Page 1 of 2 12 LastLast
Results 1 to 10 of 18

Thread: Virus/Malware won't let me connect to Internet

  1. #1
    Junior Member elgarza's Avatar
    Join Date
    Aug 2007
    Posts
    15

    Default Virus/Malware won't let me connect to Internet

    I have some sort of virus/malware infecting my PC and I can no longer connect to the Internet. Additionally, the virus has messed up my automatic Windows updates. When I tried to restart Automatic Updates, I receive a Error 1058 message. Any help would be greatly appreciated.

    HJT log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:37:02 PM, on 12/11/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    H:\Program Files\Bonjour\mDNSResponder.exe
    H:\WINDOWS\eHome\ehRecvr.exe
    H:\WINDOWS\eHome\ehSched.exe
    H:\WINDOWS\system32\mabidwe.exe
    H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    H:\WINDOWS\Explorer.EXE
    H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    h:\PROGRA~1\mcafee.com\agent\mcagent.exe
    H:\WINDOWS\ehome\ehtray.exe
    H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    H:\WINDOWS\stsystra.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    H:\Program Files\Messenger\msmsgs.exe
    H:\WINDOWS\system32\ctfmon.exe
    H:\Program Files\Electronic Arts\EADM\Core.exe
    H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\system32\dllhost.exe
    H:\WINDOWS\eHome\ehmsas.exe
    H:\WINDOWS\system32\wscntfy.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    H:\Program Files\Common Files\Teleca Shared\Generic.exe
    H:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    H:\Program Files\McAfee\MPF\MPFSrv.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    H:\Documents and Settings\Emily\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [mcagent_exe] "H:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EA Core] H:\Program Files\Electronic Arts\EADM\Core.exe -silent
    O4 - Global Startup: Audible Download Manager.lnk = H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://download.windowsupdate.com
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1191984465203
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191984940609
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: fffqck.dll
    O23 - Service: McAfee Application Installer Cleanup (0018621228657861) (0018621228657861mcinstcleanup) - Unknown owner - H:\WINDOWS\TEMP\001862~1.EXE (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: mabidwe - Unknown owner - H:\WINDOWS\system32\mabidwe.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - H:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: solewxte Service (solewxte) - Unknown owner - H:\WINDOWS\system32\solewxte.exe (file missing)

    --
    End of file - 7813 bytes

  2. #2
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Rename HiJackThis.exe on your desktop to something.exe. Then run renamed HijackThis and post back its log
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Junior Member elgarza's Avatar
    Join Date
    Aug 2007
    Posts
    15

    Default

    Here's the new log file. Thanks!

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:03:00 AM, on 12/19/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    H:\Program Files\Bonjour\mDNSResponder.exe
    H:\WINDOWS\eHome\ehRecvr.exe
    H:\WINDOWS\eHome\ehSched.exe
    H:\WINDOWS\system32\mabidwe.exe
    H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Canon\CAL\CALMAIN.exe
    H:\WINDOWS\system32\dllhost.exe
    H:\Program Files\McAfee\MPF\MPFSrv.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    H:\WINDOWS\system32\wscntfy.exe
    h:\PROGRA~1\mcafee.com\agent\mcagent.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\Explorer.EXE
    H:\WINDOWS\ehome\ehtray.exe
    H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    H:\WINDOWS\eHome\ehmsas.exe
    H:\WINDOWS\stsystra.exe
    H:\Program Files\Messenger\msmsgs.exe
    H:\WINDOWS\system32\ctfmon.exe
    H:\Program Files\Electronic Arts\EADM\Core.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    H:\Program Files\Common Files\Teleca Shared\Generic.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    H:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    H:\Documents and Settings\Emily\Desktop\something.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {0FA40AB2-70E9-42A7-A9C1-2011532D774B} - H:\WINDOWS\system32\ljJBuvww.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: {7d87b440-64c8-990a-0c84-6f1a6613caa6} - {6aac3166-a1f6-48c0-a099-8c46044b78d7} - H:\WINDOWS\system32\fffqck.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [mcagent_exe] "H:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EA Core] H:\Program Files\Electronic Arts\EADM\Core.exe -silent
    O4 - Global Startup: Audible Download Manager.lnk = H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://download.windowsupdate.com
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1191984465203
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191984940609
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: fffqck.dll
    O20 - Winlogon Notify: awtqqoPG - awtqqoPG.dll (file missing)
    O23 - Service: McAfee Application Installer Cleanup (0018621228657861) (0018621228657861mcinstcleanup) - Unknown owner - H:\WINDOWS\TEMP\001862~1.EXE (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - H:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: mabidwe - Unknown owner - H:\WINDOWS\system32\mabidwe.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - H:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: solewxte Service (solewxte) - Unknown owner - H:\WINDOWS\system32\solewxte.exe (file missing)

    --
    End of file - 8592 bytes

  4. #4
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi again,


    Please visit this webpage for download links, and instructions for running ComboFix tool:

    http://www.bleepingcomputer.com/comb...o-use-combofix

    Please ensure you read this guide carefully and install the Recovery Console first.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should see a blue screen prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
      Remember to re-enable them afterwards.

    2. Click Yes to allow ComboFix to continue scanning for malware.


    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review, and so we may continue cleansing the system:

    C:\ComboFix.txt
    New HijackThis log.


    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  5. #5
    Junior Member elgarza's Avatar
    Join Date
    Aug 2007
    Posts
    15

    Default

    Okay, I've followed your instructions. Ran ComboFix --> Here are the ComboFix log and a new HJT log. FYI, my hard drive is H:\ (not the typical C:\)

    ComboFix Log

    ComboFix 08-12-18.03 - Emily 2008-12-19 20:36:50.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.554 [GMT -5:00]
    Running from: h:\documents and settings\Emily\Desktop\ComboFix.exe
    Command switches used :: h:\documents and settings\Emily\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    * Created a new restore point
    * Resident AV is active

    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Autorun.inf
    h:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    h:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    h:\documents and settings\LocalService\Local Settings\Temporary Internet Files\fbk.sts
    h:\windows\Install.txt
    h:\windows\system32\aatjdmld.ini
    h:\windows\system32\atsxyzd.sys
    h:\windows\system32\comsa32.sys
    h:\windows\system32\fffqck.dll
    h:\windows\system32\hcdkljaq.dll
    h:\windows\system32\Install.txt
    h:\windows\system32\KBPK080812.log
    h:\windows\system32\ljJBuvww.dll
    h:\windows\system32\mabidwe.exe
    h:\windows\system32\opnmNEww.dll
    h:\windows\system32\prunnet.exe
    h:\windows\system32\syspilog.pil
    h:\windows\system32\udxfytw.sys
    h:\windows\system32\wwvuBJjl.ini
    h:\windows\system32\wwvuBJjl.ini2
    h:\windows\Tasks\eeyogwmy.job

    ----- BITS: Possible infected sites -----

    hxxp://childhe.com
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_AFINDING
    -------\Legacy_AFISICX
    -------\Legacy_MABIDWE
    -------\Legacy_MACIDWE
    -------\Legacy_NOBICYT
    -------\Legacy_NOXTCYR
    -------\Legacy_NOYTCYR
    -------\Legacy_PANDRV
    -------\Legacy_PERFS
    -------\Legacy_ROUTING
    -------\Legacy_ROXTCTM
    -------\Legacy_ROYTCTM
    -------\Legacy_SEICTRL
    -------\Legacy_SOBICYT
    -------\Legacy_SOTPECA
    -------\Legacy_SOXPECA
    -------\Legacy_TDXDOWKC
    -------\Legacy_TDYDOWKC
    -------\Legacy_WSERVING
    -------\Legacy_WSLDOEKD
    -------\Service_mabidwe
    -------\Service_seictrl


    ((((((((((((((((((((((((( Files Created from 2008-11-20 to 2008-12-20 )))))))))))))))))))))))))))))))
    .

    2008-12-15 20:19 . 2008-12-15 20:56 <DIR> d-------- h:\documents and settings\Emily\Application Data\ZoomBrowser EX
    2008-12-15 20:15 . 2008-12-15 20:15 <DIR> d-------- h:\documents and settings\Emily\Application Data\CANON INC
    2008-12-15 20:15 . 2008-12-15 20:25 <DIR> d-------- h:\documents and settings\Emily\Application Data\CameraWindowDC
    2008-12-15 20:01 . 2008-12-15 20:03 <DIR> d-------- h:\program files\Canon
    2008-12-15 20:01 . 2008-12-15 20:01 <DIR> d-------- h:\documents and settings\All Users\Application Data\ZoomBrowser
    2008-12-15 19:59 . 2008-12-15 19:59 <DIR> d-------- h:\program files\Common Files\Canon
    2008-12-08 13:40 . 2008-12-08 13:40 <DIR> d-------- h:\windows\system32\config\systemprofile\Application Data\Sony Ericsson
    2008-12-08 13:39 . 2008-12-08 13:39 <DIR> d-------- h:\documents and settings\LocalService\Application Data\Sony Ericsson
    2008-12-06 09:44 . 2008-12-06 09:44 <DIR> d-------- h:\documents and settings\LocalService\Application Data\SACore
    2008-12-06 08:27 . 2008-12-06 08:27 <DIR> d-------- h:\documents and settings\All Users\Application Data\SiteAdvisor
    2008-12-06 08:27 . 2008-12-19 20:41 9,209 --a------ h:\windows\system32\Config.MPF
    2008-12-06 08:24 . 2008-06-02 14:55 120,136 --a------ h:\windows\system32\drivers\Mpfp.sys
    2008-12-06 08:24 . 2008-06-27 06:08 79,240 --a------ h:\windows\system32\drivers\mfeavfk.sys
    2008-12-06 08:24 . 2008-06-27 06:08 40,488 --a------ h:\windows\system32\drivers\mfesmfk.sys
    2008-12-06 08:24 . 2008-06-27 06:08 35,240 --a------ h:\windows\system32\drivers\mfebopk.sys
    2008-12-06 08:23 . 2008-12-06 08:24 <DIR> d-------- h:\program files\McAfee.com
    2008-12-06 08:23 . 2008-12-07 08:50 <DIR> d-------- h:\program files\McAfee
    2008-12-06 08:23 . 2008-12-06 08:24 <DIR> d-------- h:\program files\Common Files\McAfee
    2008-12-06 08:21 . 2008-06-20 05:41 34,152 --a------ h:\windows\system32\drivers\mferkdk.sys
    2008-12-06 07:56 . 2008-12-06 08:27 <DIR> d-------- h:\documents and settings\All Users\Application Data\McAfee
    2008-12-02 06:56 . 2008-12-02 06:56 54,156 --ah----- h:\windows\QTFont.qfn
    2008-12-02 06:56 . 2008-12-02 06:56 1,409 --a------ h:\windows\QTFont.for
    2008-12-01 16:52 . 2008-12-08 22:02 574 --a------ h:\windows\wininit.ini

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-18 12:11 --------- d---a-w h:\documents and settings\All Users\Application Data\TEMP
    2008-12-09 01:21 --------- d-----w h:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-12-09 01:19 --------- d-----w h:\program files\Spybot - Search & Destroy
    2008-12-06 13:11 --------- d-----w h:\program files\Chill
    2008-11-23 02:56 --------- d-----w h:\program files\Oberon Media
    2008-11-23 02:56 --------- d-----w h:\documents and settings\Emily\Application Data\Flood Light Games
    2008-11-23 02:56 --------- d-----w h:\documents and settings\All Users\Application Data\Flood Light Games
    2008-11-10 00:34 --------- d-----w h:\documents and settings\Emily\Application Data\funkitron
    2008-10-31 22:13 --------- d-----w h:\documents and settings\Emily\Application Data\Red Alert 3
    2008-10-31 21:51 --------- d--h--w h:\program files\InstallShield Installation Information
    2008-10-31 21:51 --------- d-----w h:\program files\Electronic Arts
    2008-10-27 17:16 --------- d-----w h:\program files\Java
    2008-10-25 21:36 --------- d-----w h:\documents and settings\All Users\Application Data\Sandlot Games
    2008-10-24 22:23 --------- d-----w h:\documents and settings\Emily\Application Data\Righteous Kill
    2008-10-24 11:21 455,296 ----a-w h:\windows\system32\drivers\mrxsmb.sys
    2008-10-18 18:06 30 ----a-w h:\documents and settings\Emily\jagex_runescape_preferences.dat
    2008-10-13 20:59 24 ----a-w h:\documents and settings\The Garza's\jagex_runescape_preferences.dat
    2008-08-28 00:33 22,744 -c--a-w h:\documents and settings\Emily\Application Data\GDIPFONTCACHEV1.DAT
    2008-01-21 15:37 21,120 -c--a-w h:\documents and settings\The Garza's\Application Data\GDIPFONTCACHEV1.DAT
    2008-08-14 11:04 32,768 --sha-w h:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008081420080815\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="h:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "ctfmon.exe"="h:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "EA Core"="h:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="h:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "SunJavaUpdateSched"="h:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "Sony Ericsson PC Suite"="h:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
    "Adobe Reader Speed Launcher"="h:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "QuickTime Task"="h:\program files\QuickTime\qttask.exe" [2008-01-31 385024]
    "StartCCC"="h:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "mcagent_exe"="h:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
    "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 h:\windows\stsystra.exe]

    h:\documents and settings\All Users\Start Menu\Programs\Startup\
    Audible Download Manager.lnk - h:\program files\Audible\Bin\AudibleDownloadHelper.exe [2007-11-16 1697112]
    Kodak EasyShare software.lnk - h:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 282624]
    Microsoft Office.lnk - h:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=fffqck.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "h:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "h:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "h:\\Program Files\\Messenger\\msmsgs.exe"=
    "h:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "h:\\Program Files\\iTunes\\iTunes.exe"=
    "h:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"h:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-12-06 203280]
    S2 0018621228657861mcinstcleanup;McAfee Application Installer Cleanup (0018621228657861);h:\windows\TEMP\001862~1.EXE h:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []
    S2 solewxte;solewxte Service;h:\windows\system32\solewxte.exe []
    S3 dump_wmimmc;dump_wmimmc;\??\h:\nexon\KartRider\GameGuard\dump_wmimmc.sys []
    S3 s125bus;Sony Ericsson Device 125 driver (WDM);h:\windows\system32\DRIVERS\s125bus.sys [2007-10-18 83336]
    S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;h:\windows\system32\DRIVERS\s125mdfl.sys [2007-10-18 15112]
    S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;h:\windows\system32\DRIVERS\s125mdm.sys [2007-10-18 108680]
    S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);h:\windows\system32\DRIVERS\s125mgmt.sys [2007-10-18 100488]
    S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;h:\windows\system32\DRIVERS\s125obex.sys [2007-10-18 98696]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-06 h:\windows\Tasks\McDefragTask.job
    - h:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

    2008-12-06 h:\windows\Tasks\McQcTask.job
    - h:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

    2008-01-30 h:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
    - h:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 09:42]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{6aac3166-a1f6-48c0-a099-8c46044b78d7} - h:\windows\system32\fffqck.dll
    BHO-{DFFE8544-EF3F-4374-8C4D-3C4D332D2C8F} - h:\windows\system32\ljJBuvww.dll
    Notify-awtqqoPG - awtqqoPG.dll


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www6.comcast.net/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = localhost;*.local
    IE: E&xport to Microsoft Excel - h:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-19 20:43:37
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(488)
    h:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    h:\windows\system32\ati2evxx.exe
    h:\windows\system32\ati2evxx.exe
    h:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    h:\program files\Bonjour\mDNSResponder.exe
    h:\windows\ehome\ehrecvr.exe
    h:\windows\ehome\ehSched.exe
    h:\progra~1\McAfee\MSC\mcmscsvc.exe
    h:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
    h:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
    h:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
    h:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    h:\windows\ehome\mcrdsvc.exe
    h:\program files\Canon\CAL\CALMAIN.exe
    h:\windows\system32\dllhost.exe
    h:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    h:\windows\ehome\ehmsas.exe
    h:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
    h:\program files\Common Files\Teleca Shared\Generic.exe
    h:\program files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    h:\program files\McAfee\MPF\MpfSrv.exe
    h:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
    .
    **************************************************************************
    .
    Completion time: 2008-12-19 20:48:32 - machine was rebooted [Emily]
    ComboFix-quarantined-files.txt 2008-12-20 01:48:27

    Pre-Run: 113,801,449,472 bytes free
    Post-Run: 113,876,987,904 bytes free

    222 --- E O F --- 2008-11-12 21:55:01


    New HJT log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:51:12 PM, on 12/19/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16735)
    Boot mode: Normal

    Running processes:
    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    H:\Program Files\Bonjour\mDNSResponder.exe
    H:\WINDOWS\eHome\ehRecvr.exe
    H:\WINDOWS\eHome\ehSched.exe
    H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Canon\CAL\CALMAIN.exe
    H:\WINDOWS\system32\dllhost.exe
    h:\PROGRA~1\mcafee.com\agent\mcagent.exe
    H:\WINDOWS\ehome\ehtray.exe
    H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    H:\WINDOWS\stsystra.exe
    H:\Program Files\Messenger\msmsgs.exe
    H:\WINDOWS\system32\ctfmon.exe
    H:\Program Files\Electronic Arts\EADM\Core.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    H:\WINDOWS\eHome\ehmsas.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    H:\Program Files\Common Files\Teleca Shared\Generic.exe
    H:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    H:\Program Files\McAfee\MPF\MPFSrv.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    H:\WINDOWS\explorer.exe
    H:\Documents and Settings\Emily\Desktop\something.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [mcagent_exe] "H:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EA Core] H:\Program Files\Electronic Arts\EADM\Core.exe -silent
    O4 - Global Startup: Audible Download Manager.lnk = H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://download.windowsupdate.com
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1191984465203
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191984940609
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: fffqck.dll
    O23 - Service: McAfee Application Installer Cleanup (0018621228657861) (0018621228657861mcinstcleanup) - Unknown owner - H:\WINDOWS\TEMP\001862~1.EXE (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - H:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - H:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: solewxte Service (solewxte) - Unknown owner - H:\WINDOWS\system32\solewxte.exe (file missing)

    --
    End of file - 8168 bytes

  6. #6
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    You installed wrong version of recovery console. Your XP is pro while you installed recovery console meant for home edition. We have to remove it and install correct one.

    Removing the Recovery Console

    * Restart your computer, click Start, click My Computer, and then double-click the hard disk on which you installed the Recovery Console (H: ).
    * On the Tools menu, click Folder Options, and then click the View tab.
    * Click Show hidden files and folders, click to clear the Hide protected operating system files check box, and then click OK.
    * At the root folder, delete the Cmdcons folder and the Cmldr file.
    * At the root folder, right-click the Boot.ini file, and then click Properties.
    * Click to clear the Read-only check box, and then click OK.
    * WARNING: Modifying the Boot.ini file incorrectly may prevent your computer from restarting. Be sure to delete only the entry for the Recovery Console. Also, it is recommended that you change the attribute for the Boot.ini file back to a read-only state after you complete this procedure. Open the Boot.ini file in Microsoft Windows Notepad, and remove the entry for the Recovery Console. It looks similar to this:

    H:\cmdcons\bootsect.dat="Microsoft Windows Recovery Console" /cmdcons
    * Save the file and close it.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  7. #7
    Junior Member elgarza's Avatar
    Join Date
    Aug 2007
    Posts
    15

    Default

    Done with remove the wrong version of recovery console. Do you want to install the recovery console for Windows XP Pro now?

    Thanks for your patience.

  8. #8
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Yes, alternatively you can start ComboFix and it should ask if you want install recovery console. Answer 'yes' to that
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  9. #9
    Junior Member elgarza's Avatar
    Join Date
    Aug 2007
    Posts
    15

    Default

    Ran ComboFix again with correct recovery console. Here are new log files

    ComboFix log

    ComboFix 08-12-18.03 - Emily 2008-12-20 8:39:51.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.531 [GMT -5:00]
    Running from: h:\documents and settings\Emily\Desktop\ComboFix.exe
    Command switches used :: h:\documents and settings\Emily\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2008-11-20 to 2008-12-20 )))))))))))))))))))))))))))))))
    .

    2008-12-15 20:19 . 2008-12-15 20:56 <DIR> d-------- h:\documents and settings\Emily\Application Data\ZoomBrowser EX
    2008-12-15 20:15 . 2008-12-15 20:15 <DIR> d-------- h:\documents and settings\Emily\Application Data\CANON INC
    2008-12-15 20:15 . 2008-12-15 20:25 <DIR> d-------- h:\documents and settings\Emily\Application Data\CameraWindowDC
    2008-12-15 20:01 . 2008-12-15 20:03 <DIR> d-------- h:\program files\Canon
    2008-12-15 20:01 . 2008-12-15 20:01 <DIR> d-------- h:\documents and settings\All Users\Application Data\ZoomBrowser
    2008-12-15 19:59 . 2008-12-15 19:59 <DIR> d-------- h:\program files\Common Files\Canon
    2008-12-08 13:40 . 2008-12-08 13:40 <DIR> d-------- h:\windows\system32\config\systemprofile\Application Data\Sony Ericsson
    2008-12-08 13:39 . 2008-12-08 13:39 <DIR> d-------- h:\documents and settings\LocalService\Application Data\Sony Ericsson
    2008-12-06 09:44 . 2008-12-06 09:44 <DIR> d-------- h:\documents and settings\LocalService\Application Data\SACore
    2008-12-06 08:27 . 2008-12-06 08:27 <DIR> d-------- h:\documents and settings\All Users\Application Data\SiteAdvisor
    2008-12-06 08:27 . 2008-12-20 07:49 9,343 --a------ h:\windows\system32\Config.MPF
    2008-12-06 08:24 . 2008-06-02 14:55 120,136 --a------ h:\windows\system32\drivers\Mpfp.sys
    2008-12-06 08:24 . 2008-06-27 06:08 79,240 --a------ h:\windows\system32\drivers\mfeavfk.sys
    2008-12-06 08:24 . 2008-06-27 06:08 40,488 --a------ h:\windows\system32\drivers\mfesmfk.sys
    2008-12-06 08:24 . 2008-06-27 06:08 35,240 --a------ h:\windows\system32\drivers\mfebopk.sys
    2008-12-06 08:23 . 2008-12-06 08:24 <DIR> d-------- h:\program files\McAfee.com
    2008-12-06 08:23 . 2008-12-07 08:50 <DIR> d-------- h:\program files\McAfee
    2008-12-06 08:23 . 2008-12-06 08:24 <DIR> d-------- h:\program files\Common Files\McAfee
    2008-12-06 08:21 . 2008-06-20 05:41 34,152 --a------ h:\windows\system32\drivers\mferkdk.sys
    2008-12-06 07:56 . 2008-12-06 08:27 <DIR> d-------- h:\documents and settings\All Users\Application Data\McAfee
    2008-12-02 06:56 . 2008-12-02 06:56 54,156 --ah----- h:\windows\QTFont.qfn
    2008-12-02 06:56 . 2008-12-02 06:56 1,409 --a------ h:\windows\QTFont.for
    2008-12-01 16:52 . 2008-12-08 22:02 574 --a------ h:\windows\wininit.ini

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-12-20 02:18 --------- d-----w h:\program files\Quicken
    2008-12-18 12:11 --------- d---a-w h:\documents and settings\All Users\Application Data\TEMP
    2008-12-09 01:21 --------- d-----w h:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-12-09 01:19 --------- d-----w h:\program files\Spybot - Search & Destroy
    2008-12-06 13:11 --------- d-----w h:\program files\Chill
    2008-11-23 02:56 --------- d-----w h:\program files\Oberon Media
    2008-11-23 02:56 --------- d-----w h:\documents and settings\Emily\Application Data\Flood Light Games
    2008-11-23 02:56 --------- d-----w h:\documents and settings\All Users\Application Data\Flood Light Games
    2008-11-10 00:34 --------- d-----w h:\documents and settings\Emily\Application Data\funkitron
    2008-10-31 22:13 --------- d-----w h:\documents and settings\Emily\Application Data\Red Alert 3
    2008-10-31 21:51 107,888 ----a-w h:\windows\system32\CmdLineExt.dll
    2008-10-31 21:51 --------- d--h--w h:\program files\InstallShield Installation Information
    2008-10-31 21:51 --------- d-----w h:\program files\Electronic Arts
    2008-10-31 21:50 6,176 ----a-w h:\windows\system32\ealregsnapshot1.reg
    2008-10-27 17:16 --------- d-----w h:\program files\Java
    2008-10-25 21:36 --------- d-----w h:\documents and settings\All Users\Application Data\Sandlot Games
    2008-10-24 22:23 --------- d-----w h:\documents and settings\Emily\Application Data\Righteous Kill
    2008-10-24 11:21 455,296 ----a-w h:\windows\system32\drivers\mrxsmb.sys
    2008-10-23 12:36 286,720 ----a-w h:\windows\system32\gdi32.dll
    2008-10-18 18:06 30 ----a-w h:\documents and settings\Emily\jagex_runescape_preferences.dat
    2008-10-16 20:38 826,368 ----a-w h:\windows\system32\wininet.dll
    2008-10-16 19:13 202,776 ----a-w h:\windows\system32\wuweb.dll
    2008-10-16 19:13 1,809,944 ----a-w h:\windows\system32\wuaueng.dll
    2008-10-16 19:12 561,688 ----a-w h:\windows\system32\wuapi.dll
    2008-10-16 19:12 323,608 ----a-w h:\windows\system32\wucltui.dll
    2008-10-16 19:09 92,696 ----a-w h:\windows\system32\cdm.dll
    2008-10-16 19:09 51,224 ----a-w h:\windows\system32\wuauclt.exe
    2008-10-16 19:09 43,544 ----a-w h:\windows\system32\wups2.dll
    2008-10-16 19:08 34,328 ----a-w h:\windows\system32\wups.dll
    2008-10-16 19:06 268,648 ----a-w h:\windows\system32\mucltui.dll
    2008-10-16 19:06 208,744 ----a-w h:\windows\system32\muweb.dll
    2008-10-13 20:59 24 ----a-w h:\documents and settings\The Garza's\jagex_runescape_preferences.dat
    2008-10-03 10:02 247,326 ----a-w h:\windows\system32\strmdll.dll
    2008-09-30 21:43 1,286,152 ----a-w h:\windows\system32\msxml4.dll
    2008-08-28 00:33 22,744 -c--a-w h:\documents and settings\Emily\Application Data\GDIPFONTCACHEV1.DAT
    2008-01-21 15:37 21,120 -c--a-w h:\documents and settings\The Garza's\Application Data\GDIPFONTCACHEV1.DAT
    2008-08-14 11:04 32,768 --sha-w h:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008081420080815\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="h:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "ctfmon.exe"="h:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "EA Core"="h:\program files\Electronic Arts\EADM\Core.exe" [2008-07-22 2772992]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="h:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "SunJavaUpdateSched"="h:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
    "Sony Ericsson PC Suite"="h:\program files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 528384]
    "Adobe Reader Speed Launcher"="h:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
    "QuickTime Task"="h:\program files\QuickTime\qttask.exe" [2008-01-31 385024]
    "StartCCC"="h:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
    "mcagent_exe"="h:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
    "SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 h:\windows\stsystra.exe]

    h:\documents and settings\All Users\Start Menu\Programs\Startup\
    Audible Download Manager.lnk - h:\program files\Audible\Bin\AudibleDownloadHelper.exe [2007-11-16 1697112]
    Kodak EasyShare software.lnk - h:\program files\KODAK\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 282624]
    Microsoft Office.lnk - h:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=fffqck.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "h:\\Program Files\\KODAK\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "h:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "h:\\Program Files\\Messenger\\msmsgs.exe"=
    "h:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "h:\\Program Files\\iTunes\\iTunes.exe"=
    "h:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

    R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"h:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-12-06 203280]
    S2 0018621228657861mcinstcleanup;McAfee Application Installer Cleanup (0018621228657861);h:\windows\TEMP\001862~1.EXE h:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []
    S2 solewxte;solewxte Service;h:\windows\system32\solewxte.exe []
    S3 dump_wmimmc;dump_wmimmc;\??\h:\nexon\KartRider\GameGuard\dump_wmimmc.sys []
    S3 s125bus;Sony Ericsson Device 125 driver (WDM);h:\windows\system32\DRIVERS\s125bus.sys [2007-10-18 83336]
    S3 s125mdfl;Sony Ericsson Device 125 USB WMC Modem Filter;h:\windows\system32\DRIVERS\s125mdfl.sys [2007-10-18 15112]
    S3 s125mdm;Sony Ericsson Device 125 USB WMC Modem Driver;h:\windows\system32\DRIVERS\s125mdm.sys [2007-10-18 108680]
    S3 s125mgmt;Sony Ericsson Device 125 USB WMC Device Management Drivers (WDM);h:\windows\system32\DRIVERS\s125mgmt.sys [2007-10-18 100488]
    S3 s125obex;Sony Ericsson Device 125 USB WMC OBEX Interface;h:\windows\system32\DRIVERS\s125obex.sys [2007-10-18 98696]

    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-06 h:\windows\Tasks\McDefragTask.job
    - h:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

    2008-12-06 h:\windows\Tasks\McQcTask.job
    - h:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

    2008-01-30 h:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
    - h:\program files\Spybot - Search & Destroy\SpybotSD.exe [2008-07-07 09:42]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www6.comcast.net/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = localhost;*.local
    IE: E&xport to Microsoft Excel - h:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-12-20 08:41:10
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(656)
    h:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2008-12-20 8:42:19
    ComboFix-quarantined-files.txt 2008-12-20 13:42:16
    ComboFix2.txt 2008-12-20 13:19:22
    ComboFix3.txt 2008-12-20 01:48:34

    Pre-Run: 113,355,988,992 bytes free
    Post-Run: 113,345,708,032 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    168 --- E O F --- 2008-12-20 02:24:21


    HJT log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:46:20 AM, on 12/20/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    H:\WINDOWS\System32\smss.exe
    H:\WINDOWS\system32\winlogon.exe
    H:\WINDOWS\system32\services.exe
    H:\WINDOWS\system32\lsass.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\svchost.exe
    H:\WINDOWS\System32\svchost.exe
    H:\WINDOWS\system32\Ati2evxx.exe
    H:\WINDOWS\system32\spoolsv.exe
    H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    H:\Program Files\Bonjour\mDNSResponder.exe
    H:\WINDOWS\eHome\ehRecvr.exe
    H:\WINDOWS\eHome\ehSched.exe
    H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    H:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
    H:\WINDOWS\system32\svchost.exe
    H:\Program Files\Canon\CAL\CALMAIN.exe
    H:\WINDOWS\ehome\ehtray.exe
    H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
    H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
    H:\WINDOWS\stsystra.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
    H:\Program Files\McAfee.com\Agent\mcagent.exe
    H:\WINDOWS\system32\ctfmon.exe
    H:\Program Files\Electronic Arts\EADM\Core.exe
    H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
    H:\WINDOWS\system32\dllhost.exe
    H:\WINDOWS\eHome\ehmsas.exe
    H:\Program Files\Common Files\Teleca Shared\Generic.exe
    H:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
    H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    H:\Program Files\McAfee\MPF\MPFSrv.exe
    H:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
    H:\WINDOWS\system32\notepad.exe
    H:\WINDOWS\system32\imapi.exe
    H:\WINDOWS\explorer.exe
    H:\Program Files\Internet Explorer\iexplore.exe
    H:\Documents and Settings\Emily\Desktop\something.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www6.comcast.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
    O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [StartCCC] "H:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
    O4 - HKLM\..\Run: [mcagent_exe] "H:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [ctfmon.exe] H:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EA Core] H:\Program Files\Electronic Arts\EADM\Core.exe -silent
    O4 - Global Startup: Audible Download Manager.lnk = H:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = H:\Program Files\KODAK\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - H:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: http://download.windowsupdate.com
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1191984465203
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1191984940609
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - h:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: fffqck.dll
    O23 - Service: McAfee Application Installer Cleanup (0018621228657861) (0018621228657861mcinstcleanup) - Unknown owner - H:\WINDOWS\TEMP\001862~1.EXE (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - H:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - H:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - H:\Program Files\Canon\CAL\CALMAIN.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - H:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - H:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: solewxte Service (solewxte) - Unknown owner - H:\WINDOWS\system32\solewxte.exe (file missing)

    --
    End of file - 8298 bytes

  10. #10
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Good. Now we continue


    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Driver::
    solewxte
    
    File::
    h:\windows\system32\solewxte.exe
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=""

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Uninstall old Adobe Reader versions and get the latest one here or get Foxit Reader here.


    Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

    Updating Java:
    • Download the latest version of Java Runtime Environment (JRE) 6 Update 11.
    • Scroll down to where it says
      The J2SE Runtime Environment (JRE) allows end-users to run Java applications.
    • Click the
      Download
      button to the right.
    • Select Windows on platform combobox and check the box that says:
      Accept License Agreement. Click continue.
    • The page will refresh.
    • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
    • Close any programs you may have running - especially your web browser.
    • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
    • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
    • Click the Remove or Change/Remove button.
    • Repeat as many times as necessary to remove each Java versions.
    • Reboot your computer once all Java components are removed.
    • Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version. Note: Uncheck MSN toolbar option if you don't want to install it.




    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


    Post back its report, a fresh hjt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •