ernel32.dll

brzyskibusiness · August 3, 2010

Hi,

My computer is infected with Trojan.Agent ernel32.dll. Scans pick it up and attempt to delete on reboot, but it always reappears. Have tried FileAssassin and Unlocker with no luck. Any help greatly appreciated!

MBAM Log file:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4382

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/2/2010 10:57:17 PM

mbam-log-2010-08-02 (22-57-17).txt

Scan type: Quick scan

Objects scanned: 148745

Time elapsed: 9 minute(s), 12 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 4

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.121,93.188.161.211 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{245fba2c-496e-4654-bea6-cf5daee5d778}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.121,93.188.161.211 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e4e6cb23-0b30-45f3-a453-5889ba15593c}\DhcpNameServer (Trojan.DNSChanger) -> Data: 93.188.162.121,93.188.161.211 -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{e4e6cb23-0b30-45f3-a453-5889ba15593c}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.121,93.188.161.211 -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\ernel32.dll (Trojan.Agent) -> Delete on reboot.

================

DDS Log File:

DDS (Ver_10-03-17.01) - NTFSx86

Run by HP_Owner at 21:50:37.23 on Mon 08/02/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2551.1992 [GMT -4:00]

AV: ESET NOD32 Antivirus 4.2 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

C:\Program Files\Java\jre6\bin\jqs.exe

c:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\WINDOWS\system32\HPZipm12.exe

C:\Program Files\SmartSVN 6\bin\statuscached.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Linksys\WUSB300N\WLService.exe

C:\Program Files\Linksys\WUSB300N\WUSB300N.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe

C:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

C:\HP\KBD\KBD.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\WINDOWS\system32\igfxtray.exe

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

C:\Program Files\Unlocker\UnlockerAssistant.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Documents and Settings\HP_Owner\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank

uSearch Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

uSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

uInternet Connection Wizard,ShellNext = hxxp://www.satx.rr.com/

uInternet Settings,ProxyOverride = <local>

uInternet Settings,ProxyServer = http=127.0.0.1:5577

uSearchURL,(Default) = hxxp://www.google.com/keyword/%s

mSearchAssistant = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q305&bd=pavilion&pf=desktop

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

TB: {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - No File

TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - No File

TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [HPBootOp] "c:\program files\hewlett-packard\hp boot optimizer\HPBootOp.exe" /run

mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe

mRun: [KBD] c:\hp\kbd\KBD.EXE

mRun: [PS2] c:\windows\system32\ps2.exe

mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [AdobeCS4ServiceManager] "c:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin

mRun: [Adobe_ID0ENQBO] c:\progra~1\common~1\adobe\adobev~2\server\bin\VERSIO~2.EXE

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [AutoTBar] c:\program files\hp\digital imaging\bin\AUTOTBAR.EXE

mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [unlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\tabuse~1.lnk - c:\windows\system32\wtablet\TabUserW.exe

mPolicies-system: EnableLUA = 0 (0x0)

IE: &Google Search - c:\program files\google\GoogleToolbar1.dll/cmsearch.html

IE: Backward Links - c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

IE: Cached Snapshot of Page - c:\program files\google\GoogleToolbar1.dll/cmcache.html

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: Similar Pages - c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

IE: Translate into English - c:\program files\google\GoogleToolbar1.dll/cmtrans.html

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - hxxps://webdl.symantec.com/activex/symdlmgr.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_10-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab

TCP: NameServer = 93.188.162.121,93.188.161.211

TCP: {245FBA2C-496E-4654-BEA6-CF5DAEE5D778} = 93.188.162.121,93.188.161.211

TCP: {E4E6CB23-0B30-45F3-A453-5889BA15593C} = 93.188.162.121,93.188.161.211

Notify: AtiExtEvent - Ati2evxx.dll

Notify: igfxcui - igfxsrvc.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hp_owner\applic~1\mozilla\firefox\profiles\knvmx3f7.default\

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\hp_owner\application data\move networks\plugins\npqmp071503000010.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

c:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2010-3-29 114984]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2010-3-29 95872]

R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-3-29 810120]

R2 statuscached;SmartSVN Status Cache;c:\program files\smartsvn 6\bin\statuscached.exe [2009-6-6 215040]

R2 WUSB300NSvc;WUSB300NSvc;c:\program files\linksys\wusb300n\WLService.exe [2007-1-19 53307]

R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2008-11-22 23064]

S0 nsytv;nsytv; [x]

S3 Adobe Version Cue CS4;Adobe Version Cue CS4;c:\program files\common files\adobe\adobe version cue cs4\server\bin\VersionCueCS4.exe [2008-8-15 284016]

S3 Cdrmgrfonpsde;Cdrmgrfonpsde;c:\windows\system32\drivers\symndis.sys --> c:\windows\system32\drivers\symndis.sys [?]

S3 NPF;WinPcap Packet Driver (NPF);c:\windows\system32\drivers\npf.sys [2010-7-16 50704]

============== File Associations ===============

.txt=

=============== Created Last 30 ================

2010-08-03 01:45:43 0 ----a-w- c:\documents and settings\hp_owner\defogger_reenable

2010-08-02 19:40:32 0 d-----w- c:\program files\Unlocker

2010-07-19 04:16:13 0 d-----w- c:\program files\ESET

2010-07-16 17:27:12 150 ----a-w- C:\zrpt.xml

2010-07-16 17:26:58 0 d-----w- c:\docume~1\alluse~1\applic~1\Update

2010-07-16 17:26:58 0 ----a-w- c:\windows\system32\perf73845.dat

2010-07-16 05:47:05 50704 ----a-w- c:\windows\system32\drivers\npf.sys

2010-07-16 05:47:05 281104 ----a-w- c:\windows\system32\wpcap.dll

2010-07-16 05:47:05 100880 ----a-w- c:\windows\system32\Packet.dll

2010-07-16 05:46:28 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-14 22:10:30 391 ----a-w- c:\windows\exe.js

2010-07-14 03:18:01 93702 ----a-w- c:\windows\system32\subrange.uce

2010-07-14 03:18:01 8484 ----a-w- c:\windows\system32\kanji_2.uce

2010-07-14 03:18:01 6948 ----a-w- c:\windows\system32\kanji_1.uce

2010-07-14 03:18:01 605696 ----a-w- c:\windows\system32\getuname.dll

2010-07-14 03:18:01 605696 ----a-w- c:\windows\system32\dllcache\getuname.dll

2010-07-14 03:18:01 60458 ----a-w- c:\windows\system32\ideograf.uce

2010-07-14 03:18:01 24006 ----a-w- c:\windows\system32\gb2312.uce

2010-07-14 03:18:01 22984 ----a-w- c:\windows\system32\bopomofo.uce

2010-07-14 03:18:01 16740 ----a-w- c:\windows\system32\shiftjis.uce

2010-07-14 03:18:01 12876 ----a-w- c:\windows\system32\korean.uce

2010-07-14 03:18:00 80384 ----a-w- c:\windows\system32\dllcache\charmap.exe

2010-07-14 03:18:00 80384 ----a-w- c:\windows\system32\charmap.exe

2010-07-14 03:17:58 114688 ----a-w- c:\windows\system32\dllcache\calc.exe

2010-07-14 03:17:58 114688 ----a-w- c:\windows\system32\calc.exe

==================== Find3M ====================

2010-05-05 13:30:57 173056 ------w- c:\windows\system32\dllcache\ie4uinit.exe

2009-03-12 05:03:52 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009031220090313\index.dat

============= FINISH: 21:52:17.62 ===============

Attach.zip

ARK.zip

Maniac · August 4, 2010

Hello brzyskibusiness! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

**Note: If you need more detailed information, please visit the web page of ComboFix in BleepingComputer. **

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Stay with me until given the 'all clear' even if symptoms diminish. Lack of symptoms does not always mean the job is complete.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by me or another helper.

Please download ComboFix from

Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
- Open Tools -> Options -> Main tab
- Set to Always ask me where to Save the files.

[*]During the download, rename Combofix to Combo-Fix as follows:

[*]It is important you rename Combofix during the download, but not after.

[*]Please do not rename Combofix to other names, but only to the one indicated.

[*]Close any open browsers.

[*]Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

-----------------------------------------------------------

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause unpredictable results.
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
-----------------------------------------------------------

Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

-----------------------------------------------------------

[*]Double click on combo-Fix.exe & follow the prompts.

[*]When finished, it will produce a report for you.

[*]Please post the C:\Combo-Fix.txt for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

brzyskibusiness · August 4, 2010

Borislav,

Thanks very much for your reply and assistance. ComboFix ran without incident, here is the report:

==========================================

ComboFix 10-08-03.04 - HP_Owner 08/04/2010 12:05:08.1.1 - x86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2551.2056 [GMT -4:00]

Running from: c:\documents and settings\HP_Owner\Desktop\Combo-Fix.exe

AV: ESET NOD32 Antivirus 4.2 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\HP_Owner\Application Data\3a61a042.exe

C:\test.txt

c:\windows\system32\drivers\npf.sys

c:\windows\system32\ernel32.dll

c:\windows\system32\Ijl11.dll

c:\windows\system32\inf

c:\windows\system32\inf\hpqps2kb.inf

c:\windows\system32\lsprst7.dll

c:\windows\system32\Packet.dll

c:\windows\system32\ssprs.dll

c:\windows\system32\wpcap.dll

D:\Autorun.inf

Infected copy of c:\windows\system32\drivers\imapi.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_NPF

-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2010-07-04 to 2010-08-04 )))))))))))))))))))))))))))))))

.

2010-08-02 19:40 . 2010-08-02 19:40 -------- d-----w- c:\program files\Unlocker

2010-07-28 16:32 . 2010-07-28 16:32 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\ESET

2010-07-28 13:56 . 2010-07-28 13:56 -------- d--h--w- c:\documents and settings\NetworkService\Application Data\{04L4F65Z-6X8X-1X93-7861-9IYZ7O7M}

2010-07-27 22:32 . 2010-07-27 22:32 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET

2010-07-19 04:16 . 2010-07-19 04:16 -------- d-----w- c:\program files\ESET

2010-07-19 04:16 . 2010-07-19 04:16 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2010-07-16 17:27 . 2010-07-16 17:42 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\kntirdvtj

2010-07-16 17:26 . 2010-07-16 17:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Update

2010-07-16 17:26 . 2010-07-16 17:26 0 ----a-w- c:\windows\system32\perf73845.dat

2010-07-16 05:52 . 2010-07-16 05:52 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Thunderbird

2010-07-16 05:52 . 2010-07-16 05:52 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Thunderbird

2010-07-16 05:46 . 2010-07-28 22:11 1324 ----a-w- c:\windows\system32\d3d9caps.dat

2010-07-14 22:11 . 2010-07-14 22:11 -------- d-----w- c:\documents and settings\NetworkService\Application Data\AdobeUM

2010-07-14 22:10 . 2010-07-14 22:10 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe

2010-07-07 19:24 . 2010-07-08 00:12 -------- d-----w- c:\documents and settings\HP_Owner\Local Settings\Application Data\mrckwieyb

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-04 16:24 . 2005-08-09 01:06 316 ----a-w- c:\windows\system32\tablet.dat

2010-08-04 15:54 . 2005-08-02 08:24 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\CoreFTP

2010-08-03 03:20 . 2009-06-12 14:55 -------- d-----w- c:\documents and settings\HP_Owner\Application Data\FileZilla

2010-08-02 15:40 . 2008-02-02 04:18 -------- d-----w- c:\program files\Mozilla Thunderbird

2010-07-28 19:43 . 2010-02-25 17:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-28 16:04 . 2005-09-27 03:02 -------- d-----w- c:\program files\Spybot - Search & Destroy

2010-07-14 04:40 . 2005-07-29 16:14 109088 ----a-w- c:\documents and settings\HP_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-07-14 01:55 . 2007-01-31 23:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype

2010-07-14 01:47 . 2005-05-26 16:29 -------- d-----w- c:\program files\Common Files\Real

2010-07-14 01:44 . 2005-05-26 16:46 -------- d-----w- c:\program files\PC-Doctor for Windows

2010-07-14 01:40 . 2005-05-26 16:36 -------- d-----w- c:\program files\Microsoft Works

2010-07-14 01:38 . 2005-08-02 17:52 -------- d-----w- c:\program files\Macromedia

2010-07-14 01:38 . 2005-05-26 16:34 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-07-14 01:38 . 2005-08-02 17:53 -------- d-----w- c:\program files\Common Files\Macromedia

2010-07-14 01:29 . 2005-05-26 16:18 -------- d-----w- c:\program files\Hewlett-Packard

2010-07-14 01:22 . 2008-01-08 02:34 -------- d-----w- c:\program files\Bonjour

2010-07-14 01:21 . 2005-07-29 20:14 -------- d-----w- c:\program files\Common Files\AOL

2007-08-25 03:52 . 2007-10-01 17:44 300400 ----a-w- c:\program files\mozilla firefox\components\coFFPlgn.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartSVN1]

@="{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}"

[HKEY_CLASSES_ROOT\CLSID\{CC8811D1-1B32-4f3d-A9BF-D21C8F3C0366}]