Hey, need help with removing Hijack.Zones and trojan Downloader

ScottyChaos · May 5, 2011

I thought I had gotten rid of them before, but they just came back. Can someone help me with this please? MBAM didn't remove them. Lots of help is appreciated!

screen317 · May 8, 2011

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, download DDS by sUBs and save it to your Desktop.

Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

ScottyChaos · May 8, 2011

Hi and welcome to Malwarebytes.
Please update MBAM, run a Quick Scan, and post its log.
Next, download DDS by sUBs and save it to your Desktop.
Double-click on the DDS icon and let the scan run. When it has run two logs will be produced, please post only DDS.txt directly into your reply.

The scans are almost done, however, now there's something weird going on. There's a white box on my desktop in the lower right hand corner of my screen, like it's part of the background. Changing the background does nothing, and I don't know what to do.

ScottyChaos · May 8, 2011

Here's the MBAM log:

Malwarebytes' Anti-Malware 1.50.1.1100

www.malwarebytes.org

Database version: 6531

Windows 6.1.7600

Internet Explorer 8.0.7600.16385

5/8/2011 6:58:36 AM

mbam-log-2011-05-08 (06-58-36).txt

Scan type: Quick scan

Objects scanned: 171358

Time elapsed: 4 minute(s), 5 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here's the DDS log:

.

DDS (Ver_11-03-05.01) - NTFSx86

Run by Scott at 6:55:44.93 on Sun 05/08/2011

Internet Explorer: 8.0.7600.16385 BrowserJavaVersion: 1.6.0_24

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.1526.484 [GMT -4:00]

.

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\ibmpmsvc.exe

C:\Windows\system32\svchost.exe -k RPCSS

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\WUDFHost.exe

C:\Windows\system32\svchost.exe -k NetworkService

C:\Windows\System32\spoolsv.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\system32\rundll32.exe

C:\Windows\system32\AEADISRV.EXE

C:\Windows\System32\svchost.exe -k Akamai

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\svchost.exe -k bthsvcs

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

C:\Windows\system32\taskhost.exe

C:\Windows\system32\sppsvc.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Lenovo\TrackPoint\tp4serv.exe

C:\Windows\System32\igfxtray.exe

C:\Windows\System32\igfxpers.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Windows\system32\igfxsrvc.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\SuperAntiSpyware - Professional - XxXFreakyXxX\SUPERAntiSpywarePro.exe

C:\Program Files\MagicDisc\MagicDisc.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Windows\system32\SearchIndexer.exe

C:\Program Files\Windows Media Player\wmpnetwk.exe

C:\Windows\System32\svchost.exe -k LocalServicePeerNet

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Mozilla Firefox\plugin-container.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Windows\system32\SearchProtocolHost.exe

C:\Windows\system32\SearchFilterHost.exe

C:\Windows\explorer.exe

C:\Windows\system32\DllHost.exe

C:\Users\Scott\Desktop\dds.scr

C:\Windows\system32\conhost.exe

C:\Windows\system32\wbem\wmiprvse.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = google.com

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

uRun: [sUPERAntiSpyware] c:\program files\superantispyware - professional - xxxfreakyxxx\SUPERAntiSpywarePro.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [TrackPointSrv] c:\program files\lenovo\trackpoint\tp4serv.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 10.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [AdobeAAMUpdater-1.0] "c:\program files\common files\adobe\oobe\pdapp\uwa\UpdaterStartupUtility.exe"

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

StartupFolder: c:\users\scott\appdata\roaming\micros~1\windows\startm~1\programs\startup\imvu.lnk - c:\users\scott\appdata\roaming\imvuclient\IMVUQualityAgent.exe

StartupFolder: c:\users\scott\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe

mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)

mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office12\EXCEL.EXE/3000

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

Notify: igfxcui - igfxdev.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\users\scott\appdata\roaming\mozilla\firefox\profiles\gjx9373r.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Playdom Customized Web Search

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&q=

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll

FF - plugin: c:\windows\system32\wat\npWatWeb.dll

.

============= SERVICES / DRIVERS ===============

.

R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2009-7-13 20992]

R3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]

R3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\drivers\tp4track.sys [2009-11-24 23152]

R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-4-1 38224]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]

S3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\drivers\VSTAZL3.SYS [2009-7-13 207360]

S3 SrvHsfV92;SrvHsfV92;c:\windows\system32\drivers\VSTDPV3.SYS [2009-7-13 980992]

S3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\drivers\VSTCNXT3.SYS [2009-7-13 661504]

S3 StorSvc;Storage Service;c:\windows\system32\svchost.exe -k LocalSystemNetworkRestricted [2009-7-13 20992]

S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2010-8-16 1343400]

.

=============== Created Last 30 ================

.

2011-05-06 15:32:45 -------- d-----w- c:\program files\Pando Networks

2011-05-06 10:19:14 -------- d-sh--w- C:\$RECYCLE.BIN

2011-05-06 10:14:58 -------- d-----w- c:\users\scott\appdata\local\temp

2011-05-06 10:08:10 98816 ----a-w- c:\windows\sed.exe

2011-05-06 10:08:10 89088 ----a-w- c:\windows\MBR.exe

2011-05-06 10:08:10 256512 ----a-w- c:\windows\PEV.exe

2011-05-06 10:08:10 161792 ----a-w- c:\windows\SWREG.exe

2011-05-06 09:48:06 -------- d-----w- c:\users\scott\appdata\roaming\SUPERAntiSpyware.com

2011-05-06 09:48:06 -------- d-----w- c:\progra~2\SUPERAntiSpyware.com

2011-05-06 09:47:50 -------- d-----w- c:\program files\SuperAntiSpyware - Professional - XxXFreakyXxX

2011-05-06 01:42:56 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll

2011-05-06 01:42:56 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll

2011-05-06 01:42:56 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll

2011-05-06 01:42:56 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll

2011-05-06 01:42:56 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll

2011-05-06 01:42:55 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll

2011-05-06 01:42:55 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll

2011-05-06 01:42:55 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2011-05-04 19:45:52 -------- d-----w- c:\program files\iPod

2011-05-04 19:45:51 -------- d-----w- c:\program files\iTunes

2011-05-04 19:44:40 -------- d-----w- c:\program files\Bonjour

2011-04-27 22:19:51 69632 ------w- c:\program files\common files\installshield\updateservice\issch.exe

2011-04-27 22:19:51 380928 ------w- c:\program files\common files\installshield\updateservice\agent.exe

2011-04-27 22:19:51 212992 ------w- c:\program files\common files\installshield\updateservice\ISDM.exe

2011-04-27 22:10:15 -------- d-----w- c:\program files\common files\Akamai

2011-04-25 22:44:45 -------- d-----w- c:\progra~2\Hi-Rez Studios

2011-04-25 22:44:43 -------- d-----w- c:\program files\Hi-Rez Studios

2011-04-21 18:01:14 -------- d-----w- C:\Games

2011-04-20 18:38:45 -------- d-----w- c:\program files\common files\Steam

2011-04-20 18:31:28 17280 ----a-w- c:\windows\system32\roboot.exe

2011-04-14 20:40:13 311296 ----a-w- c:\windows\system32\drivers\srv.sys

2011-04-14 20:40:13 309760 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-04-14 20:40:13 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-04-14 20:39:30 428032 ----a-w- c:\windows\system32\vbscript.dll

2011-04-14 20:37:49 2331136 ----a-w- c:\windows\system32\win32k.sys

2011-04-14 20:37:46 191488 ----a-w- c:\windows\system32\FXSCOVER.exe

2011-04-14 20:37:45 1164288 ----a-w- c:\windows\system32\mfc42u.dll

2011-04-14 20:37:45 1137664 ----a-w- c:\windows\system32\mfc42.dll

2011-04-14 20:37:44 740864 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-14 20:37:43 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-04-14 20:37:43 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-04-14 20:37:43 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-04-14 20:37:43 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-13 20:14:09 -------- d-----w- c:\progra~2\EA Core

2011-04-13 20:14:08 -------- d-----w- c:\progra~2\Electronic Arts

2011-04-13 20:11:18 53248 ----a-w- c:\windows\system32\CSVer.dll

2011-04-13 20:11:05 -------- d-----w- C:\Intel

2011-04-13 19:42:01 -------- d--h--w- c:\windows\msdownld.tmp

2011-04-13 19:41:55 -------- d-----w- c:\windows\system32\directx

2011-04-11 02:35:02 -------- d-----w- c:\users\scott\appdata\local\The Weather Channel

.

==================== Find3M ====================

.

2011-04-06 20:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 20:20:16 75040 ----a-w- c:\windows\system32\jdns_sd.dll

2011-04-06 20:20:16 197920 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 20:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe

2011-04-02 12:03:16 2 --shatr- c:\windows\winstart.bat

2011-03-27 20:56:29 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-03-03 05:29:23 132608 ----a-w- c:\windows\system32\dnsrslvr.dll

2011-03-03 05:27:30 28672 ----a-w- c:\windows\system32\dnscacheugc.exe

2011-02-24 05:32:44 981504 ----a-w- c:\windows\system32\wininet.dll

2011-02-24 05:30:16 44544 ----a-w- c:\windows\system32\licmgr10.dll

2011-02-24 04:23:48 386048 ----a-w- c:\windows\system32\html.iec

2011-02-24 03:50:26 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2011-02-19 05:32:08 34304 ----a-w- c:\windows\system32\atmlib.dll

2011-02-19 03:37:02 294912 ----a-w- c:\windows\system32\atmfd.dll

2011-02-18 20:36:58 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

.

============= FINISH: 6:56:42.18 ===============

ScottyChaos · May 8, 2011

Also, I had recently changed my bg to a beautiful picture of the Himalayas, but then like 10 minutes later, it automatically changes back to a black screen. I looked on the web before, and got this:

Mine does too. It all started when I some kind of nasty win32.trojan and fraudtool virus. I noticed my background would change to black on reboots even after changing it everytime.

(taken from here.)

screen317 · May 11, 2011

Hi,

I believe you are still infected.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

When the tool is finished, it will produce a report for you.
Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

ScottyChaos · May 11, 2011

ComboFix 11-05-11.01 - Scott 05/11/2011 17:19:19.2.2 - x86

Microsoft Windows 7 Professional 6.1.7600.0.1252.1.1033.18.1526.995 [GMT -4:00]

Running from: c:\users\Scott\Downloads\ComboFix.exe

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2011-04-11 to 2011-05-11 )))))))))))))))))))))))))))))))

.

2011-05-06 09:48 . 2011-05-06 09:48 -------- d-----w- c:\users\Scott\AppData\Roaming\SUPERAntiSpyware.com

2011-05-06 09:48 . 2011-05-06 09:48 -------- d-----w- c:\programdata\SUPERAntiSpyware.com

2011-05-06 09:47 . 2011-05-06 09:47 -------- d-----w- c:\program files\SuperAntiSpyware - Professional - XxXFreakyXxX

2011-05-06 01:42 . 2011-05-06 01:42 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll

2011-05-06 01:42 . 2011-05-06 01:42 781272 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll

2011-05-06 01:42 . 2011-05-06 01:42 465880 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll

2011-05-06 01:42 . 2011-05-06 01:42 1874904 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll

2011-05-06 01:42 . 2011-05-06 01:42 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll

2011-05-06 01:42 . 2011-05-06 01:42 1892184 ----a-w- c:\program files\Mozilla Firefox\d3dx9_42.dll

2011-05-06 01:42 . 2011-05-06 01:42 1974616 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_42.dll

2011-05-06 01:42 . 2011-05-06 01:42 142296 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll

2011-05-05 00:36 . 2011-05-05 00:36 -------- d-----w- c:\users\win7-test\AppData\Roaming\Unity

2011-05-05 00:31 . 2011-05-05 00:31 -------- d-----w- c:\users\win7-test\AppData\Local\Unity

2011-05-04 19:45 . 2011-05-04 19:45 -------- d-----w- c:\program files\iPod

2011-05-04 19:45 . 2011-05-04 19:46 -------- d-----w- c:\program files\iTunes

2011-05-04 19:44 . 2011-05-04 19:44 -------- d-----w- c:\program files\Bonjour

2011-04-27 22:19 . 2011-05-05 21:38 -------- d--h--w- c:\program files\InstallShield Installation Information

2011-04-27 22:10 . 2011-05-11 10:39 -------- d-----w- c:\program files\Common Files\Akamai

2011-04-25 22:45 . 2011-04-25 22:45 -------- d-----w- c:\users\win7-test\AppData\Roaming\Hi-Rez Studios

2011-04-25 22:44 . 2011-04-27 23:37 -------- d-----w- c:\programdata\Hi-Rez Studios

2011-04-25 22:44 . 2011-04-27 23:37 -------- d-----w- c:\program files\Hi-Rez Studios

2011-04-25 20:43 . 2011-04-26 01:14 -------- d-----w- c:\users\win7-test\Tracing

2011-04-21 20:38 . 2011-04-27 23:31 -------- d-----w- c:\program files\Common Files\InstallShield

2011-04-21 19:17 . 2011-04-21 19:17 -------- d-----w- c:\users\win7-test\AppData\Local\Diagnostics

2011-04-21 18:01 . 2011-04-21 19:17 -------- d-----w- C:\Games

2011-04-20 18:38 . 2011-04-20 18:39 -------- d-----w- c:\program files\Common Files\Steam

2011-04-20 18:31 . 2011-04-20 18:31 -------- d-----w- c:\users\win7-test\AppData\Roaming\Systweak

2011-04-20 18:31 . 2011-04-09 17:17 17280 ----a-w- c:\windows\system32\roboot.exe

2011-04-20 18:06 . 2011-04-20 18:06 -------- d-----w- c:\users\win7-test\AppData\Local\FalloutNV

2011-04-20 12:06 . 2011-04-20 12:06 -------- d-----w- c:\users\Public\Games

2011-04-16 19:32 . 2011-04-16 19:32 -------- d-----w- c:\users\win7-test\AppData\Roaming\Malwarebytes

2011-04-16 18:05 . 2011-05-03 10:53 -------- d-----w- c:\users\win7-test\AppData\Local\Adobe

2011-04-14 20:40 . 2011-02-23 05:06 311296 ----a-w- c:\windows\system32\drivers\srv.sys

2011-04-14 20:40 . 2011-02-23 05:05 309760 ----a-w- c:\windows\system32\drivers\srv2.sys

2011-04-14 20:40 . 2011-02-23 05:05 113664 ----a-w- c:\windows\system32\drivers\srvnet.sys

2011-04-14 20:39 . 2011-02-18 05:36 428032 ----a-w- c:\windows\system32\vbscript.dll

2011-04-14 20:37 . 2011-03-03 03:31 2331136 ----a-w- c:\windows\system32\win32k.sys

2011-04-14 20:37 . 2011-02-12 05:30 191488 ----a-w- c:\windows\system32\FXSCOVER.exe

2011-04-14 20:37 . 2011-03-11 05:40 1164288 ----a-w- c:\windows\system32\mfc42u.dll

2011-04-14 20:37 . 2011-03-11 05:40 1137664 ----a-w- c:\windows\system32\mfc42.dll

2011-04-14 20:37 . 2011-03-08 05:38 740864 ----a-w- c:\windows\system32\inetcomm.dll

2011-04-14 20:37 . 2011-02-23 05:05 221696 ----a-w- c:\windows\system32\drivers\mrxsmb10.sys

2011-04-14 20:37 . 2011-02-23 05:05 95744 ----a-w- c:\windows\system32\drivers\mrxsmb20.sys

2011-04-14 20:37 . 2011-02-23 05:05 123392 ----a-w- c:\windows\system32\drivers\mrxsmb.sys

2011-04-14 20:37 . 2011-02-23 05:05 69632 ----a-w- c:\windows\system32\drivers\bowser.sys

2011-04-13 20:14 . 2011-04-13 20:14 -------- d-----w- c:\programdata\EA Core

2011-04-13 20:14 . 2011-04-13 20:14 -------- d-----w- c:\programdata\Electronic Arts

2011-04-13 20:11 . 2011-04-13 20:11 -------- d-----w- c:\program files\Intel

2011-04-13 20:11 . 2011-02-28 12:09 53248 ----a-w- c:\windows\system32\CSVer.dll

2011-04-13 20:11 . 2011-04-13 20:11 -------- d-----w- C:\Intel

2011-04-13 19:42 . 2011-04-21 19:11 -------- d--h--w- c:\windows\msdownld.tmp

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-04-06 20:20 . 2011-04-06 20:20 91424 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 20:20 . 2011-04-06 20:20 75040 ----a-w- c:\windows\system32\jdns_sd.dll

2011-04-06 20:20 . 2011-04-06 20:20 197920 ----a-w- c:\windows\system32\dnssdX.dll

2011-04-06 20:20 . 2011-04-06 20:20 107808 ----a-w- c:\windows\system32\dns-sd.exe

2011-04-02 12:03 . 2011-04-02 12:03 2 --shatr- c:\windows\winstart.bat

2011-03-27 20:56 . 2011-03-27 20:56 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-03-23 14:11 . 2011-03-28 10:32 6792528 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{356AD35F-F933-4B5D-8187-8E7B452F846F}\mpengine.dll

2011-02-18 20:36 . 2011-02-18 20:36 41984 ----a-w- c:\windows\system32\drivers\usbaapl.sys

2011-02-18 20:36 . 2011-02-18 20:36 4184352 ----a-w- c:\windows\system32\usbaaplrc.dll

2011-05-06 01:42 . 2011-05-06 01:42 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SUPERAntiSpyware"="c:\program files\SuperAntiSpyware - Professional - XxXFreakyXxX\SUPERAntiSpywarePro.exe" [2010-10-25 2408688]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-05-18 1314816]

"TrackPointSrv"="c:\program files\Lenovo\TrackPoint\tp4serv.exe" [2009-11-24 93032]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-08-06 141848]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-08-06 173592]

"Persistence"="c:\windows\system32\igfxpers.exe" [2009-08-06 150552]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-11-10 932288]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]

"Malwarebytes' Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2010-12-20 963976]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-04-20 58656]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-04-27 421160]

.

c:\users\Scott\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

IMVU.lnk - c:\users\Scott\AppData\Roaming\IMVUClient\IMVUQualityAgent.exe [N/A]

MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2011-4-1 576000]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R3 GGSAFERDriver;GGSAFER Driver;c:\program files\Garena\safedrv.sys [x]

R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL3.SYS [2009-07-13 207360]

R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV3.SYS [2009-07-13 980992]

R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT3.SYS [2009-07-13 661504]

R3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\Wat\WatAdminSvc.exe [2010-08-16 1343400]

R3 XDva385;XDva385;c:\windows\system32\XDva385.sys [x]

S2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe [2009-07-14 20992]

S3 netw5v32;Intel® Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\netw5v32.sys [2009-07-13 4231168]

S3 Tp4Track;PS/2 TrackPoint Driver;c:\windows\system32\DRIVERS\tp4track.sys [2009-11-24 23152]

S4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2010-12-20 38224]

.

--- Other Services/Drivers In Memory ---

.

*NewlyCreated* - MBAMSWISSARMY

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Akamai REG_MULTI_SZ Akamai

.

------- Supplementary Scan -------

.

uStart Page = google.com

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\users\Scott\AppData\Roaming\Mozilla\Firefox\Profiles\gjx9373r.default\

FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&SearchSource=3&q={searchTerms}

FF - prefs.js: browser.search.selectedEngine - Playdom Customized Web Search

FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2464976&q=

.

- - - - ORPHANS REMOVED - - - -

.

AddRemove-bc8a6440-918f-11dd-ad8b-0800200c9a66_is1 - c:\program files\Turbine\DDO Unlimited\unins000.exe

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

Completion time: 2011-05-11 17:26:41

ComboFix-quarantined-files.txt 2011-05-11 21:26

ComboFix2.txt 2011-05-06 10:19

.

Pre-Run: 66,857,644,032 bytes free

Post-Run: 68,035,493,888 bytes free

.

- - End Of File - - E3190C6F91208C7D00F305E0B974EC24

screen317 · May 12, 2011

Hi,

Next, please run a free online scan with the ESET Online Scanner

Note: You will need to use Internet Explorer for this scan.

Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic

Next, download my Security Check from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Let me know how things are running now and what issues remain.

-screen317

ScottyChaos · May 13, 2011

Hi,
Next, please run a free online scan with the ESET Online Scanner
Note: You will need to use Internet Explorer for this scan.
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the ActiveX control to install
Click Start
Make sure that the options Remove found threats and the option Scan unwanted applications is checked
Click Scan
Wait for the scan to finish
Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste that log as a reply to this topic
Next, download my Security Check from here or here.
Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.
Let me know how things are running now and what issues remain.
-screen317

Eset:

C:\Users\win7-test\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\61\23dbfa3d-6f2cc32f multiple threats deleted - quarantined

C:\_OTL\MovedFiles\04022011_121549\C_Windows\System32\scrnsave9.dll a variant of Win32/Kryptik.NDI trojan cleaned by deleting - quarantined

SecurityCheck:

Results of screen317's Security Check version 0.99.10

Windows 7 (UAC is enabled)

Internet Explorer 8

``````````````````````````````

Antivirus/Firewall Check:

Windows Firewall Enabled!

ESET Online Scanner v3

WMI entry may not exist for antivirus; attempting automatic update.

```````````````````````````````

Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware

Java 6 Update 24

Adobe Flash Player 10.2.159.1

Adobe Reader X (10.0.1)

Mozilla Firefox (x86 en-US..)

````````````````````````````````

Process Check:

objlist.exe by Laurent

``````````End of Log````````````

screen317 · May 16, 2011

Hi,

Navigate to Start --> Run, and type Combofix /uninstall in the box that appears. Click OK afterward. Notice the space between the X and the /uninstall

This uninstalls all of ComboFix's components.

Delete SecurityCheck.

After that, navigate to Start --> Control Panel --> Add or Remove Programs, and uninstall the following program (if present):

Java

Hey, need help with removing Hijack.Zones and trojan Downloader

Recommended Posts

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information