Spyware / Malware / Virus Removal

[Closed] Infected with Alpha Antivirus

3 min read

Looking for the outcome? Ask AI

juniornt Topic Starter

Post #1November 23, 2009, 5:04 PM UTC

Hi, I recently started getting a pop-up saying that my computer was infected and to please click "yes" if I wanted to block the virus. Being as I have TrendMicro Antivirus and it wasn't a popup from them I was a bit suspicious. Turns out I have Alpha Antivirus. I searched the web for a removal guide and was instructed to use MBAM. While it seems to have worked for the most part, I still see some remnants left so I wanted to make sure my machine was clean. Here are the DDS, RootRepeal, and MBAM logs which I have gathered. On a side note, I never had the attach.txt pop up after running DDS. DDS: DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 11:46:33.75 on Mon 11/23/2009 Internet Explorer: 7.0.6001.18000 Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3002.2056 [GMT -5:00] AV: Trend Micro AntiVirus *On-access scanning enabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\SLsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\Dwm.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Program Files\Trend Micro\BM\TMBMSRV.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted C:\Windows\system32\taskeng.exe C:\Program Files\SMINST\BLService.exe C:\Program Files\CyberLink\Shared files\RichVideo.exe C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Program Files\Trend Micro\Internet Security\TmProxy.exe C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Windows\system32\DRIVERS\xaudio.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Windows\System32\igfxtray.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Canon\MyPrinter\BJMYPRT.EXE C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Windows Sidebar\sidebar.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\Synaptics\SynTP\SynTPHelper.exe C:\Windows\system32\wuauclt.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Owner\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uStart Page = hxxp://www.yahoo.com/ uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=Presario&pf=cnnb BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN uRun: [Sidebar] "c:\program files\windows sidebar\Sidebar.exe" /autorun mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [IgfxTray] c:\windows\system32\igfxtray.exe mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe mRun: [Persistence] c:\windows\system32\igfxpers.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [QlbCtrl.exe] c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe /Start mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe mRun: [UfSeAgnt.exe] "c:\program files\trend micro\internet security\UfSeAgnt.exe" mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab Notify: igfxcui - igfxdev.dll ============= SERVICES / DRIVERS =============== R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\sminst\BLService.exe [2009-4-22 365952] R2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2008-7-29 50192] R2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2009-7-18 36368] R2 TmProxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2009-6-29 677128] R3 Com4QLBEx;Com4QLBEx;c:\program files\hewlett-packard\hp quick launch buttons\Com4QLBEx.exe [2009-4-22 193840] R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\system32\drivers\IntcHdmi.sys [2008-6-29 112128] S2 Norton Internet Security;Norton Internet Security;"c:\program files\norton internet security\engine\16.0.0.125\ccsvchst.exe" /s "norton internet security" /m "c:\program files\norton internet security\engine\16.0.0.125\dimaster.dll" /prefetch:1 –> c:\program files\norton internet security\engine\16.0.0.125\ccSvcHst.exe [?] =============== Created Last 30 ================ 2009-11-23 11:22 –d—– c:\users\owner\appdata\roaming\Malwarebytes 2009-11-23 11:22 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2009-11-23 11:22 –d—– c:\programdata\Malwarebytes 2009-11-23 11:22 –d—– c:\progra~2\Malwarebytes 2009-11-23 11:22 19,160 a——- c:\windows\system32\drivers\mbam.sys 2009-11-23 11:22 –d—– c:\program files\Malwarebytes' Anti-Malware 2009-11-12 07:15 –d—– c:\program files\common files\AAntivirusUninstall 2009-11-12 07:14 –d—– c:\program files\AAntivirus 2009-11-11 15:34 2,035,712 a——- c:\windows\system32\win32k.sys 2009-11-11 15:32 351,232 a——- c:\windows\system32\WSDApi.dll 2009-11-04 06:41 1,383,424 a——- c:\windows\system32\mshtml.tlb 2009-10-27 15:22 310,784 a——- c:\windows\system32\unregmp2.exe 2009-10-27 15:22 8,147,456 a——- c:\windows\system32\wmploc.DLL ==================== Find3M ==================== 2009-09-10 12:30 213,504 a——- c:\windows\system32\msv1_0.dll 2009-09-10 10:48 93,552 a——- c:\windows\help\oem\scripts\RegRestore.exe 2009-09-10 10:48 12,288 a——- c:\windows\help\oem\scripts\BackgroundCopyManager1_5.dll 2009-09-10 10:48 9,728 a——- c:\windows\help\oem\scripts\BackgroundCopyManager.DLL 2009-09-04 07:24 61,440 a——- c:\windows\system32\msasn1.dll 2009-08-31 08:55 293,376 a——- c:\windows\system32\psisdecd.dll 2009-08-31 08:55 428,544 a——- c:\windows\system32\EncDec.dll 2009-08-28 07:39 28,672 a——- c:\windows\system32\Apphlpdm.dll 2009-08-28 07:39 173,056 a——- c:\windows\apppatch\AcXtrnal.dll 2009-08-28 07:38 2,153,984 a——- c:\windows\apppatch\AcGenral.dll 2009-08-28 07:38 541,696 a——- c:\windows\apppatch\AcLayers.dll 2009-08-28 07:38 459,776 a——- c:\windows\apppatch\AcSpecfc.dll 2009-08-28 05:15 4,240,384 a——- c:\windows\system32\GameUXLegacyGDFs.dll 2009-08-27 08:32 833,024 a——- c:\windows\system32\wininet.dll 2009-08-27 08:29 78,336 a——- c:\windows\system32\ieencode.dll 2009-08-27 05:58 26,624 a——- c:\windows\system32\ieUnatt.exe 2009-08-11 10:56 86,016 a——- c:\windows\inf\infstrng.dat 2009-08-11 10:56 51,200 a——- c:\windows\inf\infpub.dat 2009-08-11 10:56 86,016 a——- c:\windows\inf\infstor.dat 2009-04-22 09:18 665,600 a——- c:\windows\inf\drvindex.dat 2008-01-20 21:43 174 a–sh— c:\program files\desktop.ini 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 07:42 287,440 a——- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 07:42 30,674 a——- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 04:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 04:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat ============= FINISH: 11:47:23.11 =============== RootRepeal: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/11/23 11:48 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP1 ================================================== Drivers ——————- Name: dump_dumpata.sys Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys Address: 0x8F474000 Size: 45056 File Visible: No Signed: - Status: - Name: dump_msahci.sys Image Path: C:\Windows\System32\Drivers\dump_msahci.sys Address: 0x8F47F000 Size: 40960 File Visible: No Signed: - Status: - Name: rootrepeal2.sys Image Path: C:\Windows\system32\drivers\rootrepeal2.sys Address: 0xABDAF000 Size: 49152 File Visible: No Signed: - Status: - Processes ——————- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1176 Status: Locked to the Windows API! ==EOF== MBAM: Malwarebytes' Anti-Malware 1.41 Database version: 2775 Windows 6.0.6001 Service Pack 1 11/23/2009 11:29:47 AM mbam-log-2009-11-23 (11-29-47).txt Scan type: Quick Scan Objects scanned: 81168 Time elapsed: 4 minute(s), 20 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 3 Registry Values Infected: 0 Registry Data Items Infected: 1 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{35a5b43b-cb8a-49ca-a9f4-d3b308d2e3cc} (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowSearch (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully. Folders Infected: (No malicious items detected) Files Infected: C:\Windows\System32\ExplorerImages.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. Thanks for any help you can provide. -Jr

CatByte

Post #2November 23, 2009, 7:45 PM UTC

Hi,

Please do the following:

Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

juniornt

Post #3November 23, 2009, 9:38 PM UTC

Here you go. While I was running ComboFix, a window popped up saying that a rootkit was detected and ComboFix needed to restart windows in order to continue running. Thanks for the help.

Here's the log:

ComboFix:

ComboFix 09-11-22.08 - Owner 11/23/2009 16:00.1.1 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.3002.2141 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated) {7D2296BC-32CC-4519-917E-52E652474AF5}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2006731069-4194233102-3759409975-500
c:\$recycle.bin\S-1-5-21-2695152621-2261875020-35187774-500

Infected copy of c:\windows\system32\drivers\atapi.sys was found and disinfected
Restored copy from - Kitty ate it

.
((((((((((((((((((((((((( Files Created from 2009-10-23 to 2009-11-23 )))))))))))))))))))))))))))))))
.

2009-11-23 21:27 . 2009-11-23 21:28 ——– d—–w- c:\users\Owner\AppData\Local\temp
2009-11-23 21:27 . 2009-11-23 21:27 ——– d—–w- c:\users\Default\AppData\Local\temp
2009-11-23 16:22 . 2009-11-23 16:22 ——– d—–w- c:\users\Owner\AppData\Roaming\Malwarebytes
2009-11-23 16:22 . 2009-09-10 19:54 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-23 16:22 . 2009-11-23 16:22 ——– d—–w- c:\programdata\Malwarebytes
2009-11-23 16:22 . 2009-09-10 19:53 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-11-23 16:22 . 2009-11-23 16:22 4096 d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-11-12 12:15 . 2009-11-12 12:15 ——– d—–w- c:\program files\Common Files\AAntivirusUninstall
2009-11-12 12:14 . 2009-11-12 12:15 ——– d—–w- c:\program files\AAntivirus
2009-11-11 20:34 . 2009-08-14 13:53 2035712 —-a-w- c:\windows\system32\win32k.sys
2009-11-11 20:32 . 2009-08-10 13:05 351232 —-a-w- c:\windows\system32\WSDApi.dll
2009-10-27 20:22 . 2009-09-10 15:21 310784 —-a-w- c:\windows\system32\unregmp2.exe
2009-10-27 20:22 . 2009-09-10 15:21 8147456 —-a-w- c:\windows\system32\wmploc.DLL

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-12 08:16 . 2006-11-02 11:18 4096 d—–w- c:\program files\Windows Mail
2009-09-27 22:30 . 2009-09-27 22:30 ——– d—–w- c:\users\Owner\AppData\Roaming\com.directv.supercast.AA1ECC8BBAFE4E1BBF2D418DC006AF207FACE6CA.1
2009-09-27 22:29 . 2009-09-27 22:29 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-09-27 22:29 . 2009-09-27 22:29 ——– d—–w- c:\program files\DIRECTV
2009-09-27 22:29 . 2009-09-27 22:30 38208 —-a-w- c:\users\Owner\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-09-27 22:29 . 2009-09-27 22:30 38208 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-09-14 09:44 . 2009-10-14 01:14 144896 —-a-w- c:\windows\system32\drivers\srv2.sys
2009-09-10 17:30 . 2009-10-14 01:21 213504 —-a-w- c:\windows\system32\msv1_0.dll
2009-09-10 15:48 . 2009-09-20 19:25 93552 —-a-w- c:\windows\Help\OEM\scripts\RegRestore.exe
2009-09-10 15:48 . 2009-09-20 19:25 12288 —-a-w- c:\windows\Help\OEM\scripts\BackgroundCopyManager1_5.dll
2009-09-10 15:48 . 2009-09-20 19:25 9728 —-a-w- c:\windows\Help\OEM\scripts\BackgroundCopyManager.DLL
2009-09-04 12:24 . 2009-10-14 01:14 61440 —-a-w- c:\windows\system32\msasn1.dll
2009-08-31 13:55 . 2009-10-14 01:19 293376 —-a-w- c:\windows\system32\psisdecd.dll
2009-08-31 13:55 . 2009-10-14 01:19 428544 —-a-w- c:\windows\system32\EncDec.dll
2009-08-28 12:39 . 2009-09-02 00:31 28672 —-a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-02 00:31 4240384 —-a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 13:32 . 2009-10-14 01:20 833024 —-a-w- c:\windows\system32\wininet.dll
2009-08-27 13:29 . 2009-10-14 01:20 78336 —-a-w- c:\windows\system32\ieencode.dll
2009-08-27 10:58 . 2009-10-14 01:20 26624 —-a-w- c:\windows\system32\ieUnatt.exe
2009-04-22 14:18 . 2009-04-22 14:09 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2008-06-09 2363392]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-09-30 972080]
"Sidebar"="c:\program files\Windows Sidebar\Sidebar.exe" [2008-01-21 1233920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-17 1049896]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-07-10 150040]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-07-10 170520]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-07-10 145944]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-01 995528]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-18 1848648]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2008-12-12 722256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=""
"FirewallOverride"=""

R2 Recovery Service for Windows;Recovery Service for Windows;c:\program files\SMINST\BLService.exe [4/22/2009 10:17 AM 365952]
R2 tmevtmgr;tmevtmgr;c:\windows\System32\drivers\tmevtmgr.sys [7/29/2008 4:06 PM 50192]
R2 tmpreflt;tmpreflt;c:\windows\System32\drivers\tmpreflt.sys [7/18/2009 6:49 PM 36368]
R2 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [6/29/2009 6:17 PM 677128]
R3 IntcHdmiAddService;Intel® High Definition Audio HDMI;c:\windows\System32\drivers\IntcHdmi.sys [6/29/2008 9:52 AM 112128]
S2 Norton Internet Security;Norton Internet Security;"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe" /s "Norton Internet Security" /m "c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll" /prefetch:1 –> c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe [?]
S3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [4/22/2009 9:14 AM 193840]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-11-23 c:\windows\Tasks\AAntivirus.job
- c:\program files\AAntivirus\alpha.exe [2009-11-12 12:14]

2009-11-01 c:\windows\Tasks\HPCeeScheduleForOwner.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2009-04-22 18:34]

2009-11-23 c:\windows\Tasks\User_Feed_Synchronization-{F99ED7DA-E994-4A8A-AA34-3354BBE308B1}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp;=iehome&locale;=en_us&c;=91&bd;=Presario&pf;=cnnb
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-23 16:28
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\16.0.0.125\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Engine\16.0.0.125\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-11-23 16:35
ComboFix-quarantined-files.txt 2009-11-23 21:35

Pre-Run: 96,587,554,816 bytes free
Post-Run: 96,672,960,512 bytes free

- - End Of File - - 79764A4167BDB2EECE40F15019B8EAB5

CatByte

Post #4November 23, 2009, 11:41 PM UTC

Hi,

Please do the following:

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Infected_Alpha_Antivirus_t108459.html&view=findpost&p=612922#entry612922

Collect::
c:\program files\AAntivirus\alpha.exe

Folder::
c:\program files\Common Files\AAntivirusUninstall
c:\program files\AAntivirus

File::
c:\windows\Tasks\AAntivirus.job

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000000
"FirewallOverride"=dword:00000000

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you.
Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.

NEXT

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Run an on-line scan with Kaspersky

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

In your next reply please include

ComboFix Log
MBAM Log
Kaspersky report

CatByte

Post #5December 1, 2009, 12:22 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Infected with Alpha Antivirus

✨ Ask AI

Ask AI