Lumpy
2008-05-13, 00:01
Your help is appreciated more than I can express.
My head hurts from days of fighting this. I had it licked once... so I thought.
I'll spare ALL the gory details but I will tell you that this is my father's Gateway laptop. He's notoriously gets these things because he downloads every thing that is offered him and I tell him constantly... You know the story... My girlfriend's desktop is also infected and I think it's the same thing. She is in another state so the only way I've been able to help her is via desktop sharing on AIMPRO. I've got hers on hold for the moment...
Bloody looking medical waste symbol is blocking wallpaper (I have managed to find the way to shrink that for now)... Very crafty these bastards aren't they? Spybot has told me that both Virtumonde and Smitfraud are not showing up anymore but what does come up after a scan is: Microsoft.WindowsSecurityCenter.AntivirusOverride and Zlob.Downloader.vcf.
Every time this lap top starts it starts with the Virus protection shut off. I thought that was something else causing it but now I'm thinking otherwise.
There is a window that pops up that is designed to look like a Microsoft Program but it's a web page from security-defender.com ... Striking similarities to Microsoft’s Security program. Oh, I'm sure he didn't click on it (I say laughing sarcastically)
Here is what Kaspersky tells me:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, May 12, 2008 3:42:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 12/05/2008
Kaspersky Anti-Virus database records: 763380
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 46179
Number of viruses found: 8
Number of infected objects: 13
Number of suspicious objects: 0
Duration of the scan process: 00:57:12
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-05072008-231511.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Value Customer\.housecall6.6\Quarantine\installer_abr.exe.bac_a03648 Infected: not-a-virus:FraudTool.Win32.SpywareIsolator.q skipped
C:\Documents and Settings\Value Customer\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{B9E52980-8F9D-4530-801B-AD05D4444AF2} Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\History\History.IE5\MSHist012008051220080513\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Temp\~DF53BF.tmp Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Value Customer\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Trend Micro\RUBotted\botaa.db Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\qadovnel.dll.vir Infected: Trojan.Win32.Vapsup.epw skipped
C:\QooBox\Quarantine\C\WINDOWS\xbaqktfv.exe.vir Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047738.dll Infected: Trojan.Win32.Monder.gen skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047739.dll Infected: Trojan.Win32.Monder.an skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047740.dll Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP197\A0047960.exe Infected: not-a-virus:FraudTool.Win32.AntiVirus2008.m skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP206\A0048446.dll Infected: Trojan.Win32.Vapsup.evt skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050115.dll Infected: Trojan.Win32.Vapsup.epw skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050116.exe Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050134.exe Infected: Trojan-Downloader.Win32.Zlob.mel skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP222\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\gndarmblsnv.dll Infected: Trojan.Win32.Vapsup.epx skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5050D493-EA30-4EB7-A3EE-A6791E86502E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\tdomgafw.dll Infected: Trojan.Win32.Vapsup.evt skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
And here is what HJT tells me:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:54 PM, on 5/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7AB98D83-D60B-4317-A3DC-C84B4D76D6DF} - C:\WINDOWS\system32\qoMeEWqP.dll (file missing)
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: mkrndofl - {115D076F-3923-4086-A906-662C5A4D9BD3} - C:\WINDOWS\mkrndofl.dll (file missing)
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.realtytools.com
O15 - Trusted Zone: http://*.toolkitcma.com
O15 - Trusted Zone: http://*.toolkitcma2.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2564B8E6-7D84-11D4-A689-30475BC10000} - http://www.toolkitcma.com/tkweb/tkweb.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O21 - SSODL: wetkadmr - {9FE64069-467D-4CB5-B067-4E6A4BD4AD90} - C:\WINDOWS\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {C984BCE7-B349-4584-AD8C-FCF48E47DC66} - C:\WINDOWS\tdomgafw.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
--
End of file - 6619 bytes
And here is what Combofix says:
ComboFix 08-05-07.2 - Value Customer 2008-05-12 15:49:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.422 [GMT -4:00]
Running from: C:\Documents and Settings\Value Customer\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.
2008-05-12 12:51 . 2008-05-12 12:51 <DIR> d-------- C:\VundoFix Backups
2008-05-08 14:07 . 2008-05-08 14:07 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-08 14:07 . 2008-05-08 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-07 23:15 . 2008-05-07 23:15 <DIR> d-------- C:\Program Files\Windows Defender
2008-05-07 19:38 . 2008-05-07 19:38 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\InstallShield
2008-05-07 19:38 . 2007-11-27 22:51 35,216 --a------ C:\WINDOWS\system32\drivers\TMPassthru.sys
2008-05-07 19:32 . 2008-05-08 13:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-07 15:46 . 2008-05-07 20:13 <DIR> d-------- C:\Documents and Settings\Value Customer\.housecall6.6
2008-05-07 13:20 . 2008-05-07 13:29 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-05-05 11:36 . 2008-05-07 13:40 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-05 11:33 . 2008-05-05 11:33 9,722,720 --a------ C:\spybotsd152.exe
2008-05-05 06:39 . 2008-05-05 05:03 167,936 --a------ C:\WINDOWS\tdomgafw.dll
2008-05-05 06:39 . 2008-05-05 05:04 102,400 --a------ C:\WINDOWS\svorbmke.exe
2008-05-04 23:15 . 2008-05-06 10:12 21,031,280 --a------ C:\aaw2007.exe
2008-05-04 14:00 . 2008-05-04 14:00 <DIR> d-------- C:\Intel
2008-05-04 14:00 . 2003-10-02 16:17 155,648 -ra------ C:\WINDOWS\system32\igfxres.dll
2008-05-04 12:54 . 2008-05-07 13:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-04 12:30 . 2008-05-04 17:14 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\VersionTracker Pro
2008-05-03 22:22 . 2008-05-04 21:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-03 22:22 . 2008-05-03 22:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-02 21:46 . 2008-05-05 13:16 513 --a------ C:\WINDOWS\wininit.ini
2008-05-02 20:37 . 2008-05-07 14:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-02 10:41 . 2008-05-02 10:41 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\Antivirus
2008-05-02 08:53 . 2008-05-05 13:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-05-02 07:57 . 2008-05-05 08:06 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\TmpRecentIcons
2008-05-02 01:30 . 2008-04-30 12:19 258,048 --a------ C:\WINDOWS\gndarmblsnv.dll
2008-04-14 17:00 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-04-14 17:00 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-04-14 17:00 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-04-14 16:55 . 2008-04-14 16:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-14 16:55 . 2008-04-14 16:56 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-07 23:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-02 23:32 --------- d-----w C:\Documents and Settings\Value Customer\Application Data\Yahoo!
2008-05-02 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-05-02 23:23 --------- d-----w C:\Documents and Settings\Value Customer\Application Data\Move Networks
2008-05-02 23:07 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-02 19:53 --------- d-----w C:\Program Files\Yahoo!
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2007-12-10 18:43 0 -c--a-w C:\Documents and Settings\Value Customer\Application Data\sdsce.dll
.
((((((((((((((((((((((((((((( snapshot@2008-05-08_12.49.14.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-08 16:43:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 18:22:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7AB98D83-D60B-4317-A3DC-C84B4D76D6DF}]
C:\WINDOWS\system32\qoMeEWqP.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{115D076F-3923-4086-A906-662C5A4D9BD3}"= "C:\WINDOWS\mkrndofl.dll" [ ]
[HKEY_CLASSES_ROOT\clsid\{115d076f-3923-4086-a906-662c5a4d9bd3}]
[HKEY_CLASSES_ROOT\mkrndofl.1]
[HKEY_CLASSES_ROOT\TypeLib\{F0E09FD8-4D0F-44F6-ADDD-245B68442CE7}]
[HKEY_CLASSES_ROOT\mkrndofl]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-02 16:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-02 16:19 118784]
"GWMDMMSG"="GWMDMMSG.exe" [2003-02-10 18:34 90112 C:\WINDOWS\GWMDMMSG.exe]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-10-03 20:50 684032]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-11-27 15:59 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-27 15:59 561152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-06-04 13:57 188416]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 07:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TMRUBottedTray"="C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2007-12-19 00:18 288088]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wetkadmr"= {9FE64069-467D-4CB5-B067-4E6A4BD4AD90} - C:\WINDOWS\wetkadmr.dll [ ]
"tdomgafw"= {C984BCE7-B349-4584-AD8C-FCF48E47DC66} - C:\WINDOWS\tdomgafw.dll [2008-05-05 05:03 167936]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R2 RUBotted;Trend Micro RUBotted Service;"C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe" [2007-12-19 00:18]
R3 PRISM;Gateway Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys [2003-04-10 20:32]
R3 TMPassthruMP;TMPassthruMP;C:\WINDOWS\system32\DRIVERS\TMPassthru.sys [2007-11-27 22:51]
S3 FLASHREADER;USB Reader;C:\WINDOWS\system32\Drivers\camUSB.sys [2003-02-10 18:33]
S3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-07-17 16:32]
S3 TMPassthru;Trend Micro Passthru Ndis Service;C:\WINDOWS\system32\DRIVERS\TMPassthru.sys [2007-11-27 22:51]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-05 22:03:11 C:\WINDOWS\Tasks\Defragment.job"
- C:\WINDOWS\system32\dfrg.msc
"2008-05-11 08:00:21 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\WINDOWS\system32\cleanmgr.exe
"2008-05-12 18:25:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-05-11 10:00:00 C:\WINDOWS\Tasks\SpybotSD.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
"2008-05-11 22:14:00 C:\WINDOWS\Tasks\UpdateSpyBot.job"
- C:\Program Files\Spybot - Search & Destroy\Update.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 15:50:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-12 15:53:51
ComboFix-quarantined-files.txt 2008-05-12 19:52:53
ComboFix2.txt 2008-05-08 16:49:32
Pre-Run: 16,925,007,872 bytes free
Post-Run: 17,090,240,512 bytes free
151 --- E O F --- 2008-04-17 07:03:08
***IT MAY BE NOTEWORTHY TO MENTION THIS: There is a popup that says :
Cannot find ‘file:///C:WINDOWS/privacy_danger/index.htm’
I wish I was in better spirits but I’ve seriously tried to fight this thing with everything I have to avoid asking for help but I really need it. I know people probably say this all the time but I truly hope to learn more and become a helper eventually as well. That, I believe I owe to the world for being in it and if I ask for help I believe I need to do it with vigilant gratitude. Thank you for ANY help!
Peace and Freedom,
Lumpy
My head hurts from days of fighting this. I had it licked once... so I thought.
I'll spare ALL the gory details but I will tell you that this is my father's Gateway laptop. He's notoriously gets these things because he downloads every thing that is offered him and I tell him constantly... You know the story... My girlfriend's desktop is also infected and I think it's the same thing. She is in another state so the only way I've been able to help her is via desktop sharing on AIMPRO. I've got hers on hold for the moment...
Bloody looking medical waste symbol is blocking wallpaper (I have managed to find the way to shrink that for now)... Very crafty these bastards aren't they? Spybot has told me that both Virtumonde and Smitfraud are not showing up anymore but what does come up after a scan is: Microsoft.WindowsSecurityCenter.AntivirusOverride and Zlob.Downloader.vcf.
Every time this lap top starts it starts with the Virus protection shut off. I thought that was something else causing it but now I'm thinking otherwise.
There is a window that pops up that is designed to look like a Microsoft Program but it's a web page from security-defender.com ... Striking similarities to Microsoft’s Security program. Oh, I'm sure he didn't click on it (I say laughing sarcastically)
Here is what Kaspersky tells me:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, May 12, 2008 3:42:28 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 12/05/2008
Kaspersky Anti-Virus database records: 763380
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
Scan Statistics:
Total number of scanned objects: 46179
Number of viruses found: 8
Number of infected objects: 13
Number of suspicious objects: 0
Duration of the scan process: 00:57:12
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-05072008-231511.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Value Customer\.housecall6.6\Quarantine\installer_abr.exe.bac_a03648 Infected: not-a-virus:FraudTool.Win32.SpywareIsolator.q skipped
C:\Documents and Settings\Value Customer\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{B9E52980-8F9D-4530-801B-AD05D4444AF2} Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\History\History.IE5\MSHist012008051220080513\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Temp\~DF53BF.tmp Object is locked skipped
C:\Documents and Settings\Value Customer\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Value Customer\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Value Customer\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Trend Micro\RUBotted\botaa.db Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\qadovnel.dll.vir Infected: Trojan.Win32.Vapsup.epw skipped
C:\QooBox\Quarantine\C\WINDOWS\xbaqktfv.exe.vir Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047738.dll Infected: Trojan.Win32.Monder.gen skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047739.dll Infected: Trojan.Win32.Monder.an skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP194\A0047740.dll Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP197\A0047960.exe Infected: not-a-virus:FraudTool.Win32.AntiVirus2008.m skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP206\A0048446.dll Infected: Trojan.Win32.Vapsup.evt skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050115.dll Infected: Trojan.Win32.Vapsup.epw skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050116.exe Infected: Trojan.Win32.Vapsup.epx skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP217\A0050134.exe Infected: Trojan-Downloader.Win32.Zlob.mel skipped
C:\System Volume Information\_restore{9E24328E-DFD2-40EF-9CB0-15A3B903713A}\RP222\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\gndarmblsnv.dll Infected: Trojan.Win32.Vapsup.epx skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{5050D493-EA30-4EB7-A3EE-A6791E86502E}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\tdomgafw.dll Infected: Trojan.Win32.Vapsup.evt skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
And here is what HJT tells me:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:19:54 PM, on 5/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\GWMDMMSG.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {7AB98D83-D60B-4317-A3DC-C84B4D76D6DF} - C:\WINDOWS\system32\qoMeEWqP.dll (file missing)
O2 - BHO: TrendProtect - {E3578B37-6346-4EC1-A82B-38273A100DCF} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: mkrndofl - {115D076F-3923-4086-A906-662C5A4D9BD3} - C:\WINDOWS\mkrndofl.dll (file missing)
O3 - Toolbar: TrendProtect - {F83BE649-1CC3-48EE-B2E2-0826CEF3822A} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TMRUBottedTray] "C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.realtytools.com
O15 - Trusted Zone: http://*.toolkitcma.com
O15 - Trusted Zone: http://*.toolkitcma2.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2564B8E6-7D84-11D4-A689-30475BC10000} - http://www.toolkitcma.com/tkweb/tkweb.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O18 - Protocol: trendprotect - {BC3A5F6F-12A0-4B14-A184-32939F413823} - C:\Program Files\Trend Micro\TrendProtect\MSIE\wrs.dll
O21 - SSODL: wetkadmr - {9FE64069-467D-4CB5-B067-4E6A4BD4AD90} - C:\WINDOWS\wetkadmr.dll (file missing)
O21 - SSODL: tdomgafw - {C984BCE7-B349-4584-AD8C-FCF48E47DC66} - C:\WINDOWS\tdomgafw.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: PrismXL - Lanovation - C:\Program Files\Common Files\Lanovation\PrismXL\PRISMXL.SYS
O23 - Service: Trend Micro RUBotted Service (RUBotted) - Trend Micro Inc. - C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe
--
End of file - 6619 bytes
And here is what Combofix says:
ComboFix 08-05-07.2 - Value Customer 2008-05-12 15:49:08.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.422 [GMT -4:00]
Running from: C:\Documents and Settings\Value Customer\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\privacy_danger
C:\WINDOWS\privacy_danger\images\capt.gif
C:\WINDOWS\privacy_danger\images\danger.jpg
C:\WINDOWS\privacy_danger\images\down.gif
C:\WINDOWS\privacy_danger\images\spacer.gif
C:\WINDOWS\privacy_danger\index.htm
.
((((((((((((((((((((((((( Files Created from 2008-04-12 to 2008-05-12 )))))))))))))))))))))))))))))))
.
2008-05-12 12:51 . 2008-05-12 12:51 <DIR> d-------- C:\VundoFix Backups
2008-05-08 14:07 . 2008-05-08 14:07 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-08 14:07 . 2008-05-08 14:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-07 23:15 . 2008-05-07 23:15 <DIR> d-------- C:\Program Files\Windows Defender
2008-05-07 19:38 . 2008-05-07 19:38 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\InstallShield
2008-05-07 19:38 . 2007-11-27 22:51 35,216 --a------ C:\WINDOWS\system32\drivers\TMPassthru.sys
2008-05-07 19:32 . 2008-05-08 13:09 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-07 15:46 . 2008-05-07 20:13 <DIR> d-------- C:\Documents and Settings\Value Customer\.housecall6.6
2008-05-07 13:20 . 2008-05-07 13:29 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-05-05 11:36 . 2008-05-07 13:40 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-05 11:33 . 2008-05-05 11:33 9,722,720 --a------ C:\spybotsd152.exe
2008-05-05 06:39 . 2008-05-05 05:03 167,936 --a------ C:\WINDOWS\tdomgafw.dll
2008-05-05 06:39 . 2008-05-05 05:04 102,400 --a------ C:\WINDOWS\svorbmke.exe
2008-05-04 23:15 . 2008-05-06 10:12 21,031,280 --a------ C:\aaw2007.exe
2008-05-04 14:00 . 2008-05-04 14:00 <DIR> d-------- C:\Intel
2008-05-04 14:00 . 2003-10-02 16:17 155,648 -ra------ C:\WINDOWS\system32\igfxres.dll
2008-05-04 12:54 . 2008-05-07 13:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-04 12:30 . 2008-05-04 17:14 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\VersionTracker Pro
2008-05-03 22:22 . 2008-05-04 21:48 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-03 22:22 . 2008-05-03 22:22 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-02 21:46 . 2008-05-05 13:16 513 --a------ C:\WINDOWS\wininit.ini
2008-05-02 20:37 . 2008-05-07 14:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-02 10:41 . 2008-05-02 10:41 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\Antivirus
2008-05-02 08:53 . 2008-05-05 13:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-05-02 07:57 . 2008-05-05 08:06 <DIR> d-------- C:\Documents and Settings\Value Customer\Application Data\TmpRecentIcons
2008-05-02 01:30 . 2008-04-30 12:19 258,048 --a------ C:\WINDOWS\gndarmblsnv.dll
2008-04-14 17:00 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-04-14 17:00 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-04-14 17:00 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-04-14 16:55 . 2008-04-14 16:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-04-14 16:55 . 2008-04-14 16:56 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-07 23:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-02 23:32 --------- d-----w C:\Documents and Settings\Value Customer\Application Data\Yahoo!
2008-05-02 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-05-02 23:23 --------- d-----w C:\Documents and Settings\Value Customer\Application Data\Move Networks
2008-05-02 23:07 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-02 19:53 --------- d-----w C:\Program Files\Yahoo!
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2007-12-10 18:43 0 -c--a-w C:\Documents and Settings\Value Customer\Application Data\sdsce.dll
.
((((((((((((((((((((((((((((( snapshot@2008-05-08_12.49.14.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-08 16:43:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-12 18:22:08 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2005-05-24 16:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 19:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 19:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7AB98D83-D60B-4317-A3DC-C84B4D76D6DF}]
C:\WINDOWS\system32\qoMeEWqP.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{115D076F-3923-4086-A906-662C5A4D9BD3}"= "C:\WINDOWS\mkrndofl.dll" [ ]
[HKEY_CLASSES_ROOT\clsid\{115d076f-3923-4086-a906-662c5a4d9bd3}]
[HKEY_CLASSES_ROOT\mkrndofl.1]
[HKEY_CLASSES_ROOT\TypeLib\{F0E09FD8-4D0F-44F6-ADDD-245B68442CE7}]
[HKEY_CLASSES_ROOT\mkrndofl]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2003-10-02 16:37 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2003-10-02 16:19 118784]
"GWMDMMSG"="GWMDMMSG.exe" [2003-02-10 18:34 90112 C:\WINDOWS\GWMDMMSG.exe]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-10-03 20:50 684032]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-11-27 15:59 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-27 15:59 561152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb06.exe" [2002-06-04 13:57 188416]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 07:24 286720]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TMRUBottedTray"="C:\Program Files\Trend Micro\RUBotted\TMRUBottedTray.exe" [2007-12-19 00:18 288088]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= file:///C:\WINDOWS\privacy_danger\index.htm
FriendlyName= Privacy Protection
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"wetkadmr"= {9FE64069-467D-4CB5-B067-4E6A4BD4AD90} - C:\WINDOWS\wetkadmr.dll [ ]
"tdomgafw"= {C984BCE7-B349-4584-AD8C-FCF48E47DC66} - C:\WINDOWS\tdomgafw.dll [2008-05-05 05:03 167936]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R2 RUBotted;Trend Micro RUBotted Service;"C:\Program Files\Trend Micro\RUBotted\TMRUBotted.exe" [2007-12-19 00:18]
R3 PRISM;Gateway Wireless LAN Driver;C:\WINDOWS\system32\DRIVERS\PRISMNDS.sys [2003-04-10 20:32]
R3 TMPassthruMP;TMPassthruMP;C:\WINDOWS\system32\DRIVERS\TMPassthru.sys [2007-11-27 22:51]
S3 FLASHREADER;USB Reader;C:\WINDOWS\system32\Drivers\camUSB.sys [2003-02-10 18:33]
S3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-07-17 16:32]
S3 TMPassthru;Trend Micro Passthru Ndis Service;C:\WINDOWS\system32\DRIVERS\TMPassthru.sys [2007-11-27 22:51]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-05 22:03:11 C:\WINDOWS\Tasks\Defragment.job"
- C:\WINDOWS\system32\dfrg.msc
"2008-05-11 08:00:21 C:\WINDOWS\Tasks\Disk Cleanup.job"
- C:\WINDOWS\system32\cleanmgr.exe
"2008-05-12 18:25:24 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-05-11 10:00:00 C:\WINDOWS\Tasks\SpybotSD.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
"2008-05-11 22:14:00 C:\WINDOWS\Tasks\UpdateSpyBot.job"
- C:\Program Files\Spybot - Search & Destroy\Update.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-12 15:50:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-05-12 15:53:51
ComboFix-quarantined-files.txt 2008-05-12 19:52:53
ComboFix2.txt 2008-05-08 16:49:32
Pre-Run: 16,925,007,872 bytes free
Post-Run: 17,090,240,512 bytes free
151 --- E O F --- 2008-04-17 07:03:08
***IT MAY BE NOTEWORTHY TO MENTION THIS: There is a popup that says :
Cannot find ‘file:///C:WINDOWS/privacy_danger/index.htm’
I wish I was in better spirits but I’ve seriously tried to fight this thing with everything I have to avoid asking for help but I really need it. I know people probably say this all the time but I truly hope to learn more and become a helper eventually as well. That, I believe I owe to the world for being in it and if I ask for help I believe I need to do it with vigilant gratitude. Thank you for ANY help!
Peace and Freedom,
Lumpy