UnclePete Posted December 16, 2010 ID:361639 Share Posted December 16, 2010 Just joined the Malwarebytes forum tonight, after having read it avidly during many frustrating nights trying to eradicate a virus (about which more in a moment). I am really impressed by the level of knowledge and altruism of those who make suggestions to solve complex problems. So...I have contracted the whitesmoke virus, which I've attempted to remove with malwarebytes (it came back in various altered forms), McAfee (don't get me started), and Rootkill. Finally, I've run combofix, and done nothing more, other than append the log below. I would be very grateful for any suggestions!ComboFix 10-12-13.02 - Alex Kougasian 12/15/2010 22:26:57.1.2 - x86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.204 [GMT -5:00]Running from: H:\ComboFix.exeAV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} * Created a new restore pointWARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\system32\atdl32.dllc:\windows\system32\downloadc:\windows\system32\Download\ispinfo.csvc:\windows\system32\Thumbs.dbc:\windows\winhelp.ini.((((((((((((((((((((((((( Files Created from 2010-11-16 to 2010-12-16 ))))))))))))))))))))))))))))))).2010-12-11 21:20 . 2010-12-11 21:20 -------- d-----w- c:\documents and settings\Don't be schpilkes2010-12-09 04:16 . 2010-12-09 04:16 -------- d--h--w- c:\windows\system32\GroupPolicy2010-12-07 11:24 . 2010-12-07 11:24 -------- d-----w- c:\windows\system32\%APPDATA%2010-12-06 06:33 . 2010-12-06 06:33 -------- d-----w- c:\windows\system32\wbem\Repository2010-11-24 02:51 . 2010-11-24 03:19 -------- d-----w- c:\program files\Eusing Free Registry Cleaner.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-11-29 22:42 . 2009-11-14 19:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-11-29 22:42 . 2009-11-14 19:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-10-14 03:28 . 2010-09-24 02:14 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys2010-10-14 03:28 . 2010-09-24 02:14 141792 ----a-w- c:\windows\system32\mfevtps.exe2010-10-14 03:28 . 2010-09-24 02:14 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys2010-10-14 03:28 . 2010-09-24 02:14 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys2010-10-14 03:28 . 2010-09-24 02:14 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys2010-10-14 03:28 . 2010-09-24 02:14 386840 ----a-w- c:\windows\system32\drivers\mfehidk.sys2010-10-14 03:28 . 2010-09-24 02:14 313288 ----a-w- c:\windows\system32\drivers\mfefirek.sys2010-10-14 03:28 . 2010-09-24 02:13 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys2010-10-14 03:28 . 2010-09-24 02:13 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys2010-10-14 03:28 . 2010-09-24 02:13 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys2010-10-14 03:28 . 2010-09-24 02:13 152960 ----a-w- c:\windows\system32\drivers\mfeavfk.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]2010-09-29 02:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-06 68856][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-13 61952]"CreateCD_Reminder"="c:\windows\Sonysys\VAIO Recovery\reminder.exe" [2004-07-16 53248]"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 151552]"SoundMan"="SOUNDMAN.EXE" [2004-11-02 77824]"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 2748928]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 339968]"EPSON Stylus CX5800F Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIALA.EXE" [2005-05-10 98304]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-04 30192]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-20 202256]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]CompuServe 7.0 Tray Icon.lnk - c:\program files\CompuServe 7.0\cstray.exe [2006-4-4 32840]ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-10-2 303104]Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [1997-1-10 16384]Lotus SmartCenter 97.lnk - c:\lotus\smartctr\smartctr.exe [1997-2-12 163840]Lotus SuiteStart 97.lnk - c:\lotus\smartctr\suitest.exe [1997-2-12 31232]Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]SecurityProviders rpasspc.dll, msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@=""[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"=R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/23/2010 9:14 PM 84072]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/23/2010 9:14 PM 188136]R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [9/23/2010 9:14 PM 141792]R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/23/2010 9:13 PM 55840]R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/23/2010 9:14 PM 313288]R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/28/2010 10:40 PM 135664]S3 bfastfao;bfastfao;\??\c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys --> c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys [?]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/23/2006 12:56 AM 30192]S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/23/2010 9:14 PM 84264]S3 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys [10/5/2009 10:30 PM 1984]S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]--- Other Services/Drivers In Memory ---*Deregistered* - mfeavfk01.Contents of the 'Scheduled Tasks' folder2009-08-20 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]2010-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-16 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-08-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-16 c:\windows\Tasks\RegCure Program Check.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2010-12-09 c:\windows\Tasks\RegCure.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2006-02-24 c:\windows\Tasks\Registration reminder 2.job- c:\windows\system32\OOBE\oobebaln.exe [2005-02-23 12:00]2010-12-16 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job- c:\program files\Ask.com\UpdateTask.exe [2010-09-29 02:44]..------- Supplementary Scan -------.uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeopleuSearchURL,(Default) = hxxp://www.google.com/search/?q=%s.- - - - ORPHANS REMOVED - - - -AddRemove-I Love Math! - c:\windows\Uninst.exe -rDK Multimedia\I Love Math!\1.0.4.0AddRemove-I Love Spelling! - c:\windows\Uninst.exe -rDK Multimedia\I Love Spelling!\1.0.0.0AddRemove-Scooby-Doo, Showdown in Ghost Town - c:\program files\The Learning Company\Scooby-Doo**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-12-15 22:54Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(3412)c:\windows\system32\WININET.dllc:\windows\system32\ieframe.dll.------------------------ Other Running Processes ------------------------.c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\windows\eHome\ehRecvr.exec:\windows\eHome\ehSched.exec:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exec:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exec:\program files\Sony\Sony TV Tuner Library\SMceMan.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exec:\windows\wanmpsvc.exec:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exec:\program files\Common Files\McAfee\SystemCore\mcshield.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exec:\windows\SOUNDMAN.EXEc:\windows\AGRSMMSG.exec:\windows\system32\dllhost.exec:\program files\Sony\Sony TV Tuner Library\RM_SV.exec:\windows\eHome\ehmsas.exec:\program files\iPod\bin\iPodService.exe.**************************************************************************.Completion time: 2010-12-15 22:59:54 - machine was rebootedComboFix-quarantined-files.txt 2010-12-16 03:59Pre-Run: 184,229,634,048 bytes freePost-Run: 191,817,515,008 bytes free- - End Of File - - CED7F87D6BFD7A21666450F06C370A79 Link to post Share on other sites More sharing options...
LDTate Posted December 17, 2010 ID:362296 Share Posted December 17, 2010 Please don't attach the scans / logs, use "copy/paste".DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.Vista and Windows 7 users:1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")Stay with this topic until I give you the all clean post.You might want to print these instructions out.I suggest you do this:1.Click Start > Settings > Control Panel. 2.Next, open Add/Remove Programs and remove if listed:Ask.comNext:Please download ATF Cleaner by Atribune.Download - ATF Cleaner Link to post Share on other sites More sharing options...
UnclePete Posted December 18, 2010 Author ID:362741 Share Posted December 18, 2010 Please don't attach the scans / logs, use "copy/paste".DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.Vista and Windows 7 users:1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")Stay with this topic until I give you the all clean post.You might want to print these instructions out.I suggest you do this:1.Click Start > Settings > Control Panel. 2.Next, open Add/Remove Programs and remove if listed:Ask.comNext:Please download ATF Cleaner by Atribune.Download - ATF Cleaner Link to post Share on other sites More sharing options...
LDTate Posted December 18, 2010 ID:362743 Share Posted December 18, 2010 Run a new combofix scan Link to post Share on other sites More sharing options...
UnclePete Posted December 19, 2010 Author ID:362874 Share Posted December 19, 2010 Thanks for your reply. Since I last wrote, I detected some part of the virus had returned (my disk drive was grinding for no apparent reason), so I ran Malwarebytes and found one infected file. I then ran rootkill, which found nothing.Then I found your message recommending that I run combofix again. I have done that, and I append the log below (in your first message, you suggest that I cut and paste in a different manner from the one I'm doing -- is there some part you do not wish me to copy? Please let me know. In any event, the log in its entirety is appended).Again, thanks for your help:ComboFix 10-12-13.02 - Peter Kougasian 12/19/2010 0:54.2.2 - x86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.234 [GMT -5:00]Running from: H:\ComboFix.exeAV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}FW: McAfee Firewall *Disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.((((((((((((((((((((((((( Files Created from 2010-11-19 to 2010-12-19 ))))))))))))))))))))))))))))))).2010-12-18 19:51 . 2010-12-19 05:36 -------- d-----w- c:\documents and settings\Peter Kougasian\Local Settings\Application Data\AskToolbar2010-12-18 19:47 . 2010-12-18 20:04 -------- d-----w- c:\program files\Content Manager2010-12-11 21:20 . 2010-12-11 21:20 -------- d-----w- c:\documents and settings\Don't be schpilkes2010-12-09 04:16 . 2010-12-09 04:16 -------- d--h--w- c:\windows\system32\GroupPolicy2010-12-07 11:24 . 2010-12-07 11:24 -------- d-----w- c:\windows\system32\%APPDATA%2010-12-06 06:33 . 2010-12-06 06:33 -------- d-----w- c:\windows\system32\wbem\Repository2010-11-24 02:51 . 2010-11-24 03:19 -------- d-----w- c:\program files\Eusing Free Registry Cleaner.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-11-29 22:42 . 2009-11-14 19:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-11-29 22:42 . 2009-11-14 19:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-10-14 03:28 . 2010-09-24 02:14 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys2010-10-14 03:28 . 2010-09-24 02:14 141792 ----a-w- c:\windows\system32\mfevtps.exe2010-10-14 03:28 . 2010-09-24 02:14 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys2010-10-14 03:28 . 2010-09-24 02:14 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys2010-10-14 03:28 . 2010-09-24 02:14 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys2010-10-14 03:28 . 2010-09-24 02:14 386840 ----a-w- c:\windows\system32\drivers\mfehidk.sys2010-10-14 03:28 . 2010-09-24 02:14 313288 ----a-w- c:\windows\system32\drivers\mfefirek.sys2010-10-14 03:28 . 2010-09-24 02:13 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys2010-10-14 03:28 . 2010-09-24 02:13 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys2010-10-14 03:28 . 2010-09-24 02:13 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys2010-10-14 03:28 . 2010-09-24 02:13 152960 ----a-w- c:\windows\system32\drivers\mfeavfk.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]2010-09-29 02:44 1400712 ----a-w- c:\program files\Ask.com\GenericAskToolbar.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2010-09-29 1400712][HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1][HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}][HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-05-23 95800]"Magellan CmTray"="c:\program files\Content Manager\CmTray.exe" [2010-12-08 458752][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-13 61952]"CreateCD_Reminder"="c:\windows\Sonysys\VAIO Recovery\reminder.exe" [2004-07-16 53248]"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 151552]"SoundMan"="SOUNDMAN.EXE" [2004-11-02 77824]"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 2748928]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 339968]"EPSON Stylus CX5800F Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIALA.EXE" [2005-05-10 98304]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-04 30192]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-20 202256]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]CompuServe 7.0 Tray Icon.lnk - c:\program files\CompuServe 7.0\cstray.exe [2006-4-4 32840]ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-10-2 303104]Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [1997-1-10 16384]Lotus SmartCenter 97.lnk - c:\lotus\smartctr\smartctr.exe [1997-2-12 163840]Lotus SuiteStart 97.lnk - c:\lotus\smartctr\suitest.exe [1997-2-12 31232]Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]SecurityProviders rpasspc.dll, msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@=""[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"=R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/23/2010 9:14 PM 84072]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/23/2010 9:14 PM 188136]R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [9/23/2010 9:14 PM 141792]R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/23/2010 9:13 PM 55840]R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/23/2010 9:14 PM 313288]R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/28/2010 10:40 PM 135664]S3 bfastfao;bfastfao;\??\c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys --> c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys [?]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/23/2006 12:56 AM 30192]S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/23/2010 9:14 PM 84264]S3 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys [10/5/2009 10:30 PM 1984]S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]--- Other Services/Drivers In Memory ---*Deregistered* - mfeavfk01.Contents of the 'Scheduled Tasks' folder2009-08-20 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-08-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-19 c:\windows\Tasks\RegCure Program Check.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2010-12-09 c:\windows\Tasks\RegCure.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2006-02-24 c:\windows\Tasks\Registration reminder 2.job- c:\windows\system32\OOBE\oobebaln.exe [2005-02-23 12:00]..------- Supplementary Scan -------.uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uStart Page = hxxp://www.yahoo.com/?ilc=1uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeopleuInternet Settings,ProxyOverride = <local>uInternet Settings,ProxyServer = http=127.0.0.1:43902uSearchURL,(Default) = hxxp://search.yahoo.com/search?fr=mcafee&p=%s.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-12-19 01:19Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-3890283167-2226702390-4246952313-1005\Software\Microsoft\SystemCertificates\AddressBook*]@Allowed: (Read) (RestrictedCode)@Allowed: (Read) (RestrictedCode)[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(540)c:\windows\system32\WININET.dllc:\progra~1\mcafee\SITEAD~1\saHook.dllc:\windows\system32\ieframe.dll.------------------------ Other Running Processes ------------------------.c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\windows\eHome\ehRecvr.exec:\windows\eHome\ehSched.exec:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exec:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exec:\program files\Sony\Sony TV Tuner Library\SMceMan.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exec:\windows\wanmpsvc.exec:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exec:\program files\Common Files\McAfee\SystemCore\mcshield.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exec:\windows\system32\dllhost.exec:\program files\Sony\Sony TV Tuner Library\RM_SV.exec:\windows\system32\rundll32.exec:\progra~1\mcafee.com\agent\mcagent.exec:\windows\SOUNDMAN.EXEc:\windows\eHome\ehmsas.exec:\windows\AGRSMMSG.exec:\program files\iPod\bin\iPodService.exec:\progra~1\mcafee\mpf\mpfalert.exe.**************************************************************************.Completion time: 2010-12-19 01:29:28 - machine was rebootedComboFix-quarantined-files.txt 2010-12-19 06:29ComboFix2.txt 2010-12-16 03:59Pre-Run: 191,699,755,008 bytes freePost-Run: 191,684,780,032 bytes free- - End Of File - - 46FF7E05C5B3B3BA9B77E093B1F4D8DC Link to post Share on other sites More sharing options...
LDTate Posted December 19, 2010 ID:362920 Share Posted December 19, 2010 Copy/paste the text in the Codebox below into notepad:Here's how to do that:Click Start > Run type Notepad click OK.This will open an empty notepad file: Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. KillAll::DDS::uInternet Settings,ProxyOverride = <local>uInternet Settings,ProxyServer = http=127.0.0.1:43902Folder::c:\program files\Ask.comSave this file to your desktop, Save this as "CFScript" Here's how to do that:1.Click File;2.Click Save As... Change the directory to your desktop;3.Change the Save as type to "All Files"; 4.Type in the file name: CFScript5.Click Save ...Drag CFScript.txt into ComboFix.exeThen post the results log using Copy / PasteAlso please describe how your computer behaves at the moment. Link to post Share on other sites More sharing options...
UnclePete Posted December 19, 2010 Author ID:363060 Share Posted December 19, 2010 Copy/paste the text in the Codebox below into notepad:Here's how to do that:Click Start > Run type Notepad click OK.This will open an empty notepad file: Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. KillAll::DDS::uInternet Settings,ProxyOverride = <local>uInternet Settings,ProxyServer = http=127.0.0.1:43902Folder::c:\program files\Ask.comSave this file to your desktop, Save this as "CFScript" Here's how to do that:1.Click File;2.Click Save As... Change the directory to your desktop;3.Change the Save as type to "All Files"; 4.Type in the file name: CFScript5.Click Save ...Drag CFScript.txt into ComboFix.exeThen post the results log using Copy / PasteAlso please describe how your computer behaves at the moment.I have followed your instructions, and the combofix log is posted below.As for how the computer is performing: after several days of blissful, purring-like a kitten, the hard drive has again been whirring for no apparent reason, McAFee reported that it detected a Trojan Horse virus, and I was unable to reach anything using internet explorer until I reset to default settings. I ran the Kaspersky utility, which found no infected files. I then followed all of your instructions, and I have posed the log below. Again, thanks for all your help!ComboFix 10-12-18.02 - Alex Kougasian 12/19/2010 16:00:03.3.2 - x86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.117 [GMT -5:00]Running from: c:\documents and settings\Alex Kougasian\Desktop\ComboFix.exeCommand switches used :: c:\documents and settings\Alex Kougasian\Desktop\CFScript.txtAV: McAfee Anti-Virus and Anti-Spyware *Disabled/Updated* {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}FW: McAfee Firewall *Enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\program files\Ask.comc:\program files\Ask.com\cobrand.icoc:\program files\Ask.com\config.xmlc:\program files\Ask.com\favicon.icoc:\program files\Ask.com\fv_45.icoc:\program files\Ask.com\GenericAskToolbar.dllc:\program files\Ask.com\mupcfg.xmlc:\program files\Ask.com\SaUpdate.exec:\program files\Ask.com\UpdateTask.exe.((((((((((((((((((((((((( Files Created from 2010-11-19 to 2010-12-19 ))))))))))))))))))))))))))))))).2010-12-18 19:51 . 2010-12-19 05:36 -------- d-----w- c:\documents and settings\Peter Kougasian\Local Settings\Application Data\AskToolbar2010-12-18 19:47 . 2010-12-18 20:04 -------- d-----w- c:\program files\Content Manager2010-12-11 21:20 . 2010-12-11 21:20 -------- d-----w- c:\documents and settings\Don't be schpilkes2010-12-09 04:16 . 2010-12-09 04:16 -------- d--h--w- c:\windows\system32\GroupPolicy2010-12-07 11:24 . 2010-12-07 11:24 -------- d-----w- c:\windows\system32\%APPDATA%2010-12-06 06:33 . 2010-12-06 06:33 -------- d-----w- c:\windows\system32\wbem\Repository2010-11-24 02:51 . 2010-11-24 03:19 -------- d-----w- c:\program files\Eusing Free Registry Cleaner.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2010-11-29 22:42 . 2009-11-14 19:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-11-29 22:42 . 2009-11-14 19:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys2010-10-14 03:28 . 2010-09-24 02:14 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys2010-10-14 03:28 . 2010-09-24 02:14 141792 ----a-w- c:\windows\system32\mfevtps.exe2010-10-14 03:28 . 2010-09-24 02:14 88544 ----a-w- c:\windows\system32\drivers\mfendisk.sys2010-10-14 03:28 . 2010-09-24 02:14 84264 ----a-w- c:\windows\system32\drivers\mferkdet.sys2010-10-14 03:28 . 2010-09-24 02:14 84072 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys2010-10-14 03:28 . 2010-09-24 02:14 386840 ----a-w- c:\windows\system32\drivers\mfehidk.sys2010-10-14 03:28 . 2010-09-24 02:14 313288 ----a-w- c:\windows\system32\drivers\mfefirek.sys2010-10-14 03:28 . 2010-09-24 02:13 95600 ----a-w- c:\windows\system32\drivers\mfeapfk.sys2010-10-14 03:28 . 2010-09-24 02:13 55840 ----a-w- c:\windows\system32\drivers\cfwids.sys2010-10-14 03:28 . 2010-09-24 02:13 52104 ----a-w- c:\windows\system32\drivers\mfebopk.sys2010-10-14 03:28 . 2010-09-24 02:13 152960 ----a-w- c:\windows\system32\drivers\mfeavfk.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-06 68856][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" [2004-08-13 61952]"CreateCD_Reminder"="c:\windows\Sonysys\VAIO Recovery\reminder.exe" [2004-07-16 53248]"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-01-14 151552]"SoundMan"="SOUNDMAN.EXE" [2004-11-02 77824]"AlcWzrd"="ALCWZRD.EXE" [2004-11-29 2748928]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-08 155648]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-08 126976]"AGRSMMSG"="AGRSMMSG.exe" [2004-10-08 88363]"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-23 339968]"EPSON Stylus CX5800F Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIALA.EXE" [2005-05-10 98304]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-04 30192]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-20 202256]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-01 421160]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-09-30 1193848]c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]CompuServe 7.0 Tray Icon.lnk - c:\program files\CompuServe 7.0\cstray.exe [2006-4-4 32840]ExifLauncher2.lnk - c:\program files\FinePixViewer\QuickDCF2.exe [2010-10-2 303104]Lotus QuickStart.lnk - c:\lotus\wordpro\ltsstart.exe [1997-1-10 16384]Lotus SmartCenter 97.lnk - c:\lotus\smartctr\smartctr.exe [1997-2-12 163840]Lotus SuiteStart 97.lnk - c:\lotus\smartctr\suitest.exe [1997-2-12 31232]Service Manager.lnk - c:\program files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2002-12-17 74308][HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]SecurityProviders rpasspc.dll, msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]@=""[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@=""[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]"DisableMonitoring"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"=R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [9/23/2010 9:14 PM 84072]R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McMPFSvc;McAfee Personal Firewall Service;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [9/23/2010 9:13 PM 271480]R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\Mcafee\SystemCore\mfefire.exe [9/23/2010 9:14 PM 188136]R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [9/23/2010 9:14 PM 141792]R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe -sVAIO_VEDB [?]R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [9/23/2010 9:13 PM 55840]R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [9/23/2010 9:14 PM 313288]R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/28/2010 10:40 PM 135664]S3 bfastfao;bfastfao;\??\c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys --> c:\docume~1\PETERK~1\LOCALS~1\Temp\bfastfao.sys [?]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [11/23/2006 12:56 AM 30192]S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [9/23/2010 9:14 PM 88544]S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [9/23/2010 9:14 PM 84264]S3 papycpu;papycpu;c:\windows\system32\drivers\papycpu.sys [10/5/2009 10:30 PM 1984]S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB --> c:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE -i VAIO_VEDB [?]--- Other Services/Drivers In Memory ---*Deregistered* - mfeavfk01.Contents of the 'Scheduled Tasks' folder2009-08-20 c:\windows\Tasks\AppleSoftwareUpdate.job- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-29 03:40]2010-12-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-19 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-05 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1005.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-08-18 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-3890283167-2226702390-4246952313-1007.job- c:\program files\Real\RealUpgrade\realupgrade.exe [2010-02-25 02:09]2010-12-19 c:\windows\Tasks\RegCure Program Check.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2010-12-09 c:\windows\Tasks\RegCure.job- c:\program files\RegCure\RegCure.exe [2008-04-21 21:21]2006-02-24 c:\windows\Tasks\Registration reminder 2.job- c:\windows\system32\OOBE\oobebaln.exe [2005-02-23 12:00]..------- Supplementary Scan -------.uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeopleuSearchURL,(Default) = hxxp://www.google.com/search/?q=%s.- - - - ORPHANS REMOVED - - - -BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dllToolbar-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dllWebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - c:\program files\Ask.com\GenericAskToolbar.dll**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2010-12-19 16:21Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]@Denied: (A 2) (Everyone)@="FlashBroker""LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe,-101"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]"Enabled"=dword:00000001[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10k_ActiveX.exe"[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]@Denied: (A 2) (Everyone)@="IFlashBroker4"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]@="{00020424-0000-0000-C000-000000000046}"[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}""Version"="1.0".--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'explorer.exe'(3172)c:\windows\system32\WININET.dllc:\progra~1\mcafee\SITEAD~1\saHook.dllc:\windows\system32\ieframe.dll.------------------------ Other Running Processes ------------------------.c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\windows\eHome\ehRecvr.exec:\windows\eHome\ehSched.exec:\program files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exec:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exec:\program files\Sony\Sony TV Tuner Library\SMceMan.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exec:\windows\wanmpsvc.exec:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exec:\program files\Common Files\McAfee\SystemCore\mcshield.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exec:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exec:\windows\system32\dllhost.exec:\program files\Sony\Sony TV Tuner Library\RM_SV.exec:\windows\system32\rundll32.exec:\windows\SOUNDMAN.EXEc:\windows\AGRSMMSG.exec:\windows\eHome\ehmsas.exec:\program files\iPod\bin\iPodService.exe.**************************************************************************.Completion time: 2010-12-19 16:31:40 - machine was rebootedComboFix-quarantined-files.txt 2010-12-19 21:31ComboFix2.txt 2010-12-19 06:29ComboFix3.txt 2010-12-16 03:59Pre-Run: 191,620,280,320 bytes freePost-Run: 191,612,411,904 bytes freeWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsUnsupportedDebug="do not select this" /debugmulti(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect- - End Of File - - F059046BEC26D911D16A12DED7844B20 Link to post Share on other sites More sharing options...
LDTate Posted December 19, 2010 ID:363103 Share Posted December 19, 2010 http://www.eset.eu/online-scannerGo here to run an online scannner from ESET.Click the green ESET Online Scanner button.Read the End User License Agreement and check the box: YES, I accept the Terms of Use.Click on the Start button next to it.You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.A new window will appear asking "Do you want to install this software?"".Answer Yes to download and install the ActiveX controls that allows the scan to run.Click Start.Check Remove found threats and Scan potentially unwanted applications.Click Scan to begin. If offered the option to get information or buy software. Just close the window. Wait for the scan to finishUse notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topic. Link to post Share on other sites More sharing options...
UnclePete Posted December 20, 2010 Author ID:363152 Share Posted December 20, 2010 http://www.eset.eu/online-scannerGo here to run an online scannner from ESET.Click the green ESET Online Scanner button.Read the End User License Agreement and check the box: YES, I accept the Terms of Use.Click on the Start button next to it.You may receive an alert on the address bar that "This site might require the following ActiveX control...Click here to install...". Click on that alert and then click Insall ActiveX component.A new window will appear asking "Do you want to install this software?"".Answer Yes to download and install the ActiveX controls that allows the scan to run.Click Start.Check Remove found threats and Scan potentially unwanted applications.Click Scan to begin. If offered the option to get information or buy software. Just close the window. Wait for the scan to finishUse notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txtCopy and paste that log as a reply to this topic.Thanks for your help. I have done exactly as you said. The display at the end of the program said it found no infected items. I went to the C drive and copied the log, and I have reproduced it below:ESETSmartInstaller@High as CAB hook log:OnlineScanner.ocx - registred OK# version=7# iexplore.exe=7.00.6000.17055 (vista_gdr.100414-0533)# OnlineScanner.ocx=1.0.0.6415# api_version=3.0.2# EOSSerial=02ce5a29253d7d408a6c50c45c5fc069# end=finished# remove_checked=true# archives_checked=true# unwanted_checked=true# unsafe_checked=false# antistealth_checked=true# utc_time=2010-12-20 12:37:15# local_time=2010-12-19 07:37:15 (-0500, Eastern Standard Time)# country="United States"# lang=9# osver=5.1.2600 NT Service Pack 2# compatibility_mode=5121 16777189 100 75 0 9035140 0 0# compatibility_mode=8192 67108863 100 0 0 0 0 0# scanned=163692# found=0# cleaned=0# scan_time=3934 Link to post Share on other sites More sharing options...
LDTate Posted December 20, 2010 ID:363153 Share Posted December 20, 2010 Good job The following will implement some cleanup procedures as well as reset System Restore points:For XP: Click START run Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.For Vista / Windows 7 Click START Search Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.If you used DeFoggerTo re-enable your Emulation drivers, double click DeFogger to run the tool. The application window will appear Click the Re-enable button to re-enable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OKIMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.Your Emulation drivers are now re-enabled.Here's my usual all clean postTo be on the safe side, I would also change all my passwords. This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.Log looks good Make your Internet Explorer more secure - This can be done by following these simple instructions:From within Internet Explorer click on the Tools menu and then click on Options.Click once on the Security tabClick once on the Internet icon so it becomes highlighted.Click once on the Custom Level button.Change the Download signed ActiveX controls to PromptChange the Download unsigned ActiveX controls to DisableChange the Initialize and script ActiveX controls not marked as safe to DisableChange the Installation of desktop items to PromptChange the Launching programs and files in an IFRAME to PromptChange the Navigate sub-frames across different domains to PromptWhen all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button.Next press the Apply button and then the OK to exit the Internet Properties page.[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.Without a firewall your computer is succeptible to being hacked and taken over.I am very serious about this and see it happen almost every day with my clients.Simply using a Firewall in its default configuration can lower your risk greatly.[*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE.[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.This will ensure your computer has always the latest security updates available installed on your computer.If there are new updates to install, install them immediately, reboot your computer, and revisit the siteuntil there are no more critical updates.Only run one Anti-Virus and Firewall program.I would suggest you read:PC Safety and Security--What Do I Need?.How to Prevent Malware: Link to post Share on other sites More sharing options...
UnclePete Posted December 20, 2010 Author ID:363180 Share Posted December 20, 2010 Good job The following will implement some cleanup procedures as well as reset System Restore points:For XP: Click START run Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.For Vista / Windows 7 Click START Search Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the U, it needs to be there.If you used DeFoggerTo re-enable your Emulation drivers, double click DeFogger to run the tool. The application window will appear Click the Re-enable button to re-enable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OKIMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.Your Emulation drivers are now re-enabled.Here's my usual all clean postTo be on the safe side, I would also change all my passwords. This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.Log looks good Make your Internet Explorer more secure - This can be done by following these simple instructions:From within Internet Explorer click on the Tools menu and then click on Options.Click once on the Security tabClick once on the Internet icon so it becomes highlighted.Click once on the Custom Level button.Change the Download signed ActiveX controls to PromptChange the Download unsigned ActiveX controls to DisableChange the Initialize and script ActiveX controls not marked as safe to DisableChange the Installation of desktop items to PromptChange the Launching programs and files in an IFRAME to PromptChange the Navigate sub-frames across different domains to PromptWhen all these settings have been made, click on the OK button. If it prompts you as to whether or not you want to save the settings, press the Yes button.Next press the Apply button and then the OK to exit the Internet Properties page.[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.Without a firewall your computer is succeptible to being hacked and taken over.I am very serious about this and see it happen almost every day with my clients.Simply using a Firewall in its default configuration can lower your risk greatly.[*] WOT , Web of Trust, As 'Googling' is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:Green to go Yellow for caution Red to stop WOT has an addon available for both Firefox and IE.[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.This will ensure your computer has always the latest security updates available installed on your computer.If there are new updates to install, install them immediately, reboot your computer, and revisit the siteuntil there are no more critical updates.Only run one Anti-Virus and Firewall program.I would suggest you read:PC Safety and Security--What Do I Need?.How to Prevent Malware:Wow! Never thought I'd get the thumbs-up emoticon and the "all clear" message! I will certainly take your additional advice to try to prevent future infections. Once again, thanks for working me through this. I can assure you your generosity won't soon be forgotten! Link to post Share on other sites More sharing options...
LDTate Posted December 20, 2010 ID:363181 Share Posted December 20, 2010 You're more than welcome. Glad we were able to helpPeace be with you Link to post Share on other sites More sharing options...
LDTate Posted December 23, 2010 ID:364414 Share Posted December 23, 2010 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts