View Full Version : Infected by Virtumonde and Smitfraud-C?!
Hi there!
I think my OS got infected after downloading a .exe, i probably shouldn't =(
Although my Wallpaper hasn't changed SpyBot finds some Smitfraud-C (or related to it) entries. I also get some Windows Security Alerts directing my to webpages selling overpriced Virus scanners.
I will really appreciate any help!
P.S. From Monday on, I will be in military service for the next three weeks (don't ask, it's a swiss system) and will only be able to answer questions on weekends. Any chance we can clean this system till Sunday?!
----------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:14:05, on 30.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\dgjwzkzw.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Spybot - Search & Destroy\SpybotSD.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avcenter.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ActHlp] C:\WINDOWS\system32\hetihaxg.exe
O4 - HKCU\..\Run: [InstallProgram] C:\WINDOWS\system32\dgjwzkzw.exe
O4 - HKLM\..\Policies\Explorer\Run: [fLerPpReez] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Run POPFile.lnk = C:\Programme\POPFile\runpopfile.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
O21 - SSODL: cfgadmui - {607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 6221 bytes
pskelley
2008-08-31, 15:34
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.
Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
This can be a tough infection to remove so do not expect fast or easy.
1) We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
* Run Spybot-S&D in Advanced Mode.
* If it is not already set to do this Go to the Mode menu select "Advanced Mode"
* On the left hand side, Click on Tools
* Then click on the Resident Icon in the List
* Uncheck "Resident TeaTimer" and OK any prompts.
* Restart your computer.
(leave TT disabled until we finish)
2) Looks like you have multiple infections, we need to search first.
http://siri.geekstogo.com/SmitfraudFix.php <<< download Smitfraudfix from here and follow ONLY these directions.
Search:
Double-click SmitfraudFix.exe
Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt
Note: process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/processutil/processutil.htm
Post only the C:\rapport.txt
Thanks
here you go:
SmitFraudFix v2.343
Scan done at 20:09:35.92, 31.08.2008
Run from D:\Michael\Eigene Dateien\Eigene Downloads\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
»»»»»»»»»»»»»»»»»»»»»»»» Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\dgjwzkzw.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\iPod\bin\iPodService.exe
D:\Michael\Eigene Dateien\Eigene Downloads\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\wuauclt.exe
»»»»»»»»»»»»»»»»»»»»»»»» hosts
hosts file corrupted !
127.0.0.1 legal-at-spybot.info
127.0.0.1 www.legal-at-spybot.info
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Michael
»»»»»»»»»»»»»»»»»»»»»»»» C:\Dokumente und Einstellungen\Michael\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» D:\Michael\AUSLAG~1\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Programme
C:\Programme\akl\ FOUND !
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
!!!Attention, following keys are not inevitably infected!!!
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,"
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
Description: Realtek RTL8139-Familie-PCI-Fast Ethernet-NIC - Paketplaner-Miniport
DNS Server Search Order: 192.168.1.1
DNS Server Search Order: 0.0.0.0
Description: Intel(R) PRO/Wireless 2200BG Network Connection - Paketplaner-Miniport
DNS Server Search Order: 195.186.1.107
DNS Server Search Order: 195.186.4.107
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS1\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS2\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
thanks for xour help so far
michael
pskelley
2008-08-31, 21:52
Thanks for returning your information, Smitfraudfix found the infection and it also found this:
»»»»»»»»»»»»»»»»»»»»»»»» hosts
hosts file corrupted !
After we clean, in the next C:\rapport.txt, there may be a very large hosts file (items starting with 127.0.0.1) and I do not need to see it. Edit (remove) it from the C:\rapport.txt before you post it.
Clean:
Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)
Double-click SmitfraudFix.exe
Select 2 and hit Enter to delete infected files.
You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.
The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.
A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt
Optional:
To restore Trusted and Restricted site zone, select 3 and hit Enter.
You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone.
Note, if you use SpywareBlaster and/or IE-SPYAD, it will be necessary to re-install the protection both afford. For SpywareBlaster, run the program and re-protect all items. For IE-SPYAD, run the batch file and reinstall the protection.
Post the C:\rapport.txt and a new HJT log.
Thanks...Phil
ok, here we go:
SmitFraudFix v2.343
Scan done at 23:06:33.84, 31.08.2008
Run from D:\Michael\Eigene Dateien\Eigene Downloads\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
// stuff you told me not to post...
