Please help...can't get rid of this one

C

Canuck78

New member
The malware on my computer is redirecting my browser. My Avast! is deactivated and I can't get it to run, can't get spybot or any other security software to run. I downloaded HighjackThis, but can't get it to run either. I know I have PC AntiSpyware 2010 on my computer, but can't get rid of it since I can't run any security software. Help please!
 
You can try this:

Boot your machine into safe mode. To reach safe mode you would tap the f8 key during a computer restart. chose the first option from the list: safe mode.
Once at the safe mode desktop try running your AV and any anti-malware apps you have. See if this helps any.

Until clean I suggest using the machine as little as possible, in fact when not in use you can pull the plug on your modem or router or just shut it down so there is no network connectivity.
 
First off, thank you for helping me.

Here is what I have done so far:
Booted in safe mode, tried to run Avast! and SpybotSD with same result, error message "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item" Renamed Spybot and tried to run it. It comes up, but as soon as I chose to perform a scan, it shuts down and I can't open it again.

I have tried HJT and it will not run in safe mode or in normal mode. I have also renamed it, but still will not work.

I have backed up registry with ERUNT.

I also have a Kaspersky log if that would be helpful. Their online scan is the online thing I have been able to run so far and I have kept the log. Let me know if you need it.
 
Do you have access to another machine that you could read a guide on?

We will try combofix, there is a guide to read first. Read through the guide then download combofix onto the infected machine. Before you save it to your desktop rename combofix.exe to combofix1.exe then save it to your desktop.

Double click the saved icon on your desktop and follow the prompts.

Another possibility is to rename and save the combofix1.exe to a usb flash drive then transfer it via usb to the infected computer. If you do this leave the usb drive in the infected computer. Its possible for some malware to infect usb drives and spread to a non-infected computer if inserted back into one.

Guide to using Combofix
 
Downloaded ComboFix and renamed it. When I double-click on it, the window "Open File - Security Warning" opens and it says "The publisher could not be verified. Are you sure you want to run this software?". I click run, the window goes away and then nothing happens.
 
try booting into safe mode to run combofix. To reach safe mode you would tap the f8 key during a computer restart. Chose the first option: safe mode. Once at the safe mode desktop try running combofix.
 
Not good. See if you can get RootRepeal on board. And use the machine as little as possible, pull the plug on router/modem when not in use and no bank/financial stuff.

Please download: RootRepeal

http://ad13.geekstogo.com/RootRepeal.exe

Click the icon on your desktop to start.
Click on the Report tab at the bottom of the window
Next, Click on the Scan button
In the Select Scan Window check everything:

Drivers
Files
Processes
SSDT
Stealth Objects
Hidden Services

Click the OK button
In the next dialog window select all the drives that are listed
Click OK to start the scan

May take some time to complete.
When done click the Save Report button.
Save the report to your desktop
To Exit RootRepeal: click File>Exit
Post the report in your reply
 
This actually worked. Here is the RootRepeal Report:

ROOTREPEAL (c) AD, 2007-2009
==================================================
Scan Start Time: 2009/08/25 21:39
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: dump_iaStor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iaStor.sys
Address: 0x99116000 Size: 778240 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0x985DA000 Size: 49152 File Visible: No Signed: -
Status: -

Name: win32k.sys:1
Image Path: C:\WINDOWS\win32k.sys:1
Address: 0x9A784000 Size: 20480 File Visible: No Signed: -
Status: -

Name: win32k.sys:2
Image Path: C:\WINDOWS\win32k.sys:2
Address: 0xA0B5F000 Size: 61440 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\eventlog.dll
Status: Locked to the Windows API!

Path: c:\documents and settings\user\local settings\temp\~df2f60.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Path: c:\documents and settings\user\local settings\temp\~df9370.tmp
Status: Allocation size mismatch (API: 16384, Raw: 0)

Processes
-------------------
Path: C:\WINDOWS\system32\braviax.exe
PID: 1032 Status: Hidden from the Windows API!

