Virus problem, ping blocking, and svchost.exe problem.

jotaro123 · June 8, 2011

Malware bytes keep saying it blocks incoming AND outgoing ip addresses.

heres a little list of em.

07:25:39 Jackson IP-BLOCK 95.143.193.1

LDTate · June 10, 2011

Logs will be closed if you haven't replied within 3 days

Due to recent changes in AVG and how it interacts with CF, AVG must be uninstalled to run ComboFix.

AVG > AVG Removal Tool (x86) - AVG Removal Tool (x64)

AVG Identity Protection > AVGIDPUninstaller

Please do not attach the scan results from Combofx. Use copy/paste.

DO NOT use any TOOLS such as Combofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

XP Users

Double-click My Computer.

Click the Tools menu, and then click Folder Options.

Click the View tab.

Uncheck "Hide file extensions for known file types."

Under the "Hidden files" folder, select "Show hidden files and folders."

Uncheck "Hide protected operating system files."

Click Apply, and then click OK.

Vista Users

To enable the viewing of hidden and protected system files in Windows Vista please follow these steps:

Close all programs so that you are at your desktop.

Click on the Start button. This is the small round button with the Windows flag in the lower left corner.

Click on the Control Panel menu option.

When the control panel opens you can either be in Classic View or Control Panel Home view:

If you are in the Classic View do the following:

Double-click on the Folder Options icon.

Click on the View tab.

If you are in the Control Panel Home view do the following:

Click on the Appearance and Personalization link.

Click on Show Hidden Files or Folders.

Under the Hidden files and folders section select the radio button labeled Show hidden files and folders.

Remove the checkmark from the checkbox labeled Hide extensions for known file types.

Remove the checkmark from the checkbox labeled Hide protected operating system files.

Please do not delete anything unless instructed to.

Next:

Please download ATF Cleaner by Atribune.

Download - ATF Cleaner

jotaro123 · June 12, 2011

Hi, ok i tried to remove Avg first, but it doesnt seem to work.(the program u gave me to remove avg.)

Anything other way i can remove avg?

LDTate · June 12, 2011

If AVG will not uninstall, it is first recommended to uninstall it with AppRemover by Opswat. The AVG uninstaller can be downloaded from here > http://www.appremove.../AppRemover.exe Go to their homepage and you will see they have support for removal of other AV's as well http://www.appremover.com/

jotaro123 · June 12, 2011

Ok, I got combofix running and finished.

Noticed computer problems as of at this moment:

-Svchost.exe SYSTEM is taking CPU Still, and slowing internet speed down. (when i end this process, the windows seem to go to the classic mode, where everything is grey/white, and square. (not curved)

Combofix Log:

ComboFix 11-06-11.01 - Jackson 06/12/2011 13:15:53.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2715 [GMT -7:00]

Running from: c:\documents and settings\Jackson\My Documents\Downloads\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Tarma Installer

c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

c:\documents and settings\Jackson\Application Data\62C11AAD5B4C449A467CFCA574FCEBFC

c:\documents and settings\Jackson\Application Data\62C11AAD5B4C449A467CFCA574FCEBFC\enemies-names.txt

c:\documents and settings\Jackson\Templates\734ic5kl480kc2nvg31

c:\documents and settings\Jackson\Templates\k53phh05m63xl61w50p78u3805prg

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ITLPERF

-------\Service_itlperf

.

((((((((((((((((((((((((( Files Created from 2011-05-12 to 2011-06-12 )))))))))))))))))))))))))))))))

.

2011-06-10 14:56 . 2011-06-10 14:56 -------- d-----w- c:\documents and settings\All Users\Application Data\RoboForm

2011-06-10 14:55 . 2011-06-10 14:55 -------- d-----w- c:\program files\Siber Systems

2011-06-10 14:52 . 2011-06-10 14:52 -------- d-----w- c:\documents and settings\All Users\Application Data\hssff

2011-06-10 14:40 . 2011-06-10 14:40 -------- d-----w- c:\documents and settings\All Users\Application Data\SwagHack_Galaxy_Edition_3

2011-06-10 04:52 . 2011-06-10 04:52 -------- d--h--w- c:\windows\PIF

2011-06-08 07:30 . 2011-06-08 07:30 -------- d-----w- c:\program files\Microsoft.NET

2011-06-08 06:56 . 2011-06-10 04:03 -------- d-----w- C:\Hotspot Shield

2011-06-08 06:56 . 2011-06-10 04:03 -------- d-----w- c:\program files\Hotspot Shield

2011-06-08 03:44 . 2011-06-08 03:44 388096 ----a-r- c:\documents and settings\Jackson\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-06-08 03:44 . 2011-06-08 03:44 -------- d-----w- c:\program files\Trend Micro

2011-06-07 14:22 . 2011-06-07 14:22 -------- d-----w- c:\documents and settings\Jackson\Application Data\Malwarebytes