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\Programme\akl\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix
AntiXPVSTFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» RK
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CS1\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS1\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CS2\Services\Tcpip\..\{4BF78B90-1C02-492C-BE20-B9559B432E52}: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS2\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer=192.168.1.1,0.0.0.0
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=195.186.1.107 195.186.4.107
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
and
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:21:25, on 31.08.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\dgjwzkzw.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll
O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ActHlp] C:\WINDOWS\system32\hetihaxg.exe
O4 - HKCU\..\Run: [InstallProgram] C:\WINDOWS\system32\dgjwzkzw.exe
O4 - HKLM\..\Policies\Explorer\Run: [fLerPpReez] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Run POPFile.lnk = C:\Programme\POPFile\runpopfile.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
O21 - SSODL: cfgadmui - {607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 6045 bytes
looks like it didn't work... still get some weird Fake Windows Firewall Alerts... :sad:
well, I will try to check on the Internet if possible but I problably won't be able to answer any of your questions till next friday night or saturday due to my military service...
anyway, thanks so far
sgt. michael :cool:
pskelley
2008-09-01, 00:35
Please be patient, you had a very infected computer and these things take time. It is a lot harder to get it off than it was to get it on. I have no problem working with your schedule sir but I do suggest you leave instructions that the computer is off limits
Thanks for returning your information, you may delete Smitfraudfix from the computer, we are finished with it.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
Remove any old copies of combofix before you proceed.
Thanks to sUBs and anyone else who helped with this fix.
It is important that it is saved directly to your Desktop.
Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post the combofix log and a new HJT log.
Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Thanks
here are the 2 new logfiles
ComboFix 08-08-30.03 - Michael 2008-08-31 23:59:45.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.637 [GMT 2:00]
ausgeführt von:: D:\Michael\Auslagerungen\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.
(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Secure Solutions
C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\inst.exe
C:\Programme\Inet Delivery
C:\Programme\Inet Delivery\inetdl.exe
C:\Programme\Inet Delivery\intdel.exe
C:\WINDOWS\a.bat
C:\WINDOWS\base64.tmp
C:\WINDOWS\bdn.com
C:\WINDOWS\FVProtect.exe
C:\WINDOWS\iTunesMusic.exe
C:\WINDOWS\mslagent
C:\WINDOWS\mslagent\2_mslagent.dll
C:\WINDOWS\mslagent\mslagent.exe
C:\WINDOWS\mslagent\uninstall.exe
C:\WINDOWS\mssecu.exe
C:\WINDOWS\system32\akttzn.exe
C:\WINDOWS\system32\anticipator.dll
C:\WINDOWS\system32\awtoolb.dll
C:\WINDOWS\system32\bdn.com
C:\WINDOWS\system32\bsva-egihsg52.exe
C:\WINDOWS\system32\dpcproxy.exe
C:\WINDOWS\system32\emesx.dll
C:\WINDOWS\system32\h@tkeysh@@k.dll
C:\WINDOWS\system32\hoproxy.dll
C:\WINDOWS\system32\hxiwlgpm.dat
C:\WINDOWS\system32\hxiwlgpm.exe
C:\WINDOWS\system32\medup012.dll
C:\WINDOWS\system32\medup020.dll
C:\WINDOWS\system32\msgp.exe
C:\WINDOWS\system32\msnbho.dll
C:\WINDOWS\system32\mssecu.exe
C:\WINDOWS\system32\msvchost.exe
C:\WINDOWS\system32\mtr2.exe
C:\WINDOWS\system32\mwin32.exe
C:\WINDOWS\system32\netode.exe
C:\WINDOWS\system32\newsd32.exe
C:\WINDOWS\system32\ps1.exe
C:\WINDOWS\system32\psof1.exe
C:\WINDOWS\system32\psoft1.exe
C:\WINDOWS\system32\regc64.dll
C:\WINDOWS\system32\regm64.dll
C:\WINDOWS\system32\Rundl1.exe
C:\WINDOWS\system32\smp
C:\WINDOWS\system32\smp\msrc.exe
C:\WINDOWS\system32\sncntr.exe
C:\WINDOWS\system32\ssurf022.dll
C:\WINDOWS\system32\ssvchost.com
C:\WINDOWS\system32\ssvchost.exe
C:\WINDOWS\system32\sysreq.exe
C:\WINDOWS\system32\taack.dat
C:\WINDOWS\system32\taack.exe
C:\WINDOWS\system32\temp#01.exe
C:\WINDOWS\system32\thun.dll
C:\WINDOWS\system32\thun32.dll
C:\WINDOWS\system32\VBIEWER.OCX
C:\WINDOWS\system32\vbsys2.dll
C:\WINDOWS\system32\vcatchpi.dll
C:\WINDOWS\system32\winlogonpc.exe
C:\WINDOWS\system32\winsystem.exe
C:\WINDOWS\system32\WINWGPX.EXE
C:\WINDOWS\userconfig9x.dll
C:\WINDOWS\winsystem.exe
C:\WINDOWS\zip1.tmp
C:\WINDOWS\zip2.tmp
C:\WINDOWS\zip3.tmp
C:\WINDOWS\zipped.tmp
.
((((((((((((((((((((((( Dateien erstellt von 2008-07-28 bis 2008-08-31 ))))))))))))))))))))))))))))))
.
2008-09-01 00:05 . 2008-09-01 00:05 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Secure Solutions
2008-09-01 00:05 . 203,776 C:\WINDOWS\system32\zermzwpm.exe
2008-08-31 20:09 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-31 20:09 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-31 20:09 . 2008-08-31 00:53 88,576 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe
2008-08-31 20:09 . 2008-08-27 15:17 87,040 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-31 20:09 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-31 20:09 . 2008-08-28 22:36 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-31 20:09 . 2008-08-18 12:19 82,432 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-31 20:09 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-31 20:09 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-31 20:09 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-31 20:09 . 2008-08-31 23:06 1,870 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-30 10:13 . 2008-08-30 10:13 <DIR> d-------- C:\Programme\Trend Micro
2008-08-30 02:33 . 2008-08-30 02:33 <DIR> d-------- C:\Programme\vduorkd
2008-08-30 02:32 . 2008-08-30 02:32 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu
2008-08-30 02:32 . 2008-08-30 02:32 94,208 --a------ C:\WINDOWS\system32\hetihaxg.exe
2008-08-30 02:32 . 2008-08-30 02:32 66,048 --a------ C:\WINDOWS\system32\dgjwzkzw.exe
2008-08-28 15:08 . 2008-08-28 15:08 <DIR> d-------- C:\Programme\Programme
2008-08-28 15:08 . 2008-08-28 15:08 <DIR> d--h----- C:\Programme\InstallJammer Registry
2008-08-22 23:23 . 2008-08-22 23:26 <DIR> d-------- C:\Programme\PartyGaming
2008-08-18 03:01 . 2008-08-18 03:01 <DIR> d-------- C:\Programme\MSXML 6.0
2008-08-17 19:03 . 2008-08-17 19:03 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\schwupp
2008-08-17 14:38 . 2008-08-17 14:38 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\NSeries
2008-08-17 14:28 . 2008-08-17 14:28 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MainConcept
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Orb Networks
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OrbNetworks
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
2008-08-16 15:26 . 2008-08-16 15:26 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
2008-08-16 15:25 . 2008-08-16 15:25 <DIR> d-------- C:\Programme\SimpleCenter
2008-08-16 15:25 . 2008-08-16 15:25 <DIR> d-------- C:\Programme\Gemeinsame Dateien\i4j_jres
2008-08-16 15:23 . 2008-08-16 15:23 <DIR> d-------- C:\Programme\Gemeinsame Dateien\muvee Technologies
2008-08-16 15:23 . 2008-08-16 15:28 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Nokia
2008-08-16 15:22 . 2008-08-16 15:24 <DIR> d-------- C:\WINDOWS\Globalization
2008-08-16 15:22 . 2008-08-17 14:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
2008-08-16 15:21 . 2008-08-16 15:23 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-08-16 15:21 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Nokia
2008-08-16 15:20 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Nokia
2008-08-16 15:20 . 2008-08-16 15:20 <DIR> d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2008-08-16 15:20 . 2008-08-16 15:20 <DIR> d-------- C:\Programme\DIFX
2008-08-16 15:20 . 2008-08-16 15:23 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\PC Suite
2008-08-16 15:20 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-08-16 15:20 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-08-16 15:20 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-08-16 15:20 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-16 15:20 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-08-16 15:20 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-08-16 15:20 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-08-16 15:18 . 2008-08-17 14:28 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-16 15:16 . 2008-08-16 15:16 <DIR> d-------- C:\WINDOWS\system32\de-DE
2008-08-16 15:14 . 2008-08-16 15:14 <DIR> d-------- C:\Programme\MSBuild
2008-08-16 15:12 . 2008-08-16 15:16 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-08-16 15:11 . 2008-08-16 15:11 <DIR> d-------- C:\Programme\Reference Assemblies
2008-08-16 15:10 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-08-13 18:44 . 2008-08-29 09:38 <DIR> d-------- C:\Programme\World of Warcraft
2008-08-13 13:40 . 2008-08-13 19:22 <DIR> d-------- C:\Programme\Steam
2008-08-11 22:34 . 2008-08-11 22:34 <DIR> d-------- C:\Programme\Zattoo
2008-08-06 10:05 . 2008-08-08 19:12 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-06 09:56 . 2008-08-13 15:21 <DIR> d-------- C:\Programme\Starcraft
2008-08-06 09:56 . 2008-08-06 09:57 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-08-06 09:56 . 2008-08-06 09:58 32,955 --a------ C:\WINDOWS\scunin.dat
2008-08-06 09:56 . 2008-08-06 09:57 967 --a------ C:\WINDOWS\ScUnin.pif
2008-08-05 23:46 . 2008-08-11 17:19 <DIR> d-------- C:\Programme\SWKotOR
2008-08-05 19:39 . 2008-08-05 19:39 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\DivX
2008-08-05 10:57 . 2008-08-05 11:10 17,415 --a------ C:\WINDOWS\DIIUnin.dat
2008-08-05 10:56 . 2008-08-05 10:56 102,400 --a------ C:\WINDOWS\DIIUnin.exe
2008-08-05 10:56 . 2008-08-05 10:56 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-08-05 10:43 . 2008-08-05 10:45 <DIR> d-------- C:\Programme\DivX
2008-08-05 10:33 . 2008-08-05 10:33 <DIR> d-------- C:\Programme\Microsoft Games
2008-08-05 10:27 . 2008-08-05 10:27 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-08-05 10:27 . 2008-08-06 09:48 21,895 --a------ C:\WINDOWS\War3Unin.dat
2008-08-05 10:27 . 2008-08-05 10:27 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-08-05 10:21 . 2008-08-13 17:41 <DIR> d-------- C:\Programme\Warcraft III
2008-07-25 10:36 . 2008-07-25 10:36 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2008-07-25 10:36 . 2008-07-25 10:36 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2008-07-25 00:13 . 2008-08-05 10:02 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Vso
2008-07-25 00:13 . 2008-07-25 00:13 94,208 --a------ C:\WINDOWS\system32\drivers\ezplay.sys
2008-07-25 00:13 . 2008-08-05 10:02 94,208 --a------ C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\ezplay.sys
2008-07-25 00:13 . 2008-07-25 00:13 47,360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2008-07-25 00:13 . 2008-08-05 10:02 47,360 --a------ C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\pcouffin.sys
2008-07-24 23:48 . 2008-07-25 00:08 <DIR> d-------- C:\Program Files
2008-07-24 23:44 . 2008-07-24 23:44 <DIR> d-------- C:\Programme\DAEMON Tools Toolbar
2008-07-24 23:44 . 2008-07-24 23:44 <DIR> d-------- C:\Programme\DAEMON Tools Lite
2008-07-24 23:40 . 2008-07-24 23:40 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\DAEMON Tools
2008-07-24 23:40 . 2008-07-24 23:40 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-24 19:38 . 2008-07-24 19:38 <DIR> d-------- C:\WINDOWS\speech
2008-07-24 19:38 . 2008-07-24 19:44 <DIR> d-------- C:\WINDOWS\Lhsp
2008-07-23 18:50 . 2008-07-23 18:50 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-07-23 18:50 . 2008-07-23 18:50 10,152 --a------ C:\WINDOWS\system32\dsm_de.qm
2008-07-23 18:48 . 2008-07-23 18:48 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2008-07-23 18:48 . 2008-07-23 18:48 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2008-07-23 18:47 . 2008-07-23 18:47 634,880 --a------ C:\WINDOWS\system32\divxdec.ax
2008-07-23 18:47 . 2008-07-23 18:47 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2008-07-23 18:47 . 2008-07-23 18:47 8,523 --a------ C:\WINDOWS\system32\dpude.qm
2008-07-23 18:47 . 2008-07-23 18:47 3,051 --a------ C:\WINDOWS\system32\dtu_de.qm
2008-07-23 18:47 . 2008-07-23 18:47 416 --a------ C:\WINDOWS\system32\dtu100.dll.manifest
2008-07-23 18:47 . 2008-07-23 18:47 416 --a------ C:\WINDOWS\system32\dpl100.dll.manifest
2008-07-23 18:46 . 2008-07-23 18:46 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-07-17 18:25 . 2008-07-17 18:25 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-07-14 09:59 . 2008-07-14 09:59 16,760 --a------ C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-07-11 22:39 . 2008-07-11 22:39 173 --a------ C:\WINDOWS\Switzerland
2008-07-05 17:44 . 2008-07-05 17:44 21,840 --a------ C:\WINDOWS\system32\SIntfNT.dll
2008-07-05 17:44 . 2008-07-05 17:44 17,212 --a------ C:\WINDOWS\system32\SIntf32.dll
2008-07-05 17:44 . 2008-07-05 17:44 12,067 --a------ C:\WINDOWS\system32\SIntf16.dll
2008-07-05 15:46 . 2008-08-13 16:21 <DIR> d-------- C:\Programme\Diablo II
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 10:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-08-30 08:44 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\RssPopper
2008-08-30 07:37 --------- d-----w C:\Programme\Spybot - Search & Destroy
2008-08-27 00:40 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Azureus
2008-08-13 17:00 --------- d-----w C:\Programme\Gemeinsame Dateien\Blizzard Entertainment
2008-08-08 22:31 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\dvdcss
2008-08-05 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-07-23 16:50 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-07-23 16:50 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-07-23 16:50 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-07-23 16:50 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-07-23 16:50 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-07-23 16:50 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-07-21 16:16 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\teamspeak2
2008-07-18 20:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 20:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 20:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 20:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 20:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 20:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 20:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 20:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:30 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-06 11:38 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2008-06-24 16:22 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 665,088 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:39 247,296 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-05-07 05:14 1,293,312 ----a-w C:\WINDOWS\system32\quartz.dll
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 14:00 15360]
"ActHlp"="C:\WINDOWS\system32\hetihaxg.exe" [2008-08-30 02:32 94208]
"InstallProgram"="C:\WINDOWS\system32\dgjwzkzw.exe" [2008-08-30 02:32 66048]
"DscCmdApp"="C:\WINDOWS\system32\jwpapgfa.exe" [2008-09-01 00:06 90112]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 13:35 90112]
"FreePDF Assistant"="C:\Programme\FreePDF_XP\fpassist.exe" [2007-06-26 21:27 312320]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 23:04 266497]
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 14:00 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"fLerPpReez"="C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe" [2008-08-30 02:32 65536]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000
"NoSMMyPictures"= 01000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"cfgadmui"= {607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll [2008-08-30 02:33 122880]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Nokia Nseries PC Suite.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Nokia Nseries PC Suite.lnk
backup=C:\WINDOWS\pss\Nokia Nseries PC Suite.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a------ 2007-02-16 19:49 149024 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
--a------ 2007-02-16 19:57 1945960 C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 C:\Programme\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
--a------ 2007-05-11 03:08 2512392 C:\WINDOWS\system32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-06-09 03:28 310520 C:\Programme\Orb Networks\Orb\bin\OrbTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
--a------ 2007-10-11 19:12 94208 C:\Programme\SimpleCenter\bin\win\sclauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 05:00 132496 C:\Programme\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a------ 2007-02-16 19:45 1169776 C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\Orb.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbChannelScan.exe"=
R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-03-07 14:27]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;C:\Programme\VMLaunch\BuddyVM.sys []
S3 efipsk;efipsk;C:\DOKUME~1\Michael\LOKALE~1\Temp\efipsk.sys []
.
Inhalt des "geplante Tasks" Ordners
2008-08-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Programme\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]
.
.
------- Zus„tzlicher Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: Nach Microsoft &Excel exportieren - C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 -: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 -: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O17 -: HKLM\CCS\Interface\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-01 00:04:55
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostart Eintr„ge...
Scanne versteckte Dateien...
C:\WINDOWS\system32\jwpapgfa.exe 90112 bytes executable
Scan erfolgreich abgeschlossen
versteckte Dateien: 1
**************************************************************************
.
------------------------ Weitere, laufende Prozesse ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Programme\iPod\bin\iPodService.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-09-01 0:09:00 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2008-08-31 22:08:57
Pre-Run: 9,710,399,488 Bytes frei
Post-Run: 9,629,933,568 Bytes frei
331 --- E O F --- 2008-08-18 01:01:55
and
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:10:45, on 01.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\dgjwzkzw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ActHlp] C:\WINDOWS\system32\hetihaxg.exe
O4 - HKCU\..\Run: [InstallProgram] C:\WINDOWS\system32\dgjwzkzw.exe
O4 - HKCU\..\Run: [DscCmdApp] C:\WINDOWS\system32\jwpapgfa.exe
O4 - HKLM\..\Policies\Explorer\Run: [fLerPpReez] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Run POPFile.lnk = C:\Programme\POPFile\runpopfile.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
O21 - SSODL: cfgadmui - {607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 6251 bytes
greets
michael
pskelley
2008-09-01, 01:38
Thanks for returning your information, this is a bit difficult for me since I have absolutely no German. I am doing what I can and relying on the programs to know the language. I might suggest there is a site available in the language:
GERMAN/DUTCH FORUM
http://forums.spybot.info/forumdisplay.php?f=15
Proceed carefully and in the numbered order.
1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.
2) Open notepad and copy/paste the text in the codebox below into it:
File::
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\dgjwzkzw.exe
C:\WINDOWS\system32\jwpapgfa.exe
Folder::
C:\Programme\vduorkd
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu
Save this as CFScript
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Referring to the picture above, drag CFScript into ComboFix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)
3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
(the next item is damanged and not working right if at all, if you use it download it again once we finish)
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O4 - HKCU\..\Run: [ActHlp] C:\WINDOWS\system32\hetihaxg.exe
O4 - HKCU\..\Run: [InstallProgram] C:\WINDOWS\system32\dgjwzkzw.exe
O4 - HKCU\..\Run: [DscCmdApp] C:\WINDOWS\system32\jwpapgfa.exe
O4 - HKLM\..\Policies\Explorer\Run: [fLerPpReez] C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O21 - SSODL: cfgadmui - {607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll
Close all programs but HJT and all browser windows, then click on "Fix Checked"
4) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.
*Cleaning Prefetch may results in a few slow starts until the folder is repopulated:
http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html
5) Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe
* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post the log from CFScript, the log from MBAM and a new HJT log.
Please tell me how the computer is running.
Thanks...Phil
ok, first of all i was not able to check all the lines you told me because they werent found again by HJT. Then, i still get a fake windows firewall popup...
here are the scan yu asked for:
1. CFScript Log
ComboFix 08-09-04.09 - Michael 2008-09-05 22:22:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1031.18.641 [GMT 2:00]
ausgeführt von:: D:\Michael\Auslagerungen\Desktop\ComboFix.exe
Command switches used :: D:\Michael\Auslagerungen\Desktop\CFScript.txt
* Neuer Wiederherstellungspunkt wurde erstellt
Achtung - Auf diesem PC ist keine Wiederherstellungskonsole installiert !!
.
(((((((((((((((((((((((((((((((((((( Weitere L”schungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Secure Solutions
C:\Programme\vduorkd
C:\Programme\vduorkd\cfgadmui.dll
C:\WINDOWS\system32\dgjwzkzw.exe
C:\WINDOWS\system32\hetihaxg.exe
C:\WINDOWS\system32\jwpapgfa.exe
.
((((((((((((((((((((((( Dateien erstellt von 2008-08-05 bis 2008-09-05 ))))))))))))))))))))))))))))))
.
2008-09-05 19:58 . 2008-09-05 19:58 94,208 --a------ C:\WINDOWS\system32\krunadqb.exe
2008-09-05 19:57 . 2008-09-05 22:27 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-09-05 19:57 . 2008-09-05 19:57 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-30 10:13 . 2008-08-30 10:13 <DIR> d-------- C:\Programme\Trend Micro
2008-08-28 15:08 . 2008-08-28 15:08 <DIR> d-------- C:\Programme\Programme
2008-08-28 15:08 . 2008-08-28 15:08 <DIR> d--h----- C:\Programme\InstallJammer Registry
2008-08-22 23:23 . 2008-08-22 23:26 <DIR> d-------- C:\Programme\PartyGaming
2008-08-18 03:01 . 2008-08-18 03:01 <DIR> d-------- C:\Programme\MSXML 6.0
2008-08-17 19:03 . 2008-08-17 19:03 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\schwupp
2008-08-17 14:38 . 2008-08-17 14:38 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\NSeries
2008-08-17 14:28 . 2008-08-17 14:28 <DIR> d-------- C:\Programme\Gemeinsame Dateien\MainConcept
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Orb Networks
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\OrbNetworks
2008-08-16 15:27 . 2008-08-16 15:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Nokia
2008-08-16 15:26 . 2008-08-16 15:26 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations
2008-08-16 15:25 . 2008-08-16 15:25 <DIR> d-------- C:\Programme\SimpleCenter
2008-08-16 15:25 . 2008-08-16 15:25 <DIR> d-------- C:\Programme\Gemeinsame Dateien\i4j_jres
2008-08-16 15:23 . 2008-08-16 15:23 <DIR> d-------- C:\Programme\Gemeinsame Dateien\muvee Technologies
2008-08-16 15:23 . 2008-08-16 15:28 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Nokia
2008-08-16 15:22 . 2008-08-16 15:24 <DIR> d-------- C:\WINDOWS\Globalization
2008-08-16 15:22 . 2008-08-17 14:27 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PC Suite
2008-08-16 15:21 . 2008-08-16 15:23 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-08-16 15:21 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Nokia
2008-08-16 15:20 . 2008-08-16 15:27 <DIR> d-------- C:\Programme\Nokia
2008-08-16 15:20 . 2008-08-16 15:20 <DIR> d-------- C:\Programme\Gemeinsame Dateien\PCSuite
2008-08-16 15:20 . 2008-08-16 15:20 <DIR> d-------- C:\Programme\DIFX
2008-08-16 15:20 . 2008-08-16 15:23 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\PC Suite
2008-08-16 15:20 . 2004-08-04 14:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-08-16 15:20 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-08-16 15:20 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-08-16 15:20 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-08-16 15:20 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-08-16 15:20 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-08-16 15:20 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-08-16 15:18 . 2008-08-17 14:28 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-08-16 15:16 . 2008-08-16 15:16 <DIR> d-------- C:\WINDOWS\system32\de-DE
2008-08-16 15:14 . 2008-08-16 15:14 <DIR> d-------- C:\Programme\MSBuild
2008-08-16 15:12 . 2008-08-16 15:16 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-08-16 15:11 . 2008-08-16 15:11 <DIR> d-------- C:\Programme\Reference Assemblies
2008-08-16 15:10 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-08-13 18:44 . 2008-08-29 09:38 <DIR> d-------- C:\Programme\World of Warcraft
2008-08-13 13:40 . 2008-08-13 19:22 <DIR> d-------- C:\Programme\Steam
2008-08-11 22:34 . 2008-08-11 22:34 <DIR> d-------- C:\Programme\Zattoo
2008-08-06 10:05 . 2008-08-08 19:12 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-06 09:56 . 2008-08-13 15:21 <DIR> d-------- C:\Programme\Starcraft
2008-08-06 09:56 . 2008-08-06 09:57 94,208 --a------ C:\WINDOWS\ScUnin.exe
2008-08-06 09:56 . 2008-08-06 09:58 32,955 --a------ C:\WINDOWS\scunin.dat
2008-08-06 09:56 . 2008-08-06 09:57 967 --a------ C:\WINDOWS\ScUnin.pif
2008-08-05 23:46 . 2008-08-11 17:19 <DIR> d-------- C:\Programme\SWKotOR
2008-08-05 19:39 . 2008-08-05 19:39 <DIR> d-------- C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\DivX
2008-08-05 10:57 . 2008-08-05 11:10 17,415 --a------ C:\WINDOWS\DIIUnin.dat
2008-08-05 10:56 . 2008-08-05 10:56 102,400 --a------ C:\WINDOWS\DIIUnin.exe
2008-08-05 10:56 . 2008-08-05 10:56 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2008-08-05 10:43 . 2008-08-05 10:45 <DIR> d-------- C:\Programme\DivX
2008-08-05 10:33 . 2008-08-05 10:33 <DIR> d-------- C:\Programme\Microsoft Games
2008-08-05 10:27 . 2008-08-05 10:27 126,976 --a------ C:\WINDOWS\War3Unin.exe
2008-08-05 10:27 . 2008-08-06 09:48 21,895 --a------ C:\WINDOWS\War3Unin.dat
2008-08-05 10:27 . 2008-08-05 10:27 2,829 --a------ C:\WINDOWS\War3Unin.pif
2008-08-05 10:21 . 2008-08-13 17:41 <DIR> d-------- C:\Programme\Warcraft III
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-30 10:12 --------- d-----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-08-30 08:44 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\RssPopper
2008-08-30 07:37 --------- d-----w C:\Programme\Spybot - Search & Destroy
2008-08-27 00:40 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Azureus
2008-08-13 17:00 --------- d-----w C:\Programme\Gemeinsame Dateien\Blizzard Entertainment
2008-08-13 14:21 --------- d-----w C:\Programme\Diablo II
2008-08-08 22:31 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\dvdcss
2008-08-05 21:47 --------- d--h--w C:\Programme\InstallShield Installation Information
2008-08-05 08:02 94,208 ----a-w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\ezplay.sys
2008-08-05 08:02 47,360 ----a-w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\pcouffin.sys
2008-08-05 08:02 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\Vso
2008-07-24 22:13 94,208 ----a-w C:\WINDOWS\system32\drivers\ezplay.sys
2008-07-24 22:13 47,360 ----a-w C:\WINDOWS\system32\drivers\pcouffin.sys
2008-07-24 21:44 --------- d-----w C:\Programme\DAEMON Tools Toolbar
2008-07-24 21:44 --------- d-----w C:\Programme\DAEMON Tools Lite
2008-07-24 21:40 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-24 21:40 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\DAEMON Tools
2008-07-23 16:50 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-07-23 16:50 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-07-23 16:50 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2008-07-21 16:16 --------- d-----w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\teamspeak2
2008-07-14 07:59 16,760 ----a-w C:\Dokumente und Einstellungen\Michael\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2008-07-06 11:38 --------- d-----w C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"genadmmon"="C:\WINDOWS\system32\krunadqb.exe" [2008-09-05 94208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"FreePDF Assistant"="C:\Programme\FreePDF_XP\fpassist.exe" [2007-06-26 312320]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-17 266497]
"QuickTime Task"="C:\Programme\QuickTime\QTTask.exe" [2008-03-28 413696]
"iTunesHelper"="C:\Programme\iTunes\iTunesHelper.exe" [2008-03-30 267048]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoRecentDocsNetHood"= 01000000
"NoSMMyPictures"= 01000000
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Microsoft Office.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Nokia Nseries PC Suite.lnk]
path=C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\Nokia Nseries PC Suite.lnk
backup=C:\WINDOWS\pss\Nokia Nseries PC Suite.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NokiaMServer]
C:\Programme\Gemeinsame Dateien\Nokia\MPlatform\NokiaMServer [X]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
--a------ 2007-02-16 19:49 149024 C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AcronisTimounterMonitor]
--a------ 2007-02-16 19:57 1945960 C:\Programme\Acronis\TrueImageHome\TimounterMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Programme\Adobe\Reader 8.0\Reader\reader_sl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-07-24 17:02 490952 C:\Programme\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
--a------ 2007-05-11 03:08 2512392 C:\WINDOWS\system32\oodtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-06-09 03:28 310520 C:\Programme\Orb Networks\Orb\bin\OrbTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sclauncher]
--a------ 2007-10-11 19:12 94208 C:\Programme\SimpleCenter\bin\win\sclauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 05:00 132496 C:\Programme\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
--a------ 2007-02-16 19:45 1169776 C:\Programme\Acronis\TrueImageHome\TrueImageMonitor.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Programme\\MSN Messenger\\msnmsgr.exe"=
"C:\\Programme\\MSN Messenger\\livecall.exe"=
"C:\\Programme\\Bonjour\\mDNSResponder.exe"=
"C:\\Programme\\iTunes\\iTunes.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\Orb.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbTray.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbStreamerClient.exe"=
"C:\\Programme\\Orb Networks\\Orb\\bin\\OrbChannelScan.exe"=
R0 hotcore3;hotcore3;C:\WINDOWS\system32\drivers\hotcore3.sys [2007-03-07 38448]
S2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;C:\Programme\VMLaunch\BuddyVM.sys [ ]
S3 efipsk;efipsk;C:\DOKUME~1\Michael\LOKALE~1\Temp\efipsk.sys [ ]
.
Inhalt des "geplante Tasks" Ordners
.
- - - - Entfernte verwaiste Registrierungseintr„ge - - - -
HKCU-Run-ActHlp - C:\WINDOWS\system32\hetihaxg.exe
HKCU-Run-InstallProgram - C:\WINDOWS\system32\dgjwzkzw.exe
HKCU-Run-DscCmdApp - C:\WINDOWS\system32\jwpapgfa.exe
HKLM-Explorer_Run-fLerPpReez - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dezgpgdu\rqhsryjo.exe
SSODL-cfgadmui-{607FDFE3-DFB9-9F82-EE3F-04FB8D09B0CF} - C:\Programme\vduorkd\cfgadmui.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-05 22:27:18
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostart Eintr„ge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
------------------------ Weitere, laufende Prozesse ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-09-05 22:30:57 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2008-09-05 20:30:51
ComboFix2.txt 2008-08-31 22:09:02
Pre-Run: 9,698,295,808 Bytes frei
Post-Run: 9,691,066,368 Bytes frei
210 --- E O F --- 2008-08-18 01:01:55
2. HJT Log made right after CFScript finished:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:34:07, on 05.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\krunadqb.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\krunadqb.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [genadmmon] C:\WINDOWS\system32\krunadqb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Run POPFile.lnk = C:\Programme\POPFile\runpopfile.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5883 bytes
3. MBAM Log // just sais that it didnt find anything
Malwarebytes' Anti-Malware 1.26
Datenbank Version: 1118
Windows 5.1.2600 Service Pack 2
06.09.2008 15:15:16
mbam-log-2008-09-06 (15-15-16).txt
Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|H:\|X:\|)
Durchsuchte Objekte: 103565
Laufzeit: 2 hour(s), 58 minute(s), 40 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
4. HJT Log made after MBAM Scan was done
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:18:48, on 06.09.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Programme\FreePDF_XP\fpassist.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\krunadqb.exe
C:\PROGRA~1\POPFile\popfileib.exe
C:\Programme\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [genadmmon] C:\WINDOWS\system32\krunadqb.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Run POPFile.lnk = C:\Programme\POPFile\runpopfile.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Subscribe in RSS Popper - C:\Programme\RSS Popper\ie_subscribe.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{81F853C6-20FF-42E7-B7EB-8F0D751F475E}: NameServer = 192.168.1.1,0.0.0.0
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Programme\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Programme\Gemeinsame Dateien\Acronis\Schedule2\schedul2.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Programme\Gemeinsame Dateien\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programme\Nokia\PC Connectivity Solution\ServiceLayer.exe
--
End of file - 5416 bytes
might this be the reason for the fake alarm?
O4 - HKCU\..\Run: [genadmmon] C:\WINDOWS\system32\krunadqb.exe
pskelley
2008-09-06, 16:58
i still get a fake windows firewall popup...
Please post error message word for word, I have no idea what it is until I research it.
I am having issues understanding the language and will continue, but I suggest in the future you post here:
GERMAN/DUTCH FORUM
http://forums.spybot.info/forumdisplay.php?f=15
1) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm. Click OK.
You may reverse this for safety when we are finished.
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
O4 - HKCU\..\Run: [genadmmon] C:\WINDOWS\system32\krunadqb.exe
Close all programs but HJT and all browser windows, then click on "Fix Checked"
Right click Start > Explore and navigate to these files/folders and delete them if there.
C:\WINDOWS\system32\krunadqb.exe <<< delete that file
Restart and post a new HJT log and any error message you receive "word for word"
Thanks
pskelley
2008-09-15, 14:36
2008-09-06, 09:58 <<< no response since, this topic is closed:sad: