Page 8 of 11 FirstFirst ... 4567891011 LastLast
Results 71 to 80 of 109

Thread: Browser Hijack and Virus

  1. 2009-09-28, 20:57 #71
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      File::
c:\documents and settings\default\Application Data\cixadura.dat
    • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.


    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  2. 2009-09-29, 07:24 #72
    Off Track
    Off Track is offline
    Member
    Join Date
    Sep 2009
    Posts
    59

    Default Latest Combofix

    Here's the latest ...

    ComboFix 09-09-27.04 - default 09/28/2009 22:59.8.1 - FAT32x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.112 [GMT -6:00]
    Running from: c:\documents and settings\default\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\default\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    FILE ::
    "c:\documents and settings\default\Application Data\cixadura.dat"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\default\Application Data\cixadura.dat

    .
    ((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
    .

    2009-09-23 18:49 . 2009-09-23 18:49 -------- d-----w- c:\documents and settings\default\DoctorWeb
    2009-09-22 13:10 . 2009-09-22 13:10 -------- d-----w- C:\Rooter$
    2009-09-18 19:18 . 2009-09-18 19:18 -------- d-----w- c:\program files\ESET
    2009-09-17 18:31 . 2009-09-17 18:31 4224 ----a-w- c:\windows\system32\dllcache\beep.sys
    2009-09-17 18:31 . 2009-09-17 18:30 4224 ------w- c:\windows\system32\drivers\beep.sys
    2009-09-15 18:29 . 2009-09-15 18:29 -------- d-----w- C:\Combo-Fix
    2009-09-15 17:57 . 2009-09-15 17:57 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE
    2009-09-15 13:02 . 2009-09-15 13:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\AVG8
    2009-09-15 00:01 . 2009-09-15 00:01 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
    2009-09-10 06:09 . 2009-09-10 06:09 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
    2009-09-10 06:04 . 2009-09-10 06:04 -------- d-----w- c:\documents and settings\default\Application Data\AVG8
    2009-09-10 06:04 . 2009-09-10 06:04 -------- d-----w- c:\documents and settings\default\Application Data\AVG8
    2009-09-08 19:28 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
    2009-09-08 05:45 . 2009-09-08 06:01 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-07 04:28 . 2009-09-07 04:28 -------- d-sh--w- c:\documents and settings\default\IECompatCache
    2009-09-07 02:42 . 2009-09-07 02:42 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
    2009-09-07 02:31 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
    2009-09-07 01:52 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
    2009-09-07 01:51 . 2009-09-07 01:51 -------- d--h--w- c:\documents and settings\All Users\Application Data\{EF63305C-BAD7-4144-9208-D65528260864}
    2009-09-07 01:50 . 2009-09-07 01:50 -------- d-----w- c:\program files\Lavasoft
    2009-09-06 22:51 . 2009-09-06 22:51 -------- d-----w- c:\program files\Trend Micro
    2009-09-06 19:57 . 2009-09-06 19:57 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2009-09-06 19:35 . 2009-09-06 19:35 -------- d-----w- c:\windows\system32\scripting
    2009-09-06 19:35 . 2009-09-06 19:35 -------- d-----w- c:\windows\l2schemas
    2009-09-06 19:35 . 2009-09-06 19:35 -------- d-----w- c:\windows\system32\en
    2009-09-06 19:35 . 2009-09-06 19:35 -------- d-----w- c:\windows\system32\bits
    2009-09-06 19:26 . 2009-09-06 19:27 -------- d-----w- c:\windows\EHome
    2009-09-06 18:31 . 2009-09-06 18:31 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
    2009-09-06 18:22 . 2009-09-06 18:22 -------- d-sh--w- c:\documents and settings\default\PrivacIE
    2009-09-06 18:22 . 2009-09-06 18:22 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-09-06 18:21 . 2009-09-06 18:21 -------- d-sh--w- c:\documents and settings\default\IETldCache
    2009-09-06 18:19 . 2009-09-06 18:19 -------- d-----w- c:\windows\ie8updates
    2009-09-06 18:18 . 2009-09-06 18:18 -------- d--h--w- c:\windows\ie8
    2009-09-06 18:17 . 2009-08-07 08:48 100352 ------w- c:\windows\system32\dllcache\iecompat.dll
    2009-09-06 18:17 . 2009-07-03 17:09 12800 ------w- c:\windows\system32\dllcache\xpshims.dll
    2009-09-06 18:17 . 2009-07-03 17:09 594432 ------w- c:\windows\system32\dllcache\msfeeds.dll
    2009-09-06 18:17 . 2009-07-03 17:09 55296 ------w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-09-06 18:17 . 2009-07-03 17:09 246272 ------w- c:\windows\system32\dllcache\ieproxy.dll
    2009-09-06 18:17 . 2009-07-03 17:09 1985536 ------w- c:\windows\system32\dllcache\iertutil.dll
    2009-09-06 18:03 . 2008-10-16 20:06 268648 ----a-w- c:\windows\system32\mucltui.dll
    2009-09-06 01:11 . 2009-09-28 13:25 0 --sha-w- c:\windows\system32\temppf.sys
    2009-09-03 23:16 . 2009-09-03 23:17 45 ----a-w- c:\documents and settings\default\jagex_runescape_preferences2.dat

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-09-10 20:54 . 2008-08-29 04:36 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-09-10 20:53 . 2008-08-29 04:36 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-09-04 00:28 . 2008-07-01 21:59 37 ----a-w- c:\documents and settings\default\jagex_runescape_preferences.dat
    2009-08-18 02:53 . 2009-08-18 02:53 -------- d-----w- c:\program files\iPod
    2009-08-18 02:53 . 2009-08-18 02:53 -------- d-----w- c:\program files\iTunes
    2009-08-18 02:53 . 2009-08-18 02:53 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-08-18 02:51 . 2009-08-18 02:51 -------- d-----w- c:\program files\Bonjour
    2009-08-18 02:50 . 2009-08-18 02:50 -------- d-----w- c:\program files\QuickTime
    2009-08-16 19:04 . 2009-05-23 14:43 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-08-16 19:04 . 2008-01-27 03:36 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-08-16 19:04 . 2009-05-23 14:43 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-08-08 05:48 . 2009-08-08 05:48 -------- d-----w- c:\program files\MSBuild
    2009-08-08 05:48 . 2009-08-08 05:48 -------- d-----w- c:\program files\Reference Assemblies
    2009-08-08 05:44 . 2009-08-08 05:43 -------- d-----w- c:\program files\MSXML 6.0
    2009-08-05 09:01 . 2008-01-23 03:28 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    2009-07-17 19:01 . 2008-01-23 03:25 58880 ----a-w- c:\windows\system32\atl.dll
    2009-07-12 18:21 . 2008-01-23 03:34 233472 ----a-w- c:\windows\system32\wmpdxm.dll
    2009-07-09 18:16 . 2009-08-18 02:47 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-07-09 18:16 . 2008-01-29 04:22 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-07-03 17:09 . 2008-01-23 03:31 915456 ------w- c:\windows\system32\wininet.dll
    2000-10-13 22:56 . 2000-10-13 22:56 23357 ----a-w- c:\program files\folder.htt
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-09-15_19.04.36 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-09-28 02:44 . 2009-09-28 02:44 68961 c:\windows\SYSTEM32\DRIVERS\gmer.sys
    - 2008-01-23 04:22 . 2009-09-15 18:38 49152 c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2008-01-23 04:22 . 2009-09-29 04:55 49152 c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    + 2009-09-06 18:31 . 2009-09-28 22:27 16384 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
    - 2009-09-06 18:31 . 2009-09-15 18:38 16384 c:\windows\SYSTEM32\config\systemprofile\IETldCache\index.dat
    + 2008-01-23 04:22 . 2009-09-29 04:55 49152 c:\windows\SYSTEM32\config\systemprofile\Cookies\index.dat
    - 2008-01-23 04:22 . 2009-09-15 18:38 49152 c:\windows\SYSTEM32\config\systemprofile\Cookies\index.dat
    - 2008-01-23 04:22 . 2009-09-15 18:38 360448 c:\windows\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2008-01-23 04:22 . 2009-09-29 04:55 360448 c:\windows\SYSTEM32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
    + 2009-09-28 02:44 . 2006-11-28 21:23 573440 c:\windows\gmer.exe
    + 2009-09-28 02:44 . 2009-09-28 02:44 565311 c:\windows\gmer.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-07-24 1090816]

    [HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-08-10 28739]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-16 2007832]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-08 149280]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "Microsoft Works Update Detection"="c:\program files\Microsoft Works\WkDetect.exe" [2000-08-10 28739]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "Printing Migration"="c:\windows\system32\spool\migrate.dll" [2004-08-04 30208]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Filseclab Messenger.lnk - c:\program files\Common Files\Filseclab\FilMsg.exe [2007-7-30 315652]
    Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-7-7 282624]
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-08-16 19:04 11952 ----a-w- c:\windows\SYSTEM32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
    BootExecute REG_MULTI_SZ autocheck autochk /p \??\c:\0autocheck autochk *\0lsdelete

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
    @="Service"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "MSMSGS"=c:\progra~1\MESSEN~1\msmsgs.exe /background
    "MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe"
    "Microsoft Works Update Detection"=c:\program files\Microsoft Works\WkDetect.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "QuickTime Task"="c:\windows\SYSTEM32\QTTASK.EXE" -atboottime
    "CreateCD50"="c:\program files\Common Files\Adaptec Shared\CreateCD\CreateCD50.exe" -r
    "AdaptecDirectCD"="c:\program files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe"
    "RealTray"=c:\program files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    "TaskMonitor"=c:\windows\taskmon.exe
    "PCHealth"=c:\windows\PCHealth\Support\PCHSchd.exe -s
    "WorksFUD"=c:\program files\Microsoft Works\wkfud.exe
    "Microsoft Works Portfolio"=c:\program files\Microsoft Works\WksSb.exe /AllUsers
    "Microsoft Works Update Detection"=c:\program files\Microsoft Works\WkDetect.exe
    "MULTIMEDIA KEYBOARD"=c:\program files\Netropa\Multimedia Keyboard\MMKeybd.exe
    "LoadQM"=loadqm.exe
    "HPAIO_PrintFolderMgr"=c:\windows\SYSTEM\hpoopm07.exe
    "DownloadWare"="c:\program files\DownloadWare\dw.exe" /H
    "SearchEnhancement"="c:\program files\SCBAR\V1\SCBAR.EXE" /U
    "KodakCCS"=c:\program files\Common Files\KODAK\KODAK_DR\KodakCCS.exe --pdr: "c:\program files\Common Files\KODAK\KODAK_DR\dcmnter.pdr"

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
    "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
    "NAV Agent"=c:\progra~1\NORTON~1\NAVAPW32.EXE
    "RecoverFromReboot"=c:\windows\TEMP\RECOVE~1.EXE
    "BJCFD"=c:\program files\BroadJump\Client Foundation\CFD.exe
    "QuickTime Task"="c:\windows\SYSTEM32\QTTASK.EXE" -atboottime
    "xfilter"="c:\program files\Filseclab\xfilter\xfilter.exe" -a

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices-]
    "SchedulingAgent"=mstask.exe
    "StillImageMonitor"=c:\windows\SYSTEM32\STIMON.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [9/6/2009 7:52 PM 64160]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [5/23/2009 8:43 AM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\SYSTEM32\DRIVERS\avgtdix.sys [5/23/2009 8:43 AM 108552]
    R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [5/23/2009 8:42 AM 908056]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/23/2009 8:42 AM 297752]
    R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 8:49 AM 1028432]
    R3 LNE100;Linksys LNE100TX(v5) Fast Ethernet Adapter;c:\windows\SYSTEM32\DRIVERS\lne100v5.sys [5/25/2009 7:49 PM 36224]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
    "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
    rundll rnasetup.dll,installoptionalcomponent rna
    .
    Contents of the 'Scheduled Tasks' folder

    2009-08-31 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

    2009-09-29 c:\windows\Tasks\Ad-Aware Update (Weekly).job
    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-07-03 01:52]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com
    mStart Page = hxxp://www.google.com
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
    DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso4.cab
    DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-09-28 23:11
    Windows 5.1.2600 Service Pack 3 FAT NTAPI

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(368)
    c:\windows\system32\vct3216.acm
    c:\windows\system32\vct3216.dll
    c:\windows\system32\MVOICE.VWP

    - - - - - - - > 'lsass.exe'(432)
    c:\windows\system32\WININET.dll
    .
    Completion time: 2009-09-29 23:17
    ComboFix-quarantined-files.txt 2009-09-29 05:17
    ComboFix2.txt 2009-09-28 13:46
    ComboFix3.txt 2009-09-28 04:40
    ComboFix4.txt 2009-09-23 05:18
    ComboFix5.txt 2009-09-29 04:51

    Pre-Run: 3,679,961,088 bytes free
    Post-Run: 3,686,121,472 bytes free

    233 --- E O F --- 2009-09-08 20:07
  3. 2009-09-29, 08:12 #73
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Does AVG still find something?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  4. 2009-09-29, 20:17 #74
    Off Track
    Off Track is offline
    Member
    Join Date
    Sep 2009
    Posts
    59

    Default AVG finds

    Shaba:

    AVG finds the following, which it cannot heal.

    "\\?\globalroot\systemroot\system32\vsfocetkopabwq.dll";"Virus identified Packed.Hidden";"Infected"
    "\\?\globalroot\systemroot\system32\vsfocetkopabwq.dll";"Virus identified Packed.Hidden";"Infected"
    "\\?\globalroot\systemroot\system32\vsfocetkopabwq.dll";"Virus identified Packed.Hidden";"Infected"
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE (3984)";"Virus identified Packed.Hidden";"Infected"
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE (916)";"Virus identified Packed.Hidden";"Infected"
    "C:\WINDOWS\Explorer.EXE (2128)";"Virus identified Packed.Hidden";"Infected"
  5. 2009-09-29, 20:24 #75
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Download Avenger by Swandog and unzip it to your Desktop.

    Note: This programme must be run from an account with Administrator priviledges.

    • Open the Avenger folder and double click Avenger.exe to launch the programme.
    • Copy the text in the code box below and Paste it into the Input script here: box.

    Code:
    Files to delete:
c:\windows\system32\vsfocetkopabwq.dll
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    • Ensure the following:
      • Scan for Rootkits is checked.
      • Automatically disable any rootkits found is Unchecked.
    • Press the Execute key.
    • Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
    • Post the log back here please. (it can also be found at C:\avenger.txt)
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  6. 2009-09-29, 20:53 #76
    Off Track
    Off Track is offline
    Member
    Join Date
    Sep 2009
    Posts
    59

    Default

    Here is the Avenger log. It says it could not delete the file ...?




    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com

    Platform: Windows XP

    *******************

    Script file opened successfully.
    Script file read successfully.

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:

    Rootkit scan active.
    No rootkits found!


    Error: could not delete file "c:\windows\system32\vsfocetkopabwq.dll"
    Deletion of file "c:\windows\system32\vsfocetkopabwq.dll" failed!
    Status: 0xc0000156


    Completed script processing.

    *******************

    Finished! Terminate.
  7. 2009-09-29, 21:02 #77
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    That is anyway progress as it found it.

    Locate if present the following file & delete it:

    C:\windows\ntbtlog.txt

    Restart the computer
    Just before the OS loading screen starts hit F8 as if going to safe mode.
    From the advanced boot menu choose "enable boot logging" then hit enter.
    Post the following file:

    C:\windows\[b]ntbtlog.txt[/b
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  8. 2009-09-29, 21:17 #78
    Off Track
    Off Track is offline
    Member
    Join Date
    Sep 2009
    Posts
    59

    Default

    Here is the file c:\windows\ntbtlog.txt, after stating in "enable boot logging".

    I did not see a file with the [b] or [/b in the name

    ==========

    Service Pack 3 9 29 2009 13:08:32.500
    Loaded driver \WINDOWS\system32\ntoskrnl.exe
    Loaded driver \WINDOWS\system32\hal.dll
    Loaded driver \WINDOWS\system32\KDCOM.DLL
    Loaded driver \WINDOWS\system32\BOOTVID.dll
    Loaded driver ACPI.sys
    Loaded driver \WINDOWS\system32\DRIVERS\WMILIB.SYS
    Loaded driver pci.sys
    Loaded driver isapnp.sys
    Loaded driver intelide.sys
    Loaded driver \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
    Loaded driver MountMgr.sys
    Loaded driver ftdisk.sys
    Loaded driver PartMgr.sys
    Loaded driver VolSnap.sys
    Loaded driver atapi.sys
    Loaded driver disk.sys
    Loaded driver \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
    Loaded driver fltmgr.sys
    Loaded driver sr.sys
    Loaded driver Lbd.sys
    Loaded driver PxHelp20.sys
    Loaded driver Fastfat.sys
    Loaded driver KSecDD.sys
    Loaded driver NDIS.sys
    Loaded driver Mup.sys
    Loaded driver agp440.sys
    Loaded driver \SystemRoot\system32\DRIVERS\processr.sys
    Loaded driver \SystemRoot\system32\DRIVERS\nv4_mini.sys
    Loaded driver \SystemRoot\system32\DRIVERS\HSFBS2S2.sys
    Loaded driver \SystemRoot\system32\DRIVERS\HSFDPSP2.sys
    Loaded driver \SystemRoot\system32\DRIVERS\HSFCXTS2.sys
    Loaded driver \SystemRoot\System32\Drivers\Modem.SYS
    Loaded driver \SystemRoot\system32\DRIVERS\LNE100V5.sys
    Loaded driver \SystemRoot\system32\DRIVERS\fdc.sys
    Loaded driver \SystemRoot\system32\DRIVERS\i8042prt.sys
    Loaded driver \SystemRoot\system32\DRIVERS\kbdclass.sys
    Loaded driver \SystemRoot\system32\DRIVERS\mouclass.sys
    Loaded driver \SystemRoot\system32\DRIVERS\serial.sys
    Loaded driver \SystemRoot\system32\DRIVERS\serenum.sys
    Loaded driver \SystemRoot\system32\DRIVERS\parport.sys
    Loaded driver \SystemRoot\system32\DRIVERS\imapi.sys
    Loaded driver \SystemRoot\system32\DRIVERS\cdrom.sys
    Loaded driver \SystemRoot\system32\DRIVERS\redbook.sys
    Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys
    Loaded driver \SystemRoot\system32\DRIVERS\usbuhci.sys
    Loaded driver \SystemRoot\system32\drivers\ac97intc.sys
    Loaded driver \SystemRoot\system32\DRIVERS\audstub.sys
    Loaded driver \SystemRoot\system32\DRIVERS\rasl2tp.sys
    Loaded driver \SystemRoot\system32\DRIVERS\ndistapi.sys
    Loaded driver \SystemRoot\system32\DRIVERS\ndiswan.sys
    Loaded driver \SystemRoot\system32\DRIVERS\raspppoe.sys
    Loaded driver \SystemRoot\system32\DRIVERS\raspptp.sys
    Loaded driver \SystemRoot\system32\DRIVERS\ptilink.sys
    Loaded driver \SystemRoot\system32\DRIVERS\raspti.sys
    Loaded driver \SystemRoot\system32\DRIVERS\termdd.sys
    Loaded driver \SystemRoot\system32\DRIVERS\swenum.sys
    Loaded driver \SystemRoot\system32\DRIVERS\update.sys
    Loaded driver \SystemRoot\system32\DRIVERS\mssmbios.sys
    Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
    Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
    Loaded driver \SystemRoot\system32\drivers\MODEMCSA.sys
    Loaded driver \SystemRoot\system32\DRIVERS\usbhub.sys
    Loaded driver \SystemRoot\system32\DRIVERS\Dot4.sys
    Loaded driver \SystemRoot\system32\DRIVERS\flpydisk.sys
    Loaded driver \SystemRoot\system32\DRIVERS\Dot4Scan.sys
    Loaded driver \SystemRoot\system32\DRIVERS\Dot4Prt.sys
    Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS
    Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS
    Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS
    Did not load driver \SystemRoot\System32\Drivers\Changer.SYS
    Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS
    Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
    Loaded driver \SystemRoot\System32\Drivers\Null.SYS
    Loaded driver \SystemRoot\System32\Drivers\Beep.SYS
    Loaded driver \SystemRoot\System32\drivers\vga.sys
    Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS
    Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys
    Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
    Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
    Loaded driver \systemroot\system32\drivers\vsfocepesvjulp.sys
    Loaded driver \SystemRoot\system32\DRIVERS\rasacd.sys
    Loaded driver \SystemRoot\system32\DRIVERS\msgpc.sys
    Loaded driver \SystemRoot\system32\DRIVERS\ipsec.sys
    Loaded driver \SystemRoot\system32\DRIVERS\tcpip.sys
    Loaded driver \SystemRoot\System32\Drivers\avgtdix.sys
    Loaded driver \SystemRoot\system32\DRIVERS\netbt.sys
    Loaded driver \SystemRoot\System32\drivers\afd.sys
    Loaded driver \SystemRoot\system32\DRIVERS\netbios.sys
    Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS
    Loaded driver \SystemRoot\system32\DRIVERS\rdbss.sys
    Loaded driver \SystemRoot\system32\DRIVERS\mrxsmb.sys
    Loaded driver \SystemRoot\System32\Drivers\Fips.SYS
    Loaded driver \SystemRoot\System32\Drivers\avgmfx86.sys
    Loaded driver \SystemRoot\system32\DRIVERS\ipnat.sys
    Loaded driver \SystemRoot\system32\DRIVERS\wanarp.sys
    Loaded driver \SystemRoot\System32\Drivers\avgldx86.sys
    Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS
    Loaded driver \SystemRoot\system32\DRIVERS\ndisuio.sys
    Did not load driver \SystemRoot\system32\DRIVERS\rdbss.sys
    Did not load driver \SystemRoot\system32\DRIVERS\mrxsmb.sys
    Loaded driver \SystemRoot\system32\drivers\wdmaud.sys
    Loaded driver \SystemRoot\system32\drivers\sysaudio.sys
    Loaded driver \SystemRoot\system32\drivers\splitter.sys
    Loaded driver \SystemRoot\system32\drivers\aec.sys
    Loaded driver \SystemRoot\system32\drivers\swmidi.sys
    Loaded driver \SystemRoot\system32\drivers\DMusic.sys
    Loaded driver \SystemRoot\system32\drivers\kmixer.sys
    Loaded driver \SystemRoot\system32\drivers\drmkaud.sys
    Loaded driver \SystemRoot\system32\DRIVERS\mrxdav.sys
    Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS
    Did not load driver \SystemRoot\System32\Drivers\ASCTRM.SYS
    Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys
    Loaded driver \SystemRoot\system32\DRIVERS\srv.sys
    Did not load driver \SystemRoot\system32\DRIVERS\ipnat.sys
    Loaded driver \SystemRoot\System32\Drivers\HTTP.sys
    Loaded driver \SystemRoot\system32\drivers\kmixer.sys
    Loaded driver \SystemRoot\system32\drivers\kmixer.sys
  9. 2009-09-29, 21:39 #79
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Good, bad driver is there


    • Open the Avenger folder and double click Avenger.exe to launch the programme.
    • Copy the text in the code box below and Paste it into the Input script here: box.

    Code:
    Files to delete:
c:\windows\system32\drivers\vsfocepesvjulp.sys
c:\windows\system32\vsfocetkopabwq.dll
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

    • Ensure the following:
      • Scan for Rootkits is checked.
      • Automatically disable any rootkits found is Unchecked.
    • Press the Execute key.
    • Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
    • Post the log back here please. (it can also be found at C:\avenger.txt)
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  10. 2009-09-30, 05:47 #80
    Off Track
    Off Track is offline
    Member
    Join Date
    Sep 2009
    Posts
    59

    Default Avenger log

    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com

    Platform: Windows XP

    *******************

    Script file opened successfully.
    Script file read successfully.

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:

    Rootkit scan active.
    No rootkits found!


    Error: could not delete file "c:\windows\system32\drivers\vsfocepesvjulp.sys"
    Deletion of file "c:\windows\system32\drivers\vsfocepesvjulp.sys" failed!
    Status: 0xc0000156


    Error: could not delete file "c:\windows\system32\vsfocetkopabwq.dll"
    Deletion of file "c:\windows\system32\vsfocetkopabwq.dll" failed!
    Status: 0xc0000156


    Completed script processing.

    *******************

    Finished! Terminate.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules