Jump to content

Cloud Protection malware


Recommended Posts

I think I got rid of most everything but computer still can not access the internet. For some reason the wireless card was disabled. I re-enabled it but it still can not acquire an address from the router. All my other devices have no problem connecting to the router and getting access to the internet. See logs. Thanks in advance for your help.

.

DDS (Ver_2011-08-26.01) - NTFSx86 NETWORK

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23

Run by Cissy at 20:40:17 on 2011-10-17

Microsoft Windows XP Professional 5.1.2600.3.950.852.1033.18.2039.1626 [GMT -4:00]

.

AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}

.

============== Running Processes ===============

.

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\conime.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.startnow.com/?src=startpage&provider=Bing&provider_code=Z059&partner_id=308&product_id=435&affiliate_id=&channel=rjacs&toolbar_id=200&toolbar_version=2.0&install_country=US&install_date=20110705&user_guid=AC71D1676720426E95CC9BAF0DE93FFD&machine_id=c57737da232d1ef51e57cf2c40f0c938&browser=IE&os=win&os_version=5.1-x86-SP3

uInternet Settings,ProxyOverride = intranet;*.local

uInternet Settings,ProxyServer = http=localhost:8080

mWinlogon: SfcDisable=-99 (0xffffff9d)

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: StartNow Toolbar Helper: {6e13d095-45c3-4271-9475-f3b48227dd9f} - c:\program files\startnow toolbar\Toolbar32.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: StartNow Toolbar: {5911488e-9d1e-40ec-8cbb-06b231cc153f} - c:\program files\startnow toolbar\Toolbar32.dll

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background

uRun: [Google Update] "c:\documents and settings\cissy\local settings\application data\google\update\GoogleUpdate.exe" /c

uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background

mRun: [ETDWare] c:\program files\elantech\ETDCtrl.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [<NO NAME>]

mRun: [AsusTray] c:\program files\eeepc\acpi\AsTray.exe

mRun: [AsusACPIServer] c:\program files\eeepc\acpi\AsAcpiSvr.exe

mRun: [AsusEPCMonitor] c:\program files\eeepc\acpi\AsEPCMon.exe

mRun: [lxdxmon.exe] "c:\program files\lexmark 3600-4600 series\lxdxmon.exe"

mRun: [lxdxamon] "c:\program files\lexmark 3600-4600 series\lxdxamon.exe"

mRun: [iMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

mRun: [MSPY2002] c:\windows\system32\ime\pintlgnt\ImScInst.exe /SYNC

mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC

mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [CMS] "c:\program files\cms\exe\Open.exe"

mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [ApnUpdater] "c:\program files\ask.com\updater\Updater.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [TRRRZ9hhYXjelBt8234A] c:\windows\system32\qooFF3pmG.exe

mRun: [i77fLLgZZjYwkVO] c:\documents and settings\cissy\application data\svhostu.exe

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

dRunOnce: [iE8] rundll32 advpack.dll,LaunchINFSection IE8.INF,FirstUserStart

dRunOnce: [showDeskFix] regsvr32 /s /n /i:u shell32

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000

IE: Foxy ?? - c:\documents and settings\cissy\my documents\downloads\foxy 1.9.9 ????????\Foxy.exe/download.htm

IE: Foxy ?U¡Mu - c:\docume~1\cissy\locals~1\temp\7zo3.tmp\Foxy.exe/download.htm

IE: Foxy ¡Pj¡¦M - c:\docume~1\cissy\locals~1\temp\7zo3.tmp\Foxy.exe/search.htm

IE: Foxy ¤U¸ü - c:\documents and settings\cissy\my documents\downloads\foxy 1.9.9 ÁcÅ餤¤å§k¦w¸Ëª©\Foxy.exe/download.htm

IE: Foxy ·j´M - c:\documents and settings\cissy\my documents\downloads\foxy 1.9.9 ÁcÅ餤¤å§k¦w¸Ëª©\Foxy.exe/search.htm

IE: Send to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm

IE: Send To Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab

TCP: DhcpNameServer = 192.168.1.1

TCP: Interfaces\{917E10B1-DC0A-4F07-BFA0-73388420AC71} : DhcpNameServer = 192.168.1.1

Notify: igfxcui - igfxdev.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\cissy\application data\mozilla\firefox\profiles\xoppebi0.default\

FF - prefs.js: browser.startup.homepage - hxxp://gmail.com/

FF - prefs.js: keyword.URL - hxxp://www.startnow.com/s/?src=addrbar&provider=Bing&provider_code=Z059&partner_id=308&product_id=435&affiliate_id=&channel=rjacs&toolbar_id=200&toolbar_version=2.0&install_country=US&install_date=20110705&user_guid=AC71D1676720426E95CC9BAF0DE93FFD&machine_id=c57737da232d1ef51e57cf2c40f0c938&browser=FF&os=win&os_version=5.1-x86-SP3&q=

FF - prefs.js: network.proxy.type - 0

FF - plugin: c:\documents and settings\cissy\local settings\application data\google\update\1.3.21.69\npGoogleUpdate3.dll

FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll

FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll

.

============= SERVICES / DRIVERS ===============

.

R0 iastor78;iastor78;c:\windows\system32\drivers\iastor78.sys [2009-12-27 308248]

S1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165648]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 foxy;Foxy: Filtering HTTP Proxy;"c:\program files\foxy-1.3.0\foxy.exe" "--config=c:\program files\foxy-1.3.0\foxy.cfg" --> c:\program files\foxy-1.3.0\foxy.exe [?]

S2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]

S2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdxserv.exe [2011-6-30 94208]

S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-10-17 366152]

S2 Toolbar Updater Service;Toolbar Updater Service;c:\program files\startnow toolbar\ToolbarUpdaterService.exe [2011-3-24 199904]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-6-30 1684736]

S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-10-17 22216]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2008-4-14 14336]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

.

=============== Created Last 30 ================

.

2011-10-18 00:30:49 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2011-10-18 00:25:23 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5773f68b-5bb1-411a-93d0-9c9c7e47ecab}\offreg.dll

2011-10-17 23:33:54 -------- d-----w- c:\documents and settings\cissy\application data\Malwarebytes

2011-10-17 23:33:41 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes

2011-10-17 23:33:37 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-10-17 23:33:36 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-10-17 23:14:18 -------- d-----w- c:\documents and settings\cissy\application data\RnG4aQH6dKfLhX

2011-10-17 23:14:18 -------- d-----w- c:\documents and settings\cissy\application data\JucS1ibD3

2011-10-17 11:33:41 -------- d-----w- c:\windows\pss

2011-10-17 11:32:01 -------- d-----w- c:\documents and settings\cissy\application data\rwkIVzONtAuSiFp

2011-10-17 11:32:00 -------- d-----w- c:\documents and settings\cissy\application data\qELgTZqjY

2011-10-17 07:50:27 -------- d-----w- c:\documents and settings\cissy\application data\QqhYCwkIVlNx0c2

2011-10-17 07:50:27 -------- d-----w- c:\documents and settings\cissy\application data\dcA1uvD2oFpHsJd

2011-10-17 07:38:22 -------- d-----w- c:\documents and settings\cissy\application data\L9hYXXwkUVlOBx0

2011-10-17 07:38:21 -------- d-----w- c:\documents and settings\cissy\application data\sA0uSoobF3m5Q6g

2011-10-17 07:37:57 102400 ----a-w- c:\documents and settings\cissy\application data\svhostu.exe

2011-10-17 07:37:57 -------- d-----w- c:\documents and settings\cissy\application data\wlOONNxxAu

2011-10-17 07:37:35 -------- d-----w- c:\documents and settings\cissy\application data\yekkIrrzNyxAuS

2011-10-17 04:59:33 73728 ----a-w- c:\windows\system32\javacpl.cpl

2011-10-17 04:59:33 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-10-17 02:20:42 7269712 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5773f68b-5bb1-411a-93d0-9c9c7e47ecab}\mpengine.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin7.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin6.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin5.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin4.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin3.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin2.dll

2011-10-14 02:20:40 159744 ----a-w- c:\program files\internet explorer\plugins\npqtplugin.dll

2011-10-12 17:55:33 -------- d-----w- c:\program files\iPod

2011-10-12 17:55:23 -------- d-----w- c:\program files\iTunes

2011-10-12 17:51:49 -------- d-----w- c:\program files\Bonjour

.

==================== Find3M ====================

.

2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2011-09-09 09:12:13 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-06 13:25:11 1867904 ----a-w- c:\windows\system32\win32k.sys

2011-08-31 03:05:04 83816 ----a-w- c:\windows\system32\dns-sd.exe

2011-08-31 03:05:04 73064 ----a-w- c:\windows\system32\dnssd.dll

2011-08-31 03:05:04 50536 ----a-w- c:\windows\system32\jdns_sd.dll

2011-08-31 03:05:04 178536 ----a-w- c:\windows\system32\dnssdX.dll

2011-08-22 23:47:42 919552 ----a-w- c:\windows\system32\wininet.dll

2011-08-22 23:47:42 43520 ----a-w- c:\windows\system32\licmgr10.dll

2011-08-22 23:47:42 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2011-08-22 11:52:07 385024 ----a-w- c:\windows\system32\html.iec

2011-08-17 13:49:54 138496 ----a-w- c:\windows\system32\drivers\afd.sys

.

============= FINISH: 20:41:07.10 ===============

attach.zip

Link to post
Share on other sites

  • Staff

Hi and welcome to Malwarebytes.

Please update MBAM, run a Quick Scan, and post its log.

Next, please visit this webpage for instructions for running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

  • When the tool is finished, it will produce a report for you.
  • Please post the contents of C:\ComboFix.txt along with a new DDS log so we may continue cleaning the system.

Link to post
Share on other sites

  • 2 weeks later...
  • 2 weeks later...
  • Staff

Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.