[Resolved] Koobface worm infection
#1
Posted 25 October 2009 - 10:51 AM
Register to Remove
#2
Posted 25 October 2009 - 12:35 PM
Proud Graduate of the WTT Classroom
#3
Posted 25 October 2009 - 12:52 PM
#4
Posted 25 October 2009 - 01:35 PM
- I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
- The fixes are specific to your problem and should only be used for the issues on this machine.
- You will need to run all tools as an Administrator. To run a program as an Administrator you must right click on the program and select "Run as Administrator"
- Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
- It's often worth reading through these instructions and printing them for ease of reference.
- If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
- Please reply to this thread. Do not start a new topic.
STEP 1.
Please download DDS by sUBs from one of the following links and save it to your desktop.
- Disable any script blocking protection (How to Disable your Security Programs)
- Double click DDS icon to run the tool (may take up to 3 minutes to run)
- When done, DDS.txt will open.
- After a few moments, attach.txt will open in a second window.
- Save both reports to your desktop.
- Post the contents of the DDS.txt report in your next reply
- Attach the Attach.txt report to your post by doing the following:
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on to insert the attachment into your post
STEP 2.
Download the GMER Rootkit Scanner. Unzip it to your Desktop.
Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
Right Click on the GMER.exe icon and select "Run as Administrator".
Accept the prompt to allow GMER to run.
**Caution**
These types of scans can produce false positives. Do NOT take any action on any "<--- ROOKIT" entries unless advised!
If possible rootkit activity is found, you will be asked if you would like to perform a full scan.
- Click NO
- In the right panel, you will see a bunch of boxes that have been checked ... leave everything checked and ensure the Show all box is un-checked.
- Now click the Scan button.
Once the scan is complete, you may receive another notice about rootkit activity. - Click OK.
- GMER will produce a log. Click on the [Save..] button, and in the File name area, type in "GMER.txt"
- Save it where you can easily find it, such as your desktop.
____________________________________________________
Please make sure you include the following items in your next post:
1. The logs that were produced after running DDS.
2. The log that was produced after running GMER.
3. An update on how your computer is currently running as well as if you are experiencing any problems?
Proud Graduate of the WTT Classroom
#5
Posted 25 October 2009 - 10:44 PM
I think I have everything you asked for. The computer has been fine since I ran Malwarebytes' Anti-Malware before I posted. i was getting a lot of pop-ups for virus scan, etc. I posted to make sure it is totally cleaned.
Ok, here is the attachment:
Attach.txt 5.42KB 479 downloads
Here is the DDS.txt:
DDS (Ver_09-10-24.04) - NTFSx86
Run by jayFREE at 23:39:46.86 on Sun 10/25/2009
Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.274 [GMT -4:00]
SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\System32\WinService.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\LogMeIn\x86\LogMeInSystray.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\jayFREE\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.comcast.net/
uSearch Bar = about:blank
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! ¤u¨ã¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Yahoo! ¤u¨ã¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\jayfree\appdata\roaming\microsoft\windows\start menu\programs\startup\YPOPs.lnk.disabled
StartupFolder: c:\programdata\microsoft\windows\start menu\programs\startup\Kodak EasyShare software.lnk.disabled
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
================= FIREFOX ===================
FF - ProfilePath - c:\users\jayfree\appdata\roaming\mozilla\firefox\profiles\4bex005d.default\
FF - prefs.js: browser.search.defaulturl - hxxp://fruttisearch.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Search
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - prefs.js: keyword.URL - hxxp://fruttisearch.com/search.php?q=
FF - component: c:\users\jayfree\appdata\roaming\mozilla\firefox\profiles\4bex005d.default\extensions\{39124730-0779-11de-8c30-0800200c9a66}\components\daff.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\users\jayfree\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\jayfree\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\jayfree\appdata\roaming\mozilla\plugins\NPAbacheck.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
As per the instructions you would have received, kindly ensure any onboard
script blocking tools have been disabled for they shall interfere with DDS.
DDS is a non-invasive diagnostic tool.
- DDS makes no registry writes/changes
- DDS does not create any permanent files/folders.
This scan should not take longer than three minutes to complete.
When the scan is complete, a logfile/report shall pop open.
Post the contents of the logfile to the forum where it was requested
We only require it to run just once. Dispose after use.
