menu\Programs\Antimalware Doctor

c:\documents and settings\Dan\Start Menu\Programs\Antimalware Doctor\Antimalware Doctor.lnk

c:\documents and settings\Dan\Start Menu\Programs\Antimalware Doctor\Uninstall.lnk

c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe

c:\program files\QuickTime\QTTask.exe

c:\windows\system32\ctfmon .exe

c:\windows\system32\kzorpglk.dll

c:\windows\system32\nwiz .exe

c:\windows\system32\regsvr32 .exe

c:\windows\system32\rundll32 .exe

 <pre>
c:\program files\Common Files\Adobe\ARM\1.0\adobearm .exe ---^> c:\program files\Common Files\Adobe\ARM\1.0\adobearm.exe
c:\program files\QuickTime\qttask	  .exe ---^> c:\program files\QuickTime\qttask.exe
c:\program files\QuickTime\qttask .exe ---^> c:\program files\QuickTime\qttask.exe
</pre>

.

Infected copy of c:\windows\system32\drivers\intelppm.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_USBXBOX

((((((((((((((((((((((((( Files Created from 2010-04-16 to 2010-05-16 )))))))))))))))))))))))))))))))

.

2010-05-15 01:17 . 2010-05-15 01:17 -------- d-----w- C:\_OTL

2010-05-10 05:13 . 2010-05-10 05:13 -------- d-----w- C:\spoolerlogs

2010-05-10 04:50 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys

2010-05-10 04:50 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-05-10 02:31 . 2010-05-10 02:31 296448 ----a-w- c:\windows\system32\barfgizb.dll

2010-05-07 15:04 . 2010-05-07 15:04 96704 ----a-w- c:\windows\system32\fa443773.exe

2010-05-04 02:58 . 2010-05-04 02:58 -------- d-----w- c:\program files\iPod

2010-05-04 02:49 . 2010-05-04 02:49 -------- d-----w- c:\program files\Bonjour

2010-04-29 22:26 . 2010-04-29 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

2010-04-29 22:26 . 2010-04-29 22:26 -------- d-----w- c:\program files\IObit

2010-04-29 07:19 . 2010-04-29 07:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

2010-04-26 11:52 . 2010-04-29 07:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-20 06:10 . 2010-04-20 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-18 05:26 . 2010-04-18 05:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-16 19:49 . 2010-02-07 16:28 -------- d-----w- c:\program files\QuickTime

2010-05-16 19:29 . 2008-09-17 19:17 -------- d-----w- c:\program files\McAfee

2010-05-16 19:29 . 2008-09-17 19:17 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee

2010-05-15 04:34 . 2004-08-04 12:00 36352 ----a-w- c:\windows\system32\drivers\intelppm.sys

2010-05-10 12:58 . 2008-09-17 20:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-05-10 04:48 . 2004-08-04 12:00 182656 -c--a-w- c:\windows\system32\drivers\ndis.sys

2010-05-09 17:17 . 2010-04-12 01:02 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-05-04 03:00 . 2010-02-07 16:35 -------- d-----w- c:\program files\iTunes

2010-05-04 02:58 . 2008-11-09 14:43 -------- d-----w- c:\program files\Common Files\Apple

2010-05-04 02:51 . 2010-04-16 12:15 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS

2010-05-04 02:43 . 2010-05-04 02:43 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe

2010-05-01 05:15 . 2010-04-12 22:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-04-29 23:36 . 2009-06-20 16:28 -------- d-----w- c:\documents and settings\Dan\Application Data\Amazon

2010-04-29 23:36 . 2009-06-20 16:25 -------- d-----w- c:\program files\Amazon

2010-04-29 20:39 . 2010-04-12 22:29 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 20:39 . 2010-04-12 22:29 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-04-21 17:08 . 2010-05-02 16:34 52224 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\FFExternalAlert.dll

2010-04-21 17:08 . 2010-05-02 16:34 101376 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\RadioWMPCore.dll

2010-04-16 12:20 . 2008-09-17 21:02 -------- d-----w- c:\program files\Common Files\Adobe

2010-04-16 12:16 . 2010-04-16 12:16 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe

2010-04-12 22:29 . 2010-04-12 22:29 -------- d-----w- c:\documents and settings\Dan\Application Data\Malwarebytes

2010-04-12 22:29 . 2010-04-12 22:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-04-12 22:10 . 2008-10-05 16:27 86472 -c--a-w- c:\documents and settings\Dan\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-04-10 20:52 . 2008-11-11 05:32 -------- d-----w- c:\program files\Free Offers from Freeze.com

2010-04-08 18:20 . 2010-04-08 18:20 91424 ----a-w- c:\windows\system32\dnssd.dll

2010-04-08 18:20 . 2010-04-08 18:20 107808 ----a-w- c:\windows\system32\dns-sd.exe

2010-04-07 03:31 . 2010-03-03 00:48 439816 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\setup.exe

2010-04-04 15:23 . 2008-11-11 05:35 -------- d-----w- c:\documents and settings\Dan\Application Data\dvdcss

2010-03-26 07:48 . 2010-03-26 07:48 20846064 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\rp\RealPlayerSPGold.exe

2010-03-18 20:41 . 2009-12-18 20:13 79488 ----a-w- c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2010-03-11 12:38 . 2004-08-04 12:00 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38 . 2004-08-04 12:00 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38 . 2004-08-04 12:00 17408 ------w- c:\windows\system32\corpol.dll

2010-03-09 11:09 . 2004-08-04 12:00 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-03-03 08:48 . 2010-03-03 08:48 8405312 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe

2010-03-03 08:48 . 2010-03-03 08:48 149000 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\chr_helper\LaunchHelper.exe

2010-03-03 08:48 . 2010-03-03 08:48 10309448 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\chr\ChromeInstaller.exe

2010-03-03 08:48 . 2010-03-03 08:48 283280 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\carb\CarboniteSetupLiteRealPreinstaller.exe

2010-03-03 08:48 . 2010-03-03 08:48 181768 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\carb\LaunchHelper.exe

2010-03-03 08:48 . 2010-03-03 08:48 79368 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\vista.exe

2010-03-03 08:48 . 2010-03-03 08:48 64000 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\inst_config\gcapi_dll.dll

2010-03-03 08:48 . 2010-03-03 08:48 52288 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\inst_config\gtapi.dll

2010-03-03 08:48 . 2010-03-03 08:48 50688 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\inst_config\fftbapi.dll

2010-03-03 08:48 . 2010-03-03 08:48 49152 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\inst_config\CarboniteCompatibility.dll

2010-03-03 08:48 . 2010-03-03 08:48 118784 ----a-w- c:\documents and settings\Dan\Application Data\Real\Update\setup3.10\RUP\inst_config\compat.dll

2010-02-24 13:11 . 2004-08-04 12:00 455680 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2010-02-16 14:08 . 2004-08-04 12:00 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25 . 2004-08-03 22:59 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2009-11-24 19:14 . 2009-11-24 19:14 10437264 ----a-w- c:\program files\mozilla firefox\plugins\PDFNetC.dll

2009-11-28 18:10 . 2009-11-28 18:10 107760 ----a-w- c:\program files\mozilla firefox\plugins\ScorchPDFWrapper.dll

.

<pre>
c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray .exe
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\IObit\IObit Security 360\is360tray .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\McAfee\Common Framework\udaterui .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\Microsoft Office\Office12\groovemonitor .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-02-23 3026944]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-04-28 142120]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk

backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk

backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Dan^Start Menu^Programs^Startup^Adobe Media Player.lnk]

path=c:\documents and settings\Dan\Start Menu\Programs\Startup\Adobe Media Player.lnk

backup=c:\windows\pss\Adobe Media Player.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

c:\program files\Common Files\Real\Update_OB\realsched.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\WINDOWS\\system32\\spoolsv.exe"=

R2 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [9/16/2008 1:03 PM 169312]

S0 gcusv;gcusv; [x]

S3 LinksysFVNETusbl(AR)®;Linksys FVNETusbl(AR)® Service for Instant Wireless USB Network Adapter ver.2.6;c:\windows\system32\drivers\vnetusbl.sys [3/9/2004 7:48 PM 108032]

.

Contents of the 'Scheduled Tasks' folder

2010-05-16 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-05-06 03:18]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\

FF - component: c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\FFExternalAlert.dll

FF - component: c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\RadioWMPCore.dll

FF - plugin: c:\documents and settings\Dan\Application Data\Move Networks\plugins\npqmp071505000010.dll

FF - plugin: c:\documents and settings\Dan\Application Data\Move Networks\plugins\npqmp071505000011.dll

FF - plugin: c:\program files\Musicnotes\npmusicn.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-16 14:49

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1784)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\McAfee\Common Framework\FrameworkService.exe

c:\windows\system32\nvsvc32.exe

c:\program files\McAfee\Common Framework\naPrdMgr.exe

c:\windows\system32\SearchIndexer.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2010-05-16 14:54:30 - machine was rebooted

ComboFix-quarantined-files.txt 2010-05-16 19:54

Pre-Run: 103,859,597,312 bytes free

Post-Run: 103,841,226,752 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 445439F7C42A8DB424C7BB7322C35DCD

ComboFixLog.txt

kahdah · May 16, 2010

1. Open notepad and copy/paste the text in the codebox below into it:

http://forums.malwarebytes.org/index.php?showtopic=50105

Collect::
c:\windows\system32\barfgizb.dll
c:\windows\system32\fa443773.exe

DirLook::
c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

RenV::
c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray .exe
c:\program files\Adobe\Reader 9.0\Reader\reader_sl .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\Common Files\Sonic\Update Manager\sgtray .exe
c:\program files\IObit\IObit Security 360\is360tray .exe
c:\program files\iTunes\ituneshelper .exe
c:\program files\Java\jre6\bin\jusched .exe
c:\program files\McAfee\Common Framework\udaterui .exe
c:\program files\Messenger\msmsgs .exe
c:\program files\Microsoft Office\Office12\groovemonitor .exe

Save this as CFScript.txt

Drag CFScript.txt into ComboFix.exe

2. Save the above as CFScript.txt

3. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

4. During this run Combofix will collect and automatically upload some sample files.

You will see it say Combofix needs to upload some samples.

If it fails to do that do the requested steps at the bottom of this post to manually upload the samples.

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

Combofix.txt

===========

Note::

If Combofix fails to upload anything please do the following:

Go to Start > My Computer > C:\

Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip

Click Here to upload the submit.zip please.

yymellen · May 17, 2010

4. During this run Combofix will collect and automatically upload some sample files.
You will see it say Combofix needs to upload some samples.
If it fails to do that do the requested steps at the bottom of this post to manually upload the samples.
5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:
Combofix.txt
===========
Note::
If Combofix fails to upload anything please do the following:
Go to Start > My Computer > C:\
Then Navigate to C:\Qoobox\Quarantine\[4]-Submit_Date_Time.zip
Click Here to upload the submit.zip please.

4. It wasn't able to automatically upload the files.

It did not ask me to reboot.

I found the submit zip folder.

I clicked on the "here" link to upload the zip file I get:

Unable to connect

Firefox can't establish a connection to the server at www.bleepingcomputer.com.

And yet I'm able to post this message, so the internet connection is good. Just can't get into bleepingcomputer, I guess.

Do you want me to post the LOG that was generated after that CFScript/ComboFix run?

kahdah · May 17, 2010

Yes please post the log.

yymellen · May 17, 2010

Yes please post the log.

FYI, overnight, windows installed a security update and rebooted my computer.

None of those dwwin files popped up, so that's a start.

Here's the log from last night:

ComboFix 10-05-16.01 - Dan 05/16/2010 21:38:42.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.310 [GMT -5:00]

Running from: c:\documents and settings\Dan\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt

file zipped: c:\windows\system32\barfgizb.dll

file zipped: c:\windows\system32\fa443773.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\barfgizb.dll

c:\windows\system32\fa443773.exe

.

((((((((((((((((((((((((( Files Created from 2010-04-17 to 2010-05-17 )))))))))))))))))))))))))))))))

.

2010-05-16 19:51 . 2010-05-16 19:51 -------- d-----w- c:\windows\LastGood

2010-05-15 01:17 . 2010-05-15 01:17 -------- d-----w- C:\_OTL

2010-05-10 05:13 . 2010-05-10 05:13 -------- d-----w- C:\spoolerlogs

2010-05-10 04:50 . 2008-04-13 18:40 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys

2010-05-10 04:50 . 2008-04-13 18:40 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-05-04 02:58 . 2010-05-04 02:58 -------- d-----w- c:\program files\iPod

2010-05-04 02:49 . 2010-05-04 02:49 -------- d-----w- c:\program files\Bonjour

2010-05-04 02:43 . 2010-05-04 02:43 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.1.12\SetupAdmin.exe

2010-05-02 16:34 . 2010-04-21 17:08 52224 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\FFExternalAlert.dll

2010-05-02 16:34 . 2010-04-21 17:08 101376 ----a-w- c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\geif10ke.default\extensions\{aac4043a-8832-4abe-9963-35377f30b8e6}\components\RadioWMPCore.dll

2010-04-29 22:26 . 2010-04-29 22:26 -------- d-----w- c:\documents and settings\All Users\Application Data\IObit

2010-04-29 22:26 . 2010-04-29 22:26 -------- d-----w- c:\program files\IObit

2010-04-29 07:19 . 2010-04-29 07:19 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Apple Computer

2010-04-26 11:52 . 2010-04-29 07:19 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

2010-04-20 06:10 . 2010-04-20 06:11 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-04-18 05:26 . 2010-04-18 05:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-17 02:38 . 2010-02-07 16:35 -------- d-----w- c:\program files\iTunes