Infected with Rootkit.Bubnix, cannot remove it

frustrateduser · August 20, 2010

Followed the instructions here after having run the Anti-Malware program a few times and it still finding Rootkit.Bubnix. When running GMER, I got a blue screen, so that log file is not attached.

DDS Log:

DDS (Ver_10-03-17.01) - NTFSx86

Run by Administrator at 13:46:08.42 on Fri 08/20/2010

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2611 [GMT -4:00]

AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\Program Files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe

C:\WINDOWS\system32\inetsrv\inetinfo.exe

C:\Program Files\Java\jre1.6.0_02\bin\javaw.exe

C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

C:\Program Files\Java\jre6\bin\jqs.exe

c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe -k HPZ12

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\Program Files\Xobni\XobniService.exe

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

C:\WINDOWS\SMINST\Scheduler.exe

C:\Program Files\Microsoft IntelliType Pro\itype.exe

C:\Program Files\Microsoft IntelliPoint\ipoint.exe

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Microsoft Security Essentials\msseces.exe

C:\Documents and Settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe

C:\Program Files\SonicWALL Global VPN Client\SWGVpnClient.exe

c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\SonicWALL Global VPN Client\RampartSvc.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\FireFox35\firefox.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.hp.com

mRun: [MsmqIntCert] regsvr32 /s mqrt.dll

mRun: [AGRSMMSG] AGRSMMSG.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [soundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe

mRun: [Recguard] c:\windows\sminst\Recguard.exe

mRun: [Reminder] c:\windows\creator\Remind_XP.exe

mRun: [scheduler] c:\windows\sminst\Scheduler.exe

mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe"

mRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe"

mRun: [startCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe

mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe

mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mlbtvn~1.lnk - c:\documents and settings\aricketson\local settings\application data\autobahn\mlb-nexdef-autobahn.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sonicw~1.lnk - c:\program files\sonicwall global vpn client\SWGVpnClient.exe

IE: Send To &Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab

DPF: {195B4BBF-E1E4-4020-9773-0A8C6F65EA35} - hxxp://p.playfirst.com/play/game/cookingdash/CookingDashWeb.1.0.0.9.cab

DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab

DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} - hxxp://www.shockwave.com/content/dinerdash2/sis/DinerDash2.1.0.0.67.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1186414487937

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll

Notify: AtiExtEvent - Ati2evxx.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\8acjn281.default\

FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: XULRunner: {90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} - c:\documents and settings\aricketson\local settings\application data\{90BD25AE-4FBC-48D5-8F25-38DC10EF35E1}

FF - HiddenExtension: XULRunner: {B4A0AE1B-F237-4795-9931-E068D77841CA} - c:\documents and settings\administrator\local settings\application data\{b4a0ae1b-f237-4795-9931-e068d77841ca}\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox35\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox35\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

c:\program files\firefox35\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

============= SERVICES / DRIVERS ===============

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216]

R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [2007-8-6 91136]

R2 FDXAPISVC;FedExAPI Service;c:\program files\fedex\fedex ship manager api\atom\AtomSvc.exe [2007-11-29 53248]

R2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2008-5-2 46824]

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2006-4-14 87936]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-6-10 35968]

R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2010-8-19 20480]

R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [2007-8-6 23180]

S1 mferkdk;VSCore mferkdk;\??\c:\program files\mcafee\virusscan enterprise\mferkdk.sys --> c:\program files\mcafee\virusscan enterprise\mferkdk.sys [?]

S2 DirMngr;DirMngr;c:\program files\gnu\gnupg\dirmngr.exe [2007-9-17 219136]

S2 SMTPSVCJavaQuickStarterService;Simple Mail Transfer Protocol (SMTP) SMTPSVCJavaQuickStarterService;c:\windows\system32\6to4svcx.exe srv --> c:\windows\system32\6to4svcx.exe srv [?]

S2 TapiSrvodserv;Telephony TapiSrvodserv;c:\windows\system32\3076n.exe srv --> c:\windows\system32\3076n.exe srv [?]

S2 XobniServiceLmHosts;XobniService XobniServiceLmHosts;c:\windows\system32\1031n.exe srv --> c:\windows\system32\1031n.exe srv [?]

