View Full Version : Help with virtumonde removal
Hi,
I've been infected by numerous malware and have removed most of them with Spybot. The only one still listed by a Spybot scan is virtumonde. Other than that what I notice now is IE popups with adds to antivirus software, that I cannot surf to certain sites (liked forums.spybot.info, beepingcomputer etc) and that all time stamps are ended with the words "Virus Alert!", including in the task area.
I use AVG antivirus 8 Free edition.
Below is the HJT log from running Trend Micro HiJackThis v2.0.2. I hope format is OK.
Thanks a lot for your help!
Johan
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:37: VIRUS ALERT!, on 2008-09-16
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\XIMETA\NetDisk\LDServ.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\V0470Mon.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program\AVG\AVG8\avgtray.exe
C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program\Messenger\msmsgs.exe
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe
C:\Program\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program\Spybot - Search & Destroy\TeaTimer.exe
C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\XIMETA\NetDisk\Admin.exe
C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.BIN
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O1 - Hosts: HPC6D86A.lan HP001B78C6D86A
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
O4 - HKLM\..\Run: [V0470Mon.exe] C:\WINDOWS\V0470Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [0806ecf4] rundll32.exe "C:\WINDOWS\system32\essvkais.dll",b
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser verktyg för mediekontroll.lnk = C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Snabbstart.lnk = C:\Program\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetDisk Administrator.lnk = C:\Program\XIMETA\NetDisk\Admin.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183158670792
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.beneccus.com/controls/IlosoftImageUpload.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll blcgrl.dll
O21 - SSODL: dtseqrxk - {F502CDF1-CA12-4AAA-93B2-81008BF63271} - C:\WINDOWS\dtseqrxk.dll (file missing)
O21 - SSODL: mgxfebsq - {8A0C8ED7-D439-4B93-BAE2-FB4D2081B98D} - C:\WINDOWS\mgxfebsq.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LANSCSI Helper Service (LanScsiHelper) - XIMETA, Inc. - C:\Program\XIMETA\NetDisk\LDServ.exe
O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat6) - Apache Software Foundation - C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe
--
End of file - 8818 bytes
pskelley
2008-09-18, 15:07
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.
Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
The junk can be tough to remove, so do not expect fast or easy.
1) We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
* Run Spybot-S&D in Advanced Mode.
* If it is not already set to do this Go to the Mode menu select "Advanced Mode"
* On the left hand side, Click on Tools
* Then click on the Resident Icon in the List
* Uncheck "Resident TeaTimer" and OK any prompts.
* Restart your computer.
(leave TT disabled until we finish)
2) A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Remove any old copies of combofix before you proceed.
Thanks to sUBs and anyone else who helped with this fix.
It is important that it is saved directly to your Desktop.
Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post the combofix log and a new HJT log.
Thanks
Thanks a million for your reply!
Logs attached below. The ComboFix log states that there is no recovery console installed; I did follow the steps in order to install the console so I do not know why that is stated. Hopefully it is not serious.
Thanks again for your help!
Johan
ComboFix log:
ComboFix 08-09-16.05 - Johan 2008-09-18 20:58:04.1 - NTFSx86
Running from: C:\Documents and Settings\Johan\Skrivbord\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Johan\Cookies\johan@clicktorrent[1].txt
C:\WINDOWS\eeqb.exe
C:\WINDOWS\mgxfebsq.dll
C:\WINDOWS\system32\actskn43.ocx
C:\WINDOWS\system32\ajqjht.dll
C:\WINDOWS\system32\blcgrl.dll
C:\WINDOWS\system32\essvkais.dll
C:\WINDOWS\system32\evbghbxi.ini
C:\WINDOWS\system32\fcrrgqno.ini
C:\WINDOWS\system32\grolatdt.dll
C:\WINDOWS\system32\ixbhgbve.dll
C:\WINDOWS\system32\jlkTCcdd.ini
C:\WINDOWS\system32\jlkTCcdd.ini2
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nnnnKcCr.dll
C:\WINDOWS\system32\oajjcufl.dll
C:\WINDOWS\system32\qdmutknc.dll
C:\WINDOWS\system32\siakvsse.ini
C:\WINDOWS\system32\siakvsse.ini2
C:\WINDOWS\system32\siakvsse.tmp
C:\WINDOWS\system32\tdssadw.dll
C:\WINDOWS\system32\tdssinit.dll
C:\WINDOWS\system32\tdssl.dll
C:\WINDOWS\system32\tdsslog.dll
C:\WINDOWS\system32\tdssmain.dll
C:\WINDOWS\system32\tdssserf.dll
C:\WINDOWS\system32\tdssservers.dat
C:\WINDOWS\system32\vmpxuydt.ini
C:\WINDOWS\system32\vscgpa.dll
.
((((((((((((((((((((((((( Files Created from 2008-08-18 to 2008-09-18 )))))))))))))))))))))))))))))))
.
2008-09-15 23:37 . 2008-09-15 23:44 <KAT> d-------- C:\Program\Spybot - Search & Destroy
2008-09-15 23:37 . 2008-09-15 23:51 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-15 22:32 . 2008-09-15 22:48 2,982 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-15 19:08 . 2008-09-15 19:08 137,344 --a------ C:\WINDOWS\system32\ojsugunx.dll
2008-09-15 19:08 . 2008-09-15 19:08 137,344 --a------ C:\WINDOWS\system32\gsglep.dll
2008-09-15 18:58 . 2008-09-15 18:58 <KAT> d-------- C:\Program\Trend Micro
2008-09-14 23:57 . 2008-09-14 23:57 326,144 --a------ C:\WINDOWS\system32\ddcCTklj.dll
2008-09-14 23:48 . 2008-09-14 23:48 <KAT> d-------- C:\Program\Apple Software Update
2008-09-14 23:48 . 2008-09-14 23:48 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-14 20:39 . 2008-09-14 20:39 <KAT> d-------- C:\Documents and Settings\Pernilla\Application Data\AVGTOOLBAR
2008-09-10 21:59 . 2008-09-11 21:06 27 --a------ C:\WINDOWS\pccoach.ini
2008-09-10 21:56 . 2008-09-10 21:56 <KAT> d-------- C:\Program Files
2008-08-21 21:27 . 2008-09-14 23:41 <KAT> d-------- C:\Documents and Settings\Johan\Application Data\BitTorrent
2008-08-21 21:26 . 2008-09-01 20:13 <KAT> d-------- C:\Program\DNA
2008-08-21 21:26 . 2008-08-21 21:26 <KAT> d-------- C:\Program\BitTorrent
2008-08-21 21:26 . 2008-08-31 00:47 <KAT> d-------- C:\Documents and Settings\Johan\Application Data\DNA
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-18 19:15 --------- d-----w C:\Documents and Settings\Johan\Application Data\OpenOffice.org2
2008-09-15 18:45 --------- d-----w C:\Documents and Settings\Johan\Application Data\Azureus
2008-09-14 21:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-09-14 15:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-10 19:56 --------- d--h--w C:\Program\InstallShield Installation Information
2008-09-10 16:56 --------- d-----w C:\Program\Paint.NET
2008-08-31 13:05 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-26 20:25 --------- d-----w C:\Program\HP
2008-08-09 23:06 --------- d-----w C:\Program\Microsoft Bootvis
2008-05-24 21:30 50,992 ----a-w C:\Documents and Settings\Johan\Application Data\GDIPFONTCACHEV1.DAT
2007-12-26 21:33 28,160 ----a-w C:\Documents and Settings\Pernilla\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5560826D-E5A9-468A-B4F1-72917FA8F1D2}]
2008-09-14 23:57 326144 --a------ C:\WINDOWS\system32\ddcCTklj.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 356352]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Creative Live! Cam Manager"="C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552]
"SpybotSD TeaTimer"="C:\Program\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 1832272]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VaCtrl"="C:\Program\VoiceAge\Common\VaCtrl.exe" [2003-08-28 90112]
"V0470Mon.exe"="C:\WINDOWS\V0470Mon.exe" [2007-04-11 32768]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2007-06-29 286720]
"PRONoMgr.exe"="C:\Program\Intel\NCS\PROSet\PRONoMgr.exe" [2002-12-18 86016]
"HP Software Update"="C:\Program\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"googletalk"="C:\Program\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"Cpqset"="C:\Program\HPQ\Default Settings\cpqset.exe" [2003-05-01 180316]
"AVG8_TRAY"="C:\Program\AVG\AVG8\avgtray.exe" [2008-08-31 1235736]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-24 327680]
"Adobe Reader Speed Launcher"="C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-06 C:\WINDOWS\AGRSMMSG.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"Picasa Media Detector"="C:\Program\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]
C:\Documents and Settings\Johan\Start-meny\Program\Autostart\
OpenOffice.org 2.4.lnk - C:\Program\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
Picture Motion Browser verktyg f”r mediekontroll.lnk - C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-04-26 385024]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
HP Photosmart Premier Snabbstart.lnk - C:\Program\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
NetDisk Administrator.lnk - C:\Program\XIMETA\NetDisk\Admin.exe [2004-04-30 139345]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-03-24 12:26 110592 C:\WINDOWS\system32\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll blcgrl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= vdrcodec.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"msacm.l3codec"= l3codecp.acm
"msacm.VaAcelpNet"= VaAcelpNet.acm
"msacm.VaAmrNbF"= VaAmrNbF.acm
"msacm.VaAmrNbV"= VaAmrNbV.acm
"vidc.dvsd"= pdvcodec.dll
"vidc.mjpg"= Pvmjpg30.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program\\Azureus\\Azureus.exe"=
"C:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"=
"C:\\Program\\Mozilla Firefox\\firefox.exe"=
"C:\\Program\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\bin\\java.exe"=
"C:\\Program\\SightSpeed\\SightSpeed.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK2\\bin\\emulator.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK1\\bin\\emulator.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\jre\\bin\\java.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\OnDeviceDebug\\bin\\serialproxy.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\OnDeviceDebug\\bin\\emulator.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK2\\bin\\zayit.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK1\\bin\\utils.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\jre\\bin\\javaw.exe"=
"C:\\Program\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=
"C:\\Program\\BitTorrent\\bittorrent.exe"=
R0 lpx;LPX Protocol;C:\WINDOWS\system32\DRIVERS\lpx.sys [2004-04-30 108416]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-31 97928]
R2 avg8wd;AVG8 WatchDog;C:\Program\AVG\AVG8\avgwdsvc.exe [2008-08-31 231704]
R2 LanScsiHelper;LANSCSI Helper Service;C:\Program\XIMETA\NetDisk\LDServ.exe [2004-04-30 98387]
R3 lanscsibus;LANSCSI Bus Driver for NetDisk;C:\WINDOWS\system32\DRIVERS\lanscsibus.sys [2004-04-30 40960]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\system32\Drivers\WBSD.SYS [2003-03-20 26240]
S3 lanscsiminiport;LANSCSI Miniport Driver for NetDisk;C:\WINDOWS\system32\DRIVERS\lanscsiminiport.sys [2004-04-30 6784]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 Tomcat6;Apache Tomcat;C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [2008-01-29 57344]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{828b6872-5beb-11dc-8c28-00042371c5c4}]
\Shell\AutoRun\command - F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f90a33a4-2922-11dd-8d4b-00042371c5c4}]
\Shell\AutoRun\command - H:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
BHO-{149F11BC-D5BF-4491-B94E-C72FB081F35D} - C:\WINDOWS\system32\nnnnKcCr.dll
BHO-{8a60f9d2-5e93-471b-8aa8-972515466ccc} - C:\WINDOWS\system32\blcgrl.dll
BHO-{D209A260-0F6E-4203-BE52-BD7790D69467} - (no file)
BHO-{F54142EF-256E-405C-AA2D-257E7A2257A5} - (no file)
HKCU-Run-Google Update - C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe
HKLM-Run-0806ecf4 - C:\WINDOWS\system32\essvkais.dll
ShellExecuteHooks-{149F11BC-D5BF-4491-B94E-C72FB081F35D} - C:\WINDOWS\system32\nnnnKcCr.dll
SSODL-dtseqrxk-{F502CDF1-CA12-4AAA-93B2-81008BF63271} - C:\WINDOWS\dtseqrxk.dll
SSODL-mgxfebsq-{8A0C8ED7-D439-4B93-BAE2-FB4D2081B98D} - C:\WINDOWS\mgxfebsq.dll
Notify-nnnnKcCr - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Johan\Application Data\Mozilla\Firefox\Profiles\qb12nyry.default\
FF -: plugin - C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program\DNA\plugins\npbtdna.dll
FF -: plugin - C:\Program\Mozilla Firefox\plugins\npbittorrent.dll
FF -: plugin - C:\WINDOWS\system32\C2MP\npdivx32.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-18 21:14:11
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program\HPQ\Default Settings\cpqset.exe?|????????????3?7?0?6??????? ?pTB????????? ?????B????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"C:\Program\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"C:\Program\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.bin
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program\HP\Digital Imaging\bin\hpqste08.exe
C:\WINDOWS\system32\HPZinw12.exe
.
**************************************************************************
.
Completion time: 2008-09-18 21:23:00 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-18 19:22:55
Pre-Run: 7,508,484,096 byte ledigt
Post-Run: 7,588,757,504 byte ledigt
240 --- E O F --- 2008-09-10 01:08:18
HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:32, on 2008-09-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\XIMETA\NetDisk\LDServ.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\V0470Mon.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program\AVG\AVG8\avgtray.exe
C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program\Messenger\msmsgs.exe
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe
C:\Program\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program\Spybot - Search & Destroy\TeaTimer.exe
C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program\XIMETA\NetDisk\Admin.exe
C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.BIN
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\WINDOWS\explorer.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
O4 - HKLM\..\Run: [V0470Mon.exe] C:\WINDOWS\V0470Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser verktyg för mediekontroll.lnk = C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Snabbstart.lnk = C:\Program\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetDisk Administrator.lnk = C:\Program\XIMETA\NetDisk\Admin.exe
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183158670792
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.beneccus.com/controls/IlosoftImageUpload.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll blcgrl.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LANSCSI Helper Service (LanScsiHelper) - XIMETA, Inc. - C:\Program\XIMETA\NetDisk\LDServ.exe
O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat6) - Apache Software Foundation - C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe
--
End of file - 8578 bytes
pskelley
2008-09-18, 23:07
Thanks for returning your information, not sure about Recovery Console, we will look into that before we finish.
The first instruction I posted was to disable TeaTimer and to leave TeaTimer disabled until we finish yet it is running in the new HJT log? :sad:
C:\Program\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program\Spybot - Search & Destroy\TeaTimer.exe
Follow the instructions to disable TeaTimer and post a new HJT log.
Hi again,
That is odd; i did follow your instructions and disabled TT. Really.
Anyways, I did it again and restarted the computer, and went back into Spybot tools to check if TT was disabled or not - and this time it was. I guess I did something wrong.
New HJT log below.
Thanks again!
Johan
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:22, on 2008-09-18
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\XIMETA\NetDisk\LDServ.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\Explorer.EXE
C:\Program\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\V0470Mon.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program\AVG\AVG8\avgtray.exe
C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program\XIMETA\NetDisk\Admin.exe
C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.BIN
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
O4 - HKLM\..\Run: [V0470Mon.exe] C:\WINDOWS\V0470Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser verktyg för mediekontroll.lnk = C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Snabbstart.lnk = C:\Program\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetDisk Administrator.lnk = C:\Program\XIMETA\NetDisk\Admin.exe
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183158670792
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.beneccus.com/controls/IlosoftImageUpload.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll blcgrl.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LANSCSI Helper Service (LanScsiHelper) - XIMETA, Inc. - C:\Program\XIMETA\NetDisk\LDServ.exe
O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat6) - Apache Software Foundation - C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe
--
End of file - 8318 bytes
pskelley
2008-09-18, 23:54
BitTorrent and Azureus: <<< see this information: http://forums.spybot.info/showthread.php?t=282
If your helper detects the presence of such programs on your computer he/she will ask you to remove them. Help will be withdrawn should you not agree to their removal.
Uninstall all p2p programs on the computer.
You had a very infected computer.
1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.
2) Open notepad and copy/paste the text in the codebox below into it:
File::
C:\WINDOWS\system32\ojsugunx.dll
C:\WINDOWS\system32\ddcCTklj.dll
C:\WINDOWS\system32\gsglep.dll
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-
"AppInit_DLLs"="avgrsstx.dll"
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5560826D-E5A9-468A-B4F1-72917FA8F1D2}]
Save this as CFScript
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Referring to the picture above, drag CFScript into ComboFix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)
3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
(leave this if you set it that way)
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O20 - AppInit_DLLs: avgrsstx.dll blcgrl.dll
Close all programs but HJT and all browser windows, then click on "Fix Checked"
4) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.
*Cleaning Prefetch may results in a few slow starts until the folder is repopulated:
http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html
5) Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe
* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post the log from CFScript, the log from MBAM and a new HJT log.
How is the computer running now?
Thanks
Followed your instructions and things seems to be fully ok! Perhaps it is too early to tell but I have not run into anything strange so far. Logs included below.
Q: When the computer was infected I could not download the antimalware programs since it refused to connect to those web sites. Instead I used an USB dongle and moved the programs from another computer, not infected (as far as I know). Should I expect the USB dongle to be infected know? Which program/s should I use to check and clean it with?
Again, thanks a million!
Johan
CFSript log:
ComboFix 08-09-16.05 - Johan 2008-09-18 23:15:47.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.226 [GMT 2:00]Running from: C:\Documents and Settings\Johan\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Johan\Skrivbord\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\ddcCTklj.dll
C:\WINDOWS\system32\gsglep.dll
C:\WINDOWS\system32\jlkTCcdd.ini
C:\WINDOWS\system32\jlkTCcdd.ini2
C:\WINDOWS\system32\ojsugunx.dll
.
((((((((((((((((((((((((( Files Created from 2008-08-18 to 2008-09-18 )))))))))))))))))))))))))))))))
.
2008-09-18 21:23 . 2008-09-18 21:23 <KAT> d-------- C:\WINDOWS\system32\config\systemprofile\Lokala inställningar
2008-09-18 21:23 . 2008-09-18 21:23 <KAT> d-------- C:\Documents and Settings\Pernilla\Lokala inställningar
2008-09-18 21:23 . 2008-09-18 21:23 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala inställningar
2008-09-18 21:23 . 2008-09-18 21:23 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala inställningar
2008-09-18 21:23 . 2008-09-18 21:23 <KAT> d-------- C:\Documents and Settings\Johan\Lokala inställningar
2008-09-15 23:37 . 2008-09-15 23:44 <KAT> d-------- C:\Program\Spybot - Search & Destroy
2008-09-15 23:37 . 2008-09-15 23:51 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-15 22:32 . 2008-09-15 22:48 2,982 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-15 18:58 . 2008-09-15 18:58 <KAT> d-------- C:\Program\Trend Micro
2008-09-14 23:48 . 2008-09-14 23:48 <KAT> d-------- C:\Program\Apple Software Update
2008-09-14 23:48 . 2008-09-14 23:48 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-09-14 20:39 . 2008-09-14 20:39 <KAT> d-------- C:\Documents and Settings\Pernilla\Application Data\AVGTOOLBAR
2008-09-10 21:59 . 2008-09-11 21:06 27 --a------ C:\WINDOWS\pccoach.ini
2008-09-10 21:56 . 2008-09-10 21:56 <KAT> d-------- C:\Program Files
2008-08-21 21:26 . 2008-09-01 20:13 <KAT> d-------- C:\Program\DNA
2008-08-21 21:26 . 2008-08-31 00:47 <KAT> d-------- C:\Documents and Settings\Johan\Application Data\DNA
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-18 21:09 --------- d-----w C:\Program\Azureus
2008-09-18 20:20 --------- d-----w C:\Documents and Settings\Johan\Application Data\OpenOffice.org2
2008-09-15 18:45 --------- d-----w C:\Documents and Settings\Johan\Application Data\Azureus
2008-09-14 21:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg8
2008-09-14 15:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-10 19:56 --------- d--h--w C:\Program\InstallShield Installation Information
2008-09-10 16:56 --------- d-----w C:\Program\Paint.NET
2008-08-31 13:05 97,928 ----a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-08-26 20:25 --------- d-----w C:\Program\HP
2008-08-09 23:06 --------- d-----w C:\Program\Microsoft Bootvis
2008-05-24 21:30 50,992 ----a-w C:\Documents and Settings\Johan\Application Data\GDIPFONTCACHEV1.DAT
2007-12-26 21:33 28,160 ----a-w C:\Documents and Settings\Pernilla\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"="C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 356352]
"MSMSGS"="C:\Program\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2007-08-29 171464]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Creative Live! Cam Manager"="C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe" [2007-05-02 151552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VaCtrl"="C:\Program\VoiceAge\Common\VaCtrl.exe" [2003-08-28 90112]
"V0470Mon.exe"="C:\WINDOWS\V0470Mon.exe" [2007-04-11 32768]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2007-06-29 286720]
"PRONoMgr.exe"="C:\Program\Intel\NCS\PROSet\PRONoMgr.exe" [2002-12-18 86016]
"HP Software Update"="C:\Program\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"googletalk"="C:\Program\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2006-06-13 127036]
"Cpqset"="C:\Program\HPQ\Default Settings\cpqset.exe" [2003-05-01 180316]
"AVG8_TRAY"="C:\Program\AVG\AVG8\avgtray.exe" [2008-08-31 1235736]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-04-24 327680]
"Adobe Reader Speed Launcher"="C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 C:\WINDOWS\system32\Ati2mdxx.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2003-05-06 C:\WINDOWS\AGRSMMSG.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 15360]
"Picasa Media Detector"="C:\Program\Picasa2\PicasaMediaDetector.exe" [2007-09-28 443968]
C:\Documents and Settings\Johan\Start-meny\Program\Autostart\
OpenOffice.org 2.4.lnk - C:\Program\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
Picture Motion Browser verktyg f”r mediekontroll.lnk - C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2008-04-26 385024]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
HP Digital Imaging Monitor.lnk - C:\Program\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
HP Photosmart Premier Snabbstart.lnk - C:\Program\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
NetDisk Administrator.lnk - C:\Program\XIMETA\NetDisk\Admin.exe [2004-04-30 139345]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring]
2003-03-24 12:26 110592 C:\WINDOWS\system32\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= vdrcodec.dll
"vidc.hfyu"= huffyuv.dll
"msacm.divxa32"= DivXa32.acm
"msacm.l3codec"= l3codecp.acm
"msacm.VaAcelpNet"= VaAcelpNet.acm
"msacm.VaAmrNbF"= VaAmrNbF.acm
"msacm.VaAmrNbV"= VaAmrNbV.acm
"vidc.dvsd"= pdvcodec.dll
"vidc.mjpg"= Pvmjpg30.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program\\Microsoft Office\\Office10\\FRONTPG.EXE"=
"C:\\Program\\Mozilla Firefox\\firefox.exe"=
"C:\\Program\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\bin\\java.exe"=
"C:\\Program\\SightSpeed\\SightSpeed.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK2\\bin\\emulator.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK1\\bin\\emulator.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\jre\\bin\\java.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\OnDeviceDebug\\bin\\serialproxy.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\OnDeviceDebug\\bin\\emulator.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK2\\bin\\zayit.exe"=
"C:\\WINDOWS\\system32\\java.exe"=
"C:\\Program\\SonyEricsson\\JavaME_SDK_CLDC\\PC_Emulation\\WTK1\\bin\\utils.exe"=
"C:\\Program\\Java\\jdk1.6.0_04\\jre\\bin\\javaw.exe"=
"C:\\Program\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\RM.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\PMSRegisterFile.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\umi.exe"=
"C:\\Program\\Pinnacle\\VideoSpin\\Programs\\VideoSpin.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\RM.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\Studio.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\PMSRegisterFile.exe"=
"C:\\Program\\Pinnacle\\Studio 11\\programs\\umi.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=
R0 lpx;LPX Protocol;C:\WINDOWS\system32\DRIVERS\lpx.sys [2004-04-30 108416]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-31 97928]
R2 avg8wd;AVG8 WatchDog;C:\Program\AVG\AVG8\avgwdsvc.exe [2008-08-31 231704]
R2 LanScsiHelper;LANSCSI Helper Service;C:\Program\XIMETA\NetDisk\LDServ.exe [2004-04-30 98387]
R3 lanscsibus;LANSCSI Bus Driver for NetDisk;C:\WINDOWS\system32\DRIVERS\lanscsibus.sys [2004-04-30 40960]
R3 WBSD;Winbond Secure Digital Storage (SD/MMC) Device Driver;C:\WINDOWS\system32\Drivers\WBSD.SYS [2003-03-20 26240]
S3 lanscsiminiport;LANSCSI Miniport Driver for NetDisk;C:\WINDOWS\system32\DRIVERS\lanscsiminiport.sys [2004-04-30 6784]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2005-08-02 32512]
S3 Tomcat6;Apache Tomcat;C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe [2008-01-29 57344]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{828b6872-5beb-11dc-8c28-00042371c5c4}]
\Shell\AutoRun\command - F:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f90a33a4-2922-11dd-8d4b-00042371c5c4}]
\Shell\AutoRun\command - H:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
BHO-{71AFE083-3709-4048-B9F1-ECCA77276B96} - C:\WINDOWS\system32\ddcCTklj.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-18 23:25:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program\HPQ\Default Settings\cpqset.exe?|????????????3?7?0?6??????? ?pTB????????? ?????B????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MySQL]
"ImagePath"="\"C:\Program\MySQL\MySQL Server 5.1\bin\mysqld\" --defaults-file=\"C:\Program\MySQL\MySQL Server 5.1\my.ini\" MySQL"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.bin
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqste08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\ComboFix\pv.cfexe
.
**************************************************************************
.
Completion time: 2008-09-18 23:35:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-18 21:35:52
ComboFix2.txt 2008-09-18 19:23:01
Pre-Run: 7,714,115,584 byte ledigt
Post-Run: 7,699,755,008 byte ledigt
198 --- E O F --- 2008-09-10 01:08:18
mbam log (sorry for swedish):
Malwarebytes' Anti-Malware 1.28
Databasversion: 1170
Windows 5.1.2600 Service Pack 2
2008-09-19 01:05:35
mbam-log-2008-09-19 (01-05-35).txt
Skanningstyp: Fullständig skanning (C:\|)
Antal skannade objekt: 164918
Förfluten tid: 1 hour(s), 14 minute(s), 28 second(s)
Infekterade minnesprocesser: 0
Infekterade minnesmoduler: 0
Infekterade registernycklar: 0
Infekterade registervärden: 0
Infekterade registerdataposter: 0
Infekterade mappar: 0
Infekterade filer: 26
Infekterade minnesprocesser:
(Inga illasinnade poster hittades)
Infekterade minnesmoduler:
(Inga illasinnade poster hittades)
Infekterade registernycklar:
(Inga illasinnade poster hittades)
Infekterade registervärden:
(Inga illasinnade poster hittades)
Infekterade registerdataposter:
(Inga illasinnade poster hittades)
Infekterade mappar:
(Inga illasinnade poster hittades)
Infekterade filer:
C:\Qoobox\Quarantine\C\WINDOWS\eeqb.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\oajjcufl.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ajqjht.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\blcgrl.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ddcCTklj.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\essvkais.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\grolatdt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gsglep.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ixbhgbve.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nnnnKcCr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ojsugunx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qdmutknc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vscgpa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000061.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000062.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000063.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000064.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000065.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000066.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000067.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000069.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000070.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP1\A0000075.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP3\A0000270.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP3\A0000271.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{3C911617-EF3F-4C9B-889F-CC5007B9CA38}\RP3\A0000272.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:07, on 2008-09-19
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\system32\ZCfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\XIMETA\NetDisk\LDServ.exe
C:\Program\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\RegSrvc.exe
C:\Program\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\V0470Mon.exe
C:\Program\Java\jre1.6.0_07\bin\jusched.exe
C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
C:\Program\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program\AVG\AVG8\avgtray.exe
C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Program\Messenger\msmsgs.exe
C:\Program\DAEMON Tools\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program\XIMETA\NetDisk\Admin.exe
C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program\OpenOffice.org 2.4\program\soffice.exe
C:\Program\OpenOffice.org 2.4\program\soffice.BIN
C:\Program\HP\Digital Imaging\bin\hpqnrs08.exe
C:\Program\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\HPZinw12.exe
C:\WINDOWS\explorer.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Johan\Lokala inställningar\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\Program\AVG\AVG8\avgtoolbar.dll
O4 - HKLM\..\Run: [VaCtrl] C:\Program\VoiceAge\Common\VaCtrl.exe
O4 - HKLM\..\Run: [V0470Mon.exe] C:\WINDOWS\V0470Mon.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program\Intel\NCS\PROSet\PRONoMgr.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Cpqset] C:\Program\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Program\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [MSMSGS] "C:\Program\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Live! Cam Manager] C:\Program\Creative\Creative Live! Cam\Live! Cam Manager\CTLCMgr.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: Picture Motion Browser verktyg för mediekontroll.lnk = C:\Program\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Snabbstart.lnk = C:\Program\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NetDisk Administrator.lnk = C:\Program\XIMETA\NetDisk\Admin.exe
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1183158670792
O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} (IlosoftImageUploadCtl Class) - http://webc.beneccus.com/controls/IlosoftImageUpload.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\system32\spool\drivers\w32x86\3\HPBOID.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LANSCSI Helper Service (LanScsiHelper) - XIMETA, Inc. - C:\Program\XIMETA\NetDisk\LDServ.exe
O23 - Service: MySQL - Unknown owner - C:\Program\MySQL\MySQL.exe (file missing)
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program\Intel\NCS\Sync\NetSvc.exe
O23 - Service: PCLEPCI - Pinnacle Systems GmbH - C:\WINDOWS\system32\drivers\pclepci.sys
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: SNMP Trap Service (SNMPTRAP) - Unknown owner - C:\WINDOWS\system32\snmptrap.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Apache Tomcat (Tomcat6) - Apache Software Foundation - C:\Program\Apache Software Foundation\Tomcat 6.0\bin\tomcat6.exe
--
End of file - 8753 bytes
pskelley
2008-09-19, 03:18
Should I expect the USB dongle to be infected know?
Good chance of it, I would reformat to be sure:
http://www.scribd.com/doc/231100/Reformatting-a-USB-Drive
This is the next bridge we must cross:
I am sure you saw this:
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Review that information to understand Recovery Console. Installation is optional but if you do not have the CD's needed, as is explained, it can be installed before we remove combofix.
If you do not have access to Recovery Console via a Windows CD, I strongly advise you to install this tool.
If you do not wish to install RC, let me know so I can continue with the cleanup.
If you install RC, post the C:\*CF-RC.txt*.
http://img.photobucket.com/albums/v666/sUBs/RC1-4.gif
Since we do not need to scan with combofix, click NO
http://img.photobucket.com/albums/v666/sUBs/RC_whatnext.gif
http://img.photobucket.com/albums/v666/sUBs/RC_AllDone.gif
Thanks
Hi again,
Recovery console installed. Strangely enough I had to drop the MS file two times on the ComboFix icon for the installation to carry through. But now it is installed and the log is attached below.
BTW, when not being successful in installing the recovery I thought it might have to do that I have a grub boot installed on this machine, as well as Ubuntu. I should have informed you about that earlier, I guess. But in the end it did install, so maybe it is irrelevant.
Cheers,
Johan
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
pskelley
2008-09-19, 20:35
Good job getting RC installed:bigthumb: here is a little information for you.
http://support.microsoft.com/kb/314058
http://support.microsoft.com/kb/307654
Recovery Console is a tool that will allow you to recover from a catastrophic system failure, so let's hope you never need it. Many experts believe Microsoft should have installed it by default.
But in the end it did install, so maybe it is irrelevant.
sUBs has so many failsafes built into this powerful tool that any one of those could have resulted in the first failure.
Remove combofix from the computer like this:
Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png
Clean infected System Restore files like this:
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot
Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
Update MBAM and scan again to make sure we got all of the junk, no need to post a clean scan result.
Update AVG 8 and scan the system, to make sure it is running right and scanning clean.
Let me know all is well at this point and I will close your topic.
Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx
Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml
http://www.malwarecomplaints.info/
Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.
http://users.telenet.be/bluepatchy/miekiemoes/Links.html
I followed below steps and everything seems fine. When I run the MBAM the AVG resident shield alerted me on infections but that seemed to be the MBAM file so I wasn't alarmed by it. I tried to attach a png to show the warning, but 19 kB came out to blurry.
When I run the AVG scan it came up with some warnings on tracker cookies, which I removed.
I'll reformat the USB memory according to the link you included. I assume I can do this without it infecting my machine again, upon insertion?
I also have an external Hard drive that I occasionally connect directly to this machine. It also connects to the home network (it is a Ximeta Netdisk). If I should make sure that this drive is not infected, which scanners do you suggest? I'm guessing MBAM and AVG (as I have it installed), but I thought I'd ask. BTW, why is it not enough to scan with AVG? Is it because AVG is antivirus software only, and it does not care about spyware?
Donation done. Again, thanks a million.
Johan
pskelley
2008-09-20, 20:13
When I run the MBAM the AVG resident shield alerted me on infections
Possibly AVG 8 (which I run also) is seeing junk in the MBAM quarantine (fourth tab from the left) click that tab and "Delete All"
Here is information to help control those junk cookies:
http://www.mvps.org/winhelp2002/cookies.htm
http://www.microsoft.com/windows/ie/using/howto/privacy/config.mspx
I'll reformat the USB memory according to the link you included.
Yes, clear everything, hope you have nothing you need on it, but best not to take a chance something is infected. Once it is formatted, be careful to scan files before you put them on the stick and be super careful where you stick it.
I also have an external Hard drive that I occasionally connect directly to this machine.
if it was pugged in, MBAM should have scanned it (scans all hard drives) and AVG should scan it also. I have not checked recently, but you should be able to choose what drives to scan with AVG 8.
Is it because AVG is antivirus software only, and it does not care about spyware?
AVG will find some spyware but you should have a spyware program onboard along with AVG and your firewall. I would read the links I provided, but I will suggest this good freeware program from Microsoft.
http://www.microsoft.com/windows/products/winfamily/defender/default.mspx
Thanks...Phil