Rootkits harder removal

March 23, 2011

Rootkits cause damage to systems and the problem lies in the protection programs all its types in the foundation is not able to detect a rootkit, which may enable hackers to know what is taking placeon on the system.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 6:48:57 PM, on 3/19/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\igfxtray.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Windows Live\Messenger\msnmsgr.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Hotspot Shield\bin\openvpnas.exe

C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

C:\Program Files\Hotspot Shield\bin\hsswd.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Hotspot Shield\bin\openvpntray.exe

C:\Documents and Settings\ANYUSER\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: ????? ????? ?????? ??? Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')

O9 - Extra button: ????? ??? ?? ??????? - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra 'Tools' menuitem: &????? ??? ?? Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1300364236765

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Hotspot Shield Service (HotspotShieldService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe

O23 - Service: Hotspot Shield Routing Service (HssSrv) - AnchorFree Inc. - C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe

O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE

O23 - Service: Hotspot Shield Monitoring Service (HssWd) - Unknown owner - C:\Program Files\Hotspot Shield\bin\hsswd.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

--

End of file - 5750 bytes

AdvancedSetup · March 23, 2011

I'm sorry but you've already been warned not to infect your box for testing and to use a virtual computer if want to test.

We cannot continue to use resources when you've not followed directions. Please backup your data and rebuild your computer from scratch to include FDISK, FORMAT and install Windows. Then restore your data and install a virtual system if you want to test malware.

AdvancedSetup · March 24, 2011

Okay, run the following then and post back the log.

Download ComboFix from below:
Combofix download
* IMPORTANT !!! Place combofix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on combofix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.
With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement.
ComboFix will now automatically install the Microsoft Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Microsoft Windows Recovery Console option when you start your computer unless requested to by a helper.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see a message that says:
The Recovery Console was successfully installed.

Click on Yes, to continue scanning for malware.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
---------------------------------------------------------------------------------------------
Ensure your AntiVirus and AntiSpyware applications are re-enabled.
---------------------------------------------------------------------------------------------

March 24, 2011

Here it

AdvancedSetup · March 25, 2011

STEP 01

Please download the following scanning tool.

GMER

Download the randomly named EXE and copy the file to your Desktop. Remember what its name is.
Double click on
random named exe file
and run it.
It may take a minute to load and become available.
Uncheck
Sections
,
IAT/EAT
, and
Show All
and only select your C: drive (unless you've installed to another drive)
Click on the
SCAN
button and DO NOT use the computer while it's scanning.
Once the scan is done click on the
SAVE
button and browse to your Desktop and save the file as
GMER.LOG
Zip up the
GMER.LOG
file and save it as
gmerlog.zip
and attach it to your reply post.
DO NOT
directly post this log into a reply. You
MUST
attach it as a .ZIP file.
Click OK and quit the GMER program.

How To Use Compressed (Zipped) Folders in Windows XP

Compress and uncompress files (zip files) in Vista

STEP 02

RootRepeal - Rootkit Detector

Close ALL applications and as many items in the task tray that will stop and exit.

Please download the following tool:
RootRepeal - Rootkit Detector
Direct download link is here:
RootRepeal.rar
If you don't already have a program to open a .RAR compressed file you can download a trial version from here:
WinRAR
Extract the program file to a new folder such as
C:\RootRepeal
Run the program
RootRepeal.exe
and go to the
REPORT
tab and click on the
Scan
button
Select
ALL
of the checkboxes and then click
OK
and it will start scanning your system.
If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
When done, click on
Save Report
Save it to the same location where you ran it from, such as
C:\RootRepeal
Save it as
rootrepeal.txt
Then open that log and select all and copy/paste it back on your next reply please.
Quit the RootRepeal program.

STEP 03

Please create a BOOTLOG

Delete the following file if it exists.

C:\Windows\ntbtlog.txt

Restart the computer and press F8 when Windows start booting. This will bring up the startup options.

Select "Enable Boot Logging" option and press enter.

