Jump to content

XP Security 2012 virus


Recommended Posts

I have the XP Security 2012 virus on my p.c. It will not run Malwarebytes' Anti-Malware at all, so I cannot get to the Malwarebytes logs to post them. Below is the DDS text file, attached are the attach.txt and ark.txt logs, and below is the DDS.txt log.

Thank you in advance.

mike

.

DDS (Ver_2011-06-12.02) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22

Run by Administrator at 17:07:43 on 2011-06-13

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1505 [GMT -6:00]

.

AV: Microsoft Security Essentials *Enabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Essentials\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

svchost.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\taskmgr.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/

uInternet Connection Wizard,ShellNext = "c:\program files\outlook express\msimn.exe" //mailurl:mailto:thirstyearfest@aol.com

uInternet Settings,ProxyOverride = *.local

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"

mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE

mRun: [iSUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime

dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t

StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272465062578

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

TCP: Interfaces\{8F5E8CDE-CCD1-4A0A-846E-FAC6A4AB1527} : DhcpNameServer = 192.156.134.151 192.156.134.152 192.156.134.164

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\bdtfskn6.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll

FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

.

============= SERVICES / DRIVERS ===============

.

R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 151216]

R1 MpKsl60c00f1c;MpKsl60c00f1c;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2bfe3bfa-a576-42f2-a86e-0f9c368b5b18}\MpKsl60c00f1c.sys [2011-6-13 28752]

R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-12-10 54760]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-4-28 136176]

S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-4-28 136176]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-4 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-06-13 22:25:51 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2bfe3bfa-a576-42f2-a86e-0f9c368b5b18}\MpKsl60c00f1c.sys

2011-06-12 17:49:48 0 ---ha-w- c:\documents and settings\administrator\local settings\application data\BIT14.tmp

2011-06-12 17:49:47 0 ---ha-w- c:\documents and settings\administrator\local settings\application data\BIT13.tmp

2011-06-12 17:44:47 28752 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2bfe3bfa-a576-42f2-a86e-0f9c368b5b18}\MpKsl295e429e.sys

2011-06-12 17:41:31 -------- d-----w- c:\program files\7-Zip(2)

2011-06-11 21:55:22 339968 --sha-w- c:\documents and settings\administrator\local settings\application data\dix.exe

2011-06-11 19:13:32 6962000 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2bfe3bfa-a576-42f2-a86e-0f9c368b5b18}\mpengine.dll

2011-06-05 19:34:42 781272 ----a-w- c:\program files\mozilla firefox\mozsqlite3.dll

2011-06-05 19:34:42 1874904 ----a-w- c:\program files\mozilla firefox\mozjs.dll

2011-06-05 19:34:41 89048 ----a-w- c:\program files\mozilla firefox\libEGL.dll

2011-06-05 19:34:41 465880 ----a-w- c:\program files\mozilla firefox\libGLESv2.dll

2011-06-05 19:34:41 1892184 ----a-w- c:\program files\mozilla firefox\d3dx9_42.dll

2011-06-05 19:34:41 15832 ----a-w- c:\program files\mozilla firefox\mozalloc.dll

2011-06-05 19:34:40 1974616 ----a-w- c:\program files\mozilla firefox\D3DCompiler_42.dll

2011-06-05 19:34:40 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll

2011-06-01 17:03:25 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Identities

2011-06-01 17:03:21 -------- d-----w- c:\documents and settings\administrator\application data\Windows Desktop Search

2011-05-31 23:07:33 246784 ----a-w- c:\windows\system32\ActiveSkin.ocx

2011-05-31 23:07:24 162304 ----a-w- C:\UNWISE.EXE

2011-05-31 23:07:24 162304 ----a-w- C:\UNWISE(2).EXE

2011-05-27 19:45:37 -------- d-----w- c:\program files\iPod

2011-05-27 19:45:28 -------- d-----w- c:\program files\iTunes

2011-05-27 19:39:29 -------- d-----w- c:\program files\Bonjour

2011-05-27 19:19:17 -------- d-----w- c:\documents and settings\administrator\application data\OpenOffice.org

.

==================== Find3M ====================

.

2011-04-06 22:20:16 91424 ----a-w- c:\windows\system32\dnssd.dll

2011-04-06 22:20:16 107808 ----a-w- c:\windows\system32\dns-sd.exe

.

============= FINISH: 17:08:13.89 ===============

Archive.zip

Link to post
Share on other sites

  • Staff

Hello and welcome to Malwarebytes.

Please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

-screen317

Link to post
Share on other sites

I've got this problem on two different sites. I found that in both cases the users were checking their Hotmail when the warning popped up. It runs even in Safe Mode blocking Malwarebytes from starting. It won't even allow rkill to run. Also one of these clients has the corporate version of Malwarebytes yet it still let that thing through. I'm just scanning the hard drive of one of these computers by connecting it to a different machine. Malwarebytes's finding something. Still waiting for the results. As to Combofix I read that it's rather risky to run it.

yaro

Link to post
Share on other sites

I also have this virus and I am currently running ComboFix.

The PC is split into 3 users and the virus is only showing itself in one of the users. The virus will not allow me to do anything on that users profile except "Purchase the software to remove the TROJAN is has found" (Like I'm that stupid!) but I can do little else so I am currently trying to use Combofix in another user profile.

Once Combofix has done its thing I will post the log file.

Link to post
Share on other sites

Good stuff. I managed to remove mine connecting the hard drive to another computer and then running MB on it. When it finished and wasn't detecting anything new in successive scans I put hard drive into the original. I then started it in safe mode and all looked fine but I had to run MB 3 more times till it finally stopped finding things. Now all looks good.

yaro

Link to post
Share on other sites

  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.