SSDT
-------------------
#: 025 Function Name: NtClose
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39516b8

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3951574

#: 065 Function Name: NtDeleteValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa3951a52

#: 068 Function Name: NtDuplicateObject
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395114c

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395164e

#: 122 Function Name: NtOpenProcess
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395108c

#: 128 Function Name: NtOpenThread
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39510f0

#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\System32\Drivers\Beep.SYS" at address 0xb7dbb1a0

#: 177 Function Name: NtQueryValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395176e

#: 204 Function Name: NtRestoreKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa395172e

#: 247 Function Name: NtSetValueKey
Status: Hooked by "C:\WINDOWS\System32\Drivers\aswSP.SYS" at address 0xa39518ae

==EOF==
 
not much there. I was expecting more. rerun rootrepeal. this time:

Click the icon on your desktop to start.
Click on the Report tab at the bottom of the window
Next, Click on the Scan button
In the Select Scan Window check:

Processes


Click the OK button
In the next dialog window select all the drives that are listed
Click OK to start the scan
When finished, in the main window, right click on "terminate process and delete file" for this single entry:

C:\WINDOWS\system32\braviax.exe

reboot machine and see if you can run anything.
 
Did as instructed and tried to run Avast!, SpybotSD, HJT and ComboFix with no success. I also noticed that when I run RootRepeal again, the same line appears again:

C:\WINDOWS\system32\braviax.exe

Also, I don't know if it's relevant or not, but at the end of the RootRepeal scan, I get the following error message: "Unrecognized partition type 14 (Oxe)!"

I also still have the report from the Kaspersky scan, don't know if that would be helpful or not?
 
I forgot to mention that I tried running all those programs in both safe and normal mode with no success in either one.
 
Iam assuming all this is the working of malware. What operating system are you using? If the root repeal log is correct i cant see braviax.exe being the cause of all the problems.

You can look for the process in task manager. To get task manager you can hit at once the ctrl-alt-delete keys. Under the process tab look for braviax.exe, right click on it and select end process, click yes at the warning.
try navigating to the C:\WINDOWS\system32 directory and see if you can manually find and delete braviax.exe after ending its process

Yes you can post the Kaspersky scan.

"Unrecognized partition type 14 (Oxe)!
Click to expand...
Dont know really, you have a single hard drive and operating system installed?
 
I am running Windows XP SP3. I only have one OS installed, but I do have an external hard drive that I haven't used in a while and is not connected to the computer.

Braviax doesn't appear in the task manager. I have found it in the directory though, but can't delete it.

Here is the Kaspersky scan report:

KASPERSKY ONLINE SCANNER 7.0: scan report
Wednesday, August 26, 2009
Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Wednesday, August 26, 2009 23:44:34
Records in database: 2690294


Scan settings
scan using the following database extended
Scan archives yes
Scan e-mail databases yes

Scan area Folder
C:\

Scan statistics
Objects scanned 82658
Threats found 10
Infected objects found 20
Suspicious objects found 0
Scan duration 00:47:59

File name Threat Threats count
C:\Documents and Settings\USER\Local Settings\Temp\msupd_2.exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\F7LT3V0X\livwja[1].htm Infected: Packed.Win32.TDSS.y 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\GOR3YO71\Install[1].exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1\ebbpttlp[1].htm Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1\tqqdv[1].txt Infected: Trojan.Win32.Agent.cvfm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\a55b8[1].pdf Infected: Exploit.Win32.Pidief.bjx 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\atdhuv[1].htm Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4\nkkllpu[1].htm Infected: Trojan.Win32.Crot.v 1

C:\ekxfnpkm.exe Infected: Trojan.Win32.Crot.v 1

C:\lcbckjms.exe Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\sdlb.exe Infected: Trojan-Downloader.Win32.Small.amcm 1

C:\WINDOWS\cru629.dat Infected: Backdoor.Win32.Small.ejx 1

C:\WINDOWS\system32\cru629.dat Infected: Backdoor.Win32.Small.ejx 1

C:\WINDOWS\system32\dllcache\beep.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\dllcache\figaro.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\drivers\beep.sys Infected: Backdoor.Win32.UltimateDefender.igv 1

C:\WINDOWS\system32\tajf83ikdmf.dll Infected: Trojan-Downloader.Win32.Agent.cnhi 1

C:\WINDOWS\system32\wisdstr.exe Infected: Trojan-Dropper.Win32.FrauDrop.iy 1

C:\WINDOWS\system32\_scui.cpl Infected: Trojan.Win32.FraudPack.qys 1

C:\yihw.exe Infected: Trojan.Win32.Agent.cvfm 1

Selected area has been scanned.
 
See if you can get this on board and run it:

Download Dr.Web CureIt to the desktop:

ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

* Doubleclick the drweb-cureit icon to start the program.
* press start
* Allow the program to run the initial express scan
* This will scan the files currently running in memory. If something is found, click the YES button when it asks you if you want to cure it. This is only a short scan.
Note: A pop up may appear during this phase suggesting you purchase their program - click the X at the top right corner of this pop-up to close it.
* Once the short scan has finished, check the Complete scan box on the left side, even if nothing was found on the initial scan.
* Then click the small green arrow button on the right under the Dr.Web Antivirus picture to start the complete scan. (This scan will take some time)
* During this complete scan - if Dr.Web finds an infection a window will pop up requesting your attention. Select the Cure button.
Note:(If the file cannot be cured, Dr.Web will automatically delete the file)
* Once the scan is complete, on the menu bar, click file and choose report list.
* Save the report to your desktop. The report will be called DrWeb.csv
* Note:this report will need to be renamed to Dr.Web.txt in order to post it on the forum.
* Close Dr.Web Cureit.
* Please post the Dr.Web.txt report in your next reply
 
We seem to be making some progress. My AV is running again and I am not getting those fake alerts that I am infected anymore.

Here is the DrWeb Report:

braviax.exe;c:\windows\system32;Trojan.Fakealert.4875;Deleted.;
beep.sys;c:\windows\system32\drivers;Trojan.NtRootKit.3206;Deleted.;
lcbckjms.exe;C:\;Trojan.MulDrop.33724;Deleted.;
sdlb.exe;C:\;Trojan.MulDrop.33724;Deleted.;
yihw.exe;C:\;Trojan.Packed.2582;Deleted.;
RegUBP2b-USER.reg;C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Snapshots2;Trojan.StartPage.1505;Deleted.;
msupd_2.exe;C:\Documents and Settings\USER\Local Settings\Temp;Trojan.Fakealert.4747;Incurable.Moved.;
winamp[1].exe;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\F7LT3V0X;Trojan.Fakealert.4703;Deleted.;
Install[1].exe;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\GOR3YO71;Trojan.Fakealert.4747;Incurable.Moved.;
ebbpttlp[1].htm;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1;Trojan.MulDrop.33724;Deleted.;
tqqdv[1].txt;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUE55PD1;Trojan.Packed.2582;Deleted.;
atdhuv[1].htm;C:\Documents and Settings\USER\Local Settings\Temporary Internet Files\Content.IE5\HUZKQ1W4;Trojan.MulDrop.33724;Deleted.;
A0082662.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082664.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082679.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082680.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082685.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP139;Trojan.Fakealert.4875;Deleted.;
A0082705.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP140;Trojan.Fakealert.4875;Deleted.;
A0082707.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP140;Trojan.Fakealert.4875;Deleted.;
A0082734.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Fakealert.4875;Deleted.;
A0082751.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Fakealert.4875;Deleted.;
A0082752.sys;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.NtRootKit.3206;Deleted.;
A0082753.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.MulDrop.33724;Deleted.;
A0082754.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.MulDrop.33724;Deleted.;
A0082755.exe;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.Packed.2582;Deleted.;
A0082756.reg;C:\System Volume Information\_restore{2861689C-77A3-4720-AFC5-00C24082598C}\RP141;Trojan.StartPage.1505;Deleted.;
braviax.exe;C:\WINDOWS;Trojan.Fakealert.4875;Deleted.;
cru629.dat;C:\WINDOWS;Trojan.Proxy.1739;Deleted.;
cru629.dat;C:\WINDOWS\system32;Trojan.Proxy.1739;Deleted.;
wisdstr.exe;C:\WINDOWS\system32;Trojan.Fakealert.4747;Incurable.Moved.;
_scui.cpl;C:\WINDOWS\system32;Trojan.Fakealert.4739;Deleted.;
~.exe;C:\WINDOWS\system32;Trojan.Fakealert.4703;Deleted.;
beep.sys;C:\WINDOWS\system32\dllcache;Trojan.NtRootKit.3206;Deleted.;
figaro.sys;C:\WINDOWS\system32\dllcache;Trojan.NtRootKit.3206;Deleted
 
Here is the ComboFix Report:

ComboFix 09-08-24.05 - USER 08/29/2009 0:03.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.2602 [GMT -5:00]
Running from: c:\documents and settings\USER\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090827-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\kuvepa.com
c:\documents and settings\All Users\Application Data\limow.reg
c:\documents and settings\All Users\Application Data\ovepipud.dl
c:\documents and settings\All Users\Application Data\qigeb.dll
c:\documents and settings\All Users\Application Data\vojyxi.exe
c:\documents and settings\All Users\Documents\iheman.scr
c:\documents and settings\All Users\Documents\puluwyfi.exe
c:\documents and settings\All Users\Documents\zuwesu.sys
c:\documents and settings\USER\Application Data\mexamyq.com
c:\documents and settings\USER\Application Data\tozo.vbs
c:\documents and settings\USER\Application Data\upinyfuzi.pif
c:\documents and settings\USER\Application Data\upowikovu.scr
c:\documents and settings\USER\Application Data\ygifiryko.com
c:\documents and settings\USER\Cookies\fumefuw.com
c:\documents and settings\USER\Cookies\ipeco.com
c:\documents and settings\USER\Cookies\okacusewur.dll
c:\documents and settings\USER\Cookies\oloxi.sys
c:\documents and settings\USER\Local Settings\Application Data\fewopykyra.exe
c:\documents and settings\USER\Local Settings\Application Data\fyzehil.vbs
c:\documents and settings\USER\Local Settings\Application Data\hikogimyx._dl
c:\documents and settings\USER\Local Settings\Application Data\ijadinuwit.exe
c:\documents and settings\USER\Local Settings\Application Data\ijetequkad.com
c:\documents and settings\USER\Local Settings\Application Data\iwodosil.scr
c:\documents and settings\USER\Local Settings\Application Data\kewozaba.pif
c:\documents and settings\USER\Local Settings\Application Data\povit._dl
c:\documents and settings\USER\Local Settings\Application Data\pyromug.pif
c:\documents and settings\USER\Local Settings\Application Data\tuxiku.ban
c:\documents and settings\USER\Local Settings\Application Data\yfel.ban
c:\documents and settings\USER\Local Settings\Temporary Internet Files\gileranage._dl
c:\documents and settings\USER\Local Settings\Temporary Internet Files\hebunubere.scr
c:\documents and settings\USER\Local Settings\Temporary Internet Files\irisuviror.bin
c:\documents and settings\USER\Local Settings\Temporary Internet Files\uliqa.reg
c:\documents and settings\USER\Local Settings\Temporary Internet Files\ynodehy.dl
C:\ekxfnpkm.exe
c:\program files\Common Files\erifazu._dl
c:\program files\Common Files\horiguxeny.scr
c:\program files\Common Files\isetiqewu.scr
c:\program files\Common Files\jene.scr
c:\program files\Common Files\qoqi.com
c:\program files\Common Files\zafajodab.vbs
c:\windows\cucobacux.exe
c:\windows\isumezi.dl
c:\windows\suge.reg
c:\windows\system32\anysakugek._dl
c:\windows\system32\dosimeci.reg
c:\windows\system32\drivers\UACd.sys
c:\windows\system32\hojeq.dl
c:\windows\system32\owofiroma.bin
c:\windows\system32\rumob.bat
c:\windows\system32\tajf83ikdmf.dll
c:\windows\system32\tedebo.vbs
c:\windows\system32\umatu.dll
c:\windows\system32\uzib.pif
c:\windows\system32\weqibyn.dll
c:\windows\ubinygegoz.pif
c:\windows\upehutaz.ban
c:\windows\ymawo.reg

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-07-28 to 2009-08-29 )))))))))))))))))))))))))))))))
.

2009-08-28 02:38 . 2009-08-28 02:38 -------- d-----w- c:\documents and settings\USER\DoctorWeb
2009-08-25 01:22 . 2009-08-25 01:22 18107 ----a-w- c:\windows\suzibim.dat
2009-08-25 00:42 . 2009-08-25 00:42 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-08-23 19:31 . 2009-08-23 19:31 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-23 02:40 . 2009-08-23 02:40 -------- d-----w- c:\program files\Trend Micro
2009-08-23 02:38 . 2009-08-23 02:38 -------- d-----w- c:\program files\ERUNT
2009-08-23 02:07 . 2009-08-23 02:07 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache
2009-08-23 00:41 . 2009-08-23 16:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-23 00:41 . 2009-08-23 01:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\USER\Application Data\Malwarebytes
2009-08-23 00:10 . 2009-08-23 00:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-22 09:43 . 2009-08-22 09:43 18842 ----a-w- c:\windows\sadir.com
2009-08-22 09:43 . 2009-08-22 09:43 16248 ----a-w- c:\windows\system32\ivalitib.com
2009-08-22 09:43 . 2009-08-22 09:43 12350 ----a-w- c:\windows\system32\irilyp.dat
2009-08-14 08:19 . 2009-06-25 08:25 54272 -c----w- c:\windows\system32\dllcache\wdigest.dll
2009-08-14 08:19 . 2009-06-25 08:25 301568 -c----w- c:\windows\system32\dllcache\kerberos.dll
2009-08-14 08:19 . 2009-06-25 08:25 136192 -c----w- c:\windows\system32\dllcache\msv1_0.dll
2009-08-14 08:19 . 2009-06-24 11:18 92928 -c----w- c:\windows\system32\dllcache\ksecdd.sys
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\windows\system32\XPSViewer
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\MSBuild
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- c:\program files\Reference Assemblies
2009-08-14 08:03 . 2009-08-14 08:03 -------- d-----w- C:\994bb1b65eb8bd7bddb4
2009-08-14 08:03 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-08-14 08:03 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-08-14 08:03 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-08-14 08:03 . 2009-08-14 08:17 -------- d-----w- c:\windows\SxsCaPendDel
2009-08-12 08:00 . 2009-08-12 08:00 -------- d-----w- c:\program files\MSXML 4.0
2009-08-11 21:11 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\LocalService\Application Data\Roxio
2009-08-10 18:05 . 2009-08-10 18:05 -------- d-----w- c:\documents and settings\USER\Application Data\Roxio
2009-08-10 17:54 . 2008-04-14 05:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-08-10 17:54 . 2008-04-14 05:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-08-10 17:46 . 2009-08-10 19:37 256 ----a-w- c:\windows\system32\pool.bin
2009-08-10 17:46 . 2009-08-10 18:01 -------- d-----w- c:\documents and settings\USER\Application Data\Research In Motion
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\USER\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-08-10 17:41 . 2009-08-10 17:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Sonic
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Roxio
2009-08-10 17:39 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Sonic Shared
2009-08-10 17:38 . 2009-08-10 17:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Research In Motion
2009-08-10 17:37 . 2009-01-09 21:18 27136 ----a-r- c:\windows\system32\drivers\RimSerial.sys
2009-08-10 17:37 . 2009-08-10 17:39 -------- d-----w- c:\program files\Common Files\Roxio Shared
2009-08-10 17:36 . 2009-08-10 17:37 -------- d-----w- c:\program files\Common Files\Research In Motion
2009-08-10 17:36 . 2009-08-10 17:38 -------- d-----w- c:\program files\Research In Motion
2009-08-08 04:46 . 2009-08-08 04:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-08-07 05:21 . 2009-08-07 05:21 -------- d-----w- c:\documents and settings\USER\Freeze Tag
2009-08-07 05:18 . 2009-08-07 05:20 -------- d-----w- c:\program files\Mystery Masterpiece - The Moonstone
2009-08-05 09:01 . 2009-08-05 09:01 204800 -c----w- c:\windows\system32\dllcache\mswebdvd.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-25 13:30 . 2009-04-17 16:48 -------- d-----w- c:\program files\Common Files\Software Update Utility
2009-08-25 01:22 . 2009-08-25 01:22 18195 ----a-w- c:\program files\Common Files\mexohysu.inf
2009-08-25 01:22 . 2009-08-25 01:22 12681 ----a-w- c:\program files\Common Files\isikusicy.lib
2009-08-25 00:27 . 2009-06-16 03:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-10 18:01 . 2009-03-28 06:38 80936 ----a-w- c:\documents and settings\USER\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-10 17:39 . 2009-03-23 18:47 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-08 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Google
2009-08-07 14:58 . 2009-06-16 03:12 -------- d-----w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-08-05 20:17 . 2009-04-02 23:56 -------- d-----w- c:\documents and settings\USER\Application Data\dvdcss
2009-08-05 09:01 . 2004-08-03 20:56 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-18 04:46 . 2009-07-18 04:45 -------- d-----w- c:\program files\Common Files\Real
2009-07-18 04:46 . 2009-07-18 04:46 -------- d-----w- c:\program files\Real
2009-07-17 19:01 . 2004-08-03 20:56 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 19:50 . 2009-07-08 16:56 -------- d-----w- c:\program files\Farm Frenzy 2
2009-07-14 04:43 . 2004-08-03 20:56 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-08 17:31 . 2009-07-08 17:06 -------- d-----w- c:\documents and settings\All Users\Application Data\FarmFrenzy2
2009-07-08 06:29 . 2009-07-06 09:00 -------- d-----w- c:\documents and settings\All Users\Application Data\MumboJumbo
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\program files\AIM6
2009-07-06 16:09 . 2009-07-06 16:09 -------- d-----w- c:\program files\AIM Toolbar
2009-07-06 16:09 . 2009-04-17 16:48 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-06 16:09 . 2009-04-17 16:51 -------- d-----w- c:\documents and settings\All Users\Application Data\AOL Downloads
2009-07-03 17:09 . 2004-08-03 20:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 16:00 . 2009-04-17 17:04 -------- d-----w- c:\program files\AIMTunes
2009-06-25 08:25 . 2004-08-03 20:56 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2004-08-03 20:56 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2004-08-03 20:56 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2004-08-03 20:56 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2004-08-03 20:56 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2004-08-03 20:56 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2004-08-03 18:59 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2004-08-03 20:56 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2001-08-23 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-12 12:31 . 2004-08-03 20:56 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2004-08-03 20:56 76288 ----a-w- c:\windows\system32\telnet.exe
2009-06-10 14:19 . 2009-03-23 18:33 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-06-10 14:13 . 2004-08-03 20:56 84992 ----a-w- c:\windows\system32\avifil32.dll
2009-06-10 06:14 . 2004-08-03 20:56 132096 ----a-w- c:\windows\system32\wkssvc.dll
2009-06-03 19:09 . 2004-08-03 20:56 1291264 ----a-w- c:\windows\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2008-10-24 206112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-09-06 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-09-06 162328]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-09-06 137752]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-06-01 823296]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-06-01 974848]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2008-04-14 53248]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2007-03-27 217088]
"RemoteControl8"="c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe" [2008-03-21 83240]
"PDVD8LanguageShortcut"="c:\program files\CyberLink\PowerDVD8\Language\Language.exe" [2007-12-14 50472]
"BDRegion"="c:\program files\Cyberlink\Shared Files\brs.exe" [2008-09-13 91432]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-01 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-03-26 177472]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-07-18 198160]
"BlackBerryAutoUpdate"="c:\program files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe" [2009-07-02 623960]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2009-04-11 236016]

c:\documents and settings\USER\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2007-05-17 04:50 73728 ----a-w- c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD8\\PowerDVD8.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGames.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\QQGamesD.exe"=
"c:\\Program Files\\Tencent\\QQ Games\\Update\\Update.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [3/23/2009 2:06 PM 114768]
R2 {FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054};c:\program files\CyberLink\PowerDVD8\000.fcl [2/1/2008 8:24 PM 41456]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [3/23/2009 2:06 PM 20560]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [4/17/2009 11:48 AM 24652]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [3/23/2009 1:49 PM 812544]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-08-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-08-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-07-18 04:46]

2009-08-29 c:\windows\Tasks\User_Feed_Synchronization-{355B7B07-B470-4EFF-9466-FD543D9FD666}.job
- c:\windows\system32\msfeedssync.exe [2007-08-14 11:31]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-PC Antispyware 2010 - c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: {C19FB533-FDBA-4162-BDA8-6DD0D43D97DF} = 85.31.81.245,85.31.66.4
DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} - hxxp://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-27-0.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-29 00:10
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
"ImagePath"="\??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1028)
c:\windows\system32\VESWinlogon.dll

- - - - - - - > 'explorer.exe'(3748)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
.
**************************************************************************
.
Completion time: 2009-08-29 0:13 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-29 05:13

Pre-Run: 929,124,352 bytes free
Post-Run: 1,262,014,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

309 --- E O F --- 2009-08-27 10:20
 
ok looking good. Your redirects must be gone by now. We will use combofix:

Click Start, then Run and type Notepad and click OK.
Copy/paste the text in the code box below into notepad:

Code: 
File::
c:\windows\suzibim.dat
c:\windows\sadir.com
c:\windows\system32\ivalitib.com
c:\windows\system32\irilyp.dat
c:\program files\Common Files\mexohysu.inf
c:\program files\Common Files\isikusicy.lib
C:\994bb1b65eb8bd7bddb4

Name the Notepad file CFScript.txt and Save it to your desktop.
now locate the file you just saved and the combofix icon, both on your desktop
using your mouse drag the CFScript right on top of the combofix icon and release, combofix will run and produce a new log
please post the new combofix log.

After combofix has finished check Malwarebytes for updates do a full scan and post its log also:

Start MBAM, click the updates tab then check for updates. If an update is found, it will download and install the latest version.

click the Scanner tab, select Perform FULL SCAN, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click *Remove Selected.*

*A restart of your computer most likely will be required to remove some items.*

When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
Post the log in your reply.
 
Last edited:
You must log in or register to reply here.
Back
Top