Windows prompts you to select a Windows Installation (even if there is only one windows installation)

This boots windows normally and creates a boot log named

ntbtlog.txt

and saves it to

C:\Windows

March 25, 2011

ROOTREPEAL © AD, 2007-2009

==================================================

Scan Start Time: 2011/03/25 05:45

Program Version: Version 1.3.5.0

Windows Version: Windows XP SP3

==================================================

Drivers

-------------------

Name: catchme.sys

Image Path: C:\DOCUME~1\ANYUSER\LOCALS~1\Temp\catchme.sys

Address: 0xF87E1000 Size: 31744 File Visible: No Signed: -

Status: -

Name: dump_atapi.sys

Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys

Address: 0xAA2F9000 Size: 98304 File Visible: No Signed: -

Status: -

Name: dump_WMILIB.SYS

Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS

Address: 0xF8A7B000 Size: 8192 File Visible: No Signed: -

Status: -

Name: PROCEXP113.SYS

Image Path: C:\WINDOWS\system32\Drivers\PROCEXP113.SYS

Address: 0xF8A8B000 Size: 7872 File Visible: No Signed: -

Status: -

Name: pxtdqpow.sys

Image Path: C:\DOCUME~1\ANYUSER\LOCALS~1\Temp\pxtdqpow.sys

Address: 0xA94E1000 Size: 100480 File Visible: No Signed: -

Status: -

Name: rootrepeal.sys

Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys

Address: 0xA99CE000 Size: 49152 File Visible: No Signed: -

Status: -

==EOF==

Service Pack 3 3 25 2011 05:54:42.500

Loaded driver \WINDOWS\system32\TUKERNEL.EXE

Loaded driver \WINDOWS\system32\hal.dll

Loaded driver \WINDOWS\system32\KDCOM.DLL

Loaded driver \WINDOWS\system32\BOOTVID.dll

Loaded driver ACPI.sys

Loaded driver \WINDOWS\system32\DRIVERS\WMILIB.SYS

Loaded driver pci.sys

Loaded driver isapnp.sys

Loaded driver compbatt.sys

Loaded driver \WINDOWS\system32\DRIVERS\BATTC.SYS

Loaded driver pciide.sys

Loaded driver \WINDOWS\system32\DRIVERS\PCIIDEX.SYS

Loaded driver pcmcia.sys

Loaded driver MountMgr.sys

Loaded driver ftdisk.sys

Loaded driver dmload.sys

Loaded driver dmio.sys

Loaded driver ACPIEC.sys

Loaded driver \WINDOWS\system32\DRIVERS\OPRGHDLR.SYS

Loaded driver PartMgr.sys

Loaded driver VolSnap.sys

Loaded driver atapi.sys

Loaded driver disk.sys

Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS

Loaded driver fltmgr.sys

Loaded driver sr.sys

Loaded driver KSecDD.sys

Loaded driver Ntfs.sys

Loaded driver NDIS.sys

Loaded driver Mup.sys

Loaded driver \SystemRoot\system32\DRIVERS\intelppm.sys

Loaded driver \SystemRoot\system32\DRIVERS\igxpmp32.sys

Loaded driver \SystemRoot\system32\DRIVERS\HDAudBus.sys

Loaded driver \SystemRoot\system32\DRIVERS\bcmwl5.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys

Loaded driver \SystemRoot\system32\DRIVERS\usbehci.sys

Loaded driver \SystemRoot\system32\DRIVERS\e100b325.sys

Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys

Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\imapi.sys

Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys

Loaded driver \SystemRoot\system32\DRIVERS\redbook.sys

Loaded driver \SystemRoot\system32\DRIVERS\cpqbttn.sys

Loaded driver \SystemRoot\system32\DRIVERS\CmBatt.sys

Loaded driver \SystemRoot\system32\DRIVERS\wmiacpi.sys

Loaded driver \SystemRoot\system32\DRIVERS\audstub.sys

Loaded driver \SystemRoot\system32\DRIVERS\HssDrv.sys

Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys

Loaded driver \SystemRoot\system32\DRIVERS\msgpc.sys

Loaded driver \SystemRoot\system32\DRIVERS\psched.sys

Loaded driver \SystemRoot\system32\DRIVERS\ptilink.sys

Loaded driver \SystemRoot\system32\DRIVERS\raspti.sys

Loaded driver \SystemRoot\system32\DRIVERS\taphss.sys

Loaded driver \SystemRoot\system32\DRIVERS\rdpdr.sys

Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys

Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys

Loaded driver \SystemRoot\system32\DRIVERS\update.sys

Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys

Loaded driver \SystemRoot\system32\DRIVERS\kbdhid.sys

Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS

Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS

Loaded driver \SystemRoot\system32\drivers\CHDAud.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSFHWAZL.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSF_DPV.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

Loaded driver \SystemRoot\System32\Drivers\Modem.SYS

Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys

Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS

Did not load driver \SystemRoot\System32\Drivers\Fdc.SYS

Did not load driver \SystemRoot\System32\Drivers\Flpydisk.SYS

Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS

Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS

Did not load driver \SystemRoot\System32\Drivers\Changer.SYS

Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS

Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS

Loaded driver \SystemRoot\System32\Drivers\Null.SYS

Loaded driver \SystemRoot\System32\Drivers\Beep.SYS

Loaded driver \SystemRoot\System32\drivers\vga.sys

Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS

Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys

Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS

Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS

Loaded driver \SystemRoot\system32\DRIVERS\rasacd.sys

Loaded driver \SystemRoot\system32\DRIVERS\ipsec.sys

Loaded driver \SystemRoot\system32\DRIVERS\tcpip.sys

Loaded driver \SystemRoot\system32\DRIVERS\netbt.sys

Loaded driver \SystemRoot\system32\DRIVERS\ipnat.sys

Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys

Loaded driver \SystemRoot\System32\drivers\afd.sys

Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys

Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS

Did not load driver

Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys

Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\System32\Drivers\Fips.SYS

Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS

Loaded driver \??\C:\WINDOWS\system32\drivers\mbam.sys

Loaded driver \SystemRoot\system32\DRIVERS\fssfltr_tdi.sys

Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys

Did not load driver \SystemRoot\system32\DRIVERS\rdbss.sys

Did not load driver \SystemRoot\system32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\system32\drivers\wdmaud.sys

Loaded driver \SystemRoot\system32\drivers\sysaudio.sys

Loaded driver \SystemRoot\system32\drivers\splitter.sys

Loaded driver \SystemRoot\system32\drivers\aec.sys

Loaded driver \SystemRoot\system32\drivers\swmidi.sys

Loaded driver \SystemRoot\system32\drivers\DMusic.sys

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Loaded driver \SystemRoot\system32\drivers\drmkaud.sys

Did not load driver \SystemRoot\System32\Drivers\Parport.SYS

Did not load driver \SystemRoot\System32\Drivers\Serial.SYS

Loaded driver \SystemRoot\system32\DRIVERS\srv.sys

Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys

Did not load driver \SystemRoot\system32\DRIVERS\ipnat.sys

Loaded driver \??\C:\Program Files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys

Loaded driver \SystemRoot\System32\Drivers\HTTP.sys

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Vino's Event Viewer v01c run on Windows XP in English

Report run at 25/03/2011 6:12:50 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'Application' Log - error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'Application' Date/Time: 24/03/2011 5:19:09 PM

Type: error Category: 0

Event: 1000 Source: Application Error

Faulting application iexplore.exe, version 8.0.6001.18702, faulting module jvm.dll, version 19.1.0.2, fault address 0x000c87b2.

Log: 'Application' Date/Time: 22/03/2011 4:01:12 PM

Type: error Category: 0

Event: 5000 Source: .NET Runtime 2.0 Error Reporting

EventType clr20r3, P1 updatechecker[1].exe, P2 1.38.0.0, P3 4c5ff8fb, P4 updatechecker, P5 1.38.0.0, P6 4c5ff8fb, P7 e6, P8 d, P9 system.typeinitialization, P10 NIL.

Log: 'Application' Date/Time: 21/03/2011 11:48:52 PM

Type: error Category: 101

Event: 1002 Source: Application Hang

Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 21/03/2011 9:16:07 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 21/03/2011 9:16:07 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 21/03/2011 9:16:06 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 21/03/2011 9:16:06 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 21/03/2011 9:16:06 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 21/03/2011 9:16:06 PM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 20/03/2011 8:21:04 PM

Type: error Category: 101

Event: 1002 Source: Application Hang

Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 19/03/2011 10:44:51 AM

Type: error Category: 101

Event: 1002 Source: Application Hang

Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 19/03/2011 10:44:51 AM

Type: error Category: 101

Event: 1002 Source: Application Hang

Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 19/03/2011 10:44:51 AM

Type: error Category: 101

Event: 1002 Source: Application Hang

Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

Log: 'Application' Date/Time: 19/03/2011 7:08:29 AM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 19/03/2011 7:08:29 AM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 19/03/2011 7:08:29 AM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 19/03/2011 7:08:28 AM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 19/03/2011 7:08:28 AM

Type: error Category: 0

Event: 10103 Source: HotspotShieldService

The event description cannot be found.

Log: 'Application' Date/Time: 17/03/2011 12:05:57 AM

Type: error Category: 0

Event: 1000 Source: Application Error

Faulting application javasetup6u24.exe, version 6.0.240.71, faulting module javasetup6u24.exe, version 6.0.240.71, fault address 0x001b2788.

Log: 'Application' Date/Time: 17/03/2011 12:05:05 AM

Type: error Category: 0

Event: 1000 Source: Application Error

Faulting application javasetup6u24.exe, version 6.0.240.71, faulting module javasetup6u24.exe, version 6.0.240.71, fault address 0x001b2788.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

'System' Log - error Type

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Log: 'System' Date/Time: 25/03/2011 3:55:29 AM

Type: error Category: 0

Event: 1 Source: sr

The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

Log: 'System' Date/Time: 24/03/2011 10:34:07 PM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.72.40.52 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.72.71.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 24/03/2011 6:33:42 PM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.72.80.48 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.72.47.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 19/03/2011 2:20:33 PM

Type: error Category: 0

Event: 1 Source: sr

The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

Log: 'System' Date/Time: 19/03/2011 10:48:26 AM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.61.80.24 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.84.39.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 19/03/2011 9:25:34 AM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.68.72.44 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.61.87.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 19/03/2011 7:08:37 AM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.33.24.41 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.68.79.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 18/03/2011 10:19:04 PM

Type: error Category: 0

Event: 1002 Source: Dhcp

The IP address lease 10.68.40.29 for the Network Card with network address 00FF5CB840CA has been denied by the DHCP server 10.33.31.254 (The DHCP Server sent a DHCPNACK message).

Log: 'System' Date/Time: 18/03/2011 10:18:03 PM

Type: error Category: 0

Event: 7034 Source: Service Control Manager

The Hotspot Shield Routing Service service terminated unexpectedly. It has done this 1 time(s).

Log: 'System' Date/Time: 17/03/2011 5:40:17 PM

Type: error Category: 0

Event: 1 Source: sr

The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.

SIGVERIF.zip

gmerlog.zip.zip

AdvancedSetup · March 25, 2011

The current logs do not show or indicate any type of rootkit being active on the system.

I see where you may potentially have some hard drive errors so please run the following to correct those.

STEP 01

You may have corrupted files on your disk. Please try running the following.

First close ALL Applications as this routine will automatically restart your computer.

Click on START - RUN and copy / paste the following entry into the box and click OK

CMD /C ECHO Y|CHKDSK C: /R | SHUTDOWN /R /T 30

Though this program is legitimate and is not malware it is also known to have issues for many users. Unless you really think you need it you may want to consider removing this program from your computer, but again, that's up to you.

TuneUp Utilities 2011

After running the CHKDSK and rebooting please run the following.

STEP 02

Please download the Microsoft Genuine Advantage Diagnostic Tool

Double-click to run it and press the CONTINUE button and allow the program to check your system. When completed cick the COPY button and post back the results.

March 25, 2011

hard disk error Problem ,has been fix it

I

AdvancedSetup · March 25, 2011

But still exist. I've been run Combo Fix again, and this threat has been detected.

What threat? Please post the last log.

March 25, 2011

Rootkits shown up again. every time I running the Combo Fix ', it can not the scan for the first time since the Combo Fix operation ', then comes a message that says to me Combo Fix has detected rootkit.

And then tells me to press OK to reboot and then Combo Fix scan begins again, until the completion of the scan and without any removal of this infection, however, is unable to locate the infection.& These infections do not shown up in the log.

ComboFix 11-03-24.06 - ANYUSER 03/25/2011 23:00:24.6.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.304 [GMT 3:00]

Running from: c:\documents and settings\ANYUSER\Desktop\ComboFix.exe

.

((((((((((((((((((((((((( Files Created from 2011-02-25 to 2011-03-25 )))))))))))))))))))))))))))))))

.

2011-03-18 10:20 . 2011-03-25 14:51 -------- d-----w- C:\FU_Backup

2011-03-17 12:32 . 2011-03-17 12:32 -------- d-----w- C:\92551cd91d502ed7fcb458

2011-03-17 07:14 . 2011-03-17 07:15 -------- d-----w- C:\Hotspot Shield

2011-03-17 04:52 . 2011-03-16 21:29 -------- d-----w- C:\SWSetup

2011-03-17 04:51 . 2011-03-17 04:51 -------- d-----w- C:\Intel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2004-08-03 21:56 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2004-08-03 21:56 186880 ----a-w- c:\windows\system32\encdec.dll

2011-01-21 14:44 . 2004-08-03 21:56 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-07 14:09 . 2004-08-03 21:56 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10 . 2004-08-03 20:17 1854976 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((( SnapShot_2011-03-25_01.11.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-03-25 19:59 . 2011-03-25 19:59 16384 c:\windows\Temp\Perflib_Perfdata_368.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities 2011\WinStyler\tu_logonui.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

.

R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS [?]

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/17/2011 2:42 PM 363344]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [3/4/2011 7:30 PM 1523008]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/17/2011 2:42 PM 20952]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [10/7/2010 1:34 PM 10064]

S1 SABKUTIL;SABKUTIL;\??\c:\documents and settings\ANYUSER\Local Settings\Temporary Internet Files\Content.IE5\I2HN2ULH\SASKUTIL.SYS --> c:\documents and settings\ANYUSER\Local Settings\Temporary Internet Files\Content.IE5\I2HN2ULH\SASKUTIL.SYS [?]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

.

2011-03-25 c:\windows\Tasks\User_Feed_Synchronization-{346D76C5-8E54-4CBC-9BEF-63C9255A4439}.job

- c:\windows\system32\msfeedssync.exe [2009-03-08 01:31]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: Crawler Search - tbr:iemenu

FF - ProfilePath - c:\documents and settings\ANYUSER\Application Data\Mozilla\Firefox\Profiles\malvqzn4.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=

FF - prefs.js: browser.startup.homepage - hxxp://www.bigseekpro.com/aresdestiny/{72D01AD4-B75B-4BC4-A194-896511A26AEF}

FF - prefs.js: keyword.URL - hxxp://www.bigseekpro.com/search/toolbar/aresdestiny/{72D01AD4-B75B-4BC4-A194-896511A26AEF}?q=

FF - Ext: afurladvisor: afurladvisor@anchorfree.com - c:\program files\Mozilla Firefox\extensions\afurladvisor@anchorfree.com

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Facemoods: ffxtlbr@Facemoods.com - %profile%\extensions\ffxtlbr@Facemoods.com

FF - Ext: Billeo: {4be68a18-deba-49e0-9e09-ee7796f3b62a} - %profile%\extensions\{4be68a18-deba-49e0-9e09-ee7796f3b62a}

FF - Ext: FileBulldogToolbar: {75656794-AB59-4712-BFBC-5D816D56F3BC} - %profile%\extensions\{75656794-AB59-4712-BFBC-5D816D56F3BC}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Crawler Toolbar: {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - c:\program files\Crawler\Toolbar\firefox

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: content.notify.interval - 600000

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.switch.threshold - 600000

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-03-25 23:07

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10n_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

Completion time: 2011-03-25 23:09:37

ComboFix-quarantined-files.txt 2011-03-25 20:09

ComboFix2.txt 2011-03-25 01:13

ComboFix3.txt 2011-03-22 12:13

ComboFix4.txt 2011-03-20 12:23

ComboFix5.txt 2011-03-25 19:53

.

Pre-Run: 33,141,583,872 bytes free

Post-Run: 33,320,546,304 bytes free

.

- - End Of File - - 9D8503B0965D35C149EC62CBE9F1636D

AdvancedSetup · March 26, 2011

Well the only thing I see odd is the SABKUTIL.SYS driver running from your IE cache which it should not be.

Please start a DOS prompt and type or copy/paste the following and then press the enter key.

SC DELETE SABKUTIL

It should say successful and if it does, then reboot your computer and run Combofix again please and post back the new log.

March 26, 2011

Other things. Along with the rootkit

First, the rootkit is still present., As follows ( comofix has detected the presence of rootkit activity and need to reboot the machine

Secondly, i have been Submitted these samples to the research center, But they are not been added out as a database, which It turned out later that it Malware programs,. And those who working there, and Believed to be he was the on rightful. and that we on completely wrong, and will certainly say, (this is legitimate), although it does not have anything enough, so with VirusTotal. This is of course the softwares is infected.

These are some links.

https://support.mozilla.com/en-US/questions/775941

http://www.siteadvisor.ca/sites/bigseekpro.com/postid?p=7303182

Thirdly, have been hijacked browsers. (Internet Explorer and Firefox).

Fourthly, I have a problem and will be postponed to a later date. After fixing of these problems.

ComboFix 11-03-25.01 - ANYUSER 03/26/2011 12:30:59.7.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.503.307 [GMT 3:00]

Running from: c:\documents and settings\ANYUSER\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2011-02-26 to 2011-03-26 )))))))))))))))))))))))))))))))

.

2011-03-18 10:20 . 2011-03-25 14:51 -------- d-----w- C:\FU_Backup

2011-03-17 12:32 . 2011-03-17 12:32 -------- d-----w- C:\92551cd91d502ed7fcb458

2011-03-17 07:14 . 2011-03-17 07:15 -------- d-----w- C:\Hotspot Shield

2011-03-17 04:52 . 2011-03-16 21:29 -------- d-----w- C:\SWSetup

2011-03-17 04:51 . 2011-03-17 04:51 -------- d-----w- C:\Intel

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2004-08-03 21:56 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2004-08-03 21:56 186880 ----a-w- c:\windows\system32\encdec.dll

2011-01-21 14:44 . 2004-08-03 21:56 439296 ----a-w- c:\windows\system32\shimgvw.dll

2011-01-07 14:09 . 2004-08-03 21:56 290048 ----a-w- c:\windows\system32\atmfd.dll

2010-12-31 13:10 . 2004-08-03 20:17 1854976 ----a-w- c:\windows\system32\win32k.sys

.

((((((((((((((((((((((((((((( SnapShot_2011-03-25_01.11.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2011-03-26 09:29 . 2011-03-26 09:29 16384 c:\windows\Temp\Perflib_Perfdata_3a0.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"UIHost"="c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities 2011\WinStyler\tu_logonui.exe"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Ares\\Ares.exe"=

.

R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS [?]

R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesService32.exe [3/4/2011 7:30 PM 1523008]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [3/17/2011 2:42 PM 20952]

R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2011\TuneUpUtilitiesDriver32.sys [10/7/2010 1:34 PM 10064]

S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [3/17/2011 2:42 PM 363344]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

UxTuneUp

.

Contents of the 'Scheduled Tasks' folder

.

2011-03-26 c:\windows\Tasks\User_Feed_Synchronization-{346D76C5-8E54-4CBC-9BEF-63C9255A4439}.job