Jump to content

"desktop security 2010"


Recommended Posts

Hello RPMcMurphy,

Thank you for your help, here is the DDS txt and file attached:

DDS (Ver_10-03-17.01) - NTFSx86

Run by mike at 9:17:39,31 on 16/08/2010

Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11

Microsoft Windows XP Professionnel 5.1.2600.2.1252.33.1036.18.3032.2109 [GMT 2:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

============== Running Processes ===============

D:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

D:\WINDOWS\System32\svchost.exe -k netsvcs

D:\Program Files\Intel\WiFi\bin\S24EvMon.exe

svchost.exe

svchost.exe

D:\WINDOWS\system32\spoolsv.exe

D:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

D:\Program Files\Intel\WiFi\bin\EvtEng.exe

D:\Program Files\Java\jre6\bin\jqs.exe

D:\Program Files\Lenovo\PM Driver\PMSveH.exe

D:\Program Files\Fichiers communs\Intel\WirelessCommon\RegSrvc.exe

D:\WINDOWS\system32\svchost.exe -k imgsvc

D:\Program Files\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe

D:\WINDOWS\system32\wbem\wmiapsrv.exe

D:\WINDOWS\system32\igfxtray.exe

D:\WINDOWS\system32\igfxpers.exe

D:\WINDOWS\system32\igfxsrvc.exe

D:\Program Files\Intel\WiFi\bin\ZCfgSvc.exe

D:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe

D:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe

D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

D:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

D:\Program Files\BirdieSync\BirdieSync.exe

D:\WINDOWS\system32\ctfmon.exe

D:\Program Files\Microsoft ActiveSync\Wcescomm.exe

D:\Program Files\VoipBuster.com\VoipBuster\VoipBuster.exe

D:\Program Files\Messenger\msmsgs.exe

D:\PROGRA~1\MICROS~2\rapimgr.exe

D:\WINDOWS\system32\wbem\unsecapp.exe

D:\WINDOWS\explorer.exe

D:\WINDOWS\System32\svchost.exe -k HTTPFilter

D:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

D:\Program Files\Mozilla Firefox\firefox.exe

D:\Program Files\Mozilla Firefox\plugin-container.exe

D:\Program Files\Mozilla Thunderbird\thunderbird.exe

D:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

D:\Program Files\Fichiers communs\Intel\WirelessCommon\iFrmewrk.exe

D:\Documents and Settings\mike\Bureau\killit\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com

uSearch Page = hxxp://www.google.com

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

mDefault_Search_URL = hxxp://www.google.com/ie

mSearch Page = hxxp://www.google.com

mStart Page = hxxp://www.google.com

uInternet Settings,ProxyOverride = local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

mSearchAssistant = hxxp://www.google.com

BHO: QvodExtend: {53ac8551-0de0-4606-8a1e-a51af20add60} - d:\program files\qvodplayer\QvodExtend.dll

TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll

uRun: [CTFMON.EXE] d:\windows\system32\ctfmon.exe

uRun: [H/PC Connection Agent] "d:\program files\microsoft activesync\Wcescomm.exe"

uRun: [VoipBuster] "d:\program files\voipbuster.com\voipbuster\VoipBuster.exe" -nosplash -minimized

uRun: [MSMSGS] "d:\program files\messenger\msmsgs.exe" /background

uRun: [Desktop Security] "d:\documents and settings\mike\application data\desktop security\Desktop Security 2010.exe" /STARTUP

mRun: [igfxTray] d:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] d:\windows\system32\hkcmd.exe

mRun: [Persistence] d:\windows\system32\igfxpers.exe

mRun: [intelZeroConfig] "d:\program files\intel\wifi\bin\ZCfgSvc.exe"

mRun: [intelWireless] "d:\program files\fichiers communs\intel\wirelesscommon\iFrmewrk.exe" /tf Intel Wireless Tray

mRun: [PMHandler] d:\progra~1\lenovo\pmdriv~1\PMHandler.exe

mRun: [Acrobat Assistant 7.0] "d:\program files\adobe\acrobat 7.0\distillr\Acrotray.exe"

mRun: [egui] "d:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice

mRun: [birdieSync] d:\program files\birdiesync\BirdieSync.exe -minimized

mRunServices: [QMkYoMQvGm] d:\docume~1\mike\locals~1\temp\QMkYoMQvGm.exe

mRunServices: [securityeplgTb4.0.437.0] d:\program files\eset\eset nod32 antivirus\mozilla thunderbird\components\securitysmart.exe

mRunServices: [PurposeGeneral] d:\program files\fichiers communs\adobe\color\settings\extrasettings\generaleurope18592.exe

mRunServices: [ReadMeETicket] d:\program files\adobe\acrobat 7.0\designer 7.0\en\samples\e-ticket\readmeeticket.exe

mRunServices: [PreferencesBridge11102] d:\program files\adobe\adobe bridge cs3\resources\ro\openerbridge.exe

mRunServices: [scriptDropletScriptDroplet8.0] d:\program files\adobe\adobe photoshop cs2\samples\droplets\imageready droplets\adobeimageready.exe

mRunServices: [PurposeEurope] d:\program files\fichiers communs\adobe\color\settings\extrasettings\generaleurope18592.exe

mRunServices: [ETicketReadMe] d:\program files\adobe\acrobat 7.0\designer 7.0\en\samples\e-ticket\readmeeticket.exe

mRunServices: [imageReadyScriptDroplet] d:\program files\adobe\adobe photoshop cs2\samples\droplets\imageready droplets\adobeimageready.exe

mRunServices: [FrameworkiFramewrk] d:\program files\fichiers communs\intel\wirelesscommon\langresources\heb\wiwitrayintelr12000.exe

dRun: [CTFMON.EXE] d:\windows\system32\CTFMON.EXE

StartupFolder: d:\docume~1\mike\menudm~1\progra~1\dmarra~1\adobeg~1.lnk - d:\program files\fichiers communs\adobe\calibration\Adobe Gamma Loader.exe

StartupFolder: d:\docume~1\alluse~1\menudm~1\progra~1\dmarra~1\adobea~1.lnk - d:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe

IE: Add to Google Photos Screensa&ver - d:\windows\system32\GPhotos.scr/200

IE: Convert link target to Adobe PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert link target to existing PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert selected links to Adobe PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convert selected links to existing PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: Convert selection to Adobe PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert selection to existing PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convert to Adobe PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convert to existing PDF - d:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: E&xporter vers Microsoft Excel - d:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - d:\program files\messenger\msmsgs.exe

IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - d:\progra~1\micros~2\INetRepl.dll

IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - d:\progra~1\micros~2\INetRepl.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~3\office11\REFIEBAR.DLL

DPF: Microsoft XML Parser for Java - file://d:\windows\java\classes\xmldso.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

TCP: {6C484B72-8004-4EF9-85FD-2F178285E3D2} = 192.168.0.5,195.238.2.21

TCP: {F95E825C-090F-4C91-BBFD-DCE0E0E536BF} = 195.238.2.21,195.238.2.22

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - d:\progra~1\fichie~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxdev.dll

Hosts: 93.88.240.232 www.ressources-pnl.ch

================= FIREFOX ===================

FF - ProfilePath - d:\docume~1\mike\applic~1\mozilla\firefox\profiles\9rery3h0.default\

FF - plugin: c:\program files\divx\divx web player\npdivx32.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin2.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin3.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin4.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin5.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin6.dll

FF - plugin: c:\program files\quicktime\plugins\npqtplugin7.dll

FF - plugin: c:\program files\real\realplayer\netscape6\nppl3260.dll

FF - plugin: c:\program files\real\realplayer\netscape6\nprjplug.dll

FF - plugin: c:\program files\real\realplayer\netscape6\nprpjplug.dll

FF - plugin: d:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: d:\program files\google\picasa3\npPicasa3.dll

FF - plugin: d:\program files\google\update\1.2.183.29\npGoogleOneClick8.dll

FF - plugin: d:\program files\mozilla firefox\plugins\npatgpc.dll

FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - d:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);

d:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24);

d:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096);

d:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45);

d:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);

d:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);

d:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);

d:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);

d:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);

d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

d:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);

d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

d:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);

d:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;d:\windows\system32\drivers\ehdrv.sys [2009-5-14 107256]

R1 epfwtdir;epfwtdir;d:\windows\system32\drivers\epfwtdir.sys [2009-5-14 94360]

R1 PMHler;PMHler;d:\windows\system32\drivers\PMHler.sys [2006-5-24 10240]

R2 ekrn;ESET Service;d:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-5-14 731840]

R2 VMCService;Vodafone Mobile Connect Service;d:\program files\vodafone\vodafone mobile connect\bin\VMCService.exe [2008-11-4 14336]

S1 45f3ff37;45f3ff37;d:\windows\system32\drivers\45f3ff37.sys [2009-8-3 0]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;d:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);d:\program files\google\update\GoogleUpdate.exe [2010-7-25 136176]

S3 npf;NetGroup Packet Filter Driver;d:\windows\system32\drivers\npf.sys [2008-12-23 50704]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;d:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

=============== Created Last 30 ================

2010-08-15 09:54:57 0 d-----w- d:\docume~1\mike\applic~1\Malwarebytes

2010-08-15 09:54:36 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys

2010-08-15 09:54:33 20952 ----a-w- d:\windows\system32\drivers\mbam.sys

2010-08-15 09:54:33 0 d-----w- d:\docume~1\alluse~1\applic~1\Malwarebytes

2010-08-15 09:54:31 0 d-----w- d:\program files\Malwarebytes' Anti-Malware

2010-08-14 17:04:31 664 ----a-w- d:\windows\system32\d3d9caps.dat

2010-08-14 13:33:32 0 d-----w- d:\docume~1\mike\applic~1\Desktop Security

2010-08-13 12:43:13 0 d-----w- d:\windows\system32\fr-FR

2010-08-09 13:12:57 4376 ----a-w- d:\documents and settings\mike\intlname.ols

2010-08-03 13:56:14 5632 ----a-w- d:\windows\system32\ptpusb.dll

2010-08-03 13:56:14 159232 ----a-w- d:\windows\system32\ptpusd.dll

2010-08-03 13:56:13 15104 -c--a-w- d:\windows\system32\dllcache\usbscan.sys

2010-08-03 13:56:13 15104 ----a-w- d:\windows\system32\drivers\usbscan.sys

2010-07-27 15:21:11 0 d-----w- D:\Sales

2010-07-27 13:04:05 0 d-----w- D:\Management

2010-07-18 10:38:13 0 d-----w- D:\Invest

==================== Find3M ====================

2010-08-14 14:55:20 81840 ----a-w- d:\windows\system32\perfc00C.dat

2010-08-14 14:55:20 503242 ----a-w- d:\windows\system32\perfh00C.dat

============= FINISH: 9:17:58,39 ===============

Attach.rar

Link to post
Share on other sites

Hello,

icon11.gif Download ComboFix from one of the following locations:

Link 1

Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link

  • Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

RC1.png

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

RC2-1.png

  • Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

bradisco:

Download Mirror #1

Download Mirror #2

  • Double-click SystemLook.exe to run it.
  • Copy the content of the following codebox into the main textfield:
    :filefind
    ntfs.*
    beep.*


  • Click the Look button to start the scan.
  • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

icon11.gif Go to My Computer-> Tools-> Folder Options-> View tab:

  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:

virscan.org

Virus Total

Click on Browse, and upload the following file for analysis:

d:\windows\system32\drivers\45f3ff37.sys

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If it says already scanned -- click "reanalyze now"

Please post the results in your next reply.

Please include the following in your next post:

  • SystemLook log
  • File analysis results

Link to post
Share on other sites

bradisco:

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.malwarebytes.org/index.php?showtopic=60469
Collect::
d:\documents and settings\mike\Application Data\Desktop Security\Desktop Security 2010.exe
Suspect::
d:\windows\system32\drivers\45f3ff37.sys
Folder::
d:\documents and settings\mike\Application Data\Desktop Security
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Desktop Security"=-

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

bradisco:

icon11.gif Click Start > Run or press Windows Key + R copy/paste the following into the run box that opens and press OK:

c:\Qoobox\ComboFix-quarantined-files.txt

This will open a txt file. Either copy/paste the contents into your next post, or attach the file.

Please include the following in your next post:

  • The contents of c:\Qoobox\ComboFix-quarantined-files.txt

Link to post
Share on other sites

bradisco:

icon11.gif Go to My Computer-> Tools-> Folder Options-> View tab:

  • Under the Hidden files and folders heading:
  • Select - Show hidden files and folders.
  • Uncheck- Hide protected operating system files (recommended) option.
  • Also, make sure there is no checkmark beside Hide file extensions for known file types.
  • Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:

virscan.org

Virus Total

Click on Browse, and upload the following file for analysis:

D:\Qoobox\Quarantine\[4]-Submit_2010-08-19_09.07.14.zip

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If it says already scanned -- click "reanalyze now"

Please post the results in your next reply.

Please include the following in your next post:

  • File analysis results

Link to post
Share on other sites

bradisco:

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Driver::

Driver::
45f3ff37
File::
d:\windows\system32\drivers\45f3ff37.sys
KillAll::

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

  • ComboFix log

Link to post
Share on other sites

bradisco:

Now I need you to update your OS. Windows XP SP2 is no longer supported, you need SP3 in order to receive critical, security updates.

The easiest way to do this is to download the stand-alone update package from the Download Center. This page will say that this installation package is intended for IT professionals and developers. However, you can safely download and use this file.

http://www.microsoft.com/downloads/details...;displaylang=en

Let me know once you have this completed and we can finish cleaning your PC up.

Link to post
Share on other sites

bradisco:

Great, thanks. Here are your next instructions:

icon11.gifYour Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java components and update.

  • Go to this page.
  • Scroll down to where it says "Java Platform, Standard Edition."
  • Click the "Download JRE" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u21-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files

    [*]Click OK on Delete Temporary Files Window

    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.

    [*]Click OK to leave the Temporary Files Window

    [*]Click OK to leave the Java Control Panel.

icon11.gif You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

  • Click the Update tab
  • Click Check for Updates
  • If an update is found, it will download and install the latest version.
  • The program will close to update and reopen.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

icon11.gif Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.

Please be patient as this can take quite a long time to download.

  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:

    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases

    [*]Click on My Computer under the green Scan bar to the left to start the scan.

    [*]Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.

    [*]Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.

    [*]Click View report... at the bottom.

    [*] Click the Save report... button.

    [*] Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

  • MBAM log
  • Kaspersky log

Link to post
Share on other sites

Hi RPMcMurphy,

Ok new version Java is installed and temporary internet files erased.

Please find attached the report from Mawarebytes.

As for Kapersky I am unable to scan I keep getting this message "Launch of the Java application is interrupted! Please establish an uninterrupted Internet connection for work with this program."

Thanks

mbam_log_2010_08_24__10_03_26_.txt

Link to post
Share on other sites

bradisco:

How is your computer running now?

report.gif Most of the infections identified by Kaspersky are in your Thunderbird email. Unfortunately Kaspersky is unable to identify which particular email is infected, so delete any emails from anyone you don't know or any that have attachments, such as jokes, videos etc. (don't open them to check).

icon11.gif Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
D:\Play2zrule\Movies\QvodSetup3_blue.exe

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScriptB-4.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Please include the following in your next post:

  • ComboFix log
  • How is the computer running?

Link to post
Share on other sites

bradisco:

That looks good! Now I have some important cleanup for you to take care of:

icon11.gif Uninstall ComboFix

  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall

Combofix_uninstall_image.jpg

icon11.gif Delete the following tools along with any other logs you saved from our work:

  • DDS
  • GMER
  • SystemLook

icon11.gif Download TFC to your desktop

  • Close any open windows.
  • Double click the TFC icon to run the program
  • TFC will close all open programs itself in order to run,
  • Click the Start button to begin the process.
  • Allow TFC to run uninterrupted.
  • The program should not take long to finish it's job
  • Once its finished it should automatically reboot your machine,
  • if it doesn't, manually reboot to ensure a complete clean

icon11.gif Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application and MBAM current and updated. Scan with them at least weekly.
  • Avoid using P2P programs. Refer back to my earlier post for more information.
  • Please visit our General Computer Security Forum and review this post for some helpful information.

Please post once more so I know you are all set and I can mark this thread resolved. Good luck and stay safe!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.