What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Internet trouble caused by virus

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #2
:welcome:

Combofix is a very powerful tool and not to be taken lightly, what you see it fixing on one computer can damage another since all systems and infections are different. If you use this tool on your own, myself, this forum and sUbs will not be responsible if you damage your system


Do not attach any logs or reports, just copy and paste them in to this thread.

Download Trendmicros Hijackthis to your desktop.
  • Double click it to install
  • Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Format and make sure Wordwrap is Unchecked
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Submit Reply and not start a New Thread.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.




We Need to check for Rootkits with RootRepeal
  • Download RootRepeal from the following location and save it to your desktop.
  • Extract RootRepeal.exe from the archive.
  • Open [external image: Posted Image] on your desktop.
  • Click the [external image: Posted Image] tab.
  • Click the [external image: Posted Image] button.
  • Check all seven boxes: [external image: Posted Image]
  • Push Ok
  • Check the box for your main system drive (Usually C:), and press Ok.
  • Allow RootRepeal to run a scan of your system. This may take some time.
  • Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.


Post both reports please
Post #3
Okay, here it is.
I'm sorry for the delay, but friday I went to another town and just came back today.

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:23:16, on 17/8/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\Arquivos de programas\USB Disk Security\USBGuard.exe
C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joinville.udesc.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [USB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [IObit Security 360] C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IS360service - IObit - C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe

–
End of file - 3208 bytes


RR Log

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/08/17 09:35
Program Version: Version 1.3.5.0
Windows Version: Windows 2000 SP4
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINNT\System32\Drivers\dump_atapi.sys
Address: 0xAFA37000 Size: 90112 File Visible: No Signed: -
Status: -

Name: dump_WMILIB.SYS
Image Path: C:\WINNT\System32\Drivers\dump_WMILIB.SYS
Address: 0xEBA42000 Size: 4096 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINNT\system32\drivers\rootrepeal.sys
Address: 0xAF0AF000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
——————-
Path: c:\documents and settings\pesquisa\dados de aplicativos\mozilla\firefox\profiles\fhcoqw1q.default\sessionstore.js
Status: Size mismatch (API: 22076, Raw: 19822)

SSDT
——————-
ServiceTable Hooked [0x80484fc0]!

Hidden Services
——————-
Service Name: ControlSet001
Image Path: C:\WINNT\system32\drivers\ControlSet001.sys

Service Name: ControlSet002
Image Path: C:\WINNT\system32\drivers\ControlSet002.sys

Service Name: MountedDevices
Image Path: C:\WINNT\system32\drivers\MountedDevices.sys

Service Name: Select
Image Path: C:\WINNT\system32\drivers\Select.sys

Service Name: Setup
Image Path: C:\WINNT\system32\drivers\Setup.sys

==EOF==
Post #4
Hi,

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINNT\web\related.htm


When you ran RootRepeal, it doesn't look like you checked all 7 boxes, please run this scan again and make sure to check all 7 boxes.
Post #5
Ok, I've fixed that two entries with HJT.

Using RootRepeat, I get the following error:
[external image: Posted Image]

And the log stays the way I posted here.
Post #6
Try this one

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #7
Gmer.exe does not opens. I click it and nothing happens.
If I try to open it by the msdos prompt, it returns the program has closed.

[external image: Posted Image]
Post #8
Follow these instructions to rename Combofix as it appears you have malware that is prohibiting all security scans


Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3

[external image: Posted Image]


[external image: Posted Image]

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  • See this Link for programs that need to be disabled and instruction on how to disable them.
  • Remember to re-enable them when we're done.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
Post #9
I do not have the MS-WRC installed and, since I cannot visit MS website…
Anyway, the program didn't prompt me to download it.
Here's the log:

ComboFix 09-08-10.06 - pesquisa 17/08/2009 15:26.2.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.55.1046.18.503.336 [GMT -3:00]
Executando de: c:\documents and settings\pesquisa\Desktop\Combo-Fix.exe

ATENÇAO - ESTA MAQUINA NAO TEM O CONSOLE DE RECUPERAÇÃO INSTALADA !!
.
/wow section - STAGE 32A


((((((((((((((((((((((((((((((((((((( Outras Exclusões )))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
—- Execuções precedente ——-
.
c:\winnt\a3kebook.ini
c:\winnt\akebook.ini
c:\winnt\ANS2000.INI
c:\winnt\system32\mdm.exe
c:\winnt\system32\msconfig.exe
c:\winnt\Web\default.htt


.
(((((((((((((((( Arquivos/Ficheiros criados de 2009-07-17 to 2009-08-17 ))))))))))))))))))))))))))))
.

2009-08-17 18:26 . 2009-08-17 18:26 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_284.dat
2009-08-14 20:46 . 2009-08-14 20:46 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_344.dat
2009-08-14 13:41 . 2009-08-14 13:41 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_354.dat
2009-08-12 16:22 . 2009-08-12 16:22 1924440 —-a-w- c:\documents and settings\David\Dados de aplicativos\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-08-11 17:01 . 2009-08-11 17:01 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_4a0.dat
2009-08-10 17:57 . 2009-08-10 17:57 ——– d—–w- c:\arquivos de programas\Trend Micro
2009-08-10 17:33 . 2009-08-17 18:25 ——– d-s—w- C:\ComboFix
2009-08-10 16:53 . 2009-08-10 16:53 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\IObit
2009-08-10 16:53 . 2009-08-10 16:53 ——– d—–w- c:\arquivos de programas\IObit
2009-08-10 16:43 . 2009-08-10 16:41 158208 —-a-w- c:\winnt\msconfig.exe
2009-08-10 15:02 . 2009-08-10 15:33 117760 —-a-w- c:\documents and settings\pesquisa\Dados de aplicativos\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\SUPERAntiSpyware.com
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\arquivos de programas\SUPERAntiSpyware
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\SUPERAntiSpyware.com
2009-08-10 15:01 . 2009-08-10 15:01 ——– d—–w- c:\arquivos de programas\Arquivos comuns\Wise Installation Wizard
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\Malwarebytes
2009-08-10 14:47 . 2009-08-03 16:36 38160 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\Malwarebytes
2009-08-10 14:47 . 2009-08-10 14:47 ——– d—–w- c:\arquivos de programas\Malwarebytes' Anti-Malware
2009-08-10 14:47 . 2009-08-03 16:36 18456 —-a-w- c:\winnt\system32\drivers\mbam.sys
2009-08-10 13:50 . 2009-08-10 14:30 ——– d—–w- c:\winnt\winsxs
2009-08-10 11:53 . 2003-09-26 06:42 30749 —-a-w- c:\winnt\system32\vbajet32.dll
2009-08-10 11:53 . 2003-10-03 04:24 614429 —-a-w- c:\winnt\system32\mswstr10.dll
2009-08-10 11:53 . 2003-10-03 04:24 176157 —-a-w- c:\winnt\system32\msjint40.dll
2009-08-10 11:53 . 2003-09-26 06:43 831760 —-a-w- c:\winnt\system32\mswdat10.dll
2009-08-10 11:53 . 2003-09-26 06:42 422160 —-a-w- c:\winnt\system32\msrd2x40.dll
2009-08-10 11:53 . 2003-09-26 06:42 315664 —-a-w- c:\winnt\system32\msrd3x40.dll
2009-08-10 11:53 . 2003-09-26 06:42 213264 —-a-w- c:\winnt\system32\msltus40.dll
2009-08-10 11:53 . 2003-09-26 06:42 53520 —-a-w- c:\winnt\system32\msjter40.dll
2009-08-10 11:53 . 2003-09-26 06:42 512272 —-a-w- c:\winnt\system32\msexch40.dll
2009-08-10 11:53 . 2005-06-03 10:30 90896 —-a-w- c:\winnt\system32\CRYPTDLG.DLL
2009-08-10 11:53 . 2003-09-26 06:42 380957 —-a-w- c:\winnt\system32\expsrv.dll
2009-08-07 16:03 . 2009-08-17 12:23 ——– d—–w- c:\arquivos de programas\USB Disk Security
2009-08-06 14:00 . 2009-08-06 14:02 ——– d–h–w- c:\documents and settings\David\Dados de aplicativos
2009-08-06 14:00 . 2009-08-06 14:00 ——– d—–r- c:\documents and settings\David\Favoritos
2009-08-06 14:00 . 2009-08-06 14:00 ——– d—–w- c:\documents and settings\David
2009-08-06 14:00 . 2005-12-19 21:12 ——– d–h–w- c:\documents and settings\David\Modelos
2009-08-06 14:00 . 2005-12-19 21:01 ——– d–h–w- c:\documents and settings\David\Ambiente de impressão
2009-08-06 14:00 . 2005-12-19 21:01 ——– d—–w- c:\documents and settings\David\Menu Iniciar
2009-07-24 17:39 . 2009-07-24 17:39 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_204.dat

.
((((((((((((((((((((((((((((((((((((( Relatório Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-10 16:23 . 2005-12-19 20:43 ——– d—a-w- c:\arquivos de programas\NavNT
2009-08-10 16:23 . 2005-12-19 20:43 ——– d—–w- c:\documents and settings\All Users\Dados de aplicativos\Symantec
2009-08-10 16:22 . 2005-12-19 20:43 ——– d—–w- c:\arquivos de programas\Symantec
2009-08-10 16:22 . 2005-12-19 20:43 ——– d—–w- c:\arquivos de programas\Arquivos comuns\Symantec Shared
2009-08-06 20:05 . 2007-10-30 13:06 ——– d—–w- c:\arquivos de programas\Minilyrics
2009-08-05 13:24 . 2006-02-02 12:50 ——– d—–w- c:\documents and settings\pesquisa\Dados de aplicativos\AdobeUM
2009-07-03 18:33 . 2009-07-03 18:33 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_214.dat
2009-06-25 20:56 . 2009-06-25 20:56 16384 —-atw- c:\winnt\system32\Perflib_Perfdata_1f8.dat
2005-12-19 20:14 . 2005-12-19 20:14 22040 —h–w- c:\arquivos de programas\folder.htt
2009-03-17 14:01 . 2009-03-17 14:01 111616 –sha-r- c:\winnt\system32\xcjsiij.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-08-10_17.38.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2003-05-07 19:57 . 2003-05-07 19:57 73728 c:\winnt\system32\spool\drivers\w32x86\3\hpztbi09.dll
+ 2002-10-30 18:10 . 2002-10-30 18:10 49152 c:\winnt\system32\spool\drivers\w32x86\3\hpzrer09.dll
+ 2003-05-07 19:58 . 2003-05-07 19:58 81920 c:\winnt\system32\spool\drivers\w32x86\3\hpzflt09.dll
+ 2008-10-30 16:39 . 2003-05-23 02:52 83014 c:\winnt\system32\spool\drivers\w32x86\3\hph240.dat
+ 2008-10-30 16:39 . 2003-05-23 02:52 83014 c:\winnt\system32\spool\drivers\w32x86\3\hph140.dat
+ 2009-08-12 16:22 . 2009-08-12 16:22 84661 c:\winnt\system32\Macromed\Flash\uninstall_plugin.exe
+ 2003-05-07 19:57 . 2003-05-07 19:57 167987 c:\winnt\system32\spool\drivers\w32x86\3\hpzvip09.dll
+ 2003-05-07 20:24 . 2003-05-07 20:24 442368 c:\winnt\system32\spool\drivers\w32x86\3\hpztbx09.exe
+ 2003-05-07 19:56 . 2003-05-07 19:56 188416 c:\winnt\system32\spool\drivers\w32x86\3\hpztbu09.exe
+ 2003-05-07 20:14 . 2003-05-07 20:14 176128 c:\winnt\system32\spool\drivers\w32x86\3\hpzstw09.exe
+ 2003-05-07 20:22 . 2003-05-07 20:22 380928 c:\winnt\system32\spool\drivers\w32x86\3\hpzstc09.exe
+ 2003-05-07 18:19 . 2003-05-07 18:19 327680 c:\winnt\system32\spool\drivers\w32x86\3\hpzrm309.dll
+ 2003-04-30 18:26 . 2003-04-30 18:26 376832 c:\winnt\system32\spool\drivers\w32x86\3\hpzres09.dll
+ 2003-05-07 19:23 . 2003-05-07 19:23 335872 c:\winnt\system32\spool\drivers\w32x86\3\hpzpre09.exe
+ 2003-05-07 20:08 . 2003-05-07 20:08 475136 c:\winnt\system32\spool\drivers\w32x86\3\hpzpm309.dll
+ 2003-05-07 20:16 . 2003-05-07 20:16 155704 c:\winnt\system32\spool\drivers\w32x86\3\hpzlnt09.dll
+ 2003-05-07 20:15 . 2003-05-07 20:15 204800 c:\winnt\system32\spool\drivers\w32x86\3\hpzjui09.dll
+ 2003-04-30 18:24 . 2003-04-30 18:24 212992 c:\winnt\system32\spool\drivers\w32x86\3\hpzime09.dll
+ 2003-05-07 18:44 . 2003-05-07 18:44 638976 c:\winnt\system32\spool\drivers\w32x86\3\hpzeng09.exe
+ 2003-05-07 18:59 . 2003-05-07 18:59 270336 c:\winnt\system32\spool\drivers\w32x86\3\hpzcon09.dll
+ 2003-05-07 18:58 . 2003-05-07 18:58 208896 c:\winnt\system32\spool\drivers\w32x86\3\hpzcoi09.dll
+ 2003-05-07 19:04 . 2003-05-07 19:04 245760 c:\winnt\system32\spool\drivers\w32x86\3\hpzcfg09.exe
+ 2003-05-07 18:13 . 2003-05-07 18:13 204800 c:\winnt\system32\spool\drivers\w32x86\3\hpz2ku09.dll
+ 2008-10-30 16:39 . 2003-05-23 02:53 124011 c:\winnt\system32\spool\drivers\w32x86\3\hph7900.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121751 c:\winnt\system32\spool\drivers\w32x86\3\hph7700.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121751 c:\winnt\system32\spool\drivers\w32x86\3\hph7600.dat
+ 2008-10-30 16:39 . 2003-05-23 02:53 121051 c:\winnt\system32\spool\drivers\w32x86\3\hph7200.dat
+ 2009-07-18 03:21 . 2009-07-18 03:21 257440 c:\winnt\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2003-05-07 18:33 . 2003-05-07 18:33 9420800 c:\winnt\system32\spool\drivers\w32x86\3\hpzr3209.dll
+ 2009-07-18 03:21 . 2009-07-18 03:21 3883424 c:\winnt\system32\Macromed\Flash\NPSWF32.dll
.
(((((((((((((((((((((((((( Pontos de Carregamento do Registro )))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vazias e legítimas por defeito não são mostradas.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"USB Antivirus"="c:\arquivos de programas\USB Disk Security\USBGuard.exe" [2008-06-14 798720]
"IObit Security 360"="c:\arquivos de programas\IObit\IObit Security 360\IS360tray.exe" [2009-08-10 952080]
"Synchronization Manager"="mobsync.exe" - c:\winnt\system32\mobsync.exe [2003-06-19 111888]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="c:\arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe" [2003-06-19 189712]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\arquivos de programas\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 15:05 356352 —-a-w- c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys]
@="FSFilter System Recovery"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Iniciar^Programas^Inicializar^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Menu Iniciar\Programas\Inicializar\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinVNC4"=2 (0x2)

R?2 helpaccess;Time Server;c:\winnt\system32\svchost.exe -k netsvcs [23/1/2000 21:00 7952]
R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\SUPERAntiSpyware\sasdifsv.sys [23/6/2009 11:01 9968]
R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\SUPERAntiSpyware\SASKUTIL.SYS [23/6/2009 11:01 72944]
R2 IS360service;IS360service;c:\arquivos de programas\IObit\IObit Security 360\is360srv.exe [10/8/2009 13:53 307472]
R3 usbhub20;Suporte a hub raiz USB 2.0;c:\winnt\system32\drivers\usbhub20.sys [19/12/2005 17:34 49776]
S3 HPx9G+;HPx9G+ Device USB Driver;c:\winnt\system32\drivers\HPx9G2k.sys [12/9/2007 13:21 12658]
S3 SASENUM;SASENUM;c:\arquivos de programas\SUPERAntiSpyware\SASENUM.SYS [23/6/2009 11:01 7408]

— =Outros Serviços/Drivers Na Memória —

*Deregistered* - aujasnkj

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
helpaccess
.
.
——- Scan Suplementar ——-
.
uStart Page = hxxp://www.joinville.udesc.br/
LSP: %SystemRoot%\system32\msafd.dll
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\pesquisa\Dados de aplicativos\Mozilla\Firefox\Profiles\fhcoqw1q.default\
FF - prefs.js: browser.startup.homepage - about:blank

—- FIREFOX POLICIES —-
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\arquivos de programas\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\arquivos de programas\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\arquivos de programas\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-17 15:31
Windows 5.0.2195 Service Pack 4 NTFS

Procurando processos ocultos …

Procurando entradas auto inicializáveis ocultas …

Procurando ficheiros/arquivos ocultos …

Varredura completada com sucesso
arquivos/ficheiros ocultos: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\helpaccess]
"ServiceDll"="c:\winnt\system32\xcjsiij.dll"
.
——————— CHAVES DO REGISTRO BLOQUEADAS ———————

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINNT\\system32\\Macromed\\Flash\\FlashUtil10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
——————— DLLs Carregadas Sob os Processos em Execução ———————

- - - - - - - > 'winlogon.exe'(192)
c:\arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL
c:\winnt\system32\NavLogon.dll

- - - - - - - > 'explorer.exe'(756)
c:\winnt\AppPatch\AcLayers.DLL
c:\winnt\system32\SHDOCVW.DLL
.
Tempo para conclusão: 2009-08-17 15:32
ComboFix-quarantined-files.txt 2009-08-17 18:32
ComboFix2.txt 2009-08-10 17:40

Pré-execução: 7.446.347.776 bytes disponíveis
Pós execução: 7.439.732.736 bytes disponíveis

247

And the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:35:21, on 17/8/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\CF4385.exe
C:\WINNT\explorer.exe
C:\WINNT\system32\MSTask.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joinville.udesc.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [USB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [IObit Security 360] C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IS360service - IObit - C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe

–
End of file - 2873 bytes
Post #10
Hi,

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see.

C:\WINNT\system32\CF4385.exe






Download CCleaner from here to clean temp files from your computer.
  • Double click on the file to start the installation of the program.
  • Select your language and click OK, then next.
  • Read the license agreement and click I Agree.
  • Click next to use the default install location. Click Install then finish to complete installation.
  • Double click the CCleaner shortcut on the desktop to start the program.
  • On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
  • If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
  • Click on the "Options" icon at the left side of the window, then click on "Advanced."
    deselect "Only delete files in Windows Temp folders older than 48 hours."
  • Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
  • Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
  • After CCleaner has completed its process, click Exit.

*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!
**Note** Go to Options> Cookies and any you want to keep move them to The Keep window








Please download Malwarebytes' Anti-Malware from Here or Here

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
    [external image: Posted Image]
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Post the report and also a new HJT log please
Post #11
No viruses were found in that archive. (CF4385)
The site informs that it was already analized under the name of CF9577.exe

I've performed the cleaning with CCleaner.

Malwarebytes' Anti-Malware cannot be updated, the connection to that domain is also virus-blocked.

Below is it's log:
Malwarebytes' Anti-Malware 1.40
Databank version: 2551
Windows 5.0.2195 Service Pack 4

18/8/2009 09:46:36
mbam-log-2009-08-18 (09-46-36).txt

Kind of Verification: Rápida
Objects verified: 106888
Time: 2 minute(s), 47 second(s)

Infected memory processes: 0
Infected memory modules: 0
Infected registry keys: 0
Infected registry values: 0
Infected registry items: 0
Infected directories: 0
Infected archives: 0

Processos da Memória infectados:
(Nenhum ítem malicioso foi detectado)

Módulos de Memória Infectados:
(Nenhum ítem malicioso foi detectado)

Chaves do Registro infectadas:
(Nenhum ítem malicioso foi detectado)

Valores do Registro infectados:
(Nenhum ítem malicioso foi detectado)

Ítens do Registro infectados:
(Nenhum ítem malicioso foi detectado)

Pastas infectadas:
(Nenhum ítem malicioso foi detectado)

Arquivos infectados:
(Nenhum ítem malicioso foi detectado)


Even thou nothing has changed, here's the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:50:10, on 18/8/2009
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\notepad.exe
C:\Arquivos de programas\Mozilla Firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.joinville.udesc.br/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Arquivos de programas\Free Download Manager\iefdm2.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Rádio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [USB Antivirus] C:\Arquivos de programas\USB Disk Security\USBGuard.exe
O4 - HKLM\..\Run: [IObit Security 360] C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Arquivos de programas\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O20 - Winlogon Notify: !SASWinLogon - C:\Arquivos de programas\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Serviço administrativo do gerenciador de disco lógico (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: IS360service - IObit - C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe

–
End of file - 2903 bytes


Here's something strange that may help:
If I use a proxy, I can connect to those blocked sites. (Don't think that they are blocked by the Network Admin, for other computers in the LAN can connect.)
Post #12
I wish you would have told me earlier that this was a company computer, we do not work on company computers, thats what your IT Department is for.

This may help you out, check this file with VT
c:\winnt\system32\xcjsiij.dl
Post #13
Oh, sorry. But it is not a company. It is a small public school :) And there is no such file xcjsiij.dll inside that directory, or inside the winnt dir. Ahm… can you still help me?
Post #14
Try this one

Please download Rooter Rootkit Detector to your Desktop
  • Doubleclick it to start the tool.
  • A Notepad file containing the report will open, also found at %systemdrive% (usually C:\Rooter.txt.
  • Post the report for me to see.




Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.com
  • DDS.scr
  • DDS.pif
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  • Notepad will open with the results, click no to the Optional_Scan
  • Follow the instructions that pop up for posting the results.
  • Close the program window, and delete the program from your desktop.
Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control Here
Post #15
Rooter log Rooter.exe (v1.0.2) by Eric_71 . SeDebugPrivilege granted successfully … . Windows 2000 . (5.0.2195) Service Pack 4 [32_bits] - x86 Family 15 Model 4 Stepping 3, GenuineIntel . Error OpenService (wscsvc) : 1060 [SharedAccess] RUNNING (state:4) . Internet Explorer 6.0.2800.1106 Mozilla Firefox 3.5.2 (pt-BR) . A:\ [Removable] C:\ [Fixed-NTFS] .. ( Total:14 Go - Free:7 Go ) D:\ [Fixed-NTFS] .. ( Total:23 Go - Free:14 Go ) E:\ [CD_Rom] . Scan : 20:16.40 Path : C:\Rooter.exe User : pesquisa ( Administrator -> YES ) . ———————-\\ Processes . Locked [System Process] (0) ______ System (8) ______ \SystemRoot\System32\smss.exe (148) ______ \??\C:\WINNT\system32\csrss.exe (172) ______ \??\C:\WINNT\system32\winlogon.exe (192) ______ C:\WINNT\system32\services.exe (220) ______ C:\WINNT\system32\lsass.exe (232) ______ C:\WINNT\system32\svchost.exe (412) ______ C:\WINNT\system32\spoolsv.exe (444) ______ C:\WINNT\System32\svchost.exe (476) ______ C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe (504) ______ C:\WINNT\system32\regsvc.exe (576) ______ C:\WINNT\system32\MSTask.exe (600) ______ C:\WINNT\System32\WBEM\WinMgmt.exe (668) ______ C:\WINNT\Explorer.EXE (952) ______ C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe (924) ______ C:\Arquivos de programas\Mozilla Firefox\firefox.exe (636) ______ C:\Rooter.exe (1336) . ———————-\\ Device\Harddisk0\ . \Device\Harddisk0 [Sectors : 63 x 512 Bytes] . ———————-\\ Scheduled Tasks . C:\WINNT\Tasks\desktop.ini C:\WINNT\Tasks\SA.DAT . ———————-\\ Registry . . ———————-\\ Files & Folders . ———————-\\ Scan completed at 20:16.42 . C:\Rooter$\Rooter_2.txt - (18/08/2009 | 20:16.42) And the other one: DDS (Ver_09-07-30.01) - NTFSx86 Run by [removed] at 20:17:01,76 on ter 18/08/2009 Internet Explorer: 6.0.2800.1106 BrowserJavaVersion: 1.6.0_02 Microsoft Windows 2000 Professional 5.0.2195.4.1252.55.1046.18.503.270 [GMT -3:00] ============== Running Processes =============== C:\WINNT\system32\spoolsv.exe C:\Arquivos de programas\IObit\IObit Security 360\IS360srv.exe C:\WINNT\system32\regsvc.exe C:\WINNT\system32\MSTask.exe C:\WINNT\System32\WBEM\WinMgmt.exe C:\WINNT\Explorer.EXE C:\Arquivos de programas\IObit\IObit Security 360\IS360tray.exe C:\Arquivos de programas\Mozilla Firefox\firefox.exe C:\WINNT\system32\NOTEPAD.EXE C:\Documents and Settings\pesquisa\Meus documentos\Downloads\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.joinville.udesc.br/ BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\arquivos de programas\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\arquivos de programas\java\jre1.6.0_02\bin\ssv.dll mRun: [USB Antivirus] c:\arquivos de programas\usb disk security\USBGuard.exe mRun: [IObit Security 360] c:\arquivos de programas\iobit\iobit security 360\IS360tray.exe mRun: [Synchronization Manager] mobsync.exe /logon dRunOnce: [^SetupICWDesktop] c:\arquivos de programas\internet explorer\connection wizard\icwconn1.exe /desktop uPolicies-system: ole32.dll = 0 (0x0) IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC} - c:\arquivos de programas\java\jre1.6.0_02\bin\ssv.dll DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab Notify: !SASWinLogon - c:\arquivos de programas\superantispyware\SASWINLO.dll Notify: igfxcui - igfxsrvc.dll Notify: NavLogon - c:\winnt\system32\NavLogon.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\arquivos de programas\superantispyware\SASSEH.DLL ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\pesquisa\dadosd~1\mozilla\firefox\profiles\fhcoqw1q.default\ FF - prefs.js: browser.startup.homepage - about:blank FF - HiddenExtension: Java Console: No Registry Reference - c:\arquivos de programas\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\arquivos de programas\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); c:\arquivos de programas\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".com.br"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\arquivos de programas\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); ============= SERVICES / DRIVERS =============== R?2 helpaccess;Time Server;c:\winnt\system32\svchost.exe -k netsvcs [2000-1-23 7952] R1 SASDIFSV;SASDIFSV;c:\arquivos de programas\superantispyware\sasdifsv.sys [2009-6-23 9968] R1 SASKUTIL;SASKUTIL;c:\arquivos de programas\superantispyware\SASKUTIL.SYS [2009-6-23 72944] R2 IS360service;IS360service;c:\arquivos de programas\iobit\iobit security 360\is360srv.exe [2009-8-10 307472] R3 usbhub20;Suporte a hub raiz USB 2.0;c:\winnt\system32\drivers\usbhub20.sys [2005-12-19 49776] S3 HPx9G+;HPx9G+ Device USB Driver;c:\winnt\system32\drivers\HPx9G2k.sys [2007-9-12 12658] S3 SASENUM;SASENUM;c:\arquivos de programas\superantispyware\SASENUM.SYS [2009-6-23 7408] =============== Created Last 30 ================ 2009-08-18 20:11 16,384 a——t c:\winnt\system32\Perflib_Perfdata_29c.dat 2009-08-18 20:09 –d—– C:\Rooter$ 2009-08-18 20:07 173,119 a——- C:\Rooter.exe 2009-08-18 10:14 –d—– C:\Salvo Gleison 2009-08-18 09:39 –d—– c:\arquivos de programas\CCleaner 2009-08-17 15:25 –ds—- C:\Combo-Fix 2009-08-10 14:57 –d—– c:\arquivos de programas\Trend Micro 2009-08-10 14:39 -cd—– c:\winnt\system32\dllcache\cache 2009-08-10 14:33 216,064 a——- c:\winnt\PEV.exe 2009-08-10 14:33 161,792 a——- c:\winnt\SWREG.exe 2009-08-10 14:33 98,816 a——- c:\winnt\sed.exe 2009-08-10 14:33 –ds—- C:\ComboFix 2009-08-10 13:53 –d—– c:\docume~1\alluse~1\dadosd~1\IObit 2009-08-10 13:53 –d—– c:\arquivos de programas\IObit 2009-08-10 13:43 158,208 a——- c:\winnt\msconfig.exe 2009-08-10 13:41 –d—– c:\winnt\pss 2009-08-10 12:01 –d—– c:\docume~1\alluse~1\dadosd~1\SUPERAntiSpyware.com 2009-08-10 12:01 –d—– c:\docume~1\pesquisa\dadosd~1\SUPERAntiSpyware.com 2009-08-10 12:01 –d—– c:\arquivos de programas\SUPERAntiSpyware 2009-08-10 12:01 –d—– c:\arquivos de programas\arquivos comuns\Wise Installation Wizard 2009-08-10 11:47 –d—– c:\docume~1\pesquisa\dadosd~1\Malwarebytes 2009-08-10 11:47 38,160 a——- c:\winnt\system32\drivers\mbamswissarmy.sys 2009-08-10 11:47 –d—– c:\docume~1\alluse~1\dadosd~1\Malwarebytes 2009-08-10 11:47 18,456 a——- c:\winnt\system32\drivers\mbam.sys 2009-08-10 11:47 –d—– c:\arquivos de programas\Malwarebytes' Anti-Malware 2009-08-10 10:50 –d—– c:\winnt\winsxs 2009-08-10 08:53 30,749 a——- c:\winnt\system32\vbajet32.dll 2009-08-10 08:53 831,760 a——- c:\winnt\system32\mswdat10.dll 2009-08-10 08:53 614,429 a——- c:\winnt\system32\mswstr10.dll 2009-08-10 08:53 512,272 a——- c:\winnt\system32\msexch40.dll 2009-08-10 08:53 422,160 a——- c:\winnt\system32\msrd2x40.dll 2009-08-10 08:53 315,664 a——- c:\winnt\system32\msrd3x40.dll 2009-08-10 08:53 213,264 a——- c:\winnt\system32\msltus40.dll 2009-08-10 08:53 176,157 a——- c:\winnt\system32\msjint40.dll 2009-08-10 08:53 53,520 a——- c:\winnt\system32\msjter40.dll 2009-08-10 08:53 380,957 a——- c:\winnt\system32\expsrv.dll 2009-08-10 08:53 90,896 a——- c:\winnt\system32\CRYPTDLG.DLL 2009-08-07 13:03 –d—– c:\arquivos de programas\USB Disk Security 2009-08-06 11:00 208,896 a——- c:\winnt\system32\wmpns.dll 2009-07-24 14:39 16,384 a——t c:\winnt\system32\Perflib_Perfdata_204.dat ==================== Find3M ==================== 2009-07-03 15:33 16,384 a——t c:\winnt\system32\Perflib_Perfdata_214.dat 2009-06-25 17:56 16,384 a——t c:\winnt\system32\Perflib_Perfdata_1f8.dat 2005-12-19 17:14 22,040 —-h— c:\arquivos de programas\folder.htt 2005-12-19 17:14 271 —-h— c:\arquivos de programas\desktop.ini 2000-01-23 21:00 32,528 a——- c:\winnt\inf\wbfirdma.sys 2009-03-17 11:01 111,616 a–shr– c:\winnt\system32\xcjsiij.dll ============= FINISH: 20:17:11,89 =============== and the attached one.

Attachments:

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI