Spyware / Malware / Virus Removal

[Resolved] can't connect to anti-virus url

12 min read

Looking for the outcome? Ask AI

ciacia Topic Starter

Post #1November 20, 2009, 4:19 AM UTC

Hi All, i can't connect to anti-virus url. have checked the hosts file and it's fine. Did a full scan on my laptop but no virus found. Anyone can kindly help me on this? thanks

CatByte

Post #2November 20, 2009, 7:23 AM UTC

Hi,

Please do the following:

Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.

Disable any script blocking protection
Double click dds.pif to run the tool.
When done, two DDS.txt's will open.
Save both reports to your desktop.

—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.

NEXT

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and post it in your next reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

ciacia

Post #3November 20, 2009, 9:49 AM UTC

Hi, thanks for your assistance. Please refer to attached. thanks

Attachments:

[attachment removed: dds.zip]
📎gmer.txt

ciacia

Post #4November 20, 2009, 10:07 AM UTC

Hi, Kindly note that I'm not a able to run "Malwarebytes' Anti-Malware". Some stuff seems to be closing it after i attempt to open it. thanks

CatByte

Post #5November 20, 2009, 1:00 PM UTC

Hi,

I'm not a able to run "Malwarebytes' Anti-Malware"

now that we are working together it would be more helpful for me if you didn't try and run scans on your own.

I am presently analyzing your logs and will get back to you with further instructions as soon as possible

Thanks

~CB

CatByte

Post #6November 20, 2009, 1:06 PM UTC

Hi,

Please do the following:

Download Combofix from either of the links below. You must rename it to ciacia.com before saving it.
Save it to your desktop. Change the save as file type to "all files"

**Note: In the event you already have Combofix, delete it, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".

Link 1
Link 2

———————————————————–

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

———————————————————–
NOTE: If ComboFix asks to install the Recovery Console, please ALLOW it to do so.

———————————————————–

Double click on the renamed ComboFix.exe & follow the prompts. When finished, it will produce a report for you.
Please post the C:\ComboFix.txt so we can continue cleaning the system.

———————————————————–

ciacia

Post #7November 20, 2009, 1:09 PM UTC

Noted of your advise. Will do it now and revert. thanks!

ciacia

Post #8November 20, 2009, 1:37 PM UTC last edited November 20, 2009, 2:20 PM UTC

Hi,

Ran ComboFix under safe mode. Blue screen when running in Normal Mode.

Please refer to attached log.

thanks

ComboFix 09-11-19.05 - hpadmin 11/20/2009 21:18.1.2 - x86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1650 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ciacia.com
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\rkill.pif
c:\windows\takpueb.old

.
((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))
.

2009-11-20 08:08 . 2009-11-20 08:08 ——– d—–w- C:\gmer
2009-11-20 08:08 . 2009-11-20 08:08 11418 —-a-w- C:\dds.zip
2009-11-20 08:06 . 2009-11-20 08:06 283273 —-a-w- C:\gmer.zip
2009-11-20 07:51 . 2009-09-10 06:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-20 07:51 . 2009-11-20 07:51 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-20 07:51 . 2009-09-10 06:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-20 07:01 . 2009-11-20 07:01 ——– d—–w- C:\OCR00017040
2009-11-20 04:09 . 2009-11-20 04:09 ——– d—–w- C:\malware
2009-11-20 02:51 . 2009-11-20 02:51 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\Malwarebytes
2009-11-20 02:02 . 2009-11-20 02:02 ——– d—–w- c:\program files\Sophos
2009-11-20 01:47 . 2009-11-20 01:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-16 08:11 . 2009-11-16 08:11 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\Hewlett-Packard
2009-11-05 12:16 . 2007-06-27 05:46 148480 —-a-w- c:\windows\system32\TLBINF32.DLL
2009-11-05 12:16 . 2007-06-27 05:46 24576 —-a-w- c:\windows\system32\msxml3a.dll
2009-11-05 12:16 . 2007-06-27 05:46 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2009-11-05 12:10 . 2007-06-18 16:48 90112 —-a-w- c:\windows\sqrrem32.dll
2009-11-05 12:10 . 2005-02-22 14:46 27136 —-a-w- c:\windows\pttcp32c.dll
2009-11-05 12:10 . 2005-02-22 14:46 38400 —-a-w- c:\windows\ptftp32c.dll
2009-11-05 11:56 . 2009-11-05 12:10 ——– d—–w- C:\Hyperion
2009-11-05 08:23 . 2009-11-05 08:23 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2009-11-05 08:22 . 2009-11-05 08:22 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\VMware
2009-11-05 08:21 . 2009-11-05 08:21 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\VMware
2009-11-05 08:21 . 2009-11-05 08:21 ——– d—–w- c:\program files\VMware
2009-11-04 06:51 . 2009-11-04 06:51 ——– d—–w- c:\program files\Wisdom-soft ScreenHunter 5 Free
2009-10-30 01:21 . 2008-04-14 00:11 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2009-10-30 01:21 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2009-10-29 15:20 . 2009-07-01 00:54 38056 —-a-w- c:\windows\system32\drivers\WGX.SYS
2009-10-29 15:19 . 2009-10-29 15:19 60800 —-a-w- c:\windows\system32\S32EVNT1.DLL
2009-10-29 15:19 . 2009-10-29 15:19 123952 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-10-29 15:04 . 2009-10-29 15:20 ——– d—–w- C:\temp
2009-10-29 15:04 . 2008-08-11 12:12 917 —-a-w- c:\windows\killAVScan.vbs
2009-10-29 15:04 . 2008-05-01 02:53 725 —-a-w- c:\windows\SAV10Cleanup.vbs
2009-10-28 02:35 . 2009-10-28 02:35 ——– d—–w- c:\program files\ExamDiff Pro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-20 13:04 . 2009-06-26 02:05 ——– d–h–w- c:\documents and settings\All Users\Application Data\Encentuate
2009-11-16 08:16 . 2007-09-17 15:27 ——– d—–w- c:\program files\symantec antivirus
2009-11-05 13:42 . 2009-07-26 15:21 82920 —-a-w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 15:21 . 2007-09-17 15:29 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-10-29 15:20 . 2007-09-17 15:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-10-29 15:19 . 2007-09-17 15:27 ——– d—–w- c:\program files\Symantec
2009-10-29 15:19 . 2009-10-29 15:19 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-10-29 15:19 . 2009-10-29 15:19 10563 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-10-16 08:14 . 2009-02-27 01:26 ——– d—–w- c:\program files\Spark
2009-10-15 06:54 . 2009-09-16 12:52 ——– d—–w- c:\program files\Windows Live
2009-10-15 05:17 . 2009-10-15 05:17 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\TrueCrypt
2009-10-15 05:17 . 2009-10-15 05:17 235840 —-a-w- c:\windows\system32\drivers\truecrypt.sys
2009-10-15 05:17 . 2009-10-15 05:17 ——– d—–w- c:\program files\TrueCrypt
2009-10-03 14:29 . 2009-09-27 13:47 ——– d—–w- c:\program files\LG PC Suite II
2009-09-27 13:50 . 2009-09-27 13:50 ——– d—–w- c:\program files\LG Electronics
2009-09-27 13:49 . 2009-02-16 05:23 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-09-27 13:48 . 2009-09-27 13:48 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\LG Electronics
2009-09-27 13:47 . 2009-09-27 13:47 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\InstallShield
2009-09-25 05:37 . 1980-01-01 00:00 667136 —-a-w- c:\windows\system32\wininet.dll
2009-09-25 05:37 . 1980-01-01 00:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-09-22 05:46 . 2009-09-22 05:46 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\IsolatedStorage
2009-09-11 14:18 . 1980-01-01 00:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 1980-01-01 00:00 58880 —-a-w- c:\windows\system32\msasn1.dll
2009-08-26 08:00 . 1980-01-01 00:00 247326 —-a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COEMsgDisplay"="c:\program files\Hewlett-Packard\PC COE\COEMsgDisplay.exe" [2007-04-11 26624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-26 148888]
"QuickPassword"="c:\program files\ActivCard\ActivCard Gold\agquickp.exe" [2007-06-26 225280]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
"GetIT"="c:\program files\Hewlett-Packard\GetIT\GetIT.exe" [2007-08-08 348160]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"imekrmig7.0"="c:\program files\Common Files\Microsoft Shared\IME\IMKR7\IMEKRMIG.EXE" [2003-07-15 19520]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"IDA"="c:\program files\Hewlett-Packard\PC COE\IDA.EXE" [2007-07-11 176128]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-05 159744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"IMJPMIG9.0"="c:\program files\Common Files\Microsoft Shared\IME\IMJP9\imjprmzb.exe" [2004-02-17 33992]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-05 184320]
"AAAgent"="c:\program files\Encentuate\AATray.exe" [2007-12-28 1236992]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-07-01 115560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe [2009-6-26 1537064]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2009-2-16 184320]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-6-8 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=c:\windows\takpueb.old 2nCCPGNHED

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\symantec antivirus\\Smc.exe"=
"c:\\Program Files\\symantec antivirus\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [2/23/2008 12:56 AM 101647]
R0 SBAlg;SBAlg;c:\windows\system32\drivers\SbAlg.sys [7/16/2007 12:32 PM 44720]
R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [2/23/2008 12:57 AM 6272]
R1 RsvLock;RsvLock;c:\windows\system32\drivers\RsvLock.sys [2/23/2008 12:57 AM 5840]
R1 SbFlop;SbFlop;c:\windows\system32\drivers\SbFlop.sys [2/23/2008 12:57 AM 34000]
R1 SbPrcCtl;SbPrcCtl;c:\windows\system32\drivers\SbPrcCtl.sys [2/23/2008 12:57 AM 14960]
R2 acautoreg;ActivCard Gold Autoregister;c:\program files\Common Files\ActivCard\acautoreg.exe [6/27/2007 6:06 AM 53248]
R2 AccessUpdate;AccessUpdate;c:\program files\Encentuate\AccessUpdate.exe [12/24/2007 2:38 PM 57344]
R2 Accoca;ActivCard Gold service;c:\program files\Common Files\ActivCard\accoca.exe [6/27/2007 6:06 AM 143360]
R2 Ataman TCP Remote Logon Services;Ataman TCP Remote Logon Services;c:\hyperion\BIPlus\bin\SQR\Remote\bin\atrls.exe [11/5/2009 8:15 PM 71168]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [5/20/2009 12:06 PM 87264]
R2 BMFMySQL;BMFMySQL;c:\program files\Quest Software\Benchmark Factory for Databases\Repository\MySQL\bin\mysqld-max-nt.exe [10/22/2005 11:35 PM 4431872]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [3/3/2007 11:12 PM 202096]
R2 msralinkmonitor;MSRA Link Monitor;c:\program files\Remote tools\msraLinkMonitor.exe [8/28/2007 10:28 PM 147456]
R2 radexecd;Radia Notify Daemon;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe [5/4/2005 10:35 PM 217268]
R2 radsched;Radia Scheduler Daemon;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe [8/25/2004 7:05 PM 245940]
R2 Radstgms;Radia MSI Redirector;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe [10/22/2004 10:53 PM 327860]
R2 SOCIService;SOCIService;c:\program files\Encentuate\SOCIService.exe [4/26/2005 4:59 PM 159744]
R3 akbus;ActivCard Virtual Reader Enumerator;c:\windows\system32\drivers\akbus.sys [4/6/2007 5:46 PM 13619]
R3 akpcsc;ActivCard Virtual PC/SC Device Driver;c:\windows\system32\drivers\akpcsc.sys [6/27/2007 11:10 PM 9493]
R3 aksbus;ActivIdentity Virtual Reader Enumerator;c:\windows\system32\drivers\aksbus.sys [4/6/2007 5:46 PM 13647]
R3 akspcsc;ActivIdentity Virtual PC/SC Device Driver;c:\windows\system32\drivers\akspcsc.sys [6/27/2007 11:10 PM 10161]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/30/2009 5:51 PM 102448]
R3 euccihr;plug'n'crypt CCID token reader;c:\windows\system32\drivers\euccihr-x86.sys [6/7/2006 3:34 PM 43776]
R3 euci5hr;plug'n'crypt identity token reader;c:\windows\system32\drivers\euci5hr-x86.sys [5/25/2006 11:01 AM 38272]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/17/2007 5:33 PM 36608]
R3 RadiaMsi;RadiaMsi;c:\windows\system32\drivers\radiamsi.sys [9/10/2004 9:45 PM 21504]
S2 SafeBootClientManager;SafeBoot Client Manager;c:\program files\SafeBoot\SbClientManager.exe –> c:\program files\SafeBoot\SbClientManager.exe [?]
S3 actccid;ActivCard USB Reader V2;c:\windows\system32\drivers\actccid.sys [6/27/2007 6:06 AM 47660]
S3 AKSIM;ActivKey Sim;c:\windows\system32\drivers\aksim.sys [6/27/2007 11:10 PM 27008]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [8/5/2009 6:18 PM 104448]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [7/1/2009 8:53 AM 23888]
S3 euccih;plug'n'crypt CCID token;c:\windows\system32\drivers\euccih-x86.sys [6/7/2006 2:20 PM 57088]
S3 magaService;Lan Discover Agent;c:\program files\Sygate\SSA\maga\maga.exe –> c:\program files\Sygate\SSA\maga\maga.exe [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\39.tmp –> c:\windows\system32\39.tmp [?]
S3 SmartUSB;SmartReader-USB;c:\windows\system32\drivers\SmartUSB.sys [6/27/2007 11:10 PM 17024]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 7:01 AM 2799808]
UnknownUnknown dsload;dsload; [x]

— Other Services/Drivers In Memory —

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-11-20 c:\windows\Tasks\IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\aimsi.dll [2007-07-11 21:08]

2009-11-20 c:\windows\Tasks\IDA{07A2D605-F561-11D1-BEE5-AC785AC8CD4E}001.job
- c:\progra~1\HEWLET~1\PCCOE~1\aimsi.dll [2007-07-11 21:08]

2009-11-20 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\clinvsi.dll [2007-07-05 16:18]

2009-11-20 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}001.job
- c:\program files\Hewlett-Packard\PC COE\coetl32.exe [2007-06-23 22:27]

2009-11-20 c:\windows\Tasks\IDA{884F3959-E5F7-11D1-9B15-080009F878E4}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\reltrksi.dll [2006-07-20 14:14]

2009-11-20 c:\windows\Tasks\IDA{E1B2A4DD-AE06-4B97-9B55-8E8F1348E7FB}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\critupsi.dll [2006-10-20 21:40]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://momster.intranet.mom.gov.sg/pages/default.aspx
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Trusted Zone: compaq.com\ie.config.asia
Trusted Zone: compaq.com\ie.config.eur
Trusted Zone: compaq.com\ie.config.im.hou
Trusted Zone: compaq.com\ie.config.jp
Trusted Zone: dec.com\ie.config.ecom
Trusted Zone: tandem.com\ie.config
Trusted Zone: compaq.com\ie.config.asia
Trusted Zone: compaq.com\ie.config.eur
Trusted Zone: compaq.com\ie.config.im.hou
Trusted Zone: compaq.com\ie.config.jp
Trusted Zone: dec.com\ie.config.ecom
Trusted Zone: gov.sg\*.soeasy
Trusted Zone: gov.sg\hqas03.intranet.mom
Trusted Zone: gov.sg\hqas05.intranet.mom
Trusted Zone: gov.sg\www.intranet.mom
Trusted Zone: tandem.com\ie.config
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
HKLM-Run-SafeBootTrayManager - c:\program files\SafeBoot Tray Manager\SbTrayManager.exe
Notify-avgrsstarter - avgrsstx.dll
Notify-NavLogon - (no file)
SafeBoot-Symantec Antvirus
AddRemove-HijackThis - c:\documents and settings\hpadmin.DLU5\Local Settings\Temporary Internet Files\Content.IE5\X22CO2IL\HijackThis.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 21:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\39.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1792)
c:\windows\system32\engina.dll
c:\windows\system32\libcvd.dll
c:\windows\system32\SOCIService.dll
c:\windows\system32\zlib1.dll
c:\windows\system32\enc_v3.dll
c:\windows\system32\SyncProxy.dll
c:\windows\system32\SecFactor.dll
c:\windows\system32\LibcvdObj.dll
c:\windows\system32\biom.dll
c:\windows\system32\dpFpFns.dll
c:\windows\system32\dpDevDat.dll
c:\windows\system32\dpDevClt.dll
c:\windows\system32\dpFtrEx.dll
c:\windows\system32\dpMatch.dll
c:\program files\Encentuate\CommonResource.dll
c:\program files\Encentuate\AAResource.dll

- - - - - - - > 'explorer.exe'(4796)
c:\program files\Encentuate\WinObserver2.Dll
c:\windows\system32\SyncProxy.dll
c:\windows\system32\btmmhook.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
c:\program files\Encentuate\WebObserver2.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
c:\program files\WIDCOMM\Bluetooth Software\btkeyind.dll
.
———————— Other Running Processes ————————
.
c:\program files\Encentuate\Sync.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Symantec AntiVirus\Smc.exe
c:\program files\Symantec AntiVirus\SNAC.EXE
c:\program files\Common Files\Symantec Shared\ccSvcHst.exe
c:\windows\System32\SCardSvr.exe
c:\program files\Cisco Systems\VPN Client\cvpnd.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
c:\program files\Microsoft SQL Server\MSSQL.2\OLAP\bin\msmdsrv.exe
c:\notes\ntmulti.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Symantec AntiVirus\Rtvscan.exe
c:\program files\UPHClean\uphclean.exe
c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe
c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe
c:\program files\Symantec AntiVirus\SmcGui.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
c:\windows\system32\NOTEPAD.EXE
.
**************************************************************************
.
Completion time: 2009-11-20 21:32 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-20 13:31

Pre-Run: 33,255,616,512 bytes free
Post-Run: 31,249,006,592 bytes free

- - End Of File - - 820FD5C12E2A9F5D46F797AB195A449D

Attachments:

📎ComboFix.txt

CatByte

Post #9November 20, 2009, 2:42 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/can_t_connect_anti_virus_url_t108386.html

Collect::
c:\windows\takpueb.old 

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi9"=""

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

NEXT

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*2nCCPGNHED*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

ciacia

Post #10November 20, 2009, 3:14 PM UTC

Hi, Do you mean drop the file i saved to ciacia.com? thanks

CatByte

Post #11November 20, 2009, 3:31 PM UTC last edited November 20, 2009, 3:32 PM UTC

Hi yes, sorry, I should have been more clear - ciacia.com = combofix.exe

ciacia

Post #12November 20, 2009, 3:41 PM UTC

Hi,

STEP1
=====

ComboFix 09-11-19.05 - hpadmin 11/20/2009 23:27.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2039.1348 [GMT 8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\hpadmin.DLU5\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Symantec Endpoint Protection *On-access scanning disabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
FW: Symantec Endpoint Protection *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((( Files Created from 2009-10-20 to 2009-11-20 )))))))))))))))))))))))))))))))
.

2009-11-20 04:09 . 2009-11-20 04:09 ——– d—–w- C:\malware
2009-11-20 02:51 . 2009-11-20 02:51 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\Malwarebytes
2009-11-20 02:02 . 2009-11-20 02:02 ——– d—–w- c:\program files\Sophos
2009-11-20 01:47 . 2009-11-20 01:47 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-16 08:11 . 2009-11-16 08:11 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\Hewlett-Packard
2009-11-05 12:16 . 2007-06-27 05:46 148480 —-a-w- c:\windows\system32\TLBINF32.DLL
2009-11-05 12:16 . 2007-06-27 05:46 24576 —-a-w- c:\windows\system32\msxml3a.dll
2009-11-05 12:16 . 2007-06-27 05:46 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2009-11-05 12:10 . 2007-06-18 16:48 90112 —-a-w- c:\windows\sqrrem32.dll
2009-11-05 12:10 . 2005-02-22 14:46 27136 —-a-w- c:\windows\pttcp32c.dll
2009-11-05 12:10 . 2005-02-22 14:46 38400 —-a-w- c:\windows\ptftp32c.dll
2009-11-05 11:56 . 2009-11-05 12:10 ——– d—–w- C:\Hyperion
2009-11-05 08:23 . 2009-11-05 08:23 ——– d—–w- c:\documents and settings\All Users\Application Data\VMware
2009-11-05 08:22 . 2009-11-05 08:22 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\VMware
2009-11-05 08:21 . 2009-11-05 08:21 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\VMware
2009-11-05 08:21 . 2009-11-05 08:21 ——– d—–w- c:\program files\VMware
2009-11-04 06:51 . 2009-11-04 06:51 ——– d—–w- c:\program files\Wisdom-soft ScreenHunter 5 Free
2009-10-30 01:21 . 2008-04-14 00:11 21504 -c–a-w- c:\windows\system32\dllcache\hidserv.dll
2009-10-30 01:21 . 2008-04-14 00:11 21504 —-a-w- c:\windows\system32\hidserv.dll
2009-10-29 15:20 . 2009-07-01 00:54 38056 —-a-w- c:\windows\system32\drivers\WGX.SYS
2009-10-29 15:19 . 2009-10-29 15:19 60800 —-a-w- c:\windows\system32\S32EVNT1.DLL
2009-10-29 15:19 . 2009-10-29 15:19 123952 —-a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-10-29 15:04 . 2008-08-11 12:12 917 —-a-w- c:\windows\killAVScan.vbs
2009-10-29 15:04 . 2008-05-01 02:53 725 —-a-w- c:\windows\SAV10Cleanup.vbs
2009-10-28 02:35 . 2009-10-28 02:35 ——– d—–w- c:\program files\ExamDiff Pro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-20 13:04 . 2009-06-26 02:05 ——– d–h–w- c:\documents and settings\All Users\Application Data\Encentuate
2009-11-16 08:16 . 2007-09-17 15:27 ——– d—–w- c:\program files\symantec antivirus
2009-11-05 13:42 . 2009-07-26 15:21 82920 —-a-w- c:\documents and settings\hpadmin.DLU5\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-29 15:21 . 2007-09-17 15:29 ——– d—–w- c:\program files\Common Files\Symantec Shared
2009-10-29 15:20 . 2007-09-17 15:27 ——– d—–w- c:\documents and settings\All Users\Application Data\Symantec
2009-10-29 15:19 . 2007-09-17 15:27 ——– d—–w- c:\program files\Symantec
2009-10-29 15:19 . 2009-10-29 15:19 805 —-a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-10-29 15:19 . 2009-10-29 15:19 10563 —-a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-10-16 08:14 . 2009-02-27 01:26 ——– d—–w- c:\program files\Spark
2009-10-15 06:54 . 2009-09-16 12:52 ——– d—–w- c:\program files\Windows Live
2009-10-15 05:17 . 2009-10-15 05:17 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\TrueCrypt
2009-10-15 05:17 . 2009-10-15 05:17 235840 —-a-w- c:\windows\system32\drivers\truecrypt.sys
2009-10-15 05:17 . 2009-10-15 05:17 ——– d—–w- c:\program files\TrueCrypt
2009-10-03 14:29 . 2009-09-27 13:47 ——– d—–w- c:\program files\LG PC Suite II
2009-09-27 13:50 . 2009-09-27 13:50 ——– d—–w- c:\program files\LG Electronics
2009-09-27 13:49 . 2009-02-16 05:23 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-09-27 13:48 . 2009-09-27 13:48 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\LG Electronics
2009-09-27 13:47 . 2009-09-27 13:47 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\InstallShield
2009-09-25 05:37 . 1980-01-01 00:00 667136 ——w- c:\windows\system32\wininet.dll
2009-09-25 05:37 . 1980-01-01 00:00 81920 —-a-w- c:\windows\system32\ieencode.dll
2009-09-22 05:46 . 2009-09-22 05:46 ——– d—–w- c:\documents and settings\hpadmin.DLU5\Application Data\IsolatedStorage
2009-09-11 14:18 . 1980-01-01 00:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-04 21:03 . 1980-01-01 00:00 58880 —-a-w- c:\windows\system32\msasn1.dll
2009-08-26 08:00 . 1980-01-01 00:00 247326 —-a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"COEMsgDisplay"="c:\program files\Hewlett-Packard\PC COE\COEMsgDisplay.exe" [2007-04-11 26624]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-26 148888]
"QuickPassword"="c:\program files\ActivCard\ActivCard Gold\agquickp.exe" [2007-06-26 225280]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-18 110592]
"GetIT"="c:\program files\Hewlett-Packard\GetIT\GetIT.exe" [2007-08-08 348160]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-03 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-03 59392]
"imekrmig7.0"="c:\program files\Common Files\Microsoft Shared\IME\IMKR7\IMEKRMIG.EXE" [2003-07-15 19520]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-03 455168]
"IDA"="c:\program files\Hewlett-Packard\PC COE\IDA.EXE" [2007-07-11 176128]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-01-05 872448]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-02-26 131072]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-02-26 155648]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-02-26 131072]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-01-10 472776]
"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2007-01-24 124928]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-03-05 159744]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-01-12 827392]
"IMJPMIG9.0"="c:\program files\Common Files\Microsoft Shared\IME\IMJP9\imjprmzb.exe" [2004-02-17 33992]
"WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-05 184320]
"AAAgent"="c:\program files\Encentuate\AATray.exe" [2007-12-28 1236992]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2009-07-01 115560]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-24 29696]
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-2-6 561213]
Cisco Systems VPN Client.lnk - c:\program files\Cisco Systems\VPN Client\vpngui.exe [2009-6-26 1537064]
DVD Check.lnk - c:\program files\InterVideo\DVD Check\DVDCheck.exe [2009-2-16 184320]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-6-8 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoMSAppLogo5ChannelNotify"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccEvtMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ccSetMgr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Symantec Antivirus]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\symantec antivirus\\Smc.exe"=
"c:\\Program Files\\symantec antivirus\\SNAC.EXE"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"=

R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [2/23/2008 12:56 AM 101647]
R0 SBAlg;SBAlg;c:\windows\system32\drivers\SbAlg.sys [7/16/2007 12:32 PM 44720]
R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [2/23/2008 12:57 AM 6272]
R1 RsvLock;RsvLock;c:\windows\system32\drivers\RsvLock.sys [2/23/2008 12:57 AM 5840]
R1 SbFlop;SbFlop;c:\windows\system32\drivers\SbFlop.sys [2/23/2008 12:57 AM 34000]
R1 SbPrcCtl;SbPrcCtl;c:\windows\system32\drivers\SbPrcCtl.sys [2/23/2008 12:57 AM 14960]
R2 acautoreg;ActivCard Gold Autoregister;c:\program files\Common Files\ActivCard\acautoreg.exe [6/27/2007 6:06 AM 53248]
R2 AccessUpdate;AccessUpdate;c:\program files\Encentuate\AccessUpdate.exe [12/24/2007 2:38 PM 57344]
R2 Accoca;ActivCard Gold service;c:\program files\Common Files\ActivCard\accoca.exe [6/27/2007 6:06 AM 143360]
R2 BandLuxe_Service;BandLuxe Service;c:\program files\BandRich\BandLuxe HSDPA Utility R11\BRService.exe [5/20/2009 12:06 PM 87264]
R2 MsDtsServer;SQL Server Integration Services;c:\program files\Microsoft SQL Server\90\DTS\Binn\MsDtsSrvr.exe [3/3/2007 11:12 PM 202096]
R2 msralinkmonitor;MSRA Link Monitor;c:\program files\Remote tools\msraLinkMonitor.exe [8/28/2007 10:28 PM 147456]
R2 radexecd;Radia Notify Daemon;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe [5/4/2005 10:35 PM 217268]
R2 radsched;Radia Scheduler Daemon;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe [8/25/2004 7:05 PM 245940]
R2 Radstgms;Radia MSI Redirector;c:\program files\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe [10/22/2004 10:53 PM 327860]
R2 SOCIService;SOCIService;c:\program files\Encentuate\SOCIService.exe [4/26/2005 4:59 PM 159744]
R3 akbus;ActivCard Virtual Reader Enumerator;c:\windows\system32\drivers\akbus.sys [4/6/2007 5:46 PM 13619]
R3 akpcsc;ActivCard Virtual PC/SC Device Driver;c:\windows\system32\drivers\akpcsc.sys [6/27/2007 11:10 PM 9493]
R3 aksbus;ActivIdentity Virtual Reader Enumerator;c:\windows\system32\drivers\aksbus.sys [4/6/2007 5:46 PM 13647]
R3 akspcsc;ActivIdentity Virtual PC/SC Device Driver;c:\windows\system32\drivers\akspcsc.sys [6/27/2007 11:10 PM 10161]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [10/30/2009 5:51 PM 102448]
R3 euccihr;plug'n'crypt CCID token reader;c:\windows\system32\drivers\euccihr-x86.sys [6/7/2006 3:34 PM 43776]
R3 euci5hr;plug'n'crypt identity token reader;c:\windows\system32\drivers\euci5hr-x86.sys [5/25/2006 11:01 AM 38272]
R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [4/17/2007 5:33 PM 36608]
R3 RadiaMsi;RadiaMsi;c:\windows\system32\drivers\radiamsi.sys [9/10/2004 9:45 PM 21504]
S2 Ataman TCP Remote Logon Services;Ataman TCP Remote Logon Services;c:\hyperion\BIPlus\bin\SQR\Remote\bin\atrls.exe [11/5/2009 8:15 PM 71168]
S2 BMFMySQL;BMFMySQL;c:\program files\Quest Software\Benchmark Factory for Databases\Repository\MySQL\bin\mysqld-max-nt.exe [10/22/2005 11:35 PM 4431872]
S2 SafeBootClientManager;SafeBoot Client Manager;c:\program files\SafeBoot\SbClientManager.exe –> c:\program files\SafeBoot\SbClientManager.exe [?]
S3 actccid;ActivCard USB Reader V2;c:\windows\system32\drivers\actccid.sys [6/27/2007 6:06 AM 47660]
S3 AKSIM;ActivKey Sim;c:\windows\system32\drivers\aksim.sys [6/27/2007 11:10 PM 27008]
S3 br3gmdm;BandLuxe 3.5G HSDPA Adapter - USB;c:\windows\system32\drivers\br3gmdm.sys [8/5/2009 6:18 PM 104448]
S3 COH_Mon;COH_Mon;c:\windows\system32\drivers\COH_Mon.sys [7/1/2009 8:53 AM 23888]
S3 euccih;plug'n'crypt CCID token;c:\windows\system32\drivers\euccih-x86.sys [6/7/2006 2:20 PM 57088]
S3 magaService;Lan Discover Agent;c:\program files\Sygate\SSA\maga\maga.exe –> c:\program files\Sygate\SSA\maga\maga.exe [?]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\39.tmp –> c:\windows\system32\39.tmp [?]
S3 SmartUSB;SmartReader-USB;c:\windows\system32\drivers\SmartUSB.sys [6/27/2007 11:10 PM 17024]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [9/23/2005 7:01 AM 2799808]
UnknownUnknown dsload;dsload; [x]

— Other Services/Drivers In Memory —

*Deregistered* - uphcleanhlp

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-11-20 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\clinvsi.dll [2007-07-05 16:18]

2009-11-20 c:\windows\Tasks\IDA{5B940D5F-0A3F-11D2-95B5-080009DC8202}001.job
- c:\program files\Hewlett-Packard\PC COE\coetl32.exe [2007-06-23 22:27]

2009-11-20 c:\windows\Tasks\IDA{884F3959-E5F7-11D1-9B15-080009F878E4}000.job
- c:\progra~1\HEWLET~1\PCCOE~1\reltrksi.dll [2006-07-20 14:14]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://momster.intranet.mom.gov.sg/pages/default.aspx
uInternet Settings,ProxyOverride =
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Send to &Bluetooth Device… - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a}
Trusted Zone: compaq.com\ie.config.asia
Trusted Zone: compaq.com\ie.config.eur
Trusted Zone: compaq.com\ie.config.im.hou
Trusted Zone: compaq.com\ie.config.jp
Trusted Zone: dec.com\ie.config.ecom
Trusted Zone: tandem.com\ie.config
Trusted Zone: compaq.com\ie.config.asia
Trusted Zone: compaq.com\ie.config.eur
Trusted Zone: compaq.com\ie.config.im.hou
Trusted Zone: compaq.com\ie.config.jp
Trusted Zone: dec.com\ie.config.ecom
Trusted Zone: gov.sg\*.soeasy
Trusted Zone: gov.sg\hqas03.intranet.mom
Trusted Zone: gov.sg\hqas05.intranet.mom
Trusted Zone: gov.sg\www.intranet.mom
Trusted Zone: tandem.com\ie.config
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-20 23:34
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\msftesql]
"ImagePath"="\"c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\msftesql.exe\" -s:MSSQL.1 -f:MSSQLSERVER"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\39.tmp"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters]
"SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79,
00,5c,00,4d,00,61,00,63,00,68,00,69,00,6e,00,65,00,5c,00,53,00,79,00,73,00,\
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1788)
c:\windows\system32\engina.dll
c:\windows\system32\libcvd.dll
c:\windows\system32\SOCIService.dll
c:\windows\system32\zlib1.dll
c:\windows\system32\enc_v3.dll
c:\windows\system32\SyncProxy.dll
c:\windows\system32\SecFactor.dll
c:\windows\system32\LibcvdObj.dll
c:\windows\system32\biom.dll
c:\windows\system32\dpFpFns.dll
c:\windows\system32\dpDevDat.dll
c:\windows\system32\dpDevClt.dll
c:\windows\system32\dpFtrEx.dll
c:\windows\system32\dpMatch.dll
c:\program files\Encentuate\CommonResource.dll
c:\program files\Encentuate\AAResource.dll

- - - - - - - > 'explorer.exe'(5760)
c:\program files\Encentuate\WinObserver2.Dll
c:\windows\system32\SyncProxy.dll
c:\windows\system32\btmmhook.dll
.
Completion time: 2009-11-20 23:36
ComboFix-quarantined-files.txt 2009-11-20 15:36

Pre-Run: 33,811,181,568 bytes free
Post-Run: 33,811,038,208 bytes free

- - End Of File - - 6727048650CD679366E2C2C3E269B558

STEP2
======

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 23:38 on 20/11/2009 by hpadmin (Administrator - Elevation successful)

========== filefind ==========

Searching for "*2nCCPGNHED*"
No files found.

-=End Of File=-

thanks

CatByte

Post #13November 20, 2009, 3:46 PM UTC

Hi, Please update your copy of Malwarebytes Antimalware and see if it will run now, If it wont run in normal mode, try it in safe mode. Make note of any error messages you receive.

ciacia

Post #14November 20, 2009, 3:55 PM UTC

thanks CatByte, it's working now. I'm able to access the anti virus url as well as using the software. The scan is completed and no issue. Appreciate your help. thanks!

CatByte

Post #15November 20, 2009, 9:38 PM UTC

Hi, we haven't finished yet, we still have some work to do to make sure you are totally clean, then we need to clean up our tools:

Please post the MBAM log and do this following scan:

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] can't connect to anti-virus url

✨ Ask AI

Ask AI