S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\ultramonmirror.sys --> c:\windows\system32\drivers\UltraMonMirror.sys [?]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2006-12-2 2805000]

=============== Created Last 30 ================

2010-08-20 17:44:32 0 ----a-w- c:\documents and settings\administrator\defogger_reenable

2010-08-20 17:39:33 0 d-----w- c:\program files\Trend Micro

2010-08-20 17:21:45 54016 ----a-w- c:\windows\system32\drivers\rjrdh.sys

2010-08-20 16:52:33 114688 ----a-w- c:\windows\system32\chg.exe

2010-08-19 21:11:28 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-08-19 21:02:46 0 d-----w- c:\program files\Microsoft Security Essentials

2010-08-19 16:04:41 0 d-----w- c:\docume~1\admini~1\applic~1\SonicWALL

2010-08-19 16:04:40 0 d-----w- c:\documents and settings\administrator\.autobahn

2010-08-19 15:32:15 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes

2010-08-19 15:32:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-19 15:32:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-19 15:32:06 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-19 15:32:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2010-08-19 15:17:23 0 d-sh--w- c:\documents and settings\administrator\IETldCache

2010-08-19 14:21:41 77824 ----a-w- c:\windows\system32\drvsign.exe

2010-08-19 14:21:41 3387 ----a-w- c:\windows\system32\ndisrd.inf

2010-08-19 14:21:41 20480 ----a-w- c:\windows\system32\ndisrd.sys

2010-08-19 14:21:41 1400 ----a-w- c:\windows\system32\ndisrd_m.inf

2010-08-19 14:21:41 13824 ----a-w- c:\windows\system32\snetcfg.exe

2010-08-19 14:15:41 32 --s-a-w- c:\windows\system32\2347633182.dat

2010-08-19 14:13:16 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys

2010-08-16 18:45:37 120 ----a-w- c:\windows\Brosuja.dat

2010-08-16 18:45:37 0 ----a-w- c:\windows\Ezoxulaqocuba.bin

2010-08-16 18:44:04 585504 ----a-w- c:\windows\system32\drivers\koosw.sys

==================== Find3M ====================

2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll

2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll

2010-06-24 21:51:58 11077120 ----a-w- c:\windows\system32\dllcache\ieframe.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\dllcache\wininet.dll

2010-06-24 12:22:03 12800 ------w- c:\windows\system32\dllcache\xpshims.dll

2010-06-24 12:22:02 1210368 ----a-w- c:\windows\system32\dllcache\urlmon.dll

2010-06-24 12:22:01 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll

2010-06-24 12:22:01 5951488 ----a-w- c:\windows\system32\dllcache\mshtml.dll

2010-06-24 12:22:01 206848 ----a-w- c:\windows\system32\dllcache\occache.dll

2010-06-24 12:21:59 599040 ----a-w- c:\windows\system32\dllcache\msfeeds.dll

2010-06-24 12:21:59 55296 ----a-w- c:\windows\system32\dllcache\msfeedsbs.dll

2010-06-24 12:21:59 25600 ----a-w- c:\windows\system32\dllcache\jsproxy.dll

2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll

2010-06-24 12:21:58 1986560 ----a-w- c:\windows\system32\dllcache\iertutil.dll

2010-06-24 12:21:58 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll

2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll

2010-06-24 12:21:55 387584 ----a-w- c:\windows\system32\dllcache\iedkcs32.dll

2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-23 13:44:04 1851904 ------w- c:\windows\system32\dllcache\win32k.sys

2010-06-23 12:08:09 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe

2010-06-21 15:27:11 354304 ------w- c:\windows\system32\dllcache\srv.sys

2010-06-18 13:36:12 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe

2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 14:31:20 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe

2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll

2010-06-14 07:41:45 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll

2008-09-05 14:52:43 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat

============= FINISH: 13:48:53.62 ===============

MBAM Log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4450

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

8/20/2010 1:21:43 PM

mbam-log-2010-08-20 (13-21-43).txt

Scan type: Quick scan

Objects scanned: 167159

Time elapsed: 22 minute(s), 22 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\drivers\koosw.sys (Rootkit.Bubnix) -> Delete on reboot.

Attach.zip.zip

Elise · August 22, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

frustrateduser · August 22, 2010

I have run combofix but now I am no longer able to connect to the Internet either wirelessly or wired. because of this I can't post the log. I have tried rebooting but that does not solve my connectivity problem. (I am posting this from my smartphone.)

when I run ipconfig at the command prompt, it just shows "windows ip configuration" with no actual info about the connections themselves, even if I do ipconfig /all

frustrateduser · August 22, 2010

i was able to access the internet after disabling "WinpkFilter Driver" under Local Area Connection properties.

This is the combofix log:

ComboFix 10-08-21.06 - Administrator 08/22/2010 10:56:50.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2661 [GMT -4:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}

c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome.manifest

c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome\content\_cfg.js

c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome\content\overlay.xul

c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\install.rdf

c:\documents and settings\aricketson\g2ax_customer_downloadhelper_win32_x86.exe

c:\documents and settings\aricketson\g2ax_expert_downloadhelper_win32_x86.exe

c:\documents and settings\aricketson\g2mdlhlpx.exe

C:\Thumbs.db

c:\windows\system32\2347633182.dat

c:\windows\system32\Cache

c:\windows\system32\drivers\ndisrd.sys

c:\windows\Temp\tmp3.tmp

E:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_SMTPSVCJAVAQUICKSTARTERSERVICE

-------\Legacy_TAPISRVODSERV

-------\Legacy_XOBNISERVICELMHOSTS

-------\Service_ndisrd

-------\Service_SMTPSVCJavaQuickStarterService

-------\Service_TapiSrvodserv

-------\Service_XobniServiceLmHosts

((((((((((((((((((((((((( Files Created from 2010-07-22 to 2010-08-22 )))))))))))))))))))))))))))))))

.

2010-08-22 15:05 . 2010-08-22 15:05 114688 ----a-w- c:\windows\system32\chg.exe

2010-08-22 14:15 . 2010-08-22 14:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help

2010-08-20 17:39 . 2010-08-20 17:39 -------- d-----w- c:\program files\Trend Micro

2010-08-20 17:31 . 2010-08-20 17:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla

2010-08-19 21:11 . 2010-06-01 17:37 221568 ------w- c:\windows\system32\MpSigStub.exe

2010-08-19 21:02 . 2010-08-19 21:03 -------- d-----w- c:\program files\Microsoft Security Essentials

2010-08-19 16:05 . 2010-08-19 16:05 60904 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2010-08-19 16:04 . 2010-08-19 16:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\SonicWALL

2010-08-19 16:04 . 2010-08-19 16:05 -------- d-----w- c:\documents and settings\Administrator\.autobahn

2010-08-19 16:03 . 2010-08-19 16:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer

2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes

2010-08-19 15:32 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-08-19 15:32 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-08-19 15:17 . 2010-08-19 15:17 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-08-19 14:21 . 2010-08-19 14:21 77824 ----a-w- c:\windows\system32\drvsign.exe

2010-08-19 14:21 . 2010-08-19 14:21 20480 ----a-w- c:\windows\system32\ndisrd.sys

2010-08-19 14:21 . 2010-08-19 14:21 13824 ----a-w- c:\windows\system32\snetcfg.exe

2010-08-16 18:45 . 2010-08-19 20:18 120 ----a-w- c:\windows\Brosuja.dat

2010-08-16 18:45 . 2010-08-19 14:17 0 ----a-w- c:\windows\Ezoxulaqocuba.bin

2010-08-16 18:44 . 2010-08-22 15:08 585504 ----a-w- c:\windows\system32\drivers\koosw.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-08-22 14:36 . 2009-08-19 15:07 -------- d-----w- c:\program files\FireFox35

2010-08-22 14:15 . 2007-08-04 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help

2010-08-20 15:04 . 2009-02-02 21:42 -------- d-----w- c:\program files\Firefox3

2010-08-20 13:09 . 2007-08-16 17:18 -------- d-----w- c:\program files\ViewSonic

2010-08-19 16:04 . 2006-04-14 09:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI

2010-08-19 14:21 . 2010-08-19 14:21 36 ----a-w- c:\documents and settings\LocalService\Application Data\cgvhed.dat

2010-08-19 14:13 . 2010-08-16 18:43 36 ----a-w- c:\documents and settings\NetworkService\Application Data\cgvhed.dat

2010-08-14 00:44 . 2007-08-04 15:18 -------- d-----w- c:\program files\Microsoft SQL Server

2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll

2010-06-24 12:22 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll

2010-06-23 13:44 . 2004-08-04 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys

2010-06-21 15:27 . 2004-08-04 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys

2010-06-17 14:03 . 2004-08-04 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll

2010-06-14 07:41 . 2004-08-04 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll

2008-12-19 18:34 . 2007-08-04 16:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll

2008-12-19 18:34 . 2007-08-04 16:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll

2008-12-19 18:34 . 2007-08-04 16:08 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll

2008-12-19 18:34 . 2007-08-04 16:08 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll

2008-12-19 18:34 . 2007-08-04 16:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MsmqIntCert"="mqrt.dll" [2008-04-14 177152]

"AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 88203]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 761945]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072]

"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]

"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]

"Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-01-23 802816]

"Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-02-15 892928]

"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]

"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-06 184320]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

MLB.TV NexDef Plug-in.lnk - c:\documents and settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2010-4-2 802056]

SonicWALL Global VPN Client.lnk - c:\program files\SonicWALL Global VPN Client\SWGVpnClient.exe [2007-8-6 1105920]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\WINDOWS\\SMINST\\Scheduler.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\SonicWALL Global VPN Client\\SWGVpnClient.exe"=

"c:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\devenv.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\CoreFTP\\coreftp.exe"=

"c:\\Documents and Settings\\aricketson\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"=

"c:\\Program Files\\Firefox3\\firefox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\FireFox35\\firefox.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [8/6/2007 10:30 PM 91136]

R2 FDXAPISVC;FedExAPI Service;c:\program files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe [11/29/2007 1:53 PM 53248]

R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/2/2008 1:17 PM 46824]

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [4/14/2006 5:23 AM 87936]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [6/10/2005 9:26 AM 35968]

R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [8/6/2007 10:30 PM 23180]

S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [9/17/2007 10:58 AM 219136]

S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys --> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?]

S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [12/2/2006 6:17 AM 2805000]

--- Other Services/Drivers In Memory ---

*Deregistered* - koosw

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

.

Contents of the 'Scheduled Tasks' folder

2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005Core.job

- c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23]

2010-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005UA.job

- c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23]

2010-08-22 c:\windows\Tasks\MpIdleTask.job

- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.hp.com

IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll

DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab

DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8acjn281.default\

FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

FF - HiddenExtension: XULRunner: {90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} - c:\documents and settings\aricketson\Local Settings\Application Data\{90BD25AE-4FBC-48D5-8F25-38DC10EF35E1}

---- FIREFOX POLICIES ----

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);

c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true);

c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

HKLM-Run-AAWTray - c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe

AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\FlashUtil9c.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-08-22 11:08

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????U??????(?@???????@

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\koosw]

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]

"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)

c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3480)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Microsoft Security Essentials\MsMpEng.exe

c:\windows\system32\Ati2evxx.exe

c:\windows\System32\SCardSvr.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe

c:\program files\Java\jre1.6.0_02\bin\javaw.exe

c:\windows\system32\inetsrv\inetinfo.exe

c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe

c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\SearchIndexer.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\windows\system32\wscntfy.exe

c:\windows\AGRSMMSG.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

c:\program files\SonicWALL Global VPN Client\RampartSvc.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

c:\windows\system32\SearchProtocolHost.exe

c:\windows\system32\SearchFilterHost.exe

c:\program files\FireFox35\firefox.exe

.

**************************************************************************

.

Completion time: 2010-08-22 11:23:16 - machine was rebooted

ComboFix-quarantined-files.txt 2010-08-22 15:23

Pre-Run: 29,340,127,232 bytes free

Post-Run: 29,364,269,056 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 9EC877DE78B8923948DBEA088D0F2759

Elise · August 22, 2010

Hi, if that happens again, you can also try to right-click your LAN icon in the tray and selecitng Repair.

Please let me know how things are running after the following fix.

CF-SCRIPT

-------------

We need to execute a CF-script.

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click Start > Run and in the box that opens type notepad and press enter. Copy/paste the text in the codebox below into it:

Firefox::
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8acjn281.default\
FF - HiddenExtension: XULRunner: {90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} - c:\documents and settings\aricketson\Local Settings\Application Data\{90BD25AE-4FBC-48D5-8F25-38DC10EF35E1}

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

frustrateduser · August 23, 2010

I had tried to just Repair the connection, but that was not working, so I had to manually disable that driver to be able to connect to the internet. Not sure if that's normally there or if it's part of this infection...

Results of the latest ComboFix run:

ComboFix 10-08-22.05 - Administrator 08/23/2010 10:31:02.6.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2677 [GMT -4:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

----- BITS: Possible infected sites -----

hxxp://updates.swarmcast.net

.

((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 )))))))))))))))))))))))))))))))

.

2010-08-22 17:19 . 2010-08-22 17:19 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE