Am I infected?

mtnester · October 3, 2010

I've been following the steps in " I'm infected - What do I do now?"

So far, I've had some minor issues with the steps that I just skipped over: 1) deFogger did not ask me to reboot the machine, but I did anyway; 2) I have no idea if I have any script blocker that needed to be disabled so I skipped that part of the instructions as well; DDS ran and I saved the two text files as instructed.

Where I've gotten stuck is on the step to double-click and run GMER. In doing so, I received these error messages:

1) LoadDriver ("C:\Docu..\m...\LocalS~1\Temp\fgwipoc.sys") error 0xC0000061: Access is denied. [had to click two of those to continue]

2) C:\Windows\System32\config\system: The process cannot access the file because it is being used by another process. [had to click two of those to continue.]

3) C:\WindowsSystem32\config\software: The process cannot etc., etc.

4) C:\Docum...\M...\ntuserdat: The process cannot etc., etc.

Maybe this is a simple problem? I didn't shut down Opera or Process Explorer before running the program? Do I need to kill all running processes (including anti-virus and external hard drive) before running GMER? Any other ideas to get GMER to work?

Thanks for your help.

Maniac · October 4, 2010

Hello mtnester! Welcome to Malwarebytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.

Don't worry about that! Please post your DDS log file and Attach.txt .

mtnester · October 7, 2010

I've tried working throiugh each instructed on "I'm infected" and have reached the posting step. I had updated and run my anti-virus software before beginning the process.

mbam log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4763

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.11

10/6/2010 10:30:21 PM

mbam-log-2010-10-06 (22-30-21).txt

Scan type: Quick scan

Objects scanned: 195711

Time elapsed: 13 minute(s), 46 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

dds.txt--

DDS (Ver_10-03-17.01) - FAT32x86

Run by Mom_2 at 18:32:30.37 on Sun 10/03/2010

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2047.1467 [GMT -4:00]

AV: avast! Antivirus *On-access scanning enabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

============== Running Processes ===============

SVCHOST.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Western Digital Technologies\Spindown\ExSpinDn.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Xmarks\IE Extension\xmarkssync.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet d series\Bin\hpoojd07.exe

C:\Program Files\MozyHome\mozystat.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

C:\Program Files\ProcessExplorerNt\procexp.exe

C:\WINDOWS\system32\sol.exe

D:\Program Files\Opera\Opera.exe

C:\Documents and Settings\Mom_2\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = https://email.secureserver.net/login.php?do...il.tomarkit.com

uWindow Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL

mSearch Bar = hxxp://rd.yahoo.com/customize/sbcydsl/defaults/sb/*http://www.yahoo.com/search/ie.html

mWindow Title = Microsoft Internet Explorer provided by SBC Yahoo! DSL

uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll

BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll

BHO: FoxmarksDLLBHO Class: {a2a71aba-3939-43b2-bd8f-8c1767ef9020} - c:\program files\xmarks\ie extension\foxmarksdll.dll

BHO: {ae07101b-46d4-4a98-af68-0333ea26e113} - No File

BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: OpenLastClosedTab.LastClosedTab: {e05e75e9-a653-42a3-8d05-f2f7e309bdca} - mscoree.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll

TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll

TB: Foxit Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll

TB: {A8FB8EB3-183B-4598-924D-86F0E5E37085} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [spyware Doctor] d:\programs\spywar~1\swdoctor.exe /Q

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

uRun: [Xmarks] c:\program files\xmarks\ie extension\xmarkssync.exe -q

mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [WD Spindown Utility] "c:\program files\western digital technologies\spindown\ExSpinDn.exe"

mRun: [WD Button Manager] WDBtnMgr.exe

mRun: [avast5] c:\progra~1\alwils~1\avast5\avastUI.exe /nogui

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

dRun: [Picasa Media Detector] d:\program files\picasa2\PicasaMediaDetector.exe

StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\hpaiod~1.lnk - c:\program files\hewlett-packard\aio\hp officejet d series\bin\hpoojd07.exe

StartupFolder: c:\docume~1\alluse~1.win\startm~1\programs\startup\mozyho~1.lnk - c:\program files\mozyhome\mozystat.exe

uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)

uPolicies-explorer: NoOnlinePrintsWizard = 1 (0x1)

uPolicies-explorer: MaxRecentDocs = 20 (0x14)

mPolicies-explorer: NoOnlinePrintsWizard = 1 (0x1)

IE: &eBay Search - c:\program files\ebay\ebay toolbar2\eBayTb.dll/RCSearch.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office11\EXCEL.EXE/3000

IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Resource.dll/RC_AddToList.html

IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Resource.dll/RC_HSPrint.html

IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Resource.dll/RC_Preview.html

IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Resource.dll/RC_Print.html

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll

IE: {2499216C-4BA5-11D5-BD9C-000103C116D5} - {2499216C-4BA5-11D5-BD9C-000103C116D5}

IE: {36ECAF82-3300-8F84-092E-AFF36D6C7040} - {86529161-034E-4F8A-88D2-3C625E612E04} - d:\program files\winhttrack\WinHTTrackIEBar.dll

IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD}

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: Web-Based Email Tools - hxxp://email03.secureserver.net/Download.CAB

DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll

DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scan8/oscan8.cab

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8300.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1129367722203

DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1129702935312

DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection2.cab

DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} - hxxp://www3.ca.com/securityadvisor/virusinfo/webscan.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab

DPF: {A796D216-2DE1-4EA8-BABB-FE6E7C959098} - hxxp://www.hp.com/cpso-support-new/SDD/hpsddObjSigned.cab

DPF: {A9F8D9EC-3D0A-4A60-BD82-FBD64BAD370D} - hxxp://h20264.www2.hp.com/ediags/dd/install/HPDriverDiagnosticsxp2k.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CD69D6AB-0D0D-4082-B3CF-6E5381FA227B} - hxxp://www.detto.com/hpadvisor/DTMigAdv.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\mom_2\applic~1\mozilla\firefox\profiles\60pddgxe.default\

FF - prefs.js: browser.startup.homepage - hxxps://email.secureserver.net/login.php?domain=email.tomarkit.com

FF - component: c:\program files\mcafee\siteadvisor\components\McFFPlg.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-5-1 64160]

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [2008-4-4 165584]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-4-4 17744]

S3 HPUATA;HP CD Writer Plus Controller Driver;c:\windows\system32\drivers\HPUATA.sys [2001-9-24 75776]

S4 AloPar;AloPar;c:\windows\system32\drivers\AloPar.sys [2005-10-19 5056]

=============== Created Last 30 ================

2010-10-03 21:37:22 0 ----a-w- c:\documents and settings\mom_2\defogger_reenable

2010-10-03 18:15:38 0 d-----w- c:\docume~1\mom_2\applic~1\Malwarebytes

2010-10-03 06:56:55 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-10-03 06:56:53 0 d-----w- c:\docume~1\alluse~1.win\applic~1\Malwarebytes

2010-10-03 06:56:52 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-10-03 06:56:52 0 d-----w- c:\program files\Malwarebytes' Anti-Malware

==================== Find3M ====================

2010-09-07 15:12:18 38848 ----a-w- c:\windows\avastSS.scr

2009-07-13 19:33:30 6827264 ----a-w- c:\program files\Foxit Reader.exe

2008-08-05 06:52:14 336 ----a-w- c:\program files\temp995.bat

2003-02-25 22:43:02 262144 ------w- c:\program files\Mviw0225.bs

2004-08-04 04:56:46 50688 --sh--w- c:\windows\twain_32.dll

2003-03-31 16:00:00 94784 --sh--w- c:\windows\twain.dll

2007-12-04 14:38:14 550912 --sh--w- c:\windows\system32\oleaut32.dll

2004-08-04 04:56:42 1028096 --sh--w- c:\windows\system32\mfc42.dll

2004-08-04 04:56:44 343040 --sh--w- c:\windows\system32\msvcrt.dll

2004-08-04 04:56:56 11776 --sh--w- c:\windows\system32\regsvr32.exe

2004-08-04 04:56:44 83456 --sh--w- c:\windows\system32\olepro32.dll

2004-08-04 04:56:44 413696 --sh--w- c:\windows\system32\msvcp60.dll

2004-08-04 04:56:44 54784 --sh--w- c:\windows\system32\msvcirt.dll

============= FINISH: 18:35:20.76 ===============

This is the computer that has the ethernet connection to my router. I don't know whether or not that would affect how my laptops work (or don't work) also.

Thanks in advance for your help and advice.

arkfile.zip

attachfile.zip

mtnester · October 9, 2010

Hello mtnester! Welcome to Malwarebytes' Anti-Malware Forums!
My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:
The process of cleaning your system may take some time, so please be patient.
Follow my instructions step by step if there is a problem somewhere, stop and tell me.
Stay with the thread until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.
Keep me informed about any changes.
Don't worry about that! Please post your DDS log file and Attach.txt .

Thank you! I just found my original posting so I can respond. Thank you for your help.

I zipped attach.txt and uploaded as attachment. Here is DDS file--