S&D reports "Smitfraud-C.CoreService"

gigabyte74 · Jan 28, 2008

I have a current version of Kaspersky installed but I used the on-line scanner as directed anyway. As yo ucan see, Kaspersky doesn't see anything wrong.

I have a spybot s&d report but it is too long to post so I uploaded it here:
http://www.pacifier.com/~gigabyte/report.txt

Your time and assistance is greatly appreciated.

Kaspersky:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, January 27, 2008 6:58:21 PM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/01/2008
Kaspersky Anti-Virus database records: 534290
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 61595
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:45:47

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\ApplicationHistory\IEXPLORE.EXE.26e3ad32.ini.inuse Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temp\hsperfdata_Administrator\828 Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\0231_File_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\0233_ParCtl_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\0234_Web_Monitoring_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\0235_AdBlocker_eventcritlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\0235_AdBlocker_eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\report.rpt Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\MySQL\MySQL Server 5.0\data\DESKTOP2.err Object is locked skipped
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\logs\AppLock Object is locked skipped
C:\System Volume Information\_restore{D4C0D2BA-9D07-4CA3-B7B9-0EED0C8039CF}\RP636\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\drivers\oprghdlrr.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:01:13 PM, on 1/27/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {88DD8B63-53B7-4748-8A82-AC68F27F681B} - C:\WINDOWS\System32\ddcyx.dll (file missing)
O2 - BHO: File Print FedEx Kinko's - {9566395F-43D2-4c64-B525-B501FFA276E2} - mscoree.dll (file missing)
O2 - BHO: (no name) - {A051B1FF-8D7E-418B-AABE-4FF82F4280A2} - C:\WINDOWS\System32\yayaxuu.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: File Print FedEx Kinko's - {9566395f-43d2-4c64-b525-b501ffa276e2} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SATARaid5Manager.lnk = ?
O4 - Global Startup: TrayMin200.exe.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB
O16 - DPF: {50C690FF-E11D-11D6-B30E-00C0262B86C4} (Nanox Control) - http://68.153.160.150/nanox.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1191101006531
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: yayaxuu - C:\WINDOWS\
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SATARaid5 Configuration Service (SATARaid5 Config Service) - Unknown owner - C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
O24 - Desktop Component 0: (no name) - http://www.roommates.com/member_photos/full/1471296482419c272f3c10f.jpg

--
End of file - 6985 bytes

pskelley · Jan 28, 2008

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Check the instructions to be sure, no Spybot report is reqested.

C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
http://www.greatis.com/appdata/u/v/viewmgr.exe.htm
http://www.spywareinfo.com/newsletter/archives/2005/nov4.php#viewpoint
http://www.clickz.com/news/article.php/3561546

1) We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
* Run Spybot-S&D in Advanced Mode.
* If it is not already set to do this Go to the Mode menu select "Advanced Mode"
* On the left hand side, Click on Tools
* Then click on the Resident Icon in the List
* Uncheck "Resident TeaTimer" and OK any prompts.
* Restart your computer.
(leave this off until we finish)

2) Please download ATF Cleaner by Atribune
http://www.atribune.org/content/view/25/2/
Save it to your Desktop. We will use this later.

3) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:

(the Kindo items are damaged, if you use it, install it again when we are finished)

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {88DD8B63-53B7-4748-8A82-AC68F27F681B} - C:\WINDOWS\System32\ddcyx.dll (file missing)
O2 - BHO: File Print FedEx Kinko's - {9566395F-43D2-4c64-B525-B501FFA276E2} - mscoree.dll (file missing)
O2 - BHO: (no name) - {A051B1FF-8D7E-418B-AABE-4FF82F4280A2} - C:\WINDOWS\System32\yayaxuu.dll (file missing)
O3 - Toolbar: File Print FedEx Kinko's - {9566395f-43d2-4c64-b525-b501ffa276e2} - mscoree.dll (file missing)
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O20 - Winlogon Notify: yayaxuu - C:\WINDOWS\

Close all programs but HJT and all browser windows, then click on "Fix Checked"

4) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

5) http://www.bleepingcomputer.com/combofix/how-to-use-combofix <<< tutorial if needed

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop

Download ComboFix from Here or Here to your Desktop

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Thanks

gigabyte74 · Feb 3, 2008

Round 1 complete

I didn't realize that you replied to me so fast. I subscribed to the thread but it must have ben rejected as spam. I have my spam filter set prety strict. I dumped my spam folder and hopefully once I post this reply I will be able to spot the e-mail and whitelist it.

It may also be helpfull for you to know that I have a RAID mirror running. There is a monitoring program that runs at OS startup to keep tabs on the integrity of the mirror. Kaspersky won't let that application start for some reason. Consequently, before every reboot, I must suspend Kaspersky and reactivate it once all processes have been restored. I worry that this leaves me vulnerable to some extent. I have addressed the problem with Kaspersky and I am awaiting their reply.

I could not locate the program "viewpoint" in the "add/remove programs" or on the hard drive in the specified locations.
I uninstalled the "fedexkinkos" tool. I don't use it anyway.
I disabled my licensed version of Kaspersky while performing the tasks you outlined to ensure that it would not interfear.
TeaTimer has been disabled and remains so untill you tell me otherwise.
ATF cleaner downloaded.
The HJT items you listed were fixed with the exception of the Kinkos tool that I removed. It no longer shows on the scan.
ATF cleaner ran on "main" and "firefox"
ComboFix downloaded and executed successfully. Logs follow.
Following task completion, I reactivated Kaspersky and it immediately quarantined "ComboFix". I have restored it from quarantine and added it as a "trusted application" with no restrictions.

I would like to take this oportunity to convey my deepest gratitude for your time and assistance.

ComboFix log:

ComboFix 08-02.03.1 - Administrator 2008-02-02 18:08:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.1696 [GMT -8:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\CROSOF~1
C:\Documents and Settings\Administrator\Application Data\CROSOF~1\??crosoft\
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt
C:\Program Files\outerinfo
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\Downloaded Program Files\ODCTOOLS
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

----- BITS: Possible infected sites -----

hxxp://www.download.windowsupdate.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-02-02 18:12 . 2008-02-02 18:12 <DIR> d-------- C:\temp\tn3
2008-01-27 19:00 . 2008-01-27 19:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-27 16:45 . 2008-01-27 16:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 16:40 . 2008-01-27 16:40 167,545 --a------ C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-27 10:40 . 2008-01-27 12:58 165 --a------ C:\WINDOWS\wininit.ini
2008-01-27 09:32 . 2008-01-27 09:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-22 19:43 . 2008-01-23 20:40 <DIR> d-------- C:\VundoFix Backups
2008-01-21 17:51 . 2008-01-31 11:07 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 17:51 . 2008-01-21 18:03 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-21 17:49 . 2008-01-21 20:06 <DIR> d-------- C:\Program Files\Kaspersky Internet Security 7.0
2008-01-21 17:49 . 2008-02-02 18:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-21 17:49 . 2008-02-02 18:12 2,877,984 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-21 17:49 . 2008-02-02 18:11 39,968 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-21 17:49 . 2008-02-02 18:11 39,596 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-21 17:49 . 2008-02-02 18:11 4,796 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-20 23:10 . 2008-01-21 19:19 40,960 --a------ C:\WINDOWS\VM_STI .EXE
2008-01-20 23:02 . 2008-01-21 19:33 <DIR> d--hs---- C:\WINDOWS\VmFsdWVkIGN1c3Q
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nui4
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\temp\gTiis19
2008-01-20 23:02 . 2008-01-20 23:02 86,016 --a------ C:\WINDOWS\system32\drivers\oprghdlrr.sys
2008-01-20 23:01 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-20 23:01 . 2008-01-20 23:01 <DIR> d-------- C:\temp\cXzz9
2008-01-20 13:07 . 2008-01-20 13:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-01-20 13:07 . 2008-01-20 13:07 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 01:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-29 02:01 --------- d-----w C:\Program Files\Picasa2
2008-01-27 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-23 04:20 --------- d-----w C:\Program Files\Java
2008-01-22 07:06 --------- d-----w C:\Program Files\QuickTime
2008-01-22 03:31 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-12-17 02:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-11-06 13:50 27,262,976 ----a-w C:\VIRTPART.DAT
2005-07-30 00:24 472 --sha-r C:\WINDOWS\VmFsdWVkIGN1c3Q\pAIPxqp4K3hYwak.vbs
.

Code:

<pre>
----a-w           455,968 2008-01-22 03:20:08  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel .exe
----a-w           151,552 2008-01-22 03:19:52  C:\Program Files\CyberLink\PCM4Everio\EverioService .exe
----a-w           132,496 2008-01-22 03:19:46  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w            77,824 2008-01-22 04:05:01  C:\Program Files\QuickTime\qttask      .exe
----a-w            94,208 2008-01-22 03:19:52  C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp .exe
----a-w            40,960 2008-01-22 03:19:48  C:\WINDOWS\VM_STI .EXE
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 13:18 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
SATARaid5Manager.lnk - C:\WINDOWS\Installer\{E4D034E1-7643-4E63-928F-22174534B470}\_607517601492A67A51EB97.exe [2007-11-06 17:08:28 1206]
TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2006-11-21 17:22:30 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1.0\adialhk.dll

R0 Si3124r5;SiI-3124 SoftRaid 5 Controller;C:\WINDOWS\System32\DRIVERS\Si3124r5.sys [2006-09-20 11:38]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2003-12-17 15:41]
R1 oprghdlrr;oprghdlrr;C:\WINDOWS\System32\drivers\oprghdlrr.sys [2008-01-20 23:02]
R2 SATARaid5 Config Service;SATARaid5 Configuration Service;"C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe" [2005-10-05 18:19]
R3 Intels51;Intel(R) 536EP Modem;C:\WINDOWS\System32\DRIVERS\Intels51.sys [2003-05-22 06:44]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\System32\DRIVERS\klim5.sys [2007-04-04 14:58]
S2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS []

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 02:12:14 C:\WINDOWS\Tasks\SDMsgUpdate (SmartDrawTrial).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe.-PSmartDrawTrial -V7 -SSDN.ini -A -T -N -L -X
"2008-02-01 07:00:44 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-02 18:12:47
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
.
**************************************************************************
.
Completion time: 2008-02-02 18:14:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-03 02:14:09

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:18:46 PM, on 2/2/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SATARaid5Manager.lnk = ?
O4 - Global Startup: TrayMin200.exe.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB
O16 - DPF: {50C690FF-E11D-11D6-B30E-00C0262B86C4} (Nanox Control) - http://68.153.160.150/nanox.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1191101006531
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1.0\adialhk.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SATARaid5 Configuration Service (SATARaid5 Config Service) - Unknown owner - C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
O24 - Desktop Component 0: (no name) - http://www.roommates.com/member_photos/full/1471296482419c272f3c10f.jpg

--
End of file - 6058 bytes

pskelley · Feb 3, 2008

Thanks for returning your information, you have a fairly new, very nasty variety of the Virtumonde infection, here is some information:
http://www.viruslist.com/en/weblog?weblogid=208187466
http://www.google.com/search?hl=en&q=Vundo+file+infector&btnG=Google+Search

http://www.networkworld.com/news/2007/030807-mystery-around-winfixer-slowly-unravels.html
http://www.youtube.com/watch?v=zBUZHiKhsog
http://msmvps.com/blogs/spywaresucks/search.aspx?q=winfixer+msn

This variety infects program files and the ones you see in the blue "code" box are infected at the least and wili likely have to be uninstall and reinstalled. You also have
this infection: http://www.google.com/search?hl=en&q=core.cache.dsk&btnG=Search which I think has something to do with Zedo that has to be removed. While I am familiar with that one, I have not removed this Vundo infection and want you to be aware that you have the option of reformat since some programs have to be reinstalled anyway.
Here is information: http://spyware-free.us/tutorials/reformat/
http://www.cyberwalker.net/faqs/how-tos/reinstall-faq.html
http://helpdesk.its.uiowa.edu/windows/instructions/reformat.htm

If you would prefer that to a complex cleaning proceedure, let me know.

Thanks...Phil

gigabyte74 · Feb 3, 2008

Just my luck

It seams that my problem is worse than I thought.

because you indicated that we are dealing with a relatively knew virus, I am going to brief you an aparently unrelated issues just incase something might tie things together for you:

I did have Vundo but used a popular removal tool and it hasn't shown its ugly face since. Are we just seing residual footprints or is it really still there?

I was browsing through the registry last night looking for certain known problems and did see entries for "catchme" and although I assumed it was malware, I left it alone so as not to sep on your toes while you are helping.

I have very little experiance with the windows registry but have made certain minor edits in the past. I noticed last night that there is a "history" of websites including a crapload of gay porn sites. Good grief! From experiance I also remember that the registry keeps records of every application ever installed even after they are gone. Is there a way to clean all of the old crap out of the registry?

I uninstalled "golden palace casino" from my machine a long time ago but it still shows in the "add/remove programs". I can't get rid of it. I did finally delete the entire program folder from the hard drive just for space..

My active Kaspersky aplication indicates frequent atempts to "modify" explorer.exe and frequent atempts to establish a connection to and from unknown IP addresses

Unfortunately, reformat is not an option. Can we roll up our sleeves and dive in?

pskelley · Feb 3, 2008

I did have Vundo but used a popular removal tool and it hasn't shown its ugly face since. Are we just seing residual footprints or is it really still there?

Exactly what tool did you use? From the combofix report, as I indicated, you can see in the blue box the programs this file infector has infected. Those programs will have to likely have to be uninstalled and reinstalled after all infection is removed, proceed like this.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

Code:

File::
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\oprghdlrr.sys

Folder::
C:\VundoFix Backups

RenV::
----a-w           455,968 2008-01-22 03:20:08  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel exe
----a-w           151,552 2008-01-22 03:19:52  C:\Program Files\CyberLink\PCM4Everio\EverioService exe
----a-w           132,496 2008-01-22 03:19:46  C:\Program Files\Java\jre1.6.0_03\bin\jusched exe
----a-w            77,824 2008-01-22 04:05:01  C:\Program Files\QuickTime\qttask      exe
----a-w            94,208 2008-01-22 03:19:52  C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp exe
----a-w            40,960 2008-01-22 03:19:48  C:\WINDOWS\VM_STI .EXE

Save this as CFScript to your Desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Thanks

gigabyte74 · Feb 3, 2008

vundofix.exe

Exactly what tool did you use?

Here is the tool I used that claims to remove vundo:
http://www.atribune.org/content/view/24/2/
I read quite a few success stories about it in a number of forums. This is something I did before I started this thread.
http://www.google.com/search?num=100&hl=en&safe=off&q="vundofix.exe"

I am at work now and will proceed with your instructions as soon as I get home.

gigabyte74 · Feb 3, 2008

Round 2 complete

Ethernet: disconnected
Kaspersky: paused
Combofix: ran with provided code
HJT: executed
Kaspersky: resumed
Ethernet: reconnected

combofix:

ComboFix 08-02.03.1 - Administrator 2008-02-03 14:19:45.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.1643 [GMT -8:00]
Running from: C:\Documents and Settings\Administrator\Desktop\combofix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\oprghdlrr.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\oprghdlrr.sys
C:\temp\tn3
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\xycdd.ini.bad
C:\VundoFix Backups\xycdd.ini2.bad
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\oprghdlrr.sys

.
((((((((((((((((((((((((( Files Created from 2008-01-03 to 2008-02-03 )))))))))))))))))))))))))))))))
.

2008-01-27 19:00 . 2008-01-27 19:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-27 16:45 . 2008-01-27 16:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 10:40 . 2008-01-27 12:58 165 --a------ C:\WINDOWS\wininit.ini
2008-01-27 09:32 . 2008-01-27 09:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-21 17:51 . 2008-01-31 11:07 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 17:51 . 2008-01-21 18:03 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-21 17:49 . 2008-01-21 20:06 <DIR> d-------- C:\Program Files\Kaspersky Internet Security 7.0
2008-01-21 17:49 . 2008-02-03 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-21 17:49 . 2008-02-03 14:23 2,946,080 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-21 17:49 . 2008-02-03 14:23 44,832 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-21 17:49 . 2008-02-03 14:22 40,508 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-21 17:49 . 2008-02-03 14:22 5,204 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-20 23:10 . 2008-01-21 19:19 40,960 --a------ C:\WINDOWS\VM_STI.EXE
2008-01-20 23:02 . 2008-01-21 19:33 <DIR> d--hs---- C:\WINDOWS\VmFsdWVkIGN1c3Q
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nui4
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\temp\gTiis19
2008-01-20 23:01 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-20 23:01 . 2008-01-20 23:01 <DIR> d-------- C:\temp\cXzz9
2008-01-20 13:07 . 2008-01-20 13:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-01-20 13:07 . 2008-01-20 13:07 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 01:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-29 02:01 --------- d-----w C:\Program Files\Picasa2
2008-01-27 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-23 04:20 --------- d-----w C:\Program Files\Java
2008-01-22 07:06 --------- d-----w C:\Program Files\QuickTime
2008-01-22 03:31 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-12-17 02:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-11-06 13:50 27,262,976 ----a-w C:\VIRTPART.DAT
2005-07-30 00:24 472 --sha-r C:\WINDOWS\VmFsdWVkIGN1c3Q\pAIPxqp4K3hYwak.vbs
.

Code:

<pre>
----a-w           455,968 2008-01-22 03:20:08  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel .exe
----a-w           151,552 2008-01-22 03:19:52  C:\Program Files\CyberLink\PCM4Everio\EverioService .exe
----a-w           132,496 2008-01-22 03:19:46  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w            77,824 2008-01-22 04:05:01  C:\Program Files\QuickTime\qttask      .exe
----a-w            94,208 2008-01-22 03:19:52  C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 13:18 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
SATARaid5Manager.lnk - C:\WINDOWS\Installer\{E4D034E1-7643-4E63-928F-22174534B470}\_607517601492A67A51EB97.exe [2007-11-06 17:08:28 1206]
TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2006-11-21 17:22:30 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1.0\adialhk.dll

R0 Si3124r5;SiI-3124 SoftRaid 5 Controller;C:\WINDOWS\System32\DRIVERS\Si3124r5.sys [2006-09-20 11:38]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2003-12-17 15:41]
R2 SATARaid5 Config Service;SATARaid5 Configuration Service;"C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe" [2005-10-05 18:19]
R3 Intels51;Intel(R) 536EP Modem;C:\WINDOWS\System32\DRIVERS\Intels51.sys [2003-05-22 06:44]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\System32\DRIVERS\klim5.sys [2007-04-04 14:58]
S1 oprghdlrr;oprghdlrr;C:\WINDOWS\System32\drivers\oprghdlrr.sys []
S2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS []

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 22:23:07 C:\WINDOWS\Tasks\SDMsgUpdate (SmartDrawTrial).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe.-PSmartDrawTrial -V7 -SSDN.ini -A -T -N -L -X
"2008-02-01 07:00:44 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 14:23:29
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\System32\wdfmgr.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
.
**************************************************************************
.
Completion time: 2008-02-03 14:24:56 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-03 22:24:51

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:25:45 PM, on 2/3/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SATARaid5Manager.lnk = ?
O4 - Global Startup: TrayMin200.exe.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanced/cfweb_activex.camfrogweb.com-advanced_instmodule.exe
O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/commpilot/customcontrols/BwOutlook.CAB
O16 - DPF: {50C690FF-E11D-11D6-B30E-00C0262B86C4} (Nanox Control) - http://68.153.160.150/nanox.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1191101006531
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1.0\adialhk.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SATARaid5 Configuration Service (SATARaid5 Config Service) - Unknown owner - C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
O24 - Desktop Component 0: (no name) - http://www.roommates.com/member_photos/full/1471296482419c272f3c10f.jpg

--
End of file - 6148 bytes

pskelley · Feb 4, 2008

I am seeing no good reason why that fix did not work the first time, have a look at this example:
http://forums.spybot.info/showthread.php?t=23142

Let's try again:

Open notepad and copy/paste the text in the codebox below into it:

Code:

RenV::
----a-w           455,968 2008-01-22 03:20:08  C:\Program Files\Common Files\LightScribe\LightScribeControlPanel .exe
----a-w           151,552 2008-01-22 03:19:52  C:\Program Files\CyberLink\PCM4Everio\EverioService .exe
----a-w           132,496 2008-01-22 03:19:46  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w            77,824 2008-01-22 04:05:01  C:\Program Files\QuickTime\qttask      .exe
----a-w            94,208 2008-01-22 03:19:52  C:\Program Files\Symantec\Norton Ghost 2003\GhostStartTrayApp .exe

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Thanks

gigabyte74 · Feb 4, 2008

I followed the exact same steps as in "round 2" but with the new code.

It apears to be gone!
C:\WINDOWS\system32\drivers\core.cache.dsk
I can't find it now! I also run a spybot scan and it came up clean!

Thank you SOOO much for all of your help!

Did you look at thay "vundofix.exe" info? Again, this is from just before we started but I found the log file generated by vundofix and thought I would post it. You may finde it interesting if not helpfull.

Vundofix:

VundoFix V6.7.7

Checking Java version...

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.10

Scan started at 7:43:14 PM 1/22/2008

Listing files found while scanning....

C:\windows\system32\ddcyx.dll
C:\windows\system32\xycdd.ini
C:\windows\system32\xycdd.ini2

Beginning removal...

Attempting to delete C:\windows\system32\ddcyx.dll
C:\windows\system32\ddcyx.dll Has been deleted!

Attempting to delete C:\windows\system32\xycdd.ini
C:\windows\system32\xycdd.ini Has been deleted!

Attempting to delete C:\windows\system32\xycdd.ini2
C:\windows\system32\xycdd.ini2 Has been deleted!

Performing Repairs to the registry.
Done!

Combofix:

ComboFix 08-02.03.1 - Administrator 2008-02-03 16:55:05.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.1686 [GMT -8:00]
Running from: C:\Documents and Settings\Administrator\Desktop\combofix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.

2008-01-27 19:00 . 2008-01-27 19:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-27 16:45 . 2008-01-27 16:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-27 10:40 . 2008-01-27 12:58 165 --a------ C:\WINDOWS\wininit.ini
2008-01-27 09:32 . 2008-01-27 09:32 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-01-21 17:51 . 2008-01-31 11:07 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-01-21 17:51 . 2008-01-21 18:03 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-01-21 17:49 . 2008-01-21 20:06 <DIR> d-------- C:\Program Files\Kaspersky Internet Security 7.0
2008-01-21 17:49 . 2008-02-03 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-21 17:49 . 2008-02-03 16:56 2,974,752 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-21 17:49 . 2008-02-03 16:56 46,624 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-21 17:49 . 2008-02-03 14:22 40,508 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-21 17:49 . 2008-02-03 14:22 5,204 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-20 23:10 . 2008-01-21 19:19 40,960 --a------ C:\WINDOWS\VM_STI.EXE
2008-01-20 23:02 . 2008-01-21 19:33 <DIR> d--hs---- C:\WINDOWS\VmFsdWVkIGN1c3Q
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\winzs6
2008-01-20 23:02 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nui4
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\WINDOWS\system32\extz1
2008-01-20 23:02 . 2008-01-20 23:02 <DIR> d-------- C:\temp\gTiis19
2008-01-20 23:01 . 2008-01-21 23:06 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-20 23:01 . 2008-01-20 23:01 <DIR> d-------- C:\temp\cXzz9
2008-01-20 13:07 . 2008-01-20 13:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-01-20 13:07 . 2008-01-20 13:07 0 --a------ C:\WINDOWS\nsreg.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-04 00:55 --------- d-----w C:\Program Files\QuickTime
2008-02-04 00:55 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-02-03 01:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-29 02:01 --------- d-----w C:\Program Files\Picasa2
2008-01-27 18:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-23 04:20 --------- d-----w C:\Program Files\Java
2007-12-17 02:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2007-11-06 13:50 27,262,976 ----a-w C:\VIRTPART.DAT
2005-07-30 00:24 472 --sha-r C:\WINDOWS\VmFsdWVkIGN1c3Q\pAIPxqp4K3hYwak.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVP"="C:\Program Files\Kaspersky Internet Security 7.0\avp.exe" [2007-06-28 12:51 218376]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2008-01-21 19:19 132496]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 13:18 443968]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
SATARaid5Manager.lnk - C:\WINDOWS\Installer\{E4D034E1-7643-4E63-928F-22174534B470}\_607517601492A67A51EB97.exe [2007-11-06 17:08:28 1206]
TrayMin200.exe.lnk - C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe [2006-11-21 17:22:30 278528]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1.0\adialhk.dll

R0 Si3124r5;SiI-3124 SoftRaid 5 Controller;C:\WINDOWS\System32\DRIVERS\Si3124r5.sys [2006-09-20 11:38]
R1 GhPciScan;GhostPciScanner;C:\Program Files\Symantec\Norton Ghost 2003\ghpciscan.sys [2003-12-17 15:41]
R2 SATARaid5 Config Service;SATARaid5 Configuration Service;"C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe" [2005-10-05 18:19]
R3 Intels51;Intel(R) 536EP Modem;C:\WINDOWS\System32\DRIVERS\Intels51.sys [2003-05-22 06:44]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\System32\DRIVERS\klim5.sys [2007-04-04 14:58]
S1 oprghdlrr;oprghdlrr;C:\WINDOWS\System32\drivers\oprghdlrr.sys []
S2 A4SII300;A4SII300;C:\WINDOWS\System32\drivers\A4SII300.SYS []

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2008-02-03 22:23:07 C:\WINDOWS\Tasks\SDMsgUpdate (SmartDrawTrial).job"
- C:\PROGRA~1\SMARTD~1\Messages\SDNotify.exe.-PSmartDrawTrial -V7 -SSDN.ini -A -T -N -L -X
"2008-02-01 07:00:44 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-03 16:56:52
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-03 16:57:50
ComboFix-quarantined-files.txt 2008-02-04 00:57:38

HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:59:50 PM, on 2/3/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre1.6.0_03\bin\javaw.exe
C:\Program Files\Philips\SPC 200NC PC Camera\TrayMin200.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: SATARaid5Manager.lnk = ?
O4 - Global Startup: TrayMin200.exe.lnk = ?
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/oas/ActiveX/MSDcode.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2357B3CF-7F8D-4451-8D81-FD6097610AEE} (CamfrogWEB Advanced Unicode Control) - http://activex.camfrogweb.com/advanc...instmodule.exe
O16 - DPF: {3D19135C-6D38-44AD-80F0-D9318F48726D} (BwOutlook.OutlookIntegrator) - http://appserver.dca.broadvoice.com/.../BwOutlook.CAB
O16 - DPF: {50C690FF-E11D-11D6-B30E-00C0262B86C4} (Nanox Control) - http://68.153.160.150/nanox.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/...oUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1191101006531
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2000i\AcDcToday.ocx
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred Control) - file://C:\Program Files\AutoCAD 2000i\InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2000i\AcPreview.ocx
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1.0\adialhk.dll
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: GhostStartService - Symantec Corporation - C:\Program Files\Symantec\Norton Ghost 2003\GhostStartService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: NMIndexingService - Unknown owner - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: SATARaid5 Configuration Service (SATARaid5 Config Service) - Unknown owner - C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\SATARaid5ConfigService.exe
O24 - Desktop Component 0: (no name) - http://www.roommates.com/member_phot...c272f3c10f.jpg

--
End of file - 6058 bytes

pskelley · Feb 4, 2008

That item was gone earlier, here:
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\oprghdlrr.sys

It was the infected files in the programs in the code box that were the concern.

Thanks for the vundofix log, I use that tool all of the time to clean vundo files, but to my knowledge it does not clean the files infected by this new version of vundo.

Remove vundofix if it is still on the computer and combofix and the C:\qoobox\quarantine folder from the computer and run a Kaspersky Online Scan using these settings:
* The program will launch and then begin downloading the latest definition files:
* Once the files have been downloaded click on NEXT
* Now click on Scan Settings
* In the scan settings make that the following are selected:
* Scan using the following Anti-Virus database:
* Standard
* Scan Options:
* Scan Archives
* Scan Mail Bases
* Click OK
* Now under select a target to scan:
* Select My Computer
* This will program will start and scan your system.
* The scan will take a while so be patient and let it run.
* Once the scan is complete it will display if your system has been infected.
* Now click on the Save as Text button:
* Save the file to your desktop.

Then post it here. I don't need to see it if it is clean, let me know about any malware issues.

Thanks

gigabyte74 · Feb 4, 2008

There were no infections found but a lot of stuff was skipped so I think I will let you be the judge.

Kaspersky:

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, February 04, 2008 5:32:50 AM
Operating System: Microsoft Windows XP Professional, Service Pack 1 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 4/02/2008
Kaspersky Anti-Virus database records: 507807
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 55993
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 01:38:40

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Administrator\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\MSHist012008020320080204\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\temp\hsperfdata_Administrator\812 Object is locked skipped
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Administrator\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Administrator\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.idx Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\detected.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\eventlog.rpt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Kaspersky Lab\AVP7\Report\report.rpt Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\MySQL\MySQL Server 5.0\data\DESKTOP2.err Object is locked skipped
C:\Program Files\Silicon Image\3124-W-I32-R SATARAID5\logs\AppLock Object is locked skipped
C:\System Volume Information\_restore{D4C0D2BA-9D07-4CA3-B7B9-0EED0C8039CF}\RP646\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\oakley.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{DD28A2AF-0925-4865-8BF8-ACD1C3E5B4C6}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox.idx Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.dat Object is locked skipped
C:\WINDOWS\system32\drivers\fidbox2.idx Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

pskelley · Feb 4, 2008

That is a clean scan, some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

gigabyte74 · Feb 4, 2008

Thank You!

I just wanted to take one last message to tell you that I really apreciate your help in bringing my system back to life. Hopefully with Kaspersky running full time I will be able to better prevent such things in the future.

May the Gods smile on you for your help and kindness.

gigabyte74 · Feb 5, 2008

positive side-effect

I purchased my computer second-hand but the OS and software were all suposed to be legit. A couple of months ago my OS authentication failed and I have not been able to get any updates since. Now that the malware is gone, it works again. I finaly have windows properly updated! HURAY!

S&D reports "Smitfraud-C.CoreService"

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

pskelley

In Memoriam -Always in our heart

gigabyte74

New member

gigabyte74

New member