2011-06-07 14:22 . 2011-06-07 14:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-06-07 14:22 . 2011-05-29 16:11 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-06-07 14:22 . 2011-06-07 14:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-06-07 14:22 . 2011-05-29 16:11 22712 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-06-07 05:45 . 2011-06-07 05:45 -------- d-----w- c:\windows\system32\wbem\Repository

2011-06-07 05:43 . 2011-06-07 05:43 -------- d-----w- c:\program files\OpenAL

2011-06-07 05:02 . 2011-06-07 05:02 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2011-06-04 22:22 . 2011-06-07 05:44 -------- d-----w- c:\program files\AutoHotkey

2011-06-04 22:22 . 2011-06-04 22:22 -------- d-----w- c:\windows\ShellNew

2011-06-04 01:09 . 2011-06-04 01:09 -------- d-----w- c:\program files\Common Files\xing shared

2011-06-04 01:08 . 2011-06-04 01:09 -------- d-----w- c:\program files\Real

2011-06-04 00:58 . 2011-06-04 00:59 -------- d-----w- c:\documents and settings\Jackson\dwhelper

2011-06-03 22:20 . 2011-06-03 22:20 -------- d-----w- C:\AeriaGames

2011-06-03 06:22 . 2011-06-07 22:58 -------- d-----w- c:\program files\Common Files\Akamai

2011-06-01 22:23 . 2011-06-01 22:23 444952 ----a-w- c:\windows\system32\wrap_oal.dll

2011-06-01 22:23 . 2011-06-01 22:23 109080 ----a-w- c:\windows\system32\OpenAL32.dll

2011-06-01 14:29 . 2011-06-07 05:44 -------- d-----w- C:\Gamigo

2011-05-29 22:03 . 2011-05-30 19:57 -------- d-----w- c:\program files\Bounty Bay Online

2011-05-29 02:13 . 2011-05-29 02:13 -------- d-----w- c:\documents and settings\Jackson\Local Settings\Application Data\Wicked_Interactive_LTD

2011-05-29 02:02 . 2011-06-04 06:27 -------- d-----w- c:\program files\SubaGames

2011-05-28 22:06 . 2011-05-28 22:07 -------- d-----w- c:\documents and settings\Jackson\Application Data\VMK Pal

2011-05-24 03:21 . 2011-05-24 03:21 -------- d-----w- c:\windows\Sun

2011-05-24 02:36 . 2011-05-24 02:36 -------- d-----w- c:\program files\Flip Video

2011-05-24 02:36 . 2011-05-24 02:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Flip Video

2011-05-24 02:34 . 2011-05-24 02:34 -------- d-----w- c:\documents and settings\Jackson\Local Settings\Application Data\WMTools Downloaded Files

2011-05-21 16:25 . 2011-05-26 23:39 404640 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-05-21 00:33 . 2011-05-21 00:33 -------- d-----w- c:\documents and settings\Jackson\Local Settings\Application Data\Mozilla

2011-05-20 06:18 . 2011-05-20 06:42 -------- d-----w- c:\documents and settings\Jackson\Local Settings\Application Data\Panda3D

2011-05-18 23:42 . 2011-05-18 23:42 -------- d-----w- c:\program files\Common Files\SourceTec

2011-05-18 23:42 . 2011-05-18 23:42 -------- d-----w- c:\program files\SourceTec

2011-05-15 21:29 . 2011-05-15 21:29 -------- d-----w- c:\documents and settings\Jackson\Application Data\Need for Speed World

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-06-04 01:08 . 2011-04-30 22:45 348160 ----a-w- c:\windows\system32\msvcr71.dll

2011-06-04 01:08 . 2011-04-30 22:45 499712 ----a-w- c:\windows\system32\msvcp71.dll

2011-05-04 06:17 . 2011-05-04 06:18 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-05-04 06:17 . 2011-05-04 06:18 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-04-30 22:38 . 2011-04-30 22:38 315392 ----a-w- c:\windows\HideWin.exe

2011-04-14 16:26 . 2011-05-21 00:31 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-17 3872080]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2011-01-08 111208]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2011-01-08 13880424]

"NVHotkey"="nvHotkey.dll" [2011-01-08 178792]

"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-11-04 1753192]

"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-11-26 2289664]

"RTHDCPL"="RTHDCPL.EXE" [2007-11-06 16855552]

"DELL Webcam Manager"="c:\program files\Dell\Dell Webcam Manager\DellWMgr.exe" [2007-07-27 118784]

"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-12-14 159744]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

"TkBellExe"="c:\program files\Real\RealPlayer\update\realsched.exe" [2011-06-04 273544]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG10\avgchsvx.exe /sync\0c:\progra~1\AVG\AVG10\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

@="Driver"

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

"c:\\Program Files\\Outspark\\Project Powder\\Run.exe"=

"c:\\Program Files\\REACTOR\\REACTOR.exe"=

"c:\\Program Files\\REACTOR\\ijjiOptimizer.exe"=

"c:\\ijji\\ENGLISH\\Gunz\\Gunz.exe"=

"c:\\Gamigo\\Elements of War Online\\EoW.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"56371:TCP"= 56371:TCP:Pando Media Booster

"56371:UDP"= 56371:UDP:Pando Media Booster

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

"1033:TCP"= 1033:TCP:Akamai NetSession Interface

"5000:UDP"= 5000:UDP:Akamai NetSession Interface

"11991:TCP"= 11991:TCP:spport

.

R2 hshld;Hotspot Shield Service;c:\program files\Hotspot Shield\bin\openvpnas.exe [6/2/2011 4:18 PM 298824]

R2 HssWd;Hotspot Shield Monitoring Service;c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS --> c:\program files\Hotspot Shield\bin\hsswd.exe -product HSS [?]

S0 cerc6;cerc6; [x]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [6/7/2011 7:22 AM 22712]

S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]

S3 XDva375;XDva375;\??\c:\windows\system32\XDva375.sys --> c:\windows\system32\XDva375.sys [?]

S3 XDva385;XDva385;\??\c:\windows\system32\XDva385.sys --> c:\windows\system32\XDva385.sys [?]

S4 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [6/7/2011 7:22 AM 366640]

.

Contents of the 'Scheduled Tasks' folder

.

2011-06-12 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-1409082233-630328440-1801674531-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 17:47]

.

2011-06-12 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-1409082233-630328440-1801674531-1003.job

- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-03-29 17:47]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/

IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

IE: Sothink SWF Catcher - c:\program files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm

TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11

FF - ProfilePath - c:\documents and settings\Jackson\Application Data\Mozilla\Firefox\Profiles\wkbmupta.default\

FF - prefs.js: browser.search.selectedEngine - Bing

FF - prefs.js: browser.startup.homepage - about:home

FF - prefs.js: keyword.URL - hxxp://www.startnow.com/s/?src=addrbar&provider=Bing&provider_code=Z065&partner_id=287&product_id=463&affiliate_id=&channel=9007&toolbar_id=200&toolbar_version=2.0&install_country=US&install_date=20110604&user_guid=863D2E0C45764343A16FCD5A5AB41DF5&machine_id=251e485a5ee5eb2be0f18c709b75a6dd&browser=FF&os=win&os_version=5.1-x86-SP3&q=

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 57717

FF - prefs.js: network.proxy.type - 0

.

- - - - ORPHANS REMOVED - - - -

.

ShellIconOverlayIdentifiers-{96AFBE69-C3B0-4b00-8578-D933D2896EE2} - (no file)

Notify-itlntfy - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-06-12 13:28

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]

"ImagePath"="c:\windows\system32\GameMon.des -service"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(1672)

c:\windows\system32\WININET.dll

c:\windows\System32\BCMLogon.dll

c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_e87e0bcd\MFC80.DLL

c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.5592_x-ww_179798c8\MSVCR80.dll

.

- - - - - - - > 'lsass.exe'(1732)

c:\windows\system32\WININET.dll

.

- - - - - - - > 'explorer.exe'(3696)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\windows\System32\WLTRYSVC.EXE

c:\windows\System32\bcmwltry.exe

c:\program files\Flip Video\FlipShare\FlipShareService.exe

c:\program files\Hotspot Shield\HssWPR\hsssrv.exe

c:\program files\Hotspot Shield\bin\hsswd.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\RUNDLL32.EXE

c:\windows\system32\rundll32.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\wscntfy.exe

c:\program files\DellTPad\ApMsgFwd.exe

c:\program files\DellTPad\HidFind.exe

c:\program files\DellTPad\Apntex.exe

.

**************************************************************************

.

Completion time: 2011-06-12 13:34:29 - machine was rebooted

ComboFix-quarantined-files.txt 2011-06-12 20:34

.

Pre-Run: 191,389,274,112 bytes free

Post-Run: 191,484,121,088 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

.

- - End Of File - - 52D952A43CA80B8CA8DB074C5C22EC55

jotaro123 · June 12, 2011

Oh and another problem still occuring:

-------------------------------------

- Internet Redirection.

LDTate · June 12, 2011

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

FireFox::
FF - ProfilePath - c:\documents and settings\Jackson\Application Data\Mozilla\Firefox\Profiles\wkbmupta.default\
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 57717
FF - prefs.js: network.proxy.type - 0

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

jotaro123 · June 12, 2011

ComboFix 11-06-11.01 - Jackson 06/12/2011 14:53:12.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2711 [GMT -7:00]

Running from: c:\documents and settings\Jackson\My Documents\Downloads\ComboFix.exe

Command switches used :: c:\documents and settings\Jackson\Desktop\CFScript.txt