:::::::::::::::::::::::::::::::::::::::
---- FIREFOX POLICIES ----
FF - user.js: keyword.enabled - true
FF - user.js: google.toolbar.linkdoctor.enabled - false
============= SERVICES / DRIVERS ===============
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2008-7-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-3-14 47640]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2007-10-10 42112]
=============== Created Last 30 ================
2009-10-25 15:34:16 0 d-----w- c:\windows\system32\eu-ES
2009-10-25 15:34:16 0 d-----w- c:\windows\system32\ca-ES
2009-10-25 15:34:11 0 d-----w- c:\windows\system32\vi-VN
2009-10-25 15:12:15 0 d-----w- c:\windows\system32\EventProviders
2009-10-25 15:09:13 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-10-25 14:11:05 56832 ------w- c:\windows\tqfqfkpi.knn
2009-10-25 14:09:59 2 ----a-w- c:\windows\010112010146101105.rx
2009-10-14 06:40:57 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-14 06:40:54 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-14 06:40:53 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-14 06:40:39 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-14 06:36:08 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-14 06:36:03 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-10 15:24:04 0 d-----w- c:\users\jayfree\Office Genuine Advantage
2009-10-10 01:03:40 102400 ----a-w- c:\windows\system32\tsccvid.dll
2009-10-01 05:07:21 0 d-----w- c:\users\jayfree\appdata\roaming\Malwarebytes
2009-10-01 05:07:10 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-01 05:07:07 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-01 05:07:07 0 d-----w- c:\programdata\Malwarebytes
2009-10-01 05:07:06 0 d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 21:41:08 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-09-30 21:40:09 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-09-30 21:38:38 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-09-30 21:38:38 171608 ----a-w- c:\windows\system32\wuwebv.dll
==================== Find3M ====================
2009-10-25 15:44:07 86016 ----a-w- c:\windows\inf\infstor.dat
2009-10-25 15:44:07 51200 ----a-w- c:\windows\inf\infpub.dat
2009-10-25 15:44:07 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-10-25 15:33:56 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-25 15:21:22 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-09-16 14:22:48 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 14:22:48 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 14:22:48 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 14:22:48 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 14:22:14 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-08-29 00:27:49 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22:28 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17:43 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17:43 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42:29 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-18 03:33:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 15:53:34 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49:20 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49:18 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49:18 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49:15 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49:14 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49:14 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49:13 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48:02 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-03 19:07:42 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 19:07:42 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 19:07:42 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2008-04-04 18:09:23 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 23:43:50.49 ===============
Here is the GMER.txt:
GMER 1.0.15.15163 - http://www.gmer.net
Rootkit quick scan 2009-10-26 00:40:32
Windows 6.0.6002 Service Pack 2
Running: gmer.exe; Driver: C:\Users\jayFREE\AppData\Local\Temp\pglirkob.sys
---- System - GMER 1.0.15 ----
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateFile [0x8C78179E]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcess [0x8C781738]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateProcessEx [0x8C78174C]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8C7817DC]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwNotifyChangeKey [0x8C78181F]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenProcess [0x8C781710]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwOpenThread [0x8C781724]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwProtectVirtualMemory [0x8C7817B2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwReplaceKey [0x8C781847]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRestoreKey [0x8C781833]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetContextThread [0x8C78178A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwSetInformationProcess [0x8C781776]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8C78180B]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8C7817F2]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwYieldExecution [0x8C7817C8]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwCreateUserProcess [0x8C781762]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenProcess
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtOpenThread
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) NtSetInformationProcess
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Ip Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Tcp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\Udp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
AttachedDevice \Driver\tdx \Device\RawIp Mpfp.sys (McAfee Personal Firewall Plus Driver/McAfee, Inc.)
---- EOF - GMER 1.0.15 ----
#6
Posted 28 October 2009 - 08:41 AM
SPYBOT TEATIMER
- Launch Spybot S&D, go to the Mode menu and make sure "Advanced Mode" is selected.
- On the left hand side, click on Tools, then click on the Resident Icon in the list.
- Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
- Click on the "System Startup" icon in the List
- Uncheck the "TeaTimer" box and "OK" any prompts.
- If Teatimer gives you a warning that changes were made, click the "Allow Change" box when prompted.
- Exit Spybot S&D when done.
- (When we are done, you can re-enable Teatimer using the same steps but this time place a check next to "Resident TeaTimer" and check the "TeaTimer" box in System Startup.]
STEP 2.
Please go to: VirusTotal
- Click the Browse button and search for the following file: c:\windows\tqfqfkpi.knn
- Click Open
- Then click Send File
- Please be patient while the file is scanned.
- Once the scan results appear, please provide them in your next reply.
Please post the results in your next reply
____________________________________________________
STEP 3.
Download ComboFix from one of the following locations:
Link 1
Link 2
**Note: It is important that it is saved directly to your desktop**
--------------------------------------------------------------------
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
--------------------------------------------------------------------
Double click on ComboFix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the C:\ComboFix.txt for further review.
Please make sure you include the following items in your next post:
1. The log that was produced after running ComboFix.
2. The log that was produced after scanning the file via VirusTotal.
3. An update on how your computer is running.
Proud Graduate of the WTT Classroom
#7
Posted 28 October 2009 - 08:22 PM
#8
Posted 29 October 2009 - 01:06 PM
VirSCAN Suspicious File Upload
I need to get more information on a file... please perform the following:
Note: Internet Explorer should be used... for best results.
- Please go to VirSCAN.org... a free on-line file scanning service.
- Copy / paste the complete path and file name (below) into the "Suspicious files to scan" box... at the top of the page.
c:\users\jayfree\appdata\roaming\mozilla\firefox\profiles\4bex005d.default\extensions\{39124730-0779-11de-8c30-0800200c9a66}\components\daff.dll
- Click on the Upload button. Once the file is uploaded, the scanning process will begin.
- Once the Scan completes... (scroll down) click on the "Copy to Clipboard" button.
- Open Notepad... then paste (Ctrl &V) the contents of the Clipboard into the open Notepad window.
- Save the Notepad file as "VirScan.txt"... save it to your desktop.
- Paste the contents of the VirScan.txt file, in your next reply.
STEP 2.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
- They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:
Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')
KillAll:: File:: c:\windows\tqfqfkpi.knn FireFox:: FF - ProfilePath - c:\users\jayFREE\AppData\Roaming\Mozilla\Firefox\Profiles\4bex005d.default\ FF - prefs.js: browser.search.defaulturl - hxxp://fruttisearch.com/search.php?q= FF - prefs.js: keyword.URL - hxxp://fruttisearch.com/search.php?q=
Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')
Save this file to your desktop, Save this as "CFScript"
Here's how to do that:
1.Click File;
2.Click Save As... Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save ...
- Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
- ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
- When finished, it shall produce a log for you.
- Copy and paste the contents of the log in your next reply.
____________________________________________________
Please make sure you include the following items in your next post:
1. The contents of the VirScan.txt file.
2. The log that was produced after running ComboFix.
Proud Graduate of the WTT Classroom
#9
Posted 29 October 2009 - 05:16 PM
Here are the logs you requested.
VirSCAN.org Scanned Report :
Scanned time : 2009/10/29 18:04:23 (EDT)
Scanner results: Scanners did not find malware!
File Name : daff.dll
File Size : 210944 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 88af7b222fbd1901f04880c9236c0121
SHA1 : b9eee03645b7d244dc6f76bfbceebbd31edc0b4c
Online report : http://virscan.org/r...53fa3adb8d.html
Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 00040000000000 0004-00-00 7.11 -
AhnLab V3 2009.10.29.04 2009.10.29 2009-10-29 0.90 -
AntiVir 8.2.1.50 7.1.6.168 2009-10-29 0.29 -
Antiy 2.0.18 20091029.3153836 2009-10-29 0.02 -
Arcavir 2009 200910290807 2009-10-29 0.06 -
Authentium 5.1.1 200910291823 2009-10-29 1.70 -
AVAST! 4.7.4 091029-0 2009-10-29 0.02 -
AVG 8.5.288 270.14.39/2468 2009-10-30 0.92 -
BitDefender 7.81008.4478883 7.28644 2009-10-30 3.90 -
CA (VET) 35.1.0 7088 2009-10-28 8.14 -
ClamAV 0.95.2 9959 2009-10-29 0.05 -
Comodo 3.12 2772 2009-10-29 0.76 -
CP Secure 1.3.0.5 2009.10.29 2009-10-29 0.07 -
Dr.Web 4.44.0.9170 2009.10.29 2009-10-29 6.12 -
F-Prot 4.4.4.56 20091029 2009-10-29 1.65 -
F-Secure 7.02.73807 2009.10.29.17 2009-10-29 8.85 -
Fortinet 2.81-3.120 11.0 2009-10-29 0.19 -
GData 19.8637/19.527 20091029 2009-10-29 5.39 -
ViRobot 20091029 2009.10.29 2009-10-29 0.41 -
Ikarus T3.1.01.72 2009.10.29.74326 2009-10-29 4.33 -
JiangMin 11.0.800 2009.10.26 2009-10-26 4.04 -
Kaspersky 5.5.10 2009.10.29 2009-10-29 0.06 -
KingSoft 2009.2.5.15 2009.10.29.16 2009-10-29 0.50 -
McAfee 5.3.00 5786 2009-10-29 3.36 -
Microsoft 1.5202 2009.10.29 2009-10-29 6.14 -
Norman 6.01.09 6.01.00 2009-10-29 4.01 -
Panda 9.05.01 2009.10.29 2009-10-29 3.61 -
Trend Micro 8.700-1004 6.588.02 2009-10-29 0.05 -
Quick Heal 10.00 2009.10.29 2009-10-29 1.26 -
Rising 20.0 21.53.34.00 2009-10-29 0.82 -
Sophos 3.00.1 4.46 2009-10-30 2.78 -
Sunbelt 5476 5476 2009-10-29 1.85 -
Symantec 1.3.0.24 20091029.005 2009-10-29 0.05 -
nProtect 20091029.01 6046753 2009-10-29 7.86 -
The Hacker 6.5.0.2 v00056 2009-10-28 0.85 -
VBA32 3.12.10.11 20091028.1155 2009-10-28 1.92 -
VirusBuster 4.5.11.10 10.113.1/2021054 2009-10-29 2.51 -
****************** *********************** ****************************
ComboFix 09-10-28.08 - jayFREE 10/29/2009 18:40.2.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.316 [GMT -4:00]
Running from: c:\users\jayFREE\Desktop\ComboFix.exe
Command switches used :: c:\users\jayFREE\Desktop\CFScript.txt
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
* Resident AV is active
FILE ::
"c:\windows\tqfqfkpi.knn"
.
((((((((((((((((((((((((( Files Created from 2009-09-28 to 2009-10-29 )))))))))))))))))))))))))))))))
.
2009-10-29 22:39 . 2009-04-11 06:32 19944 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-29 22:39 . 2008-01-19 07:42 45112 ----a-w- c:\windows\system32\drivers\nvstor.sys
2009-10-29 22:39 . 2007-10-26 22:51 110624 ----a-w- c:\windows\system32\drivers\nvstor32.sys
2009-10-29 01:59 . 2009-10-29 23:05 -------- d-----w- c:\users\jayFREE\AppData\Local\temp
2009-10-27 23:56 . 2009-10-28 02:14 -------- d-----w- c:\users\jayFREE\AppData\Roaming\KeePass
2009-10-27 23:27 . 2009-10-27 23:27 -------- d-----w- c:\program files\KeePass Password Safe 2
2009-10-27 23:19 . 2009-09-10 14:58 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 23:19 . 2009-09-10 14:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-26 03:28 . 2009-10-26 03:28 -------- d-----w- c:\users\jayFREE\AppData\Local\Apple
2009-10-25 18:54 . 2009-10-25 18:54 -------- d-----w- c:\windows\Sun
2009-10-25 17:51 . 2009-10-25 18:12 -------- d-----w- c:\users\jayFREE\AppData\Local\Adobe
2009-10-25 16:39 . 2009-10-25 16:39 -------- d-----w- c:\users\jayFREE\AppData\Local\Apple Computer
2009-10-25 15:34 . 2009-10-25 15:36 -------- d-----w- c:\windows\system32\ca-ES
2009-10-25 15:34 . 2009-10-25 15:36 -------- d-----w- c:\windows\system32\eu-ES
2009-10-25 15:34 . 2009-10-25 15:35 -------- d-----w- c:\windows\system32\vi-VN
2009-10-25 15:12 . 2009-10-25 15:12 -------- d-----w- c:\windows\system32\EventProviders
2009-10-25 15:09 . 2009-10-25 15:09 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-10-14 06:40 . 2009-09-10 16:48 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-14 06:40 . 2009-08-04 12:34 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-14 06:40 . 2009-08-04 12:34 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-14 06:40 . 2009-05-08 12:53 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-14 06:36 . 2009-09-04 11:41 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-14 06:36 . 2009-09-14 09:29 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-10 15:24 . 2009-10-10 15:24 -------- d-----w- c:\users\jayFREE\Office Genuine Advantage
2009-10-10 01:03 . 2005-06-15 07:00 102400 ----a-w- c:\windows\system32\tsccvid.dll
2009-10-01 05:07 . 2009-10-01 05:07 -------- d-----w- c:\users\jayFREE\AppData\Roaming\Malwarebytes
2009-10-01 05:07 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-01 05:07 . 2009-10-01 05:07 -------- d-----w- c:\programdata\Malwarebytes
2009-10-01 05:07 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-01 05:07 . 2009-10-25 16:24 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-30 21:41 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-09-30 21:41 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-09-30 21:41 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-09-30 21:41 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-09-30 21:40 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-09-30 21:40 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-09-30 21:40 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-09-30 21:38 . 2009-08-06 23:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-09-30 21:38 . 2009-08-06 22:44 33792 ----a-w- c:\windows\system32\wuapp.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-29 22:02 . 2009-03-14 15:20 -------- d-----w- c:\program files\LogMeIn
2009-10-28 23:33 . 2008-06-20 23:30 -------- d-----w- c:\programdata\Google Updater
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-10-25 15:36 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-10-25 15:36 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-10-25 15:09 . 2008-04-01 11:06 -------- d-----w- c:\program files\Viewpoint
2009-10-25 15:05 . 2008-03-31 19:16 -------- d-----w- c:\program files\McAfee
2009-10-18 00:30 . 2009-05-10 20:30 -------- d-----w- c:\users\jayFREE\AppData\Roaming\Move Networks
2009-10-14 07:06 . 2008-04-01 11:52 -------- d-----w- c:\programdata\Microsoft Help
2009-10-01 05:22 . 2008-05-24 19:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-09-30 22:41 . 2008-04-23 15:13 -------- d-----w- c:\users\jayFREE\AppData\Roaming\LimeWire
2009-09-16 14:22 . 2008-03-31 19:18 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 14:22 . 2008-03-31 19:18 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 14:22 . 2008-03-31 19:18 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 14:22 . 2008-03-31 19:18 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 14:22 . 2008-03-31 19:18 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-10 07:14 . 2008-05-15 04:08 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-10 00:57 . 2008-03-31 19:04 -------- d-----w- c:\programdata\McAfee
2009-08-29 00:27 . 2009-09-02 21:31 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14 . 2009-09-02 21:31 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22 . 2009-10-14 06:38 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17 . 2009-10-14 06:38 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 05:17 . 2009-10-14 06:38 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 03:42 . 2009-10-14 06:38 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-18 03:33 . 2009-08-18 03:33 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 16:27 . 2009-09-09 21:50 904776 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 15:53 . 2009-09-09 21:50 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49 . 2009-09-09 21:50 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49 . 2009-09-09 21:50 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49 . 2009-09-09 21:50 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49 . 2009-09-09 21:50 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49 . 2009-09-09 21:50 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49 . 2009-09-09 21:50 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49 . 2009-09-09 21:50 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48 . 2009-09-09 21:50 30720 ----a-w- c:\windows\system32\drivers\tcpipreg.sys
2009-08-14 13:48 . 2009-09-09 21:50 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-03 19:07 . 2009-08-03 19:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 19:07 . 2009-08-03 19:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 19:07 . 2009-08-03 19:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-10-29_01.55.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-04-01 09:53 . 2009-10-29 22:34 40946 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2009-10-29 22:35 44060 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2009-10-29 23:06 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 13:02 . 2009-10-29 01:55 32768 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2006-11-02 13:02 . 2009-10-29 01:55 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 13:02 . 2009-10-29 23:06 98304 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2006-11-02 13:02 . 2009-10-29 23:06 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2006-11-02 13:02 . 2009-10-29 01:55 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-04-01 09:53 . 2009-10-29 22:35 6684 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-4130002868-1829355866-1881414188-1000_UserData.bin
- 2009-10-28 07:24 . 2009-10-28 07:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-29 22:53 . 2009-10-29 22:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-10-29 22:53 . 2009-10-29 22:53 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-10-28 07:24 . 2009-10-28 07:24 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-04-05 04:43 . 2009-10-29 22:02 229008 c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2006-11-02 10:33 . 2009-10-29 23:01 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-10-28 07:32 595446 c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2009-10-28 07:32 101144 c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2009-10-29 23:01 101144 c:\windows\System32\perfc009.dat
- 2009-06-22 21:20 . 2009-10-28 22:51 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
+ 2009-06-22 21:20 . 2009-10-29 22:54 245760 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-20 68856]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-05-27 413696]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-13 148888]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
c:\users\jayFREE\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
YPOPs.lnk.disabled [2008-10-25 651]
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk.disabled [2008-4-5 2009]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"="c:\program files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"VistaSp2"=hex(:c8,e5,90,b6,89,55,ca,01
R0 SCMNdisP;General NDIS Protocol Driver;c:\windows\System32\drivers\SCMNdisP.sys [8/20/2009 7:01 PM 21728]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [7/24/2008 6:46 PM 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\System32\drivers\LMIRfsDriver.sys [3/14/2009 11:21 AM 47640]
S2 gupdate1c98669f8a5f3ce;Google Update Service (gupdate1c98669f8a5f3ce);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2009 9:43 PM 133104]
S3 MotDev;Motorola Inc. USB Device;c:\windows\System32\drivers\motodrv.sys [10/10/2007 5:41 PM 42112]
S3 RTL8187;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter Vista Driver;c:\windows\System32\drivers\wg111v2.sys [8/20/2009 7:01 PM 206336]
S3 VST_DPV;VST_DPV;c:\windows\System32\drivers\VSTDPV3.SYS [11/2/2006 6:25 AM 987648]
S3 VSTHWBS2;VSTHWBS2;c:\windows\System32\drivers\VSTBS23.SYS [11/2/2006 6:25 AM 251904]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
2009-10-26 c:\windows\Tasks\Defrag.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 16:22]
2009-10-29 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-06-20 23:28]
2009-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 01:43]
2009-10-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-02-04 01:43]
2009-10-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 16:22]
2009-10-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-10-21 16:22]
2009-10-29 c:\windows\Tasks\User_Feed_Synchronization-{0CBB3BFF-CBBC-4137-AAD2-55BFC1D339FE}.job
- c:\windows\system32\msfeedssync.exe [2009-10-14 03:41]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.comcast.net/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\jayFREE\AppData\Roaming\Mozilla\Firefox\Profiles\4bex005d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - component: c:\users\jayFREE\AppData\Roaming\Mozilla\Firefox\Profiles\4bex005d.default\extensions\{39124730-0779-11de-8c30-0800200c9a66}\components\daff.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\users\jayFREE\AppData\Roaming\Move Networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\jayFREE\AppData\Roaming\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\jayFREE\AppData\Roaming\Mozilla\plugins\NPAbacheck.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
FF - user.js: keyword.enabled - true
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\LogMeIn\x86\RaMaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\System32\WinService.exe
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Spybot - Search & Destroy\SDWinSec.exe
c:\windows\system32\WUDFHost.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\iPod\bin\iPodService.exe
c:\hp\kbd\kbd.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-10-29 19:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-29 23:11
ComboFix2.txt 2009-10-29 01:59
Pre-Run: 108,365,348,864 bytes free
Post-Run: 108,324,274,176 bytes free
- - End Of File - - CFB8785B09FCE7A66EBAE96F63D5E8A8
#10
Posted 30 October 2009 - 11:13 AM
Malwarebytes' Anti-Malware
I see that you have Malwarebytes' Anti-Malware installed on your computer could you please do a scan using these settings:
- Open Malwarebytes' Anti-Malware
- Select the Update tab
- Click Check for Updates
- After the update have been completed, Select the Scanner tab.
- Select Perform full scan, then click on Scan
- Leave the default options as it is and click on Start Scan
- When done, you will be prompted. Click OK, then click on Show Results
- Checked (ticked) all items and click on Remove Selected
- After it has removed the items, Notepad will open. Please post this log in your next reply. You can also find the log in the Logs tab. The bottom most log is the latest
____________________________________________________
STEP 2.
I'd like us to scan your machine with ESET OnlineScan
*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once the scan is finished remember to re-enable your antivirus along with your antispyware programs.
- Hold down Control and click on the following link to open ESET OnlineScan in a new window.
ESET OnlineScan - Click the button.
- For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
- Click on to download the ESET Smart Installer. Save it to your desktop.
- Double click on the icon on your desktop.
- Check
- Click the button.
- Accept any security warnings from your browser.
- Check
- Push the Start button.
- ESET
will then download updates for itself, install itself, and begin
scanning your computer. Please be patient as this can take some time. - When the scan completes, push
- Push ,
and save the file to your desktop using a unique name, such as
ESETScan. Include the contents of this report in your next reply. - Push the button.
- Push
STEP 3.
Please re-run DDS by sUBs.
Make sure to pay attention to the directions below:
- Disable any script blocking protection (How to Disable your Security Programs)
- Double click DDS icon to run the tool (may take up to 3 minutes to run)
- When done, DDS.txt will open.
- After a few moments, attach.txt will open in a second window.
- Save both reports to your desktop.
- Post the contents of the DDS.txt report in your next reply
- Attach the Attach.txt report to your post by doing the following:
- Under the reply panel is the Attachments Panel
- Browse for the attachment file you want to upload, then click the green Upload button
- Once it has uploaded, click the Manage Current Attachments drop down box
- Click on to insert the attachment into your post
Please make sure you include the following items in your next post:
1. The log that was produced after running MalwareBytes' Anti-Malware.
2. The log that was produced after running the ESET Online Scanner.
3. The logs that were produced after running DDS.
4. An update on how your computer is running?
Proud Graduate of the WTT Classroom
Register to Remove
#11
Posted 31 October 2009 - 07:55 AM
1. Malwarebytes' Anti-Malware log
Malwarebytes' Anti-Malware 1.41
Database version: 3063
Windows 6.0.6002 Service Pack 2
10/30/2009 9:00:45 PM
mbam-log-2009-10-30 (21-00-45).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 445031
Time elapsed: 2 hour(s), 41 minute(s), 0 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Windows.old\Users\Compaq_Administrator\AppData\Roaming\VideoEgg\Loader\4665\npvideoegg-loader.dll (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Windows.old\Users\Compaq_Administrator\AppData\Roaming\VideoEgg\Updater\updater.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Windows.old\Users\Compaq_Administrator\AppData\Roaming\VideoEgg\Updater\VideoEggBroker.exe (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Windows.old\Users\Compaq_Administrator\AppData\Roaming\VideoEgg\Updater\VideoEggBroker.exe.old (Adware.VideoEgg) -> Quarantined and deleted successfully.
C:\Windows.old\Windows\Downloaded Program Files\VideoEggPublisher.exe (Malware.Tool) -> Quarantined and deleted successfully.
2. ESETScan log
C:\hp\bin\wbug\CompaqPresario_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application deleted - quarantined
C:\Users\jayFREE\Documents\LimeWire\Incomplete\Preview-T-4061074-guitarless songs [very good quality].snd a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined
C:\Users\jayFREE\Documents\LimeWire\Incomplete\T-3545427-so hard to go tower of power [cd rip].mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined
C:\Users\jayFREE\Documents\LimeWire\Incomplete\T-4061074-guitarless songs [very good quality].snd a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined
C:\Windows.old\Users\Compaq_Administrator\AppData\Local\Temp\KjQYycfe.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
C:\Windows.old\Users\Compaq_Administrator\AppData\Local\Temp\KjQYycfe.ini2 Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
C:\Windows.old\Users\Compaq_Administrator\AppData\Local\Temp\removalfile.bat Win32/Adware.Virtumonde application cleaned by deleting - quarantined
C:\Windows.old\Users\Compaq_Administrator\AppData\Local\Temp\tihneddo.ini Win32/Adware.Virtumonde.NEO application cleaned by deleting - quarantined
D:\I386\APPS\APP25121\src\CompaqPresario_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application deleted - quarantined
D:\I386\APPS\APP25121\src\HPPavillion_Spring06.exe a variant of Win32/Toolbar.MyWebSearch application deleted - quarantined
3. DDS.txt and the Attach.txt
Attach.txt 10.29KB 366 downloads
DDS (Ver_09-10-26.01) - NTFSx86
Run by jayFREE at 9:37:37.34 on Sat 10/31/2009
Internet Explorer: 8.0.6001.18828 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.958.311 [GMT -4:00]
SP: Spybot - Search and Destroy *enabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
============== Running Processes ===============
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
C:\hp\kbd\kbd.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\jayFREE\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe
============== Pseudo HJT Report ===============
uStart Page = hxxp://www.comcast.net/
mSearch Bar = about:blank
uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: Yahoo! ¤u¨ã¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\progra~1\mcafee\viruss~1\scriptsn.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Yahoo! ¤u¨ã¦C: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\companion\installs\cpn\yt.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\users\jayfree\appdata\roaming\microsoft\windows\start menu\programs\startup\YPOPs.lnk.disabled
StartupFolder: c:\programdata\microsoft\windows\start menu\programs\startup\Kodak EasyShare software.lnk.disabled
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
================= FIREFOX ===================
FF - ProfilePath - c:\users\jayfree\appdata\roaming\mozilla\firefox\profiles\4bex005d.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.comcast.net/
FF - component: c:\users\jayfree\appdata\roaming\mozilla\firefox\profiles\4bex005d.default\extensions\{39124730-0779-11de-8c30-0800200c9a66}\components\daff.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\users\jayfree\appdata\roaming\move networks\plugins\npqmp071500000347.dll
FF - plugin: c:\users\jayfree\appdata\roaming\move networks\plugins\npqmp071505000010.dll
FF - plugin: c:\users\jayfree\appdata\roaming\mozilla\plugins\NPAbacheck.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: keyword.enabled - true
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-3-14 47640]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2007-10-10 42112]
=============== Created Last 30 ================
2009-10-31 01:18:11 0 d-----w- c:\program files\ESET
2009-10-29 22:39:12 45112 ----a-w- c:\windows\system32\drivers\nvstor.sys
2009-10-29 22:39:12 19944 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-29 22:39:12 110624 ----a-w- c:\windows\system32\drivers\nvstor32.sys
2009-10-29 01:39:37 98816 ----a-w- c:\windows\sed.exe
2009-10-29 01:39:37 77312 ----a-w- c:\windows\MBR.exe
2009-10-29 01:39:37 236544 ----a-w- c:\windows\PEV.exe
2009-10-29 01:39:37 161792 ----a-w- c:\windows\SWREG.exe
2009-10-27 23:56:26 0 d-----w- c:\users\jayfree\appdata\roaming\KeePass
2009-10-27 23:27:27 0 d-----w- c:\program files\KeePass Password Safe 2
2009-10-27 23:19:17 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-27 23:19:08 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-25 15:34:16 0 d-----w- c:\windows\system32\eu-ES
2009-10-25 15:34:16 0 d-----w- c:\windows\system32\ca-ES
2009-10-25 15:34:11 0 d-----w- c:\windows\system32\vi-VN
2009-10-25 15:12:15 0 d-----w- c:\windows\system32\EventProviders
2009-10-25 15:09:13 319456 ----a-w- c:\windows\DIFxAPI.dll
2009-10-14 06:40:57 218624 ----a-w- c:\windows\system32\msv1_0.dll
2009-10-14 06:40:54 3600456 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-14 06:40:53 3548216 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-14 06:40:39 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-14 06:36:08 60928 ----a-w- c:\windows\system32\msasn1.dll
2009-10-14 06:36:03 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-10 15:24:04 0 d-----w- c:\users\jayfree\Office Genuine Advantage
2009-10-10 01:03:40 102400 ----a-w- c:\windows\system32\tsccvid.dll
==================== Find3M ====================
2009-10-30 23:40:05 86016 ----a-w- c:\windows\inf\infstor.dat
2009-10-30 23:40:05 51200 ----a-w- c:\windows\inf\infpub.dat
2009-10-30 23:40:05 143360 ----a-w- c:\windows\inf\infstrng.dat
2009-10-25 15:33:56 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-10-25 15:21:22 37665 ----a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont
2009-09-16 14:22:48 79816 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 14:22:48 40552 ----a-w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 14:22:48 35272 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 14:22:48 214664 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 14:22:14 34248 ----a-w- c:\windows\system32\drivers\mferkdk.sys
2009-09-10 18:54:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-10 18:53:50 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-29 00:27:49 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-29 00:14:38 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-27 05:22:28 916480 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 05:17:43 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-08-27 05:17:43 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-08-27 03:42:29 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-18 03:33:52 1193832 ----a-w- c:\windows\system32\FM20.DLL
2009-08-14 15:53:34 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 13:49:20 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 13:49:18 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 13:49:18 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 13:49:15 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 13:49:14 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-14 13:49:14 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 13:49:13 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 13:48:02 105984 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-07 01:45:15 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-08-07 01:44:40 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-08-06 23:23:06 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-08-06 22:44:46 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-08-03 19:07:42 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 19:07:42 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 19:07:42 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2008-04-04 18:09:23 174 --sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 ----a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 ----a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 ----a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 ----a-w- c:\windows\inf\perflib\0000\perfc.dat
============= FINISH: 9:40:53.04 ===============
4. My computer still seems to be running fine. I don't see any obvious signs of infection even though I know its there.
Thanks, are we getting close to getting rid of the problems?
#12
Posted 31 October 2009 - 12:56 PM
Could you please clarify what you mean here: "My computer still seems to be running fine. I don't see any obvious signs of infection even though I know its there."
____________________________________________________
STEP 2.
The ESET Online Scanner log that you provided for me looks to be incomplete.
I need to get a look at the complete file if possible.
Please do the following:
On your keyboard press the Windows key + R
By pressing those two keys at the same time this should display the run dialog box.
Once the Run Dialog box appears please copy and paste the following:
C:\Program Files\EsetOnlineScanner\log.txt
After you've copied and pasted the above please select OK.
This should display the ESET Online Scanner log.
Once the ESET Online Scanner log is displayed please copy and paste the contents of the file into your next post.
____________________________________________________
STEP 3.
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
- Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
- Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 16. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
- Click the "Download" button to the right.
- Select the Windows platform from the drop-down menu.
- Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
- Click on the link to download Windows Offline Installation and save the file to your desktop.
- Close any programs you may have running - especially your web browser.
- Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
- Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
- Click the Remove or Change/Remove button.
- Repeat as many times as necessary to remove each Java version.
- Reboot your computer once all Java components are removed.
- Then from your desktop double-click on jre-6u16-windows-i586-p.exe to install the newest version.
- After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and AppletsTrace and Log Files
- Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. - Click OK to leave the Temporary Files Window
- Click OK to leave the Java Control Panel.
Please make sure you include the following items in your next post:
1. An answer to my question under Step 1.
2. The contents of the log.txt file.
Proud Graduate of the WTT Classroom
#13
Posted 31 October 2009 - 06:38 PM
Edited by teebee17, 31 October 2009 - 08:58 PM.
#14
Posted 31 October 2009 - 09:23 PM
I believe you were unable to locate the ESET log because the file path that I gave you was incorrect.There was no log file in the place your link indicated. Should I rescan with ESET Online Scanner?
I'd like for you to try this again.
Please do the following:
On your keyboard press the Windows key + R
By pressing those two keys at the same time this should display the run dialog box.
Once the Run Dialog box appears please copy and paste the following:
C:\Program Files\ESET\log.txt
After you've copied and pasted the above please select OK.
This should display the ESET Online Scanner log.
Once the ESET Online Scanner log is displayed please copy and paste the contents of the file into your next post.
____________________________________________________
ALTERNATIVE STEP 1.
If the above doesn't work then please do a search on your computer for a file named: log.txt
Please make sure you include the following items in your next post:
1. The contents of the log.txt file.
Proud Graduate of the WTT Classroom
#15
Posted 31 October 2009 - 10:37 PM
0 user(s) are reading this topic
0 members, 0 guests, 0 anonymous users