|
|
|
http://85.12.43.75/tst20.html help
|
|
|
sappy72
Newbie
|
11. September 2008 @ 21:52 |
Link to this message
|
I'm trying to help fix my brother-in-laws laptop and he's been hit with that malware that was taken care of in this thread
I can't fix it, so I'd like some help in doing so. Thanks alot.
|
|
Advertisement
|
|
|
|
Senior Member
|
12. September 2008 @ 00:58 |
Link to this message
|
Hi sappy72
Before we begin the cleanup process, it is important to do a little analysis first. We will analyze your computer with a tool called HijackThis.
Please download the HijackThis zip file. Save it onto a convenient place in your computer, and then unzip the file.
Rename HijackThis(.exe) to scanner(.exe).
Next, run scanner(.exe). A window will pop up.
? Click on the button which says Main Menu, then Do a system scan and save a logfile.
? Please wait for the scan to be completed.
? After the scan has completed, a text window will pop up. Please post the contents of this window here.
This will also be located at hijackthis(.txt) in the same folder that HijackThis was originally saved.
NOTE:: Do not fix anything using HijackThis, as this may also damage legitimate components of your computer.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sappy72
Newbie
|
19. September 2008 @ 16:32 |
Link to this message
|
|
I haven't been able to get on here due to work, but now as I try on my brother-in-laws laptop, I'm about to go crazy. His computer is so slow and constantly loads all these different pages. I can't get it to stop long enough to download the required software that you need for the logs.
|
Senior Member
|
20. September 2008 @ 04:02 |
Link to this message
|
Hey sappy72
Let's do a little cleanup before the analysis. Do you have a second computer and a flash drive? Follow the instructions below, except to download the tool onto your flash drive first on a different computer and then load the flash drive into the infected one.
Now, please download ComboFix.
With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it.
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
? Run Combo-Fix.exe and follow the prompts.
**Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later.
? Wait for the scan to be completed.
? If it requires a reboot, please do it.
? After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt)
Do not click on the ComoboFix window, as it may cause it to stall.
After that, follow the instructions regarding HijackThis.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sappy72
Newbie
|
22. September 2008 @ 00:54 |
Link to this message
|
Okay, thanks. Here is the COMBO-FIX log
ComboFix 08-09-05.02 - brent 2008-09-21 23:14:34.1 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1033.18.285 [GMT -5:00]
Running from: F:\Combo-Fix.exe
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Program Files\ShoppingReport
C:\Program Files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\Windows\system32\MSINET.oca
C:\Windows\system32\pac.txt
.
((((((((((((((((((((((((( Files Created from 2008-08-22 to 2008-09-22 )))))))))))))))))))))))))))))))
.
2008-09-05 16:01 . 2008-09-05 16:00 167,424 --a------ C:\Windows\System32\MSA.cpl
2008-09-04 18:23 . 2008-09-04 18:23 73,719 --a------ C:\Windows\stfMeane1000106.exe
2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\Xtmp
2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\hcp
2008-09-04 18:21 . 2008-09-04 18:21 <DIR> d-------- C:\Windows\System32\enB
2008-09-04 18:21 . 2008-09-21 23:15 <DIR> d-------- C:\Temp\1cb
2008-09-04 18:21 . 2008-09-04 18:21 167,976 --a------ C:\Windows\System32\drivers\core.cache.dsk
2008-09-04 18:21 . 2008-09-04 18:21 86,144 --a------ C:\Windows\System32\drivers\rspndrr.sys
2008-09-04 18:20 . 2008-09-04 18:20 <DIR> d-------- C:\Windows\System32\wTR02
2008-09-04 18:20 . 2008-09-04 18:21 <DIR> d-------- C:\Temp\dax41
2008-09-04 18:20 . 2008-09-21 23:15 <DIR> d-------- C:\Temp
2008-09-04 18:19 . 2008-09-04 18:19 34,816 --a------ C:\Windows\System32\rqRJApNE.dll
2008-09-04 18:19 . 2008-09-04 18:19 34,816 --a------ C:\Windows\System32\hgGvUkJa.dll
2008-09-04 16:53 . 2007-06-28 18:52 765,952 --a------ C:\Windows\System32\xvidcore.dll
2008-09-04 16:53 . 2007-06-28 18:54 180,224 --a------ C:\Windows\System32\xvidvfw.dll
2008-09-04 16:53 . 2007-06-28 18:55 77,824 --a------ C:\Windows\System32\xvid.ax
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-22 04:23 --------- d---a-w C:\ProgramData\TEMP
2008-09-07 11:12 --------- d-----w C:\Users\brent\AppData\Roaming\LimeWire
2008-09-05 22:37 --------- d-----w C:\Users\brent\AppData\Roaming\uTorrent
2008-09-04 23:34 --------- d-----w C:\ProgramData\Roxio
2008-09-04 17:33 82 ----a-w C:\Users\brent\AppData\Roaming\wklnhst.dat
2008-08-18 00:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-17 23:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-08-13 08:12 --------- d-----w C:\Program Files\Windows Mail
2008-08-09 00:53 --------- d-----w C:\Program Files\Yahoo! Games
2008-07-31 21:08 --------- d-----w C:\Program Files\AvailaSoft
2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll
2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll
2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll
2008-07-19 03:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll
2008-07-19 01:44 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-10 08:11 174 --sha-w C:\Program Files\desktop.ini
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-04-29 19:30 53,914 ----a-w C:\Program Files\INSTALL.LOG
2007-12-12 11:38 626,688 ----a-w C:\Users\brent\AppData\Roaming\win32vll.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{166BE28B-0297-42F3-80AF-0D756ED7F583}]
2008-09-04 18:19 34816 --a------ C:\Windows\system32\rqRJApNE.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-11 1232896]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"{3A3678E4-94D9-0814-0708-070700080504}"="C:\Users\brent\AppData\Roaming\win32vll.exe" [2007-12-12 626688]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-15 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
"MSServer"="C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll" [2008-09-04 34816]
"BM6723bb16"="C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll" [2008-09-19 95744]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
"DeskSiteAlert"="C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe" [2007-08-25 42248]
"MSServer"="C:\Windows\system32\rqRJApNE.dll" [2008-09-04 34816]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{166BE28B-0297-42F3-80AF-0D756ED7F583}"= "C:\Windows\system32\rqRJApNE.dll" [2008-09-04 34816]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BA5CEE05-AB9F-4B49-B2D6-5DBD9B82BA9B}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{70C89E0D-2091-4E4E-80AA-10F7DA7E99CA}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{47118C35-40C9-4462-A24C-6FC6E87B4178}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{9BEF4C77-8524-4C95-AFC5-75AF497188CF}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{19A95997-7C30-40D6-A4A2-F7A918E5A13B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{A7FE5E69-87CC-44FD-9209-67FE4462F1EC}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{481E2FFF-0BE4-42E9-B361-5CE449EFD92E}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{D95F3CF3-6322-4FAB-9761-E908B6E12318}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{AD371567-0D0E-43AD-816B-25B6B824C830}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{CA903BB7-F4C7-498E-811C-D0129109F5A3}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"TCP Query User{D8119B36-18CD-4635-9629-E55C6EB03FDB}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:UDP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling
"UDP Query User{6ED68929-E0A9-42E4-9721-B3681F353EC3}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:TCP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling
"TCP Query User{5035825A-A042-45F5-84EC-71F843EE2E27}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= UDP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe
"UDP Query User{81F1D15E-8196-4EEB-9C6F-6D249FFCF7E6}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= TCP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 8192]
R2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe [2008-01-28 303104]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2008-01-28 19712]
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2008-01-28 18304]
Start Pending2 DeskSiteCMA;DeskSiteCMA;C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe [2007-08-25 169224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00fcdaa1-c245-11dc-87ec-001d09b55d8c}]
\shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
HKCU-Run-6410888a - C:\Users\brent\AppData\Local\Temp\irisimmp.dll
HKLM-Run-Antivirus - C:\Program Files\MS Antivirus\MSA.exe
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\brent\AppData\Roaming\Mozilla\Firefox\Profiles\z3pcdu57.default\
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava11.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava12.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava13.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava14.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjava32.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
FF -: plugin - c:\Program Files\Java\jre1.6.0\bin\npoji610.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-21 23:22:02
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
{3A3678E4-94D9-0814-0708-070700080504} = C:\Users\brent\AppData\Roaming\win32vll.exe?\?R?o?a?m?i?n?g???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\BCMWLTRY.EXE
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\System32\msfeedssync.exe
C:\Windows\System32\WerFault.exe
C:\Windows\System32\LogonUI.exe
.
**************************************************************************
.
Completion time: 2008-09-21 23:33:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-22 04:32:50
Pre-Run: 41,010,450,432 bytes free
Post-Run: 40,960,942,080 bytes free
184 --- E O F --- 2008-09-04 23:52:09
And here is the HijackThis log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:50 PM, on 9/21/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16711)
Boot mode: Normal
Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
F:\Scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defa...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defa...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [DeskSiteAlert] "C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\rqRJApNE.dll,#1
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [{3A3678E4-94D9-0814-0708-070700080504}] C:\Users\brent\AppData\Roaming\win32vll.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BM6723bb16] Rundll32.exe "C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll",s
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - c:\Program Files\Java\jre1.6.0\bin\npjpi160.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ShopperReports - Compare travel rates - {C5428486-50A0-4a02-9D20-520B59A9F9B3} - (no file)
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: DeskSiteCMA - DeskSite - C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe
--
End of file - 7421 bytes
|
Senior Member
|
22. September 2008 @ 07:57 |
Link to this message
|
Hey sappy72
Please disable all security programs, such as antiviruses, antispywares, and firewalls.
Also disable your internet connection.
Open Notepad and copy/paste the text in the code box below into it:
Driver::
rspndrr
File::
C:\Windows\System32\MSA.cpl
C:\Windows\stfMeane1000106.exe
C:\Windows\System32\drivers\core.cache.dsk
C:\Windows\System32\drivers\rspndrr.sys
C:\Windows\System32\rqRJApNE.dll
C:\Windows\System32\hgGvUkJa.dll
C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll
C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll
Folder::
C:\Windows\System32\Xtmp
C:\Windows\System32\hcp
C:\Windows\System32\enB
C:\Temp\1cb
C:\Windows\System32\wTR02
C:\Temp\dax41
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSServer"=-
"BM6723bb16"=-
Save this as CFScript.txt in the same folder as ComboFix.
Then drag the CFScript.txt into Combo-Fix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt).
Do not click on the ComoboFix window, as it may cause it to stall.
Please download Superantispyware Free and install it. Follow the prompts and reboot if required.
Launch Superantispyware Free either by running C:\Program Files\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware...
Configuring SuperAntispyware
? Click on Preferences.
? In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run.
? Navigate to the tab Scanning Control.
? Make sure only these boxes are checked:
Close browsers before scanning
Scan for tracking cookies
Terminate memory threats before quarantining
Scan Alternate Data Streams
Use Kernel Direct File Access (recommended)
Use Kernel Direct Registry Access (recommended)
Use Direct Disk Access (recommended)
? Click on Close.
Updating SuperAntispyware
? At the main window, click on Check for Updates....
? Wait for SuperAntispyware to be fully updated.
Scanning Time
? Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode.
? Launch SuperAntispyware.
? At the main window, click on Scan your Computer....
? Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next.
? Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items.
? Reboot your computer.
Post A Log
? Launch SuperAntispyware
? Click on Preferences
? Navigate to the tab Statistics/Logs.
? Choose the latest scan log, and the click on View Log....
? Copy and paste the contents of the log here in your next post.
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sappy72
Newbie
|
24. September 2008 @ 17:38 |
Link to this message
|
Here is the latest COMBO-FIX log
ComboFix 08-09-05.02 - brent 2008-09-24 15:57:04.2 - NTFSx86
Microsoft® Windows Vista? Home Premium 6.0.6000.0.1252.1.1033.18.385 [GMT -5:00]
Running from: F:\Combo-Fix.exe
Command switches used :: F:\CFScript.txt
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Temp\1cb
C:\Temp\dax41\A3G.log
C:\temp\tn3
C:\Users\brent\AppData\Local\Temp\jkkHWPff.dll
C:\Users\brent\AppData\Local\Temp\vcbxbscr.dll
C:\Windows\stfMeane1000106.exe
C:\Windows\System32\drivers\core.cache.dsk
C:\Windows\System32\drivers\rspndrr.sys
C:\Windows\System32\enB\Wi03550xi.exe
C:\Windows\System32\hcp\ifd4078v1.exe
C:\Windows\System32\hgGvUkJa.dll
C:\Windows\System32\MSA.cpl
C:\Windows\System32\rqRJApNE.dll
C:\Windows\System32\wTR02\wTR022328.exe
C:\Windows\System32\Xtmp\ATV5105nt.exe
.
((((((((((((((((((((((((( Files Created from 2008-08-24 to 2008-09-24 )))))))))))))))))))))))))))))))
.
2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\Xtmp
2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\hcp
2008-09-04 18:21 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\enB
2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Windows\System32\wTR02
2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Temp\dax41
2008-09-04 18:20 . 2008-09-24 15:57 <DIR> d-------- C:\Temp
2008-09-04 16:53 . 2007-06-28 18:52 765,952 --a------ C:\Windows\System32\xvidcore.dll
2008-09-04 16:53 . 2007-06-28 18:54 180,224 --a------ C:\Windows\System32\xvidvfw.dll
2008-09-04 16:53 . 2007-06-28 18:55 77,824 --a------ C:\Windows\System32\xvid.ax
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-24 21:02 --------- d---a-w C:\ProgramData\TEMP
2008-09-07 11:12 --------- d-----w C:\Users\brent\AppData\Roaming\LimeWire
2008-09-05 22:37 --------- d-----w C:\Users\brent\AppData\Roaming\uTorrent
2008-09-04 23:34 --------- d-----w C:\ProgramData\Roxio
2008-09-04 17:33 82 ----a-w C:\Users\brent\AppData\Roaming\wklnhst.dat
2008-08-18 00:04 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-17 23:00 --------- d-----w C:\Program Files\Norton Security Scan
2008-08-13 08:12 --------- d-----w C:\Program Files\Windows Mail
2008-08-09 00:53 --------- d-----w C:\Program Files\Yahoo! Games
2008-07-31 21:08 --------- d-----w C:\Program Files\AvailaSoft
2008-07-19 05:10 53,448 ----a-w C:\Windows\System32\wuauclt.exe
2008-07-19 05:10 45,768 ----a-w C:\Windows\System32\wups2.dll
2008-07-19 05:10 36,552 ----a-w C:\Windows\System32\wups.dll
2008-07-19 05:09 563,912 ----a-w C:\Windows\System32\wuapi.dll
2008-07-19 05:09 1,811,656 ----a-w C:\Windows\System32\wuaueng.dll
2008-07-19 03:44 83,456 ----a-w C:\Windows\System32\wudriver.dll
2008-07-19 03:44 1,524,736 ----a-w C:\Windows\System32\wucltux.dll
2008-07-19 03:08 163,904 ----a-w C:\Windows\System32\wuwebv.dll
2008-07-19 01:44 31,232 ----a-w C:\Windows\System32\wuapp.exe
2008-07-15 23:48 2,048 ----a-w C:\Windows\System32\tzres.dll
2008-07-10 08:11 174 --sha-w C:\Program Files\desktop.ini
2008-06-27 03:54 826,368 ----a-w C:\Windows\System32\wininet.dll
2008-06-27 03:54 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-06-27 03:54 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-06-27 03:54 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-06-26 00:34 7,964,672 ----a-w C:\Windows\System32\NlsLexicons0024.dll
2008-06-26 00:33 9,892,864 ----a-w C:\Windows\System32\NlsLexicons000a.dll
2008-04-29 19:30 53,914 ----a-w C:\Program Files\INSTALL.LOG
2007-12-12 11:38 626,688 ----a-w C:\Users\brent\AppData\Roaming\win32vll.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-21_23.32.05.30 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-22 04:18:53 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-09-24 20:59:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-09-22 04:18:53 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-09-24 20:59:29 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-09-22 04:21:20 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-09-24 21:01:58 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-09-22 04:21:20 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-09-24 21:01:58 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-09-22 04:19:37 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-09-24 21:00:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-09-22 04:19:37 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-24 21:00:13 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-09-22 04:19:37 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-09-24 21:00:13 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-09-22 04:23:45 5,948 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3963527200-683259532-1957107418-1000_UserData.bin
+ 2008-09-24 20:50:11 5,988 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3963527200-683259532-1957107418-1000_UserData.bin
- 2008-09-22 04:23:39 57,364 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-09-24 20:50:10 57,396 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-09-07 10:32:50 205,936 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
+ 2008-09-22 04:35:58 208,530 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S4.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2006-11-02 125440]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-02-11 1232896]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"{3A3678E4-94D9-0814-0708-070700080504}"="C:\Users\brent\AppData\Roaming\win32vll.exe" [2007-12-12 626688]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-15 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 201728]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-10-09 16384]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-10-09 202544]
"DeskSiteAlert"="C:\ProgramData\DeskSite\Binex\DeskSiteAlert.exe" [2007-08-25 42248]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BA5CEE05-AB9F-4B49-B2D6-5DBD9B82BA9B}"= UDP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{70C89E0D-2091-4E4E-80AA-10F7DA7E99CA}"= TCP:C:\Program Files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{47118C35-40C9-4462-A24C-6FC6E87B4178}"= UDP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{9BEF4C77-8524-4C95-AFC5-75AF497188CF}"= TCP:C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{19A95997-7C30-40D6-A4A2-F7A918E5A13B}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{A7FE5E69-87CC-44FD-9209-67FE4462F1EC}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire
"{481E2FFF-0BE4-42E9-B361-5CE449EFD92E}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{D95F3CF3-6322-4FAB-9761-E908B6E12318}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{AD371567-0D0E-43AD-816B-25B6B824C830}"= UDP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"{CA903BB7-F4C7-498E-811C-D0129109F5A3}"= TCP:C:\Program Files\att-nap\McciBrowser.exe:motivebrowser.exe
"TCP Query User{D8119B36-18CD-4635-9629-E55C6EB03FDB}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:UDP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling
"UDP Query User{6ED68929-E0A9-42E4-9721-B3681F353EC3}C:\\program files\\yahoo! games\\yahoo! ten pin championship bowling\\yahoo ten pin championship bowling.exe"= Disabled:TCP:C:\program files\yahoo! games\yahoo! ten pin championship bowling\yahoo ten pin championship bowling.exe:Skyworks Ten Pin Championship Bowling
"TCP Query User{5035825A-A042-45F5-84EC-71F843EE2E27}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= UDP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe
"UDP Query User{81F1D15E-8196-4EEB-9C6F-6D249FFCF7E6}C:\\users\\brent\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pc8za7ba\\utorrent[1].exe"= TCP:C:\users\brent\appdata\local\microsoft\windows\temporary internet files\content.ie5\pc8za7ba\utorrent[1].exe:utorrent[1].exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|
R0 AtiPcie;ATI PCI Express (3GIO) Filter;C:\Windows\system32\DRIVERS\AtiPcie.sys [2006-10-30 8192]
R2 McciCMService;McciCMService;C:\Program Files\Common Files\Motive\McciCMService.exe [2008-01-28 303104]
S3 btwaudio;Bluetooth Audio Device Service;C:\Windows\system32\drivers\btwaudio.sys [2007-03-29 79664]
S3 btwavdt;Bluetooth AVDT Service;C:\Windows\system32\drivers\btwavdt.sys [2007-02-27 81200]
S3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-02-27 16432]
S3 MREMP50;MREMP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS [2008-01-28 19712]
S3 MRESP50;MRESP50 NDIS Protocol Driver;C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS [2008-01-28 18304]
Start Pending2 DeskSiteCMA;DeskSiteCMA;C:\ProgramData\DeskSite\Binex\DeskSiteCMA.exe [2007-08-25 169224]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{00fcdaa1-c245-11dc-87ec-001d09b55d8c}]
\shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
BHO-{166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll
HKLM-Run-MSServer - C:\Windows\system32\rqRJApNE.dll
ShellExecuteHooks-{166BE28B-0297-42F3-80AF-0D756ED7F583} - C:\Windows\system32\rqRJApNE.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-24 16:02:40
Windows 6.0.6000 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
{3A3678E4-94D9-0814-0708-070700080504} = C:\Users\brent\AppData\Roaming\win32vll.exe?\?R?o?a?m?i?n?g???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\WLTRYSVC.EXE
C:\Windows\System32\BCMWLTRY.EXE
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\Program Files\SigmaTel\C-Major Audio\WDM\stacsv.exe
C:\Windows\System32\drivers\XAudio.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
**************************************************************************
.
Completion time: 2008-09-24 16:10:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-24 21:10:25
ComboFix2.txt 2008-09-22 04:33:41
Pre-Run: 40,785,367,040 bytes free
Post-Run: 41,114,378,240 bytes free
189 --- E O F --- 2008-09-04 23:52:09
|
|
sappy72
Newbie
|
25. September 2008 @ 09:14 |
Link to this message
|
Here's the rest of what you asked for...
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 09/24/2008 at 05:21 PM
Application Version : 4.21.1004
Core Rules Database Version : 3578
Trace Rules Database Version: 1566
Scan type : Complete Scan
Total Scan Time : 00:43:49
Memory items scanned : 221
Memory threats detected : 0
Registry items scanned : 6195
Registry threats detected : 16
File items scanned : 79655
File threats detected : 3
Adware.Zango/ShoppingReport
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}
HKU\S-1-5-21-3963527200-683259532-1957107418-1000\Software\ShoppingReport
HKLM\Software\ShoppingReport
HKLM\Software\ShoppingReport#affid
HKLM\Software\ShoppingReport#Version
HKLM\Software\ShoppingReport#ProductName
HKLM\Software\ShoppingReport#requestor
HKLM\Software\ShoppingReport#SG_Not_Set
HKLM\Software\ShoppingReport#ie_user_agent
HKLM\Software\ShoppingReport#usr_RCT
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#Default Visible
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#ButtonText
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#HotIcon
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#Icon
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#CLSID
HKLM\Software\Microsoft\Internet Explorer\Extensions\{C5428486-50A0-4a02-9D20-520B59A9F9B3}#ClsidExtension
Trojan.Unclassified/BrowserDriver
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\ENB\WI03550XI.EXE.VIR
Rootkit.TNCore-Installer
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\HCP\IFD4078V1.EXE.VIR
Adware.Adservs
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\XTMP\ATV5105NT.EXE.VIR
|
Senior Member
|
28. September 2008 @ 00:31 |
Link to this message
|
|
Hey sappy72
Sorry for the terribly late reply.
What problems do you have left?
Best Regards :D
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
sappy72
Newbie
|
28. September 2008 @ 02:37 |
Link to this message
|
|
Nothing that I can tell.
I want to really thank you for your help. It was GREATLY appreciated!
|
|
Advertisement
|
|
|
Senior Member
|
29. September 2008 @ 00:57 |
Link to this message
|
|
You're welcome! Enjoy your clean computer!
Life is but a dream; you dont feel any pain unless you want to or you fall off the bed.
Success is relative; the more success the more relatives.
A computer once beat me at chess, but it was no match for me at kickboxing.
To be or not to be; thats a dumb question.
|
|
