IE wrong adress problems

itsme · October 2, 2011

yes

LDTate · October 2, 2011

Is the infected device a laptop with a wired (cat5) connection?

itsme · October 2, 2011

no, the same as mine, just a different cellphone company...

LDTate · October 2, 2011

Are we working with a pc or something else?

itsme · October 2, 2011

both are laptops

LDTate · October 2, 2011

They both should have a wired connection then.

Any luck installing the driver?

itsme · October 2, 2011

not yet...

LDTate · October 2, 2011

Did you get the driver for it?

If so, copy the driver to his desktop.

itsme · October 2, 2011

downloaded the exe file to my flash but when i double click it on his pc it says specified path does not exist. check the path...

LDTate · October 2, 2011

I think we are dealing with a new nasty RootKit infection.

Download Combofix from any of the links below but rename it to iexplore.exe before saving it to your desktop.

Download the tools needed to a flash drive or other USB device, and transfer them to the infected computer.

Note:

If combofix (iexplore.exe) won't run from the desktop, try running it from the USB device.

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save iexplore.exe to your Desktop

Double click on the iexplore.exe ComboFix.exe & follow the prompts.

Be sure to download any updates.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have SP3, use the SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

itsme · October 2, 2011

where can i look for eset nod32 antivirus program? friend says he thought he disabled and uninstalled it...

LDTate · October 2, 2011

If you can't find it in the system tray, go ahead and run combofix, it shouldn't stop it from running.

itsme · October 2, 2011

in the system tray theres a windows security center which says

virus protection is on

eset is up to date...

no links to the program itself to turn it off though...?

LDTate · October 2, 2011

If this doesn't work, go ahead and run CF

ESET NOD32 ANTIVIRUS V4

•Double click on the system tray icon: on the bottom right hand corner.

•Select Disable real-time file system protection.

•A popup will ask "Are you sure you want to disable...protection?"

•Click "Yes" to disable the Antivirus guard.

itsme · October 2, 2011

sorry, long phone call... "this machine does not have a Microsoft Windows recovery console...requires internet connectin"

LDTate · October 2, 2011

You'll need to bypass that part.

Select no.

itsme · October 2, 2011

the instruction at "0x715b9e59" referenced memory at "same as prev". memory could not be "written". click ok to terminate cancel to debug...

still busy in background

LDTate · October 2, 2011

Are you seeing "stages"?

If the number of stages are being added, just let it do it's thing.

itsme · October 2, 2011

ok.. it's rebooting now

LDTate · October 2, 2011

Post the CF log when it restarts.

It will be a notepad text file.

itsme · October 2, 2011

does it always take this long?

LDTate · October 2, 2011

It really should only take a few minutes to restart.

If there's no HD activity, manually shut it off and back on.

itsme · October 2, 2011

ComboFix 11-10-02.01 - Douw 10/02/2011 18:39:39.3.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.400 [GMT 2:00]

Running from: c:\documents and settings\Douw\Desktop\ComboFix.exe

AV: Eset NOD32 antivirus system 2.51 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

AV: Symantec Endpoint Protection *Disabled/Outdated* {FB06448E-52B8-493A-90F3-E43226D3305C}

.

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Douw\Application Data\Smart Engine

c:\documents and settings\Douw\Recent\ANTIGEN.sys

c:\documents and settings\Douw\Recent\cb.drv

c:\documents and settings\Douw\Recent\CLSV.sys

c:\documents and settings\Douw\Recent\DBOLE.dll

c:\documents and settings\Douw\Recent\DBOLE.drv

c:\documents and settings\Douw\Recent\eb.sys

c:\documents and settings\Douw\Recent\energy.dll

c:\documents and settings\Douw\Recent\energy.drv

c:\documents and settings\Douw\Recent\exec.exe

c:\documents and settings\Douw\Recent\exec.sys

c:\documents and settings\Douw\Recent\fan.dll

c:\documents and settings\Douw\Recent\fan.drv

c:\documents and settings\Douw\Recent\fix.exe

c:\documents and settings\Douw\Recent\fix.sys

c:\documents and settings\Douw\Recent\FS.dll

c:\documents and settings\Douw\Recent\kernel32.dll

c:\documents and settings\Douw\Recent\PE.dll

c:\documents and settings\Douw\Start Menu\Programs\Smart Engine.lnk

c:\documents and settings\Douw\Start Menu\Smart Engine.lnk

c:\documents and settings\Douw\WINDOWS

c:\program files\google\common\google updater\googleupdaterservice.exe

C:\RECYCLER(2)

c:\recycler(2)\S-1-5-21-2739312101-2801067174-1606002916-1005(2)\INFO2

c:\windows\system32\comct332.ocx

.

((((((((((((((((((((((((( Files Created from 2011-09-02 to 2011-10-02 )))))))))))))))))))))))))))))))

.

2011-10-02 14:03 . 2011-10-02 14:03 -------- d-----w- c:\windows\system32\wbem\Repository

2011-10-02 14:03 . 2011-10-02 14:03 -------- d-----w- c:\documents and settings\Douw\Local Settings\Application Data\ApplicationHistory

2011-10-02 14:03 . 2011-10-02 14:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\ApplicationHistory

2011-09-29 06:06 . 2011-09-29 06:06 -------- d-----w- c:\documents and settings\Douw\Application Data\Malwarebytes

2011-09-29 06:06 . 2011-09-29 06:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2011-09-29 06:06 . 2011-08-31 15:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-09-29 06:06 . 2011-09-29 06:06 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-09-28 19:28 . 2011-09-28 19:28 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys

2011-09-28 18:45 . 2011-09-28 18:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft

2011-09-12 12:23 . 2011-09-12 12:23 1409 ----a-w- c:\windows\QTFont.for

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]

"Djuqasaxogapog"="c:\windows\dkbdfg.dll" [bU]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]

"Document Manager"="c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-05-16 102400]

"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2006-06-29 1032192]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]

"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2010-10-27 207424]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-07-31 282624]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-03-16 115560]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 10.0\Reader\Reader_sl.exe" [2011-01-30 35736]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2008-03-26 135168]

"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-08-31 449608]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2005-11-18 1724416]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gemsafe]

2006-11-16 12:20 73728 ----a-w- c:\program files\Gemplus\GemSafe Libraries\BIN\WLEventNotify.dll

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]

@="Service"

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk

backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EMBASSY Trust Suite Secure Update.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\EMBASSY Trust Suite Secure Update.lnk

backup=c:\windows\pss\EMBASSY Trust Suite Secure Update.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^NkbMonitor.exe.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\NkbMonitor.exe.lnk

backup=c:\windows\pss\NkbMonitor.exe.lnkCommon Startup

.

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^STVSPCButton.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\STVSPCButton.lnk

backup=c:\windows\pss\STVSPCButton.lnkCommon Startup

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]

2005-10-27 10:00 299008 ------w- c:\program files\Creative\Shared Files\CamTray.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]

2006-08-28 21:57 395776 ----a-w- c:\progra~1\DELLSU~1\DSAgnt.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]

2005-09-08 05:20 122940 ----a-w- c:\windows\system32\DLA\DLACTRLW.EXE

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]

2005-12-09 20:29 49152 ------w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

2004-07-27 16:50 221184 ----a-w- c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

2004-07-27 16:50 81920 ----a-w- c:\program files\Common Files\InstallShield\UpdateService\issch.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

2008-07-09 13:39 570664 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]

2003-05-08 10:00 49152 ----a-w- c:\program files\ScanSoft\OmniPageSE2.0\opwareSE2.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2007-07-31 08:16 282624 ----a-w- c:\program files\QuickTime\qttask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegTool]

2007-11-08 12:36 172032 ----a-w- c:\program files\Gemplus\GemSafe Libraries\BIN\RegTool.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2006-03-24 16:30 282624 ----a-w- c:\windows\stsystra.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]

2009-10-09 11:11 25623336 ----a-r- c:\program files\Skype\Phone\Skype.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart Engine]

c:\documents and settings\All Users\Application Data\6defd5\SM6de_231.exe [bU]

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]

2008-06-18 15:15 393216 ------w- c:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpriteService]

2006-10-25 14:11 544768 ----a-w- c:\program files\Sprite Software\Sprite Backup\SpriteService.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

2005-11-10 13:03 36975 ----a-w- c:\program files\Java\jre1.5.0_06\bin\jusched.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=

"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager

"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager

"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

"c:\\Program Files\\Sprite Software\\Sprite Backup\\SpriteService.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\VMware\\VMware View\\Client\\bin\\vmware-remotemks.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\Smc.exe"=

"c:\\Program Files\\Symantec\\Symantec Endpoint Protection\\SNAC.EXE"=

"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

.

R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [9/29/2011 8:06 AM 366152]

R2 wsnm;VMware View Client Service;c:\program files\VMware\VMware View\Client\bin\wsnm.exe [11/18/2009 11:18 AM 151552]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [7/28/2011 10:00 AM 105592]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [9/29/2011 8:06 AM 22216]

S1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys --> c:\program files\SUPERAntiSpyware\SASKUTIL.sys [?]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2011 2:19 PM 136176]

S3 GemSealP;GemSealP;c:\windows\system32\drivers\GemSealP.sys [2/14/2007 3:01 PM 71936]

S3 GTKCMOS;GTKCMOS;c:\windows\system32\GTKCMOS.sys [6/15/2004 4:55 PM 7882]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [1/17/2011 2:19 PM 136176]

S3 hwcdcmdm0;HUAWEI Mobile Connect - 3G Modem;c:\windows\system32\drivers\ewusbmdm.sys [9/2/2010 11:51 AM 102400]

S3 hwusbapp;HUAWEI Mobile Connect - 3G PC UI Interface;c:\windows\system32\drivers\ewusbapp.sys [2/14/2007 9:33 AM 65152]

S3 hwusbser;HUAWEI Mobile Connect - 3G Application Interface;c:\windows\system32\drivers\ewusbser.sys [2/14/2007 9:33 AM 65152]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 phaudlwr;Philips Audio Filter;c:\windows\system32\drivers\phaudlwr.sys [1/30/2010 1:02 PM 88704]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [4/20/2009 3:46 PM 86696]

S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [4/20/2009 3:46 PM 15016]

S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [4/20/2009 3:46 PM 114472]

S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [4/20/2009 3:46 PM 108200]

S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [4/20/2009 3:46 PM 26024]

S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [4/20/2009 3:46 PM 104616]

S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [4/20/2009 3:46 PM 109736]

S3 SPC630;Philips SPC630NC PC Camera;c:\windows\system32\drivers\SPC630.sys [1/30/2010 1:02 PM 489472]

S3 SPC630m;Philips SPC630NC PC Cameram;c:\windows\system32\drivers\SPC630m.sys [1/30/2010 1:02 PM 7680]

S3 V0330VID;WebCam Vista;c:\windows\system32\drivers\V0330Vid.sys [12/5/2007 11:41 AM 173632]

S3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [6/30/2011 6:01 PM 250752]

S3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [6/30/2011 6:01 PM 398720]

.

Contents of the 'Scheduled Tasks' folder

.

2011-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-17 12:19]

.

2011-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2011-01-17 12:19]

.

2011-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2739312101-2801067174-1606002916-1005Core.job

- c:\documents and settings\Douw\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-17 12:19]

.

2011-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2739312101-2801067174-1606002916-1005UA.job

- c:\documents and settings\Douw\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-01-17 12:19]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.za/

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

TCP: Interfaces\{8CCCDA7A-9C20-4FEF-B33B-71B13299BEC5}: NameServer = 196.25.255.3,196.25.255.34

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-10-02 19:09

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'explorer.exe'(1628)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\msi.dll

c:\windows\system32\mshtml.dll

c:\windows\IME\SPGRMR.DLL

c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Intel\Wireless\Bin\EvtEng.exe

c:\program files\Intel\Wireless\Bin\S24EvMon.exe

c:\program files\Intel\Wireless\Bin\WLKeeper.exe

c:\program files\Symantec\Symantec Endpoint Protection\Smc.exe

c:\program files\Common Files\Symantec Shared\ccSvcHst.exe

c:\windows\System32\SCardSvr.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

c:\program files\Wave Systems Corp\Common\DataServer.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Dell\QuickSet\NICCONFIGSVC.exe

c:\program files\Intel\Wireless\Bin\RegSrvc.exe

c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\program files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe

c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\igfxsrvc.exe

c:\program files\Apoint\HidFind.exe

c:\program files\Apoint\Apntex.exe

c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe

c:\program files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

c:\progra~1\MI3AA1~1\rapimgr.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\tosOBEX.exe

c:\program files\Toshiba\Bluetooth Toshiba Stack\tosBtProc.exe

.

**************************************************************************

.

Completion time: 2011-10-02 19:14:49 - machine was rebooted

ComboFix-quarantined-files.txt 2011-10-02 17:14

ComboFix2.txt 2011-09-29 08:03

.

Pre-Run: 29,122,502,656 bytes free

Post-Run: 29,098,135,552 bytes free

.

- - End Of File - - 94CF84A5231FF6705C647DA21BE6825F

LDTate · October 2, 2011

IP Information for 196.25.255.3

IP Location: South Africa Pretoria Telkom Sa Ltd.microwave Building27 Teddington Strbellvillewestern Cape

Are you in South Africa?

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\windows\dkbdfg.dll
c:\documents and settings\All Users\Application Data\6defd5\SM6de_231.exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Djuqasaxogapog"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smart Engine]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

itsme · October 2, 2011

Yes I'm in SA. No lions in my area though wish there was...love the wild

IE wrong adress problems

Recommended Posts

Link to post

Share on other sites

Top Posters In This Topic

Popular Days

Top Posters In This Topic

Popular Days

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Link to post

Share on other sites

Recently Browsing 0 members

Important Information