Inescapable virus!

thedirtyfix · April 11, 2011

Please find the appropriate files attached. Despite a Full scan, the virus is continuing to attack as I write.

I was also unable to download the MBAM update. "Access is denied"

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6303

Windows 5.1.2600 Service Pack 3 (Safe Mode)

Internet Explorer 6.0.2900.5512

4/10/2011 4:45:41 PM

mbam-log-2011-04-10 (16-45-41).txt

Scan type: Full scan (C:\|)

Objects scanned: 284018

Time elapsed: 1 hour(s), 20 minute(s), 8 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 2

Registry Values Infected: 6

Registry Data Items Infected: 1

Folders Infected: 3

Files Infected: 27

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MyClearSearch Helper Service (PUP.Zwangi) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Malware.Gen) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\FaxCenterServer (Malware.Gen) -> Value: FaxCenterServer -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iTunesHelper (Malware.Gen) -> Value: iTunesHelper -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SynTPLpr (Malware.Gen) -> Value: SynTPLpr -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SynTPEnh (Malware.Gen) -> Value: SynTPEnh -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\shicoxp (Malware.Gen) -> Value: shicoxp -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\caxchg (Malware.Gen) -> Value: caxchg -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.StartPage) -> Bad: (http://myclearsearch.com/) Good: (http://www.google.com) -> Quarantined and deleted successfully.

Folders Infected:

c:\documents and settings\all users\application data\browserseek (PUP.Zwangi) -> Quarantined and deleted successfully.

c:\program files\browserseek (PUP.Zwangi) -> Quarantined and deleted successfully.

c:\program files\myclearsearch (PUP.Zwangi) -> Quarantined and deleted successfully.

Files Infected:

c:\program files\lexmark fax solutions\fm3032.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\iTunes\ituneshelper.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\synaptics\SynTP\SynTPLpr.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\program files\synaptics\SynTP\SynTPEnh.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\shicoxp.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\caxchg.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\all users\application data\browserseek\browserseek174.exe (Adware.Agent.Gen) -> Quarantined and deleted successfully.

c:\program files\myclearsearch\myclearsearchsvc.exe (PUP.Zwangi) -> Quarantined and deleted successfully.

c:\documents and settings\amason\application data\microsoft\windows media\12.0\wmpacm.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\Temp\egocarh.exe (Adware.BHO) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\Temp\inet.exe (Trojan.Agent) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\Temp\myclearsearch-setup.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\Temp\nsb22.tmp\browserseek.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\Temp\nsb22.tmp\browserseek.exe (Adware.Agent.Gen) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\temporary internet files\Content.IE5\1RMFL3B5\tgtkk[1].htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.

c:\documents and settings\amason\local settings\temporary internet files\Content.IE5\ERITSO47\zzjwaaosf[1].htm (Adware.BHO) -> Quarantined and deleted successfully.

c:\program files\browserseek\browserseek.dll (Adware.Agent.Gen) -> Quarantined and deleted successfully.

c:\program files\myclearsearch\ShowMsg.exe (PUP.Zwangi) -> Quarantined and deleted successfully.

c:\system volume information\_restore{a1d234c7-2567-4929-93b8-17007c4ddf79}\RP317\A0046903.exe (Adware.Agent.Gen) -> Quarantined and deleted successfully.

c:\Temp\ee896009-2241-4d1a-94b7-8f476921cf1c\offerapp-2533.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

c:\Temp\ee896009-2241-4d1a-94b7-8f476921cf1c\setup_dc665clbofferdp.exe (Adware.BHO) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\Ygr.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\Temp\qlgq\setup.exe (Malware.Gen) -> Quarantined and deleted successfully.

c:\WINDOWS\system32\winset.ini (Malware.Trace) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{22116563-108c-42c0-a7ce-60161b75e508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.

c:\WINDOWS\Tasks\{810401e2-dde0-454e-b0e2-aa89c9e5967c}.job (Trojan.FraudPack) -> Quarantined and deleted successfully.

c:\program files\myclearsearch\uninstall.exe (PUP.Zwangi) -> Quarantined and deleted successfully.

========================================================================

.

DDS (Ver_11-03-05.01) - NTFSx86 NETWORK

Run by amason at 14:57:22.65 on Sun 04/10/2011

Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_14

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.593 [GMT -7:00]

.

AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe

C:\Documents and Settings\amason\Desktop\dds.scr

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.xfinity.com/?cid=xfactiv_eg_self_main

mStart Page = hxxp://www.xfinity.com/?cid=xfactiv_eg_self_main

mWindow Title = Windows Internet Explorer provided by Comcast

mWinlogon: Userinit=userinit.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton antivirus\engine\18.5.0.125\ips\IPSBHO.DLL

BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\TomTomHOMERunner.exe"

mRun: [FaxCenterServer] "c:\program files\lexmark fax solutions\fm3032.exe" /s

mRun: [LXCRCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\LXCRtime.dll,_RunDLLEntry@16

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [synTPLpr] c:\program files\synaptics\syntp\SynTPLpr.exe

mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe

mRun: [shicoxp] c:\windows\shicoxp.exe

mRun: [caxchg] c:\windows\caxchg.exe

mRun: [intuit SyncManager] c:\program files\common files\intuit\sync\IntuitSyncManager.exe startup

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe

dPolicies-system: DisableTaskMgr = 1 (0x1)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1247844269106

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1256091345322

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} - hxxp://office.microsoft.com/officeupdate/content/opuc4.cab

DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab

Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\intuit\quickbooks 2010\HelpAsyncPluggableProtocol.dll

Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll

Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: igfxcui - igfxsrvc.dll

Notify: itlnfw32 - itlnfw32.dll

Notify: itlntfy - itlnfw32.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\docume~1\amason\applic~1\mozilla\firefox\profiles\77g6mh3o.default\

FF - prefs.js: network.proxy.ftp - 218.248.240.190

FF - prefs.js: network.proxy.ftp_port - 8080

FF - prefs.js: network.proxy.gopher - 218.248.240.190

FF - prefs.js: network.proxy.gopher_port - 8080

FF - prefs.js: network.proxy.http - 218.248.240.190

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.socks - 218.248.240.190

FF - prefs.js: network.proxy.socks_port - 8080

FF - prefs.js: network.proxy.ssl - 218.248.240.190

FF - prefs.js: network.proxy.ssl_port - 8080

FF - prefs.js: network.proxy.type - 4

FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\ipsffplgn\components\IPSFFPl.dll

FF - plugin: c:\documents and settings\amason\application data\facebook\npfbplugin_1_0_3.dll

FF - plugin: c:\documents and settings\amason\application data\move networks\plugins\npqmp071502000008.dll

FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\IPSFFPlgn

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\amason\application data\Move Networks

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}

.

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true);user_pref(general.useragent.extra.zencast, Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast,

============= SERVICES / DRIVERS ===============

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\nav\1205000.07d\symds.sys [2011-1-6 340016]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nav\1205000.07d\symefa.sys [2011-1-6 652336]

R3 FLASHREADER;USB Reader;c:\windows\system32\drivers\camusb.sys [2009-7-23 25600]

S1 BHDrvx86;BHDrvx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\bashdefs\20110309.001\BHDrvx86.sys [2011-3-10 800376]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\nav\1205000.07d\ironx86.sys [2011-1-6 136312]

S2 itlperf;Intel CPU;c:\windows\system32\svchost.exe -k itlsvc [2003-3-31 14336]

S2 NAV;Norton AntiVirus;c:\program files\norton antivirus\engine\18.5.0.125\ccsvchst.exe [2011-1-6 130000]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2010-12-10 92008]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2010-6-9 102448]

S3 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\ipsdefs\20110407.001\IDSXpx86.sys [2011-4-7 341944]

S3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\virusdefs\20110407.018\NAVENG.SYS [2011-4-7 86136]

S3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\nav_18.1.0.37\definitions\virusdefs\20110407.018\NAVEX15.SYS [2011-4-7 1393144]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra lite 2010.sp1d\RpcAgentSrv.exe [2010-5-9 93336]

S3 vsdatant;vsdatant;\??\c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

.

=============== Created Last 30 ================

.

2011-04-08 05:55:33 4224 ----a-w- c:\windows\system32\beep.sys

2011-04-07 01:21:03 34816 ----a-w- c:\windows\system32\itlnfw32.dll

2011-04-07 01:21:03 215552 ----a-w- c:\windows\system32\itlpfw32.dll

2011-04-07 01:11:09 -------- d--h--w- c:\docume~1\amason\applic~1\Malwarebytes

2011-04-07 01:11:04 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-07 01:11:04 -------- d--h--w- c:\docume~1\alluse~1\applic~1\Malwarebytes

2011-04-07 01:11:01 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-04-07 01:11:01 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-04-06 22:18:57 -------- d--h--w- c:\docume~1\amason\applic~1\2017491D082AE9A7D22EFD10225E4D5D

.

==================== Find3M ====================

.

2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe

2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll

.

============= FINISH: 14:58:00.10 ===============

Attach.zip

thedirtyfix · April 13, 2011

Hi, since no one has responded yet... bump. Thanks!

Elise · April 13, 2011

Hi, and :welcome:

There are still some infections left after the MBAM scan, so lets start with these.

COMBOFIX

---------------

Please download ComboFix from one of these locations:

Bleepingcomputer
ForoSpyware

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
Double click on Combofix.exe and follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, or if you are running Vista, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\Combofix.txt in your next reply.

thedirtyfix · April 21, 2011

Hi Elise, Thanks for the direction. Please find the results pasted below. I downloaded the program successfully but was unable to install the Autorecovery. The first time it didn't work it said it was because the page file might not be large enough, so it couldn't download. Then, it said something the next time I tried, but I can't recall what.

It also said I had Norton Antivirus running. I do have it installed, but I am in safe mode and it wasn't running and no processes indicated that it was active. So, I proceeded and got these results. As I'm typing the harddrive light is going non-stop and a browser just opened to a bogus site, so I'm still infected for sure.

Thanks for your help!!

ComboFix 11-04-20.04 - amason 04/21/2011 15:26:28.1.1 - x86 NETWORK

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.817 [GMT -7:00]

Running from: c:\documents and settings\amason\Desktop\ComboFix.exe

AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

.

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\amason\Application Data\2017491D082AE9A7D22EFD10225E4D5D

c:\documents and settings\amason\Application Data\2017491D082AE9A7D22EFD10225E4D5D\enemies-names.txt

c:\documents and settings\amason\Application Data\2017491D082AE9A7D22EFD10225E4D5D\local.ini

c:\documents and settings\amason\Application Data\Adobe\plugs

c:\documents and settings\amason\Application Data\Adobe\shed

c:\documents and settings\amason\Application Data\Microsoft\Windows Media\12.0

c:\documents and settings\amason\Application Data\Microsoft\Windows Media\12.0\locale.cls

c:\documents and settings\amason\Application Data\Microsoft\Windows Media\12.0\wmpacm .exe

c:\windows\favicon.ico

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_BROWSERSEEK_SERVICE

-------\Legacy_ITLPERF

-------\Service_6to4

-------\Service_BrowserSeek Service

-------\Service_itlperf

.

((((((((((((((((((((((((( Files Created from 2011-03-21 to 2011-04-21 )))))))))))))))))))))))))))))))

.

2011-04-11 01:08 . 2011-04-11 01:08 -------- d--h--w- c:\windows\PIF

2011-04-10 22:02 . 2011-04-10 22:02 -------- d-----w- c:\documents and settings\NetworkService\Application Data\FaxCtr

2011-04-10 22:02 . 2011-04-11 01:10 -------- d-----w- C:\Temp

2011-04-10 22:01 . 2011-04-10 22:01 356352 ----a-w- c:\windows\system32\lmqj.exe

2011-04-08 05:55 . 2003-03-31 12:00 4224 ----a-w- c:\windows\system32\beep.sys

2011-04-08 05:55 . 2011-04-08 05:55 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Adobe

2011-04-08 05:21 . 2011-04-08 05:21 -------- d-s---w- c:\documents and settings\NetworkService\UserData

2011-04-07 01:21 . 2011-04-07 01:21 215552 ----a-w- c:\windows\system32\itlpfw32.dll.vir

2011-04-07 01:11 . 2011-04-07 01:11 -------- d--h--w- c:\documents and settings\amason\Application Data\Malwarebytes

2011-04-07 01:11 . 2011-04-07 01:11 -------- d--h--w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-04-07 01:11 . 2010-12-21 01:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-04-07 01:11 . 2011-04-07 01:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-04-07 01:11 . 2010-12-21 01:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-02-09 13:53 . 2003-03-31 12:00 270848 ----a-w- c:\windows\system32\sbe.dll

2011-02-09 13:53 . 2003-03-31 12:00 186880 ----a-w- c:\windows\system32\encdec.dll

2011-02-02 07:58 . 2009-10-20 06:54 2067456 ----a-w- c:\windows\system32\mstscax.dll

2011-01-27 11:57 . 2009-10-20 06:54 677888 ----a-w- c:\windows\system32\mstsc.exe

.

<pre>
c:\program files\iTunes\iTunesHelper .exe
c:\program files\Lexmark Fax Solutions\fm3032 .exe
c:\program files\Synaptics\SynTP\SynTPEnh .exe
c:\program files\Synaptics\SynTP\SynTPLpr .exe
c:\windows\caxchg .exe
c:\windows\shicoxp .exe
</pre>

.

------- Sigcheck -------

.

[7] 2003-03-31 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\beep.sys

[7] 2003-03-31 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\windows\system32\dllcache\beep.sys

.

c:\windows\System32\drivers\beep.sys ... is missing !!

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2010-12-10 247144]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LXCRCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll" [2006-02-24 65536]

"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2010-10-19 1439496]

"Windows Media Player ACM"="c:\documents and settings\amason\Application Data\Microsoft\Windows Media\12.0\wmpacm .exe" [N/A]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-7-17 113664]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]

2002-10-04 01:50 684032 ------w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]

2009-02-28 00:10 35696 ------w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EzPrint]

2006-02-07 05:10 98304 ------w- c:\program files\Lexmark 2400 Series\ezprint.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GWMDMMSG]

2003-02-10 22:34 90112 ------r- c:\windows\GWMDMMSG.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]

2003-10-02 21:19 118784 ------w- c:\windows\system32\hkcmd.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]

2003-10-02 21:37 155648 ------w- c:\windows\system32\igfxtray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2009-05-27 00:18 413696 ------w- c:\program files\QuickTime\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2009-07-31 23:51 148888 ------w- c:\program files\Java\jre6\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=

"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\support\\bin\\win\\RosettaStoneLtdServices.exe"=

"c:\\Program Files\\Rosetta Stone\\Rosetta Stone V3\\RosettaStoneVersion3.exe"=

"c:\\Documents and Settings\\amason\\My Documents\\Downloads\\winscp419.exe"=

"c:\\Program Files\\Allaire\\HomeSite 4.5\\homesite45.exe"=

"c:\\Program Files\\Intuit\\QuickBooks 2010\\QBDBMgrN.exe"=

"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\RpcAgentSrv.exe"=

"c:\\Program Files\\SiSoftware\\SiSoftware Sandra Lite 2010.SP1d\\WNt500x86\\RpcSandraSrv.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"<NO NAME>"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]

"AllowInboundEchoRequest"= 1 (0x1)

.

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAV\1205000.07D\symds.sys [1/6/2011 8:29 PM 340016]

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1205000.07D\symefa.sys [1/6/2011 8:29 PM 652336]

R3 FLASHREADER;USB Reader;c:\windows\system32\drivers\camusb.sys [7/23/2009 5:54 PM 25600]

S1 BHDrvx86;BHDrvx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\BASHDefs\20110309.001\BHDrvx86.sys [3/10/2011 8:20 PM 800376]

S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAV\1205000.07D\ironx86.sys [1/6/2011 8:29 PM 136312]

S2 NAV;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\18.5.0.125\ccsvchst.exe [1/6/2011 8:28 PM 130000]

S2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [12/10/2010 5:29 AM 92008]

S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [4/10/2011 6:38 PM 102448]

S3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\Definitions\IPSDefs\20110408.001\IDSXpx86.sys [4/10/2011 6:38 PM 341944]

S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2010.SP1d\RpcAgentSrv.exe [5/9/2010 9:32 PM 93336]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

itlsvc REG_MULTI_SZ itlperf

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com

mStart Page = hxxp://www.xfinity.com/?cid=xfactiv_eg_self_main

mWindow Title = Windows Internet Explorer provided by Comcast

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

Handler: intu-help-qb3 - {c5e479ea-0a65-4b05-8c6c-2fc8cc682eb4} - c:\program files\Intuit\QuickBooks 2010\HelpAsyncPluggableProtocol.dll

FF - ProfilePath - c:\documents and settings\amason\Application Data\Mozilla\Firefox\Profiles\77g6mh3o.default\

FF - prefs.js: network.proxy.ftp - 218.248.240.190

FF - prefs.js: network.proxy.ftp_port - 8080

FF - prefs.js: network.proxy.gopher - 218.248.240.190

FF - prefs.js: network.proxy.gopher_port - 8080

FF - prefs.js: network.proxy.http - 218.248.240.190

FF - prefs.js: network.proxy.http_port - 8080

FF - prefs.js: network.proxy.socks - 218.248.240.190

FF - prefs.js: network.proxy.socks_port - 8080

FF - prefs.js: network.proxy.ssl - 218.248.240.190

FF - prefs.js: network.proxy.ssl_port - 8080

FF - prefs.js: network.proxy.type - 4

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension

FF - Ext: Norton IPS: {BBDA0591-3099-440a-AA10-41764D9DB4DB} - c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_18.1.0.37\IPSFFPlgn

FF - Ext: Move Media Player: moveplayer@movenetworks.com - c:\documents and settings\amason\Application Data\Move Networks

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}

FF - user.js: yahoo.homepage.dontask - true);user_pref(general.useragent.extra.zencast, Creative ZENcast v2.01.01);user_pref(general.useragent.extra.zencast,

.

- - - - ORPHANS REMOVED - - - -

.

Notify-itlntfy - itlnfw32.dll

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-04-21 15:36

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

LXCRCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\LXCRtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

Windows Media Player ACM = c:\documents and settings\amason\Application Data\Microsoft\Windows Media\12.0\wmpacm .exe??????????06&?@-&??????(&?h?&??????????(&? ??|?2?|????$???????????????????????????J!@??????????"@??????????????"@??????:@?k#??????YK@???????@?H-&???&???l?0????K@?????"??

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NAV]

"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\18.5.0.125\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files\Norton AntiVirus\Engine\18.5.0.125\diMaster.dll\" /prefetch:1"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(628)

c:\windows\system32\l3codecx.acm

.

- - - - - - - > 'explorer.exe'(1924)

c:\program files\iTunes\iTunesMiniPlayer.dll

c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll

c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll

c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

.

Completion time: 2011-04-21 15:40:57 - machine was rebooted

ComboFix-quarantined-files.txt 2011-04-21 22:40

.

Pre-Run: 8,147,181,568 bytes free

Post-Run: 8,473,133,056 bytes free

.

- - End Of File - - EDE64EF03DA8C6BE415F0D1AD3723679

thedirtyfix · April 22, 2011

Well, I was able to get the Recovery Console installed by adding the pagefile. (I normally don't have one because I have a Solid State drive.)

Also please note that I have dual boot with Ubuntu set up. I installed it a couple of years ago.

Here is the new ComboFix log file:

ComboFix 11-04-20.04 - amason 04/22/2011 0:21.2.1 - x86 NETWORK

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.801 [GMT -7:00]

Running from: c:\documents and settings\amason\Desktop\ComboFix.exe

AV: Norton AntiVirus *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\amason\LOCALS~1\Temp\drweb.exe

c:\docume~1\amason\LOCALS~1\Temp\gdi32.exe

c:\docume~1\amason\LOCALS~1\Temp\install.exe

c:\docume~1\amason\LOCALS~1\Temp\lsass.exe

c:\docume~1\amason\LOCALS~1\Temp\mdm.exe

c:\docume~1\amason\LOCALS~1\Temp\nvsvc32.exe

c:\docume~1\amason\LOCALS~1\Temp\r3m67p.exe

c:\docume~1\amason\LOCALS~1\Temp\services.exe

c:\docume~1\amason\LOCALS~1\Temp\setup.exe

c:\docume~1\amason\LOCALS~1\Temp\svchost.exe

c:\docume~1\amason\LOCALS~1\Temp\sysmgm.exe

c:\docume~1\amason\LOCALS~1\Temp\winamp.exe

c:\docume~1\amason\LOCALS~1\Temp\winlogon.exe

c:\documents and settings\amason\Application Data\Microsoft\conhost.exe

c:\documents and settings\NetworkService\Local Settings\Application Data\lonerty.dll

C:\Recycle.Bin

c:\recycle.bin\config.bin

c:\recycle.bin\Recycle.Bin.exe

c:\windows\avp32.exe

c:\windows\cmd.exe

c:\windows\drweb.exe

c:\windows\iexplarer.exe

c:\windows\linkinfo.dll

c:\windows\login.exe

c:\windows\lsass.exe

c:\windows\mdm.exe

c:\windows\morerv.dll

c:\windows\setup.exe

c:\windows\spoolsv.exe

c:\windows\sysmgm.exe

c:\windows\system32\6to4v32.dll

c:\windows\system32\itlnfw32.dll

c:\windows\system32\itlpfw32.dll

c:\windows\system32\winset.ini

c:\windows\taskmgr.exe

c:\windows\user.exe

c:\windows\win.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_6TO4

-------\Legacy_ITLPERF

-------\Service_6to4

-------\Service_itlperf

.

((((((((((((((((((((((((( Files Created from 2011-03-22 to 2011-04-22 )))))))))))))))))))))))))))))))

.

2011-04-21 22:49 . 2011-04-21 22:49 50000 ----a-w- c:\windows\system32\jj8a8ixl.dll