[Resolved] what happened? (failtechie)

Hi Jun23,

No problem. As long as I know you are still there.

The last part of the combofix log is missing. I need to see the part that comes after

——- Supplementary Scan ——-, the log should end with a section like this

Completion time: 2009-06-23 18:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-23 17:08

Pre-Run: 135,492,616,192 bytes free
Post-Run: 135,430,344,704 bytes free

The log can be located at C:\ it will be called combofix.txt. Please post the missing portion.

I don't see an antivirus program installed on this computer. We will take care of that shortly. Please limit internet use to downloading tools and checking this forum.


Please make an uninstall list

• Start HijackThis
• Click the Config button
• Click the Misc Tools button
• Click the Open Uninstall Manager button.
• Click the Save list button and save it to your desktop.

When you press Save, a notepad will open with the contents. Copy/paste the contents of the notepad file in your next reply.

Please post back with

• missing portion of the combofix log
• uninstall list

Thanks

Hi, Sorry, I didnt realize I cut off the end of the log. Here is the missing part of combofix.txt ************************************************************************** . ——————— DLLs Loaded Under Running Processes ——————— - - - - - - - > 'winlogon.exe'(668) c:\windows\system32\Ati2evxx.dll . ———————— Other Running Processes ———————— . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe c:\program files\COMODO\Firewall\cmdagent.exe c:\program files\Common Files\AOL\Loader\aolload.exe c:\windows\system32\tcpsvcs.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-07-12 22:40 - machine was rebooted ComboFix-quarantined-files.txt 2009-07-12 21:40 ComboFix2.txt 2009-06-23 17:08 Pre-Run: 136,553,758,720 bytes free Post-Run: 136,544,014,336 bytes free 322 and here is the uninstall list from HijackThis Hotfix for Windows XP (KB942288-v3) HP Deskjet Preloaded Printer Drivers HP Image Zone 4.2.3 HP Image Zone Plus 4.2.3 HP Photosmart Cameras 4.0 HP PSC & OfficeJet 4.0 HP Software Update HPIZ423 InterVideo DiscLabel Java 2 Runtime Environment, SE v1.4.2_03 KBD Learn2 Player (Uninstall Only) Microsoft .NET Framework 1.1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Visio MUI (English) 2007 Microsoft Office Visio Professional 2007 Microsoft Office Visio Professional 2007 Microsoft Office Word MUI (English) 2007 Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft WinUsb 1.0 Mozilla Firefox (3.0.11) MP3 Player Utilities 4.17 MSVCRT PC-Doctor for Windows Photosmart 320,370,7400,8100,8400 Series PIF DESIGNER2.1 PS2 Python 2.2 combined Win32 extensions Python 2.2.1 QuickTime RealPlayer Basic RemoveIT Pro v4 - SE ScanToWeb Segoe UI SiS VGA Utilities Skype™ 3.8 Spybot - Search & Destroy VC 9.0 Runtime Viewpoint Media Player Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Essentials Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885295 WinRAR WinRAR archiver Xvid 1.1.3 final uninstall

Hi Jun23,

Thanks. It looks like the uninstall list may be missing the top portion. Please repost it.

When copying the logs to ensure you have copied the entire log,

• right click anywhere in the log, click Select All
• right click again and click copy.

We need a new copy of combofix. Locate combofix.exe on your desktop, it has a icon that looks like a cat. Please right click it and select delete.

Please read through the instructions to familiarize yourself with what to expect when the tool runs

Download ComboFix from one of these locations. Do not run it yet, we will run it differently this time.

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Please follow all previous instructions regarding security programs.

Open a new Notepad session

• Click the Start button, click run
• in the run box type notepad
• click ok
• In the notepad, Click "Format" and be certain that Word Wrap is not checked.
  
• Copy and paste all the all of the text in the code box below into the Notepad, (including the URL). Do Not copy the word CODE

http://forums.whatthetech.com/what_happened_failtechie_t104470.html&st=15

KillAll::

Collect::[4]
c:\windows\system32\smooroaa.dll
c:\windows\system32\drivers\rrwpczyg.sys 

File::
c:\windows\system32\userinit.ooo.exe
c:\windows\system32\userinit.old.exe

Rootkit::
c:\windows\system32\drivers\rrwpczyg.sys 

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"a0fa9d1c"=-

Driver::
pggrkatg

In the notepad

• Click File, Save as…, and set the Save in to your Desktop
• In the filename box, type (including quotation marks) as the filename: "CFScript.txt"
• Click save

Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown below.

This will start ComboFix again.Close all browser/windows first.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

[external image: Posted Image]

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Please post back with

• combofix log
• uninstall list
• new HJT log taken last

How is the computer?

Thanks

Hi, I was wondering is it essential to run Combofix? After running Combofix the computer made a user account called "HP_Owner" (I didnt have any user accounts on the computer) Is there anything I can do to stop it creating accounts? This time I didnt need a password to log in, but for some reason Mozilla Firefox doesnt seem to work as before. When I try to load there a popup (or prompt, I'm not familiar with the computer name.. things ) comes up saying that Firefox crashed and I could restart and send a crash report, but when I try to restart it the same popup comes up. Right now Firefox only seems to work in safe mode. Would it help to uninstall and download Firefox again? Here is the uninstall list ABC (remove only) Adobe Acrobat - Reader 6.0.2 Update Adobe Flash Player 10 ActiveX Adobe Flash Player 10 Plugin Adobe Reader 6.0.1 Agere Systems PCI Soft Modem AOL Coach Version 1.0(Build:20040229.1 uk) AOL Uninstaller ATI Control Panel ATI Display Driver CCleaner (remove only) Choice Guard Combined Community Codec Pack 2008-09-21 16:18 COMODO Firewall Pro Dawn Of War Dawn of War - Dark Crusade Dawn of War - Soulstorm Dawn Of War - Winter Assault DG834 Easy Internet Sign-up EPSON CardMonitor EPSON Copy Utility 3 EPSON PhotoQuicker3.5 EPSON PhotoStarter3.1 EPSON PRINT Image Framer Tool2.1 EPSON Printer Software EPSON Scan EPSON Smart Panel EPSON Web-To-Page ESCX6600 Reference Guide ESCX6600 Software Guide Help and Support Additions High Definition Audio Driver Package - KB835221 HijackThis 2.0.2 Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB942288-v3) HP Deskjet Preloaded Printer Drivers HP Image Zone 4.2.3 HP Image Zone Plus 4.2.3 HP Photosmart Cameras 4.0 HP PSC & OfficeJet 4.0 HP Software Update HPIZ423 InterVideo DiscLabel Java 2 Runtime Environment, SE v1.4.2_03 KBD Learn2 Player (Uninstall Only) Microsoft .NET Framework 1.1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Access MUI (English) 2007 Microsoft Office Access Setup Metadata MUI (English) 2007 Microsoft Office Enterprise 2007 Microsoft Office Enterprise 2007 Microsoft Office Excel MUI (English) 2007 Microsoft Office Groove MUI (English) 2007 Microsoft Office Groove Setup Metadata MUI (English) 2007 Microsoft Office InfoPath MUI (English) 2007 Microsoft Office OneNote MUI (English) 2007 Microsoft Office Outlook MUI (English) 2007 Microsoft Office PowerPoint MUI (English) 2007 Microsoft Office Proof (English) 2007 Microsoft Office Proof (French) 2007 Microsoft Office Proof (Spanish) 2007 Microsoft Office Proofing (English) 2007 Microsoft Office Publisher MUI (English) 2007 Microsoft Office Shared MUI (English) 2007 Microsoft Office Shared Setup Metadata MUI (English) 2007 Microsoft Office Visio MUI (English) 2007 Microsoft Office Visio Professional 2007 Microsoft Office Visio Professional 2007 Microsoft Office Word MUI (English) 2007 Microsoft User-Mode Driver Framework Feature Pack 1.5 Microsoft WinUsb 1.0 Mozilla Firefox (3.0.11) MP3 Player Utilities 4.17 MSVCRT PC-Doctor for Windows Photosmart 320,370,7400,8100,8400 Series PIF DESIGNER2.1 PS2 Python 2.2 combined Win32 extensions Python 2.2.1 QuickTime RealPlayer Basic RemoveIT Pro v4 - SE ScanToWeb Segoe UI SiS VGA Utilities Skype™ 3.8 Spybot - Search & Destroy VC 9.0 Runtime Viewpoint Media Player Windows Live Call Windows Live Communications Platform Windows Live Essentials Windows Live Essentials Windows Live Messenger Windows Live Sign-in Assistant Windows Live Upload Tool Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB883667 Windows XP Hotfix - KB885295 WinRAR WinRAR archiver Xvid 1.1.3 final uninstall

Hi Jun23, We are using combofix to remove the infection from this computer. You have a hidden driver that we are removing and the combofix log is very important in showing us what is is remaining. Combofix doesn't create accounts. Those accounts were always there, you just didn't see them because the computer was set up to bypass the Login screen. We can reset that when we are done. It's probably a bad plugin in Firefox, possibly even malware. Use IE for now and we'll look at Firefox later. Go ahead with the instructions, we can reset the other settings when we are done. Thanks

Hi, After using Combofix nothing seems to be working on the computer properly: sound has been permanently disabled I can't copy and paste Thus I cannot carry out the tasks you have asked me to do, please advise me further :S Many thanks,

Hi Jun23, Sorry for the delay, been having a bit of problems myself. Please clarify which instructions you were not able to carry out. Where you able to create the CFScript or is this when you discovered the copy/paste problems? Thanks

Hi, I couldnt create the CFScript because copy and paste wouldnt work. I did try to type up the code you sent me but when I got to "a0fa9d1c"= I couldnt find the next symbol on the keyboard

Hi Jun23, There is something very strange going on with this computer. You were able to copy and paste the combofix log after you ran combofix the first time. Plus you posted the other logs I requested. Typing the script can be dangerous as one typo could be disasterous. I only use copy/paste as it is the only way of getting the lines 100% accurate. Let's try to determine what is going on. Forgive me if some of these questions sound very basic. They are not a reflection on you or your computer skills. It's just info I need to better determine what is going on. When you are copying from the post, are you holding down the left mouse button while dragging the cursor across the text to highlight it? At which point does the copy/paste fail? Can't copy or can't paste? Which browser are you using? If you type something into a notepad are you able to copy and paste that text into another notepad? Thanks

Hi, when I copy I tend to use the mouse, holding down the left button and dragging the cursor over the text, and sometimes I use ctrl c on the keyboard. When I copy and paste, paste doesnt work. I'm using morzilla firefox. I can copy and paste text from one notepad into another.

Hi Jun23, Nothing wrong with what you are doing. Did you try ctrl V to paste. This seems like a Firefox issue. Try using Internet Explorer. If neither of those suggestions work, we will run the CFScript another way. Please post back and let me know. Thanks

Hi, I'm not quite sure what happened but on my task bar at the bottom of the screen it isnt showing the programmes/tasks I have on any more. Is there a way to fix this? :S I tried using ctrl c and then ctrl v in Internet Explorer but paste still doesnt work. I've also used the mouse to highlight and copy the text but it doesnt work either when I use paste with the mouse.

Hi Jun23,

It looks like the remaining malware is playing with things. I'm sure we can fix it.

Hold off on the CFScript for now and just run DDS by double clicking it's icon.

Please post back with the DDS.txt. No need to post the Attach.txt

Thanks

Hi, I've been having some problems with Netgear and the firewall has blocked all the websites I go onto, so my replies would be delayed. I'll run DDS and post back ASAP when I fix this. Sorry Jun

Hi Jun23, Ok, I shall be here. Is Comodo blocking IE or Firefox, or is it blocking the actual website? Thanks