Multi-Viral, Each Scan Different Results

Shaba · Mar 20, 2008

Re-opened upon request.

Calliste · Mar 20, 2008

G'morning Shaba,

Here's the deal: Updated and ran spybot last night, it detected Smitfraud in two files. It doesn't seem to log it's scan activity so I can't post that. I had spybot fix the problems and then I re-immunized. I rebooted and rescanned, the scan came back clean. I ran a Kscan overnight and that too came back clean. Logs:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, March 20, 2008 9:16:23 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 20/03/2008
Kaspersky Anti-Virus database records: 643511
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 180555
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 02:41:27

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\Agent_PETER.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\Common Framework\Db\PrdMgr_PETER.log Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Peter K\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\History\History.IE5\MSHist012008032020080321\index.dat Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\Temp\Perflib_Perfdata_68c.dat Object is locked skipped
C:\Documents and Settings\Peter K\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Peter K\ntuser.dat Object is locked skipped
C:\Documents and Settings\Peter K\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\_restore{A9922797-F519-4769-99F2-3F88E200C078}\RP15\change.log Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped
C:\WINDOWS\Internet Logs\PETER.ldb Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\ModemLog_Creative Modem Blaster PCI DI5633.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\mmf.sys Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\Temp\ZLT07bb7.TMP Object is locked skipped
C:\WINDOWS\Temp\ZLT07bba.TMP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:24:44 AM, on 3/20/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\SBCYAH~1\CONNEC~1\CONNEC~1.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{50CA6F1C-0209-41F1-A1D9-AB52FC36E055}: NameServer = 151.164.1.8 206.13.28.12
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5148 bytes

Is this thing hiding somewhere still? I've got the firewall up and running, teatimer is doing it's thing and has had no hits since the Java update changes. Spybot is still clean ... I'm so confused.

Callie

Shaba · Mar 20, 2008

Hi

Logs are clean.

Did you save spybot scan report?

Calliste · Mar 20, 2008

Where is scan report? I checked spybot directory, some crazy stuff in there ... who knew spybot needed autocad files ... but nothing resembling a log. The only log I see is the resident log.

Callie

Calliste · Mar 20, 2008

Okay, so I'm not a dumb blonde, I swear.

I looked in the help files and figured out how to access the logs ... It allows me to see the last log, or view previous logs ... here's the thing ... according to the list-o-logs, the last scan was on 3/5/08, there is no log for the 19th, not under checks or fixes ... and I did both.

Going to keep playing with it, do a file search, perhaps it's sticking them elsewhere.

Callie

Calliste · Mar 21, 2008

log checks and log fixes were both unchecked in the settings, I rechecked them ... don't know why they were unchecked. Just my luck, eh?

callie

Shaba · Mar 21, 2008

Hi

Yes, bad luck.

Any other concerns?

Calliste · Mar 21, 2008

My main concern is that there is something hiding, and will keep rearing its ugly head.

According to ZoneAlarm, my virus scanner is not active. According to all the settings and the tray icon, my virus scanner is active. I'm getting a new updated copy of the scanner in case it's just broken.

I didn't turn off the logging function of spybot, it just decided not to log anything anymore. Perhaps when you disable TeaTimer the logs stop and enabling it again doesn't turn the logs on by default. The last log was on the 5th, which was when I re-enabled it. It's logging now, hopefully it will continue to do so.

Any other scan I can run to see if we missed something?

Callie

Shaba · Mar 21, 2008

Hi

"According to ZoneAlarm, my virus scanner is not active. According to all the settings and the tray icon, my virus scanner is active. I'm getting a new updated copy of the scanner in case it's just broken"

It's possible that ZA doesn't monitor properly McAfee.

But what it matters is that if it works ok or not.

"Any other scan I can run to see if we missed something?"

Well, I don't think so. Of course we can run scans but without further knowledge what spybot findings were there is not much we can do.

Calliste · Mar 21, 2008

they were windows\tasks files, at1 and at2. they registered as smitfraud c and I think the variant was gp? I'm going off of memory which is fairly reliable.

Shaba · Mar 21, 2008

Hi

Those files can be legit, too.

They are just tasks to perform certain acts automatically and do harm if files that they should execute don't exist anymore.

So no worries.

Calliste · Mar 21, 2008

Being a detective again ...

Checked my task scheduler log ... there are 22 tasks listed (A1 and A2 are missing ... A3 - A24 all say the same thing, that they could not start ... I scrolled down to the last time A1 and A2 popped up:
"At1.job" (SfU44S1H.exe) 3/16/2008 12:00:00 AM ** ERROR **
Unable to start task.
The specific error is:
0x80070002: The system cannot find the file specified.
Try using the Task page Browse button to locate the application.
"At2.job" (SfU44S1H.exe) 3/16/2008 1:00:00 AM ** ERROR **
Unable to start task.
The specific error is:
0x80070002: The system cannot find the file specified.
Try using the Task page Browse button to locate the application.

The newer entries are various task numbers, all trying to run the same file SfU44S1H.exe. This file appeared before in ZoneAlarm, see post #54 in this thread (page 6).

Shaba · Mar 21, 2008

Hi

Delete all those tasks and this file if exists, SfU44S1H.exe, too.

And post back how it went

Calliste · Mar 21, 2008

24 hours in a day ... 24 tasks ...

every task says to start at a time every day, every week and the 24 tasks cover every hour.

Shaba · Mar 21, 2008

Hi

Yes, those are bad.

This is maybe easier way to see what's going on:

1. Download combofix from any of these links and save it to Desktop:
Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here

Post:

- a fresh HijackThis log
- combofix report

Calliste · Mar 21, 2008

Well, I had already deleted all those tasks before your last reply. I did not find that file in the system32 file, but I found something in the prefetch folder.

SFU44S1H.EXE-07800F0C.pf

I did not delete it. Downloading Combofix now. will post logs.

Shaba · Mar 21, 2008

Hi

Thanks for info, I'll be waiting for logs

Calliste · Mar 21, 2008

Ran Combo Fix, no reboot happened.
Log:
ComboFix 08-03-20.5 - Peter K 2008-03-21 9:45:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.651 [GMT -5:00]
Running from: C:\Documents and Settings\Peter K\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Peter K\Application Data\macromedia\Flash Player\#SharedObjects\5M5FAGCN\www.broadcaster.com
C:\Documents and Settings\Peter K\Application Data\macromedia\Flash Player\#SharedObjects\5M5FAGCN\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Peter K\Application Data\macromedia\Flash Player\#SharedObjects\5M5FAGCN\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Peter K\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Peter K\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol

.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-13 13:15 . 2008-03-13 13:15 <DIR> d-------- C:\Program Files\Java
2008-03-13 13:15 . 2008-03-13 13:15 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-13 13:15 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-07 23:30 . 2008-03-07 23:30 <DIR> d-------- C:\Documents and Settings\Peter K\Application Data\Flood Light Games
2008-03-07 23:30 . 2008-03-07 23:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Flood Light Games
2008-03-06 12:51 . 2008-03-06 12:51 <DIR> d-------- C:\Program Files\Zone Labs
2008-03-06 12:51 . 2008-03-06 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-06 12:50 . 2008-03-21 09:44 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-03-06 07:56 . 2008-03-06 07:56 <DIR> d-------- C:\Documents and Settings\Peter K\Application Data\Malwarebytes
2008-03-06 07:55 . 2008-03-06 07:55 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-06 07:55 . 2008-03-06 07:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-02 23:12 . 2008-03-02 23:12 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 19:42 . 2008-03-02 20:00 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-02 19:42 . 2008-03-02 19:42 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-02 19:42 . 2008-03-02 19:42 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-02 19:42 . 2008-03-02 19:42 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-24 23:47 . 2008-02-24 23:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 18:01 . 2008-02-24 18:01 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-24 18:01 . 2008-02-24 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 15:51 . 2008-02-24 15:51 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-24 15:51 . 2008-02-24 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 03:31 2,220 ----a-w C:\Documents and Settings\Peter K\Application Data\wklnhst.dat
2008-03-17 03:30 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-11 02:57 --------- d-----w C:\Program Files\ACT
2008-03-09 13:41 --------- d-----w C:\Documents and Settings\Peter K\Application Data\Pogo Games
2008-03-09 13:39 --------- d-----w C:\Program Files\Oberon Media
2008-02-26 22:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-03 16:04 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-01-03 16:04 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-03 16:04 22,328 ----a-w C:\Documents and Settings\Peter K\Application Data\PnkBstrK.sys
2008-01-03 16:04 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-25 21:04 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2003-04-17 08:16 447,616 -c--a-w C:\WINDOWS\inf\EL2K_N64.sys
2003-04-17 08:15 147,328 -c--a-w C:\WINDOWS\inf\EL2K_XP.sys
2003-04-17 08:15 147,200 -c--a-w C:\WINDOWS\inf\EL2K_2K.sys
2006-04-09 18:48 1,057 --sha-w C:\WINDOWS\system32\mmf.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 15:08 1511453]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2003-04-23 08:39 581632]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 20:10 339968]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2003-09-29 07:10 81990]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 03:11 135251]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 18:41 163840]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 10:14 497152]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 10:31 1122304]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gf1.0.0.2]
C:\WINDOWS\system32\ggf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
-----c--- 2003-11-07 04:50 19968 C:\WINDOWS\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TCASUTIEXE]
--a------ 2003-02-12 04:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"=
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YPAGER.EXE"=
"C:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=

R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2006-04-09 12:25]
R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-06 13:08]
R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\System32\DRIVERS\TCAITDI.sys [2001-09-04 06:22]
S1 atiatbxx;Hardware TnL Rendering;C:\WINDOWS\System32\atiatbxx.sys []
S3 gtermddo;gtermddo;C:\DOCUME~1\PETERK~1\LOCALS~1\Temp\gtermddo.sys []
S3 Slnt7554;USB Soft Modem Driver;C:\WINDOWS\System32\DRIVERS\slnt7554.sys [2003-02-05 16:55]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 09:47:17
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-03-21 9:47:44
ComboFix-quarantined-files.txt 2008-03-21 14:47:42

New HJT Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:35 AM, on 3/21/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\PROGRA~1\SBCYAH~1\CONNEC~1\CONNEC~1.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{50CA6F1C-0209-41F1-A1D9-AB52FC36E055}: NameServer = 151.164.1.8 206.13.28.12
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5480 bytes

TeaTimer was still enabled and the following changes were allowed by me:

3/21/2008 9:48:22 AM Allowed (based on user decision) value "Search Page" (new data: "http://go.microsoft.com/fwlink/?LinkId=54896") changed in Browser page!
3/21/2008 9:48:26 AM Allowed (based on user decision) value "Default_Page_URL" (new data: "http://go.microsoft.com/fwlink/?LinkId=69157") changed in Browser page!
3/21/2008 9:48:29 AM Allowed (based on user decision) value "Default_Search_URL" (new data: "http://go.microsoft.com/fwlink/?LinkId=54896") changed in Browser page!
3/21/2008 9:48:34 AM Allowed (based on user decision) value "" (new data: ""%1" /S") changed in SCR Extension handler!
3/21/2008 9:48:37 AM Allowed (based on user decision) value "" (new data: "regedit.exe "%1"") changed in REG Extension handler!
3/21/2008 9:48:39 AM Allowed (based on user decision) value "AutoRun" (new data: "") deleted in Command processor!
3/21/2008 9:48:41 AM Allowed (based on user decision) value "load" (new data: "") deleted in NT startup!
3/21/2008 9:48:46 AM Allowed (based on user decision) value "scrnsave.exe" (new data: "") deleted in Desktop settings!

Shaba · Mar 21, 2008

Hi

Yes there is something left.

We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
C:\WINDOWS\system32\ggf.exe

Driver::
gtermddo
Hardware TnL Rendering

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gf1.0.0.2]

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Calliste · Mar 22, 2008

New Combofix log:

ComboFix 08-03-20.5 - Peter K 2008-03-21 20:31:55.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.682 [GMT -5:00]
Running from: C:\Documents and Settings\Peter K\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Peter K\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\ggf.exe
.

((((((((((((((((((((((((( Files Created from 2008-02-22 to 2008-03-22 )))))))))))))))))))))))))))))))
.

2008-03-13 13:15 . 2008-03-13 13:15 <DIR> d-------- C:\Program Files\Java
2008-03-13 13:15 . 2008-03-13 13:15 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-13 13:15 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-07 23:30 . 2008-03-07 23:30 <DIR> d-------- C:\Documents and Settings\Peter K\Application Data\Flood Light Games
2008-03-07 23:30 . 2008-03-07 23:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Flood Light Games
2008-03-06 12:51 . 2008-03-06 12:51 <DIR> d-------- C:\Program Files\Zone Labs
2008-03-06 12:51 . 2008-03-06 12:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-03-06 12:50 . 2008-03-21 20:31 <DIR> d-------- C:\WINDOWS\Internet Logs
2008-03-06 07:56 . 2008-03-06 07:56 <DIR> d-------- C:\Documents and Settings\Peter K\Application Data\Malwarebytes
2008-03-06 07:55 . 2008-03-06 07:55 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-06 07:55 . 2008-03-06 07:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-02 23:12 . 2008-03-02 23:12 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-02 19:42 . 2008-03-02 20:00 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-02 19:42 . 2008-03-02 19:42 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-02 19:42 . 2008-03-02 19:42 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-02 19:42 . 2008-03-02 19:42 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-02-24 23:47 . 2008-02-24 23:47 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-24 18:01 . 2008-02-24 18:01 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-24 18:01 . 2008-02-24 18:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 15:51 . 2008-02-24 15:51 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-24 15:51 . 2008-02-24 15:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-17 03:31 2,220 ----a-w C:\Documents and Settings\Peter K\Application Data\wklnhst.dat
2008-03-17 03:30 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-11 02:57 --------- d-----w C:\Program Files\ACT
2008-03-09 13:41 --------- d-----w C:\Documents and Settings\Peter K\Application Data\Pogo Games
2008-03-09 13:39 --------- d-----w C:\Program Files\Oberon Media
2008-02-26 22:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-03 16:04 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-01-03 16:04 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-01-03 16:04 22,328 ----a-w C:\Documents and Settings\Peter K\Application Data\PnkBstrK.sys
2008-01-03 16:04 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2007-12-25 21:04 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2003-04-17 08:16 447,616 -c--a-w C:\WINDOWS\inf\EL2K_N64.sys
2003-04-17 08:15 147,328 -c--a-w C:\WINDOWS\inf\EL2K_XP.sys
2003-04-17 08:15 147,200 -c--a-w C:\WINDOWS\inf\EL2K_2K.sys
2006-04-09 18:48 1,057 --sha-w C:\WINDOWS\system32\mmf.sys
.

((((((((((((((((((((((((((((( snapshot@2008-03-21_ 9.47.33.78 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2002-08-20 15:08 1511453]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"SoundMAX"="C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" [2003-04-23 08:39 581632]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-06-10 20:10 339968]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2003-09-29 07:10 81990]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 03:11 135251]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 18:41 163840]
"Launch LCDMon"="C:\Program Files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 10:14 497152]
"Launch LGDCore"="C:\Program Files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 10:31 1122304]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
-----c--- 2003-11-07 04:50 19968 C:\WINDOWS\LOGI_MWX.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TCASUTIEXE]
--a------ 2003-02-12 04:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"YPCService"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YPAGER.EXE"=
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YPAGER.EXE"=
"C:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=

R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2006-04-09 12:25]
R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-06 13:08]
R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\System32\DRIVERS\TCAITDI.sys [2001-09-04 06:22]
S1 atiatbxx;Hardware TnL Rendering;C:\WINDOWS\System32\atiatbxx.sys []
S3 Slnt7554;USB Soft Modem Driver;C:\WINDOWS\System32\DRIVERS\slnt7554.sys [2003-02-05 16:55]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 20:36:16
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
.
**************************************************************************
.
Completion time: 2008-03-21 20:38:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-22 01:38:10
ComboFix2.txt 2008-03-21 14:47:45

New HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:42:34 PM, on 3/21/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\runservice.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\SBCYAH~1\CONNEC~1\CONNEC~1.EXE
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMAXPnP] "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe"
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{50CA6F1C-0209-41F1-A1D9-AB52FC36E055}: NameServer = 151.164.1.8 206.13.28.12
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: SmartLinkService (SLService) - Unknown owner - slserv.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 5295 bytes

I may fancy myself a good detective, but you're better ... with clean Kscans, clean spybot scans ... you find something lurking in the logs.

Next step?

Callie

Multi-Viral, Each Scan Different Results

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

New member

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member