malware closes when i try to view results

torrentsnogood · July 9, 2010

I posted in general by mistake so now after i followed all the steps im posting here. please help

Elise · July 9, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
GMER log

torrentsnogood · July 9, 2010

Thank You Elise. Ok so here is where I am now. I ran malwarebytes without running rkill.exe first. This time it let me show results it didnt force close . There were 98 infected not the original 107 that I was getting everytime. I removed the threats and all the av security, defender, keylogger and multiple other popups have stopped. However when I go on the internet I still get redirected to different sites a lot. Do you still want me to do what you posted or something different now.

Elise · July 9, 2010

No, still the same logs, thank you for adding the extra information.

torrentsnogood · July 9, 2010

No, still the same logs, thank you for adding the extra information.

bbb

torrentsnogood · July 9, 2010

sorry about the bbb it wouldnt let me post the logs.

Elise · July 9, 2010

What error message did you get?

Try to attach the logs.

torrentsnogood · July 9, 2010

It says internet explorer cannot display this page, however my internet works fine for everything else. I also tried to run gmer. It runs for about 2 hrs and then freezes my computer. tried in safe mode does the same thing.

torrentsnogood · July 9, 2010

see if this works.

OTL.Txt

Extras.Txt

Elise · July 10, 2010

Hello again,

That looks suspiciously much like a rootkit. Lets see if we can confirm that.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

torrentsnogood · July 10, 2010

elise, when i run combofix it tells me av security suite is running, however it doesnt show up in the system tray or in control panel under add remove programs. combofix says it will run anyway but there could be damage to my laptop. should I run it anyway.

Elise · July 10, 2010

Yes, run it anyway.

torrentsnogood · July 10, 2010

OK. Here we go.

ComboFix 10-07-10.01 - BG 07/10/2010 14:13:54.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1652 [GMT -4:00]

Running from: c:\documents and settings\BG\Desktop\ComboFix.exe

AV: AV Security Suite *On-access scanning enabled* (Updated) {AE716D16-40FE-4cb9-8FD2-2975088F55B2}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Local Settings\Application Data\{0362A2D1-485F-47C6-A52B-78CD4E74B8C9}

c:\documents and settings\Administrator\Local Settings\Application Data\{0362A2D1-485F-47C6-A52B-78CD4E74B8C9}\chrome.manifest

c:\documents and settings\Administrator\Local Settings\Application Data\{0362A2D1-485F-47C6-A52B-78CD4E74B8C9}\chrome\content\_cfg.js

c:\documents and settings\Administrator\Local Settings\Application Data\{0362A2D1-485F-47C6-A52B-78CD4E74B8C9}\chrome\content\overlay.xul

c:\documents and settings\Administrator\Local Settings\Application Data\{0362A2D1-485F-47C6-A52B-78CD4E74B8C9}\install.rdf

c:\documents and settings\BG\Local Settings\Application Data\{14A11F10-A5E3-4D7F-830B-917E27424025}

c:\documents and settings\BG\Local Settings\Application Data\{14A11F10-A5E3-4D7F-830B-917E27424025}\chrome.manifest

c:\documents and settings\BG\Local Settings\Application Data\{14A11F10-A5E3-4D7F-830B-917E27424025}\chrome\content\_cfg.js

c:\documents and settings\BG\Local Settings\Application Data\{14A11F10-A5E3-4D7F-830B-917E27424025}\chrome\content\overlay.xul

c:\documents and settings\BG\Local Settings\Application Data\{14A11F10-A5E3-4D7F-830B-917E27424025}\install.rdf

c:\documents and settings\BG\Local Settings\Application Data\Windows Server

c:\documents and settings\BG\Local Settings\Application Data\Windows Server\flags.ini

c:\documents and settings\BG\Local Settings\Application Data\Windows Server\uses32.dat

c:\program files\Outlook Express\rasadhlp.dll

c:\windows\AegisP.inf

c:\windows\inf\vvt.pnf

c:\windows\system32\drivers\dounheg.sys

c:\windows\system32\drivers\dujvmu.sys

c:\windows\system32\drivers\iqsq.sys

c:\windows\system32\drivers\plhqmb.sys

Infected copy of c:\windows\system32\drivers\i8042prt.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_acqmxi

-------\Legacy_cesib

-------\Legacy_nssdmga

-------\Legacy_xgynwgg

-------\Service_acqmxi

-------\Service_cesib

-------\Service_nssdmga

-------\Service_xgynwgg

((((((((((((((((((((((((( Files Created from 2010-06-10 to 2010-07-10 )))))))))))))))))))))))))))))))

.

2010-07-10 16:38 . 2010-07-10 16:39 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-07-09 00:23 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-07-09 00:23 . 2010-07-09 00:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-09 00:23 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-07-08 21:19 . 2010-07-08 21:19 -------- d-----w- c:\documents and settings\BG\Application Data\Malwarebytes

2010-07-08 21:19 . 2010-07-08 21:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-08 19:23 . 2010-07-08 23:04 120 ----a-w- c:\windows\Fwada.dat

2010-07-08 19:23 . 2010-07-08 19:23 0 ----a-w- c:\windows\Wgitaku.bin

2010-07-08 15:10 . 2010-07-08 15:10 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe

2010-07-08 01:59 . 2010-07-08 01:59 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple

2010-07-07 23:35 . 2010-07-09 01:00 -------- d-----w- c:\documents and settings\BG\Local Settings\Application Data\dimldgtjn

2010-07-07 23:35 . 2010-07-09 01:00 -------- d-----w- c:\documents and settings\BG\Local Settings\Application Data\tuuldngpv

2010-07-06 21:34 . 2010-07-06 22:25 -------- d-----w- C:\orig

2010-07-06 19:48 . 2010-07-10 16:09 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-06 19:38 . 2010-07-06 19:38 -------- d-----w- c:\documents and settings\BG\Application Data\Skype

2010-07-02 17:47 . 2010-07-02 17:47 -------- d-----w- c:\program files\Sling Media

2010-07-02 17:47 . 2010-07-02 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Sling Media

2010-07-01 23:44 . 2010-07-01 23:44 -------- d-----w- C:\dell

2010-07-01 23:08 . 2010-07-01 23:09 -------- d-----w- c:\documents and settings\BG\Local Settings\Application Data\Deployment

2010-07-01 22:48 . 2010-07-01 22:48 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-07-01 22:16 . 2010-07-02 01:48 -------- d-----w- c:\documents and settings\Administrator\Application Data\Teleca

2010-07-01 22:16 . 2010-07-01 22:16 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Scansoft

2010-07-01 22:15 . 2010-07-01 22:15 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-07-01 15:12 . 2010-07-02 01:48 -------- d-----w- c:\documents and settings\BG\Application Data\Teleca

2010-07-01 15:10 . 2009-06-10 20:49 24576 ----a-w- c:\windows\system32\drivers\ANDROIDUSB.sys

2010-07-01 15:10 . 2010-07-01 15:10 -------- d-----w- c:\program files\Spirent Communications

2010-07-01 15:10 . 2010-07-02 01:48 -------- d-----w- c:\program files\HTC

2010-07-01 15:10 . 2010-07-01 15:11 -------- d-----w- c:\documents and settings\BG\.android

2010-07-01 15:04 . 2010-07-01 15:04 -------- d-----w- C:\sdk

2010-06-30 19:31 . 2010-07-07 16:55 -------- d-----w- c:\documents and settings\BG\Application Data\uTorrent

2010-06-29 19:34 . 2010-06-29 19:34 -------- d-----w- c:\program files\Lame for Audacity

2010-06-27 18:21 . 2010-06-27 18:22 -------- d-----w- c:\documents and settings\BG\Application Data\vlc

2010-06-27 18:20 . 2010-06-27 18:20 -------- d-----w- c:\program files\VideoLAN

2010-06-25 18:59 . 2006-09-28 19:32 9472 ----a-w- c:\windows\system32\drivers\pnetmdm.sys

2010-06-25 18:52 . 2008-03-21 17:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll

2010-06-25 18:38 . 2010-06-25 18:59 -------- d-----w- c:\program files\PdaNet for Android

2010-06-25 18:38 . 2009-11-08 06:41 581192 ----a-w- c:\windows\system32\WinUSBCoInstaller.dll

2010-06-25 18:38 . 2009-11-08 06:41 1112288 ----a-w- c:\windows\system32\WdfCoInstaller01007.dll

2010-06-11 18:02 . 2010-05-06 10:41 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-07-09 17:17 . 2008-12-31 04:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Rosetta Stone

2010-07-08 16:41 . 2009-02-07 17:05 -------- d-----w- c:\program files\PokerStars

2010-07-08 15:10 . 2007-11-27 20:19 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys

2010-07-08 15:10 . 2007-11-27 20:19 21361 ----a-w- c:\windows\AegisP.sys

2010-07-08 02:49 . 2007-11-28 15:57 -------- d-----w- c:\program files\Common Files\Symantec Shared

2010-07-08 02:48 . 2007-11-28 15:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec

2010-07-08 02:46 . 2010-05-18 22:34 -------- d-----w- c:\program files\Common Files\Apple

2010-07-08 02:00 . 2010-05-18 22:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple

2010-07-08 01:55 . 2010-05-20 18:22 -------- d-----w- c:\program files\ACD

2010-07-02 17:47 . 2007-11-27 20:04 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-01 15:16 . 2010-07-01 15:16 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ANDROIDUSB_01007.Wdf

2010-06-25 18:53 . 2010-06-25 18:53 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf

2010-06-25 18:52 . 2010-06-25 18:52 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf

2010-06-17 15:39 . 2009-03-24 14:19 -------- d-----w- c:\program files\Absolute Poker

2010-06-12 01:17 . 2007-11-27 21:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-06-08 14:58 . 2009-12-12 03:27 -------- d-----w- c:\program files\Microsoft Silverlight

2010-06-05 15:01 . 2010-06-05 15:01 -------- d-----w- c:\program files\Rosetta Stone

2010-06-05 15:01 . 2010-06-05 15:01 -------- d-----w- c:\documents and settings\All Users\Application Data\RosettaStoneLtdBackup

2010-05-30 16:05 . 2010-05-30 16:05 -------- d-----w- c:\documents and settings\BG\Application Data\AnvSoft

2010-05-30 15:51 . 2010-05-30 15:51 -------- d-----w- c:\documents and settings\BG\Application Data\MPEG Streamclip

2010-05-20 23:26 . 2007-11-27 19:19 74448 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-05-20 22:48 . 2007-11-27 19:02 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat

2010-05-20 22:33 . 2007-11-28 14:29 -------- d-----w- c:\program files\Common Files\Adobe

2010-05-19 00:20 . 2007-11-28 18:05 -------- d-----w- c:\documents and settings\BG\Application Data\Apple Computer

2010-05-18 22:37 . 2010-05-18 22:37 -------- d-----w- c:\documents and settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}

2010-05-18 22:37 . 2007-11-28 15:30 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer

2010-05-18 22:36 . 2007-11-28 15:30 -------- d-----w- c:\program files\QuickTime

2010-05-06 10:41 . 2004-08-04 11:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-05-02 05:22 . 2004-08-04 11:00 1851264 ----a-w- c:\windows\system32\win32k.sys

2010-04-20 05:30 . 2004-08-04 11:00 285696 ----a-w- c:\windows\system32\atmfd.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SetDefaultMIDI"="MIDIDef.exe" [2005-04-22 73728]

"CreativeTaskScheduler"="c:\program files\Creative\Shared Files\CTSched.exe" [2006-11-17 53341]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-10-04 8491008]

"nwiz"="nwiz.exe" [2007-10-04 1626112]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-10-04 81920]

"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 282624]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-07-02 159744]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-10-08 995328]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-10-08 1101824]

"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-02-12 174872]

"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]

"MimBoot"="c:\progra~1\MUSICM~1\MUSICM~1\mimboot.exe" [2006-01-19 11776]

"SPIRun"="SPIRun.dll" [2006-11-29 8704]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-12-20 28160]

"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472]

"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2008-07-10 29984]

"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2008-07-10 46368]

"PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-08-31 328992]

"BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2009-01-19 1150976]

"ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2009-01-09 114688]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-03-18 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]

"Malwarebytes Anti-Malware (rootkit-scan)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-04-29 1090952]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"nltide_3"="advpack.dll" [2009-03-08 128512]

c:\documents and settings\BG\Start Menu\Programs\Startup\

PdaNet Desktop.lnk - c:\program files\PdaNet for Android\PdaNetPC.exe [2010-6-25 447952]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-5-17 568176]

QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2007-9-11 972064]

SetPoint.lnk - c:\program files\SetPoint\SetPoint.exe [2007-11-28 532480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoWelcomeScreen"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"ForceStartMenuLogOff"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=

"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe"=

R2 SlingAgentService;SlingAgentService;c:\program files\Sling Media\SlingAgent\SlingAgentService.exe [9/25/2009 1:16 PM 93960]

R3 HTCAND32;HTC Device Driver;c:\windows\system32\drivers\ANDROIDUSB.sys [7/1/2010 11:10 AM 24576]

R3 pnetmdm;PdaNet Modem;c:\windows\system32\drivers\pnetmdm.sys [6/25/2010 2:59 PM 9472]

S0 dbupdnc;dbupdnc;c:\windows\system32\drivers\qoeyvc.sys --> c:\windows\system32\drivers\qoeyvc.sys [?]

S3 EraserUtilDrv10621;EraserUtilDrv10621;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrv10621.sys [?]

S3 t3;SB Xtreme Audio Notebook;c:\windows\system32\drivers\t3.sys [11/28/2007 9:24 PM 733184]

S3 t3filt;t3filt;c:\windows\system32\drivers\t3filt.sys [11/28/2007 9:24 PM 1656576]

.

Contents of the 'Scheduled Tasks' folder

2010-07-10 c:\windows\Tasks\WGASetup.job

- c:\windows\system32\KB905474\wgasetup.exe [2009-05-09 02:18]

.

------- Supplementary Scan -------

.

uStart Page = about:blank

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5577

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

Notify-NavLogon - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-07-10 14:23

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2476)

c:\windows\system32\WININET.dll

c:\program files\SetPoint\lgscroll.dll

c:\windows\system32\btmmhook.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\dfshim.dll

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\btncopy.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\windows\system32\CTsvcCDA.exe

c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

c:\windows\system32\nvsvc32.exe

c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\Citrix\ICA Client\ssonsvr.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\stsystra.exe

c:\program files\DellTPad\ApMsgFwd.exe

c:\windows\system32\Rundll32.exe

c:\progra~1\MUSICM~1\MUSICM~1\MMDiag.exe

c:\program files\DellTPad\HidFind.exe

c:\program files\Brother\ControlCenter3\brccMCtl.exe

c:\program files\DellTPad\Apntex.exe

c:\program files\Brother\Brmfcmon\BrMfimon.exe

c:\program files\Musicmatch\Musicmatch Jukebox\mim.exe

c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE

c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE

c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe

.

**************************************************************************

.

Completion time: 2010-07-10 14:28:38 - machine was rebooted

ComboFix-quarantined-files.txt 2010-07-10 18:28

Pre-Run: 78,560,485,376 bytes free

Post-Run: 78,843,400,192 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - A71469D5449CF47E0AA87663FE448871

Elise · July 10, 2010

Hello,

That was as suspected, a nasty rootkit. Before continuing the cleaning, please consider the following information:

BACKDOOR WARNING

------------------------------

One or more of the identified infections is known to use a backdoor.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the infection has been identified and cleaned, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do. If you decide to go through with the cleanup, please proceed with the following steps.

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

DDS::
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5577

SecCenter::
{AE716D16-40FE-4cb9-8FD2-2975088F55B2}

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

.

torrentsnogood · July 10, 2010

hey elise, I dont do any major banking on this computer, however I do purchase things off the internet once in a while with a credit card. what would you recommend?

torrentsnogood · July 10, 2010

If I decide to format and reinstall xp it cant hurt to continue cleaning this computer. So here is the next log elise.

ComboFix 10-07-10.01 - BG 07/10/2010 17:33:51.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1425 [GMT -4:00]

Running from: c:\documents and settings\BG\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\BG\Desktop\CFScript.txt