browser hijacked, IE not responding, pc freezing up (Resolved)

I'm sorry - mistake in copy & paste - here's the activescan log:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-04-10 01:16:48
PROTECTIONS: 1
MALWARE: 2
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
avast! antivirus 4.8.1335 [VPS 090409-0] 4.8.1335 Yes Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\Guest\Cookies\guest@adtech[1].txt
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF0E1F81-4D00-4423-B8A1-41E1D374A88A}\RP350\A0082622.exe
;===================================================================================================================================================================================
SUSPECTS
Sent Location \
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description \
;===================================================================================================================================================================================
108742 MEDIUM MS06-006 \
;===================================================================================================================================================================================
 
There are no problems showing there, are you still having trouble with Task Manager ?
 
Hi again and happy easter

Yes task manager is still missing the top and bottom bars..

Active scan said I had two tracking cookies that should be removed, one of which read as serious when looking at the information on that subject.
 
helmer said:
Active scan said I had two tracking cookies that should be removed, one of which read as serious when looking at the information on that subject.
Click to expand...

Tracking cookies are just dross, don't worry too much about them.


Download and Run ComboFix
Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
  • Please visit this webpage for instructions on using ComboFix:
    http://www.bleepingcomputer.com/combofix/how-to-use-combofix

    ComboFix.exe 1
    ComboFix.exe 2
    ComboFix.exe 3
  • You must download it to and run it from your Desktop
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
ComboFix SHOULD NOT be used unless requested by a forum helper

Please check Task Manager now
 
During the beginning of the Combofix scan I had an error message from windows : "pev.cfexe has encountered problems and needs to close " three times. Unlike the other times I did a combofix scan, the program was allowed to connect to microsoft online to do the restore point.
Bit combofix ran uninterrupted after that message, until completed.

During the hijack this scan I also received an error notice that was to long to remember.



ComboFix 09-04-12.02 - 2009-04-12 15:42.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383.163 [GMT 2:00]
Running from: c:\documents and settings\KHMadsen\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090411-0] *On-access scanning disabled* (Updated)
FW: COMODO Firewall Pro *enabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2009-03-12 to 2009-04-12 )))))))))))))))))))))))))))))))
.

2009-04-09 19:52 . 2009-04-12 13:34 -------- d-----w c:\program files\Panda Security
2009-04-04 19:35 . 2009-04-04 19:35 -------- d-----w c:\windows\McAfee.com
2009-04-03 22:15 . 2000-08-31 06:00 89504 ----a-w c:\windows\fdsv.exe
2009-04-03 20:50 . 2009-04-03 20:50 -------- d-----w c:\documents and settings\Application Data\Malwarebytes
2009-04-03 20:50 . 2009-03-26 14:49 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-03 20:50 . 2009-03-26 14:49 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-03 20:50 . 2009-04-03 20:50 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-03 20:50 . 2009-04-03 20:52 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-01 14:10 . 2009-04-01 14:29 0 ----a-w c:\documents and settings\KHMadsen\temp.dat
2009-03-26 15:23 . 2009-03-26 15:24 -------- dc----w C:\rsit
2009-03-24 17:30 . 2009-03-24 17:30 -------- d-----w c:\program files\ERUNT
2009-03-20 19:02 . 2009-03-20 19:02 -------- d-----w c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 13:38 . 2008-04-10 11:02 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-09 23:43 . 2007-10-10 18:06 -------- d-----w c:\program files\SpywareGuard
2009-04-09 23:43 . 2007-10-10 17:51 -------- d-----w c:\program files\SpywareBlaster
2009-03-23 09:31 . 2007-10-11 15:07 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-23 09:15 . 2008-07-11 15:34 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-23 09:15 . 2007-09-30 14:20 -------- d-----w c:\program files\Lavasoft
2009-03-16 21:24 . 2007-10-11 15:07 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-03-12 16:20 . 2007-06-22 22:20 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 16:20 . 2009-03-12 16:20 -------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd
2009-03-11 12:00 . 2007-06-23 14:50 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-08 13:04 . 2007-06-27 19:12 -------- d--h--w c:\program files\FKP
2009-03-06 17:49 . 2007-06-24 20:34 3268 ----a-w c:\windows\system32\d3d9caps.dat
2009-02-24 14:37 . 2008-12-10 18:01 -------- d-----w c:\documents and settings\\Application Data\FlowJo7
2009-02-23 17:19 . 2009-02-23 17:16 4736 -c--a-w C:\stderr.txt
2009-02-23 17:19 . 2009-02-23 17:16 98 -c--a-w C:\stdout.txt
2009-02-23 10:28 . 2009-02-23 09:51 -------- d-----w c:\program files\VideoLAN
2009-02-23 10:23 . 2009-02-23 10:23 -------- d-----w c:\documents and settings\\Application Data\vlc
2009-02-23 09:57 . 2009-02-23 09:54 -------- d-----w c:\documents and settings\Application Data\MozillaControl
2009-02-23 09:55 . 2009-02-23 09:55 -------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-02-17 16:14 . 2009-02-17 16:14 -------- d-----w c:\documents and settings\All Users\Application Data\Microgaming
2009-02-17 16:14 . 2009-02-17 16:14 -------- d-----w c:\documents and settings\All Users\Application Data\MGS
2009-02-09 10:19 . 2004-08-10 12:00 1846272 ----a-w c:\windows\system32\win32k.sys
2009-02-01 21:36 . 2008-03-31 13:33 3235 -c--a-w C:\a.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 c:\windows\KHALMNPR.Exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 c:\windows\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\documents and settings\KHMadsen\Application Data\iolo\

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a------ 2007-03-09 11:09 63712 c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-10-15 02:04 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2007-05-08 17:24 54840 c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Matrox Powerdesk]
--a------ 2004-09-14 10:13 684032 c:\windows\system32\PDesk\pdesk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

R3 MadgeTRN;Madge Token-Ring Adapter NDIS5 Driver;c:\windows\system32\DRIVERS\mdgndis5.sys [2001-08-17 164586]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abcd50b8-4e69-11dd-800f-00080234b8db}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abcd50b9-4e69-11dd-800f-00080234b8db}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b41f3bd8-21aa-11dc-a29b-0013f75838a7}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.dk/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-12 15:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2100)
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-12 15:51
ComboFix-quarantined-files.txt 2009-04-12 13:51
ComboFix2.txt 2009-04-05 14:06
ComboFix3.txt 2009-04-03 22:25
ComboFix4.txt 2007-11-02 14:33

Pre-Run: 1.310.482.432 bytes free
Post-Run: 1,403,748,352 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

166 --- E O F --- 2009-04-07 10:23




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:11:10, on 12-04-2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\mgabg.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\Scanner.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Logitech Produktregistrering.lnk = C:\Program Files\Common Files\LogiShared\eReg\SetPoint\eReg.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Send til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end til OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

(I DELETED DPF and trusted zones for privacy)

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINDOWS\system32\mgabg.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7364 bytes
 
Please do the following

Create A Batch File
Please copy (Ctrl+C) and paste (Ctrl+V) the following text in the quote to Notepad.
Save it as "All Files" and name it look.bat Please save it on your desktop.

@ECHO OFF
VFIND -tf %systemroot%\winlogon.exe >temp00
FOR /F "TOKENS=*" %%G IN ( temp00) DO @FDSV.EXE %%G >>Logit.txt
START Notepad Logit.txt
DEL temp00
DEL %0
Click to expand...
Double click on look.bat
Please be patient, as this will search the entire disc

Notepad will open, please copy/paste the results here.


Please submit a file

Please open LINK >>> THIS PAGE <<<LINK in a new window.
In the box marked Link to topic where this file was requested: please put this text
Code: 
http://forums.spybot.info/showthread.php?p=304566#post304566

In the box marked Browse to the file you want to submit: please put this text
Code: 
c:\windows\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe

In the Largest box please put
Code: 
File Requested By Katana
Winlogon for sUBs collection
Finally click SendFile
 
FileDigitalSignVerify 1.2

Copyright (C) 2007-2008 Smallfrogs

KZTechs.COM - www.KZTechs.com



FileDigitalSignVerify is used to verify digital signatures on specified files.



Status Name of signer File Path

-----------------------------------------------------------

0x800b0100 - C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe



FileDigitalSignVerify 1.2

Copyright (C) 2007-2008 Smallfrogs

KZTechs.COM - www.KZTechs.com



FileDigitalSignVerify is used to verify digital signatures on specified files.



Status Name of signer File Path

-----------------------------------------------------------

0x800b0100 - C:\WINDOWS\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\winlogon.exe



FileDigitalSignVerify 1.2

Copyright (C) 2007-2008 Smallfrogs

KZTechs.COM - www.KZTechs.com



FileDigitalSignVerify is used to verify digital signatures on specified files.



Status Name of signer File Path

-----------------------------------------------------------

0x800b0100 - C:\WINDOWS\system32\winlogon.exe
 
taskmanager tip was spot on :bigthumb: Sorry to take your time with that non-virus issue !


What about the RED text from the above combofix alert saying infected ? Was that a false alert ?


Thanks so much for all your time
 
helmer said:
1) taskmanager tip was spot on :bigthumb: Sorry to take your time with that non-virus issue !


2)What about the RED text from the above combofix alert saying infected ? Was that a false alert ?
Click to expand...

1) No problem, you weren't to know it wasn't the infection :)

2) I suspect it is a false positive, please download a fresh copy of Combofix and run it again.
 
I downloaded combofix from one of the 3 links you posted recently..

Pc/IE still stalls but it might just be a problem of disk space


here's the combofix log - got that "pev.cfexe needs to close" message from windows again after stage 8 of cf


ComboFix 09-04-14.08 - 14-04-2009 12:35.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.383.156 [GMT 2:00]
Running from: c:\documents and settings\\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090413-0] *On-access scanning disabled* (Updated)
FW: COMODO Firewall Pro *enabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-09 19:52 . 2009-04-12 13:34 -------- d-----w c:\program files\Panda Security
2009-04-04 19:35 . 2009-04-04 19:35 -------- d-----w c:\windows\McAfee.com
2009-04-03 20:50 . 2009-04-03 20:50 -------- d-----w c:\documents and settings\KHMadsen\Application Data\Malwarebytes
2009-04-03 20:50 . 2009-03-26 14:49 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-03 20:50 . 2009-03-26 14:49 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-03 20:50 . 2009-04-03 20:50 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-03 20:50 . 2009-04-03 20:52 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-01 14:10 . 2009-04-01 14:29 0 ----a-w c:\documents and settings\temp.dat
2009-03-26 15:23 . 2009-03-26 15:24 -------- dc----w C:\rsit
2009-03-24 17:30 . 2009-03-24 17:30 -------- d-----w c:\program files\ERUNT
2009-03-20 19:02 . 2009-03-20 19:02 -------- d-----w c:\program files\CCleaner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 10:32 . 2008-04-10 11:02 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-04-12 14:27 . 2007-10-10 18:06 -------- d-----w c:\program files\SpywareGuard
2009-04-12 14:26 . 2007-10-10 17:51 -------- d-----w c:\program files\SpywareBlaster
2009-03-23 09:31 . 2007-10-11 15:07 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-23 09:15 . 2008-07-11 15:34 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-23 09:15 . 2007-09-30 14:20 -------- d-----w c:\program files\Lavasoft
2009-03-16 21:24 . 2007-10-11 15:07 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
2009-03-12 16:23 . 2009-03-12 16:23 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-03-12 16:20 . 2007-06-22 22:20 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 16:20 . 2009-03-12 16:20 -------- d-----w c:\documents and settings\All Users\Application Data\LogiShrd
2009-03-11 12:00 . 2007-06-23 14:50 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-08 13:04 . 2007-06-27 19:12 -------- d--h--w c:\program files\FKP
2009-03-06 17:49 . 2007-06-24 20:34 3268 ----a-w c:\windows\system32\d3d9caps.dat
2009-02-24 14:37 . 2008-12-10 18:01 -------- d-----w c:\documents and settings\KHMadsen\Application Data\FlowJo7
2009-02-23 17:19 . 2009-02-23 17:16 4736 -c--a-w C:\stderr.txt
2009-02-23 17:19 . 2009-02-23 17:16 98 -c--a-w C:\stdout.txt
2009-02-23 10:28 . 2009-02-23 09:51 -------- d-----w c:\program files\VideoLAN
2009-02-23 10:23 . 2009-02-23 10:23 -------- d-----w c:\documents and settings\\Application Data\vlc
2009-02-23 09:57 . 2009-02-23 09:54 -------- d-----w c:\documents and settings\\Application Data\MozillaControl
2009-02-23 09:55 . 2009-02-23 09:55 -------- d-----w c:\documents and settings\All Users\Application Data\Graboid Inc
2009-02-17 16:14 . 2009-02-17 16:14 -------- d-----w c:\documents and settings\All Users\Application Data\Microgaming
2009-02-17 16:14 . 2009-02-17 16:14 -------- d-----w c:\documents and settings\All Users\Application Data\MGS
2009-02-09 10:19 . 2004-08-10 12:00 1846272 ----a-w c:\windows\system32\win32k.sys
2009-02-01 21:36 . 2008-03-31 13:33 3235 -c--a-w C:\a.txt
2008-06-17 21:21 . 2008-06-17 21:21 71088 ----a-w c:\documents and settings\Guest\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-10-12 23:11 . 2007-06-22 22:08 71088 ----a-w c:\documents and settings\\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2007-09-24 18:46 . 2007-09-24 18:46 131 ----a-w c:\documents and settings\\Local Settings\Application Data\fusioncache.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-04-12_15.48.52,43 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 10:19 . 2009-04-14 10:19 16384 c:\windows\Temp\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" - c:\windows\KHALMNPR.Exe [2007-04-11 56080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf c:\documents and settings\\Application Data\iolo\

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2007-03-09 09:09 63712 ----a-w c:\program files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 00:04 39792 ----a-w c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2007-05-08 15:24 54840 ----a-w c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Matrox Powerdesk]
2004-09-14 08:13 684032 ----a-w c:\windows\system32\PDesk\pdesk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

R3 MadgeTRN;Madge Token-Ring Adapter NDIS5 Driver;c:\windows\system32\DRIVERS\mdgndis5.sys [2001-08-17 164586]
R3 SMCWGU(SMC);SMCWUSB-G 802.11g Wireless USB 2.0 Adapter(SMC); [x]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abcd50b8-4e69-11dd-800f-00080234b8db}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abcd50b9-4e69-11dd-800f-00080234b8db}]
\Shell\AutoRun\command - E:\StartVMCLite.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b41f3bd8-21aa-11dc-a29b-0013f75838a7}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.google.dk/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
Trusted Zone:
DPF:
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
VBEFile=NOTEPAD.EXE %1
VBSFile=NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 12:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3700)
c:\progra~1\WINDOW~3\wmpband.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: ~,10time:~,-3
ComboFix-quarantined-files.txt 2009-04-14 10:42
ComboFix2.txt 2009-04-12 13:51
ComboFix3.txt 2009-04-05 14:06
ComboFix4.txt 2009-04-03 22:25
ComboFix5.txt 2009-04-14 10:33

Pre-Run: 1.312.468.992 bytes free
Post-Run: 1.370.152.960 bytes free

163 --- E O F --- 2009-04-07 10:23
 
Pc/IE still stalls but it might just be a problem of disk space
Click to expand...
Very likely, your log shows System drive C: has 1 GB (7%) free of 19 GB. Windows prefers to have at least 15% free space.

Congratulations your logs look clean :)

Let's see if I can help you keep it that way

First lets tidy up

Please delete RSIT.exe and C:\RSIT (entire folder)
You can also delete any logs we have produced, and empty your Recycle bin.


Uninstall Combofix
  • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
    • CF_Cleanup.png


Please download OTCleanup from http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe
Click the OTCleanIt icon and then click the CleanUp button.
If you get any pop ups asking if it is OK let the program proceed. At the end the program will ask to let it reboot the computer. Let it do so.
Let me know if there were any problems with OT CleanIt

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean.


You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

  • AntiSpyware is not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
  • Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
  • MalwareBytes Anti-malware <<< A New and effective program
  • a-squared Free <<< A good "realtime" or "on demand" scanner
  • superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

  • These programs don't detect malware, they help stop it getting on your machine in the first place.
    Each does a different job, so you can have more than one
  • Winpatrol
    • An excellent startup manager and then some !!
    • Notifies you if programs are added to startup
    • Allows delayed startup
    • A must have addition
  • SpywareBlaster 4.0
    • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
  • SpywareGuard 2.2
    • SpywareGuard provides real-time protection against spyware.
    • Not required if you have other "realtime" antispyware or Winpatrol
  • ZonedOut
    • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
  • MVPS HOSTS
    • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
    • For information on how to download and install, please read this tutorial by WinHelp2002.
    • Not required if you are using other host file protections

Internet Browsers

  • Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
    Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

  • Temporary Internet Files are mainly the files that are downloaded when you open a web page.
    Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
    It is a good idea to empty the Temporary Internet Files folder on a regular basis.

    Tracking Cookies are files that websites use to monitor which sites you visit and how often.
    A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
    CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

    Both of these can be cleaned manually, but a quicker option is to use a program
  • ATF Cleaner
    • Free and very simple to use
  • CCleaner
    • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'
 
Hi Katana.
Thanks for all your help !! :bigthumb:

OTCleanup rebooted right away and I didn't see what it deleted, if anything.

I will remove the programs installed during the virus cleanup - maybe keeping malwarebyte's anti malware ?

I have read your long list of recommended programs, thank you ! I have read a lot of these kinds of suggestions before, but what is difficult for me to judge about, is what individual programs complement each other well ( don't want any programs doing the same job) - and what is the best minimal setup of programs for my very small C drive.

If you don't mind reading on, these are my anti-virus and anti-spyware programs :

Awast anti-virus with constant pc and web monitoring ( free version automatically updated)
spybot with tea timer and resident IE protection running
spyware guard
spyware blaster
Ccleaner ( used to have Ad-Aware by Lavasoft instead - which is better ? )

I scan online with Kaspersky about once per 2 months and always update my programs !

I already have all the suggested settings for IE 7 - the last one " Navigate sub-frames across different domains" I have disabled for some reason.

seems like virtumonde keeps infecting my pc although I have anti-virus, anti-spyware, cookie deletions, internet protection etc. I don't know how do protect my pc better ??

Thanks for all your hard work on the many many uploaded files ! It is very much appreciated, thank you !
 
P.S. my internet explorer still freezes completely when I try to enter the download.cnet webpage - i can't even close the explorer window

Do you have any fixes for such a problem ?

Thanks you very much :-)
 
Disable Addons

Start IE
Click Tools >> Manage Add-ons >> Disable or Enable Add-ons
Disable all the addons,

Now try visiting the download.cnet webpage and see if it works.
 
One of the Addons is blocking the page, you need to disable them one by one until you locate the culprit.
 
You must log in or register to reply here.
Back
Top