Spyware / Malware / Virus Removal

[Resolved] I need help removing an infection

54 min read

Looking for the outcome? Ask AI

ken545

Post #16December 7, 2009, 12:21 AM UTC

Hi,

What I would like you to do is to drag Combofix to the trash and download a fresh copy, make sure you save it to your desktop.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above Rootkit::

File::
C:\Program Files\Common Files\svchost.exe
C:\WINDOWS\system32\drivers\svchost.exe


Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7c8eae6a-8382-11de-ad58-001d721c0ad3}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{eafde83c-b827-11de-ada4-001f3a08e774}]

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

You need to enable windows to show all files and folders, instructions Here

Go to VirusTotal and submit this file for analysis, just use the browse feature and then Send File, you will get a report back, post the report into this thread for me to see.

C:\load.exe <– This file

jmaxxx

Post #17December 7, 2009, 6:28 PM UTC

ComboFix 09-12-06.A3 - The User 07/12/2009 17:47.5.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.605 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\The User\Desktop\CFScript.txt

FILE ::
"c:\program files\Common Files\svchost.exe"
"c:\windows\system32\drivers\svchost.exe"
.

((((((((((((((((((((((((( Files Created from 2009-11-07 to 2009-12-07 )))))))))))))))))))))))))))))))
.

2016-04-12 01:00 . 2009-12-01 02:00 22016 —-a-w- C:\load.exe
2016-04-12 00:29 . 2016-04-12 00:46 ——– d—–w- C:\ComboFfffix
2016-04-12 00:12 . 2016-04-12 00:12 ——– d—–w- c:\documents and settings\The User\Local Settings\Application Data\Grubby Games
2009-12-03 09:38 . 2009-12-03 09:38 ——– d—–w- c:\documents and settings\The User\Application Data\Malwarebytes
2009-12-03 09:37 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 09:37 . 2009-12-03 09:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-03 09:37 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-03 09:37 . 2009-12-03 09:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-03 01:22 . 2016-04-12 00:49 ——– d—–w- c:\program files\trend micro
2009-12-03 01:22 . 2009-12-03 01:22 ——– d—–w- C:\rsit
2009-12-01 20:50 . 2009-12-01 02:00 65024 —-a-w- C:\ejikego.exe
2009-12-01 19:52 . 2009-12-01 22:43 ——– d—–w- c:\documents and settings\LocalService\Application Data\EndNote
2009-12-01 19:50 . 2009-12-01 11:35 ——– d—–w- c:\program files\My Tribe
2009-12-01 15:20 . 2009-12-01 15:20 ——– d—–w- c:\windows\Virtual Villagers - The Secret City
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\WINSETUP
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\UserData
2009-12-01 11:39 . 2009-12-01 09:15 ——– d—–w- c:\documents and settings\HelpAssistant\Tracing
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\REDIST
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\Phone Browser
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\Patch
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\NTI-Shadow
2009-12-01 11:27 . 1997-12-19 12:12 832000 —-a-r- c:\documents and settings\HelpAssistant\Ip.exe
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\HOSP
2009-12-01 11:27 . 2009-11-27 19:33 103784 —-a-w- c:\documents and settings\HelpAssistant\GoToAssistDownloadHelper.exe
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\gateway
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\ereg
2009-12-01 11:18 . 2009-12-07 17:45 ——– d—–w- c:\documents and settings\HelpAssistant
2009-12-01 02:00 . 2009-12-01 02:00 19968 —-a-w- C:\ijoe.exe
2009-11-30 17:53 . 2009-11-30 17:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Merscom
2009-11-30 17:53 . 2009-11-30 17:53 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-11-30 17:53 . 2009-12-01 11:41 ——– d-sh–w- c:\documents and settings\The User\Local Settings\Application Data\.#
2009-11-30 17:52 . 2009-11-30 17:52 ——– d—–w- c:\program files\Merscom
2009-11-30 17:21 . 2009-11-30 17:21 ——– d—–w- c:\program files\BFG
2009-11-30 16:03 . 2009-11-30 16:03 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-11-30 15:03 . 2009-11-30 15:03 ——– d—–w- c:\windows\Virtual Families
2009-11-28 14:51 . 2009-11-28 14:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-11-25 08:53 . 2009-10-26 10:21 94208 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
2009-11-25 08:53 . 2009-10-26 10:21 50176 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
2009-11-25 08:53 . 2009-10-20 13:33 545280 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\PicLensHelper.exe
2009-11-25 08:53 . 2009-10-20 13:33 4716544 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\components\cooliris.dll
2009-11-25 08:53 . 2009-10-20 13:33 344064 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\LaunchCooliris.exe
2009-11-25 08:53 . 2009-10-20 13:33 153600 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\plugins\npcoolirisplugin.dll
2009-11-25 08:53 . 2009-10-20 13:33 103424 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\pixomatic.dll
2009-11-23 17:41 . 2009-11-23 22:49 ——– d—–w- c:\documents and settings\The User\Local Settings\Application Data\rdalaw
2009-11-20 21:25 . 2009-11-20 21:25 77592 —ha-w- c:\windows\system32\mlfcache.dat
2009-11-15 21:44 . 2009-11-15 21:44 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-04-12 00:45 . 2009-02-04 13:00 ——– d—–w- c:\documents and settings\The User\Application Data\EndNote
2009-12-07 18:12 . 2008-05-03 21:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Kontiki
2009-12-05 10:04 . 2009-06-24 13:08 81984 —-a-w- c:\windows\system32\bdod.bin
2009-12-04 10:01 . 2007-08-07 22:02 ——– d—–w- c:\program files\Microsoft SQL Server
2009-12-03 01:23 . 2008-05-07 14:04 ——– d—–w- c:\documents and settings\The User\Application Data\uTorrent
2009-12-01 11:41 . 2009-03-17 16:26 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-27 19:33 . 2009-10-17 13:54 103784 —-a-w- c:\documents and settings\The User\GoToAssistDownloadHelper.exe
2009-11-23 22:19 . 2008-07-28 11:12 8224 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-11-14 16:29 . 2007-08-07 21:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-13 12:42 . 2008-04-14 19:07 ——– d—–w- c:\program files\MediaMonkey
2009-11-07 15:45 . 2008-04-02 06:41 96528 —-a-w- c:\documents and settings\The User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 15:34 . 2007-08-07 21:57 ——– d—–w- c:\program files\Microsoft Works
2009-11-07 15:13 . 2008-05-03 17:49 ——– d—–w- c:\program files\Doblon
2009-11-02 09:46 . 2009-11-02 09:43 3532 —-a-w- C:\drmHeader.bin
2009-10-22 19:02 . 2009-10-08 14:28 ——– d—–w- c:\program files\ResumeMaker
2009-10-22 18:46 . 2009-10-22 18:46 ——– d—–w- c:\program files\CV Writer
2009-10-17 13:54 . 2009-10-17 13:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Citrix
2009-10-17 11:10 . 2009-10-17 11:10 3638 —-a-r- c:\documents and settings\The User\Application Data\Microsoft\Installer\{DFC6573E-124D-4026-BFA4-B433C9D3FF21}\_2cd672ae.exe
2009-10-17 11:10 . 2009-10-17 11:10 ——– d—–w- c:\program files\Alex Feinman
2009-10-17 08:58 . 2009-10-17 08:58 1924440 —-a-w- c:\documents and settings\The User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-10-09 10:30 . 2009-10-09 10:30 264776 —-a-w- c:\windows\system32\bda5A9.tmp
2009-10-07 11:19 . 2009-10-07 11:19 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2009-09-11 18:13 . 2009-09-11 18:13 143736 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\plantasia_s1_l1_gF868T1L1_d708080832.exe
2009-09-11 14:03 . 2004-08-05 03:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-12-01 09:44 . 2008-08-13 18:02 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
2008-05-03 06:11 . 2008-05-03 06:11 48 -csha-w- c:\windows\S06D23318.tmp
.

((((((((((((((((((((((((((((( SnapShot_2009-12-03_09.13.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-07 17:44 . 2009-12-07 17:44 16384 c:\windows\Temp\Perflib_Perfdata_15c.dat
+ 2007-08-07 22:49 . 2009-12-05 09:55 91394 c:\windows\system32\perfc009.dat
- 2007-08-07 22:49 . 2009-12-03 08:53 91394 c:\windows\system32\perfc009.dat
+ 2007-08-07 22:49 . 2009-12-05 09:55 493374 c:\windows\system32\perfh009.dat
- 2007-08-07 22:49 . 2009-12-03 08:53 493374 c:\windows\system32\perfh009.dat
+ 2009-12-04 09:58 . 2009-12-04 09:58 817152 c:\windows\Installer\5eaeda.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-11-24 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Preload"="c:\windows\RUNXMLPL.exe" [2007-04-21 20480]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16132608]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-12 53248]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 138008]
"Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2007-03-02 208896]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2007-07-04 475136]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-05-28 342528]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SamsungPCSuiteTrayApplication"="c:\program files\Samsung\Samsung PC Studio 7\LaunchApplication.exe" [2008-08-07 278016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-06-24 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2007-12-04 1241088]

c:\documents and settings\The User\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-7-20 576000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2008-4-2 45056]
Update Agent.lnk - c:\program files\3\3Connect\AutoUpdateSrv.exe [2009-2-28 479232]

[HKLM\~\startupfolder\C:^Documents and Settings^The User^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=c:\documents and settings\The User\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=c:\windows\pss\Microsoft Office Groove.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^The User^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\The User\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 14:51 177440 ——w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-04-01 09:39 486856 ——w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 15:36 305440 ——w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-03-28 10:20 1079296 —-a-w- c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ——w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SamsungPCSuiteTrayApplication]
2008-08-07 17:10 278016 ——w- c:\program files\Samsung\Samsung PC Studio 7\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Huawei technologies\\Huawei UMTS Data Card\\3 USB Modem.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:limewire
"3389:TCP"= 3389:TCP:Remote Desktop

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [02/07/2008 12:07 82696]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/03/2009 00:40 55152]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [12/08/2008 17:40 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [14/08/2008 17:54 104456]
S2 BTWSp50;BTWSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\BTWSp50.sys –> c:\windows\system32\Drivers\BTWSp50.sys [?]
S3 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16/09/2008 12:03 169312]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 12:06 118784]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [13/01/2009 13:32 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [13/01/2009 13:32 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [13/01/2009 13:32 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [13/01/2009 13:32 12288]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07/05/2008 15:21 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=ZUxdm567YYGB&ptb=uG5WZHpD41TBpwebEtyzJQ
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://en.uk.acer.yahoo.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
IE: &Search
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe
AddRemove-Acer English Online Help Creator - c:\windows\IsUninst.exe -fc:\program files\Acer Inc.\Acer English Online Help Creator\Uninst.isu

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-07 18:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x85B2EF30]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7761fc3
\Driver\ACPI -> 0x85b2ef30
\Driver\atapi -> atapi.sys @ 0xf73e97b4
\Driver\iaStor -> iaStor.sys @ 0xf7435918
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
SecurityProcedure -> ntkrnlpa.exe @ 0x80582be6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
SecurityProcedure -> ntkrnlpa.exe @ 0x80582be6
NDIS: Broadcom NetLink ™ Gigabit Ethernet -> SendCompleteHandler -> 0x85b6b480
PacketIndicateHandler -> NDIS.sys @ 0xf728ca0b
SendHandler -> NDIS.sys @ 0xf72a0b31
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0950E4C1
malicious code @ sector 0x0950E4C4 !
PE file found in sector at 0x0950E4DA !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************
.
Completion time: 2009-12-07 18:14
ComboFix-quarantined-files.txt 2009-12-07 18:14
ComboFix2.txt 2009-12-03 09:18
ComboFix3.txt 2009-06-24 15:32

Pre-Run: 2,586,537,984 bytes free
Post-Run: 2,530,848,768 bytes free

- - End Of File - - 832850A6CDDD98025B8782BA9EA422C7

jmaxxx

Post #18December 7, 2009, 6:28 PM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:17:31, on 07/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.mywebsearch.com/mywebsearch/…D41TBpwebEtyzJQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://en.uk.acer.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: EndNote Web - {82D2E569-25A7-4E4D-9FA3-C5025B4B7912} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EndNote Web - {945C8270-A848-11D5-A805-00B0D092F45B} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [Preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SamsungPCSuiteTrayApplication] C:\Program Files\Samsung\Samsung PC Studio 7\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Update Agent.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Plant%20Tycoon/Images/stg_drm.ocx
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1208204733746
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Plant%20Tycoon/Images/armhelper.ocx
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

–
End of file - 12124 bytes

jmaxxx

Post #19December 7, 2009, 6:29 PM UTC

File load.exe received on 2009.12.07 18:23:50 (UTC) Antivirus Version Last Update Result a-squared 4.5.0.43 2009.12.07 - AhnLab-V3 5.0.0.2 2009.12.07 - AntiVir 7.9.1.102 2009.12.07 TR/Dropper.Gen Antiy-AVL 2.0.3.7 2009.12.07 - Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.06 - AVG 8.5.0.426 2009.12.07 - BitDefender 7.2 2009.12.07 - CAT-QuickHeal 10.00 2009.12.07 - ClamAV 0.94.1 2009.12.07 - Comodo 3103 2009.12.01 - DrWeb 5.0.0.12182 2009.12.07 - eSafe 7.0.17.0 2009.12.07 - eTrust-Vet 35.1.7162 2009.12.07 - F-Prot 4.5.1.85 2009.12.07 - F-Secure 9.0.15370.0 2009.12.07 - Fortinet 4.0.14.0 2009.12.07 - GData 19 2009.12.07 - Ikarus T3.1.1.74.0 2009.12.07 - Jiangmin 13.0.900 2009.12.02 - K7AntiVirus 7.10.913 2009.12.07 - Kaspersky 7.0.0.125 2009.12.07 - McAfee 5825 2009.12.07 - McAfee+Artemis 5825 2009.12.07 - McAfee-GW-Edition 6.8.5 2009.12.07 Trojan.Dropper.Gen Microsoft 1.5302 2009.12.07 - NOD32 4667 2009.12.07 - Norman 6.03.02 2009.12.07 - nProtect 2009.1.8.0 2009.12.07 - Panda 10.0.2.2 2009.12.06 - PCTools 7.0.3.5 2009.12.07 - Prevx 3.0 2009.12.07 - Rising 22.25.00.09 2009.12.07 - Sophos 4.48.0 2009.12.07 Mal/Scribble-C Sunbelt 3.2.1858.2 2009.12.06 - Symantec 1.4.4.12 2009.12.07 - TheHacker 6.5.0.2.086 2009.12.05 - TrendMicro 9.100.0.1001 2009.12.07 PAK_Generic.007 VBA32 3.12.12.0 2009.12.07 - ViRobot 2009.12.7.2074 2009.12.07 - VirusBuster 5.0.21.0 2009.12.07 - Additional information File size: 22016 bytes MD5…: b3d72ecc640af87f719aac59978c1f8c SHA1..: ef20cb62c577c48d3945c4694dc80016cdef7b10 SHA256: fd41998a0edb2e6f71b95aadfc8241bf6a36ff86ebbb22d41c282c3ad84dca2f ssdeep: 12:enGSGYPtRlWqduzTNBvKi6CerC7TBOGro3O:enGSJtTWhBBvKiTiGro
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp…..: 0x15294023 (Thu Apr 02 02:02:11 1981)
machinetype…….: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe 0x200 0.16 99ffb534f20f71c07c95abf8bf5bb547
.rdata 0x2000 0x5200 0x5000 0.12 eab3d78d545eef7eedcd5682c70a9a77

( 1 imports )
> KERNEL32.dll: ExitProcess

( 0 exports )
RDS…: NSRL Reference Data Set
- pdfid.: - trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%) sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned
Antivirus Version Last Update Result a-squared 4.5.0.43 2009.12.07 - AhnLab-V3 5.0.0.2 2009.12.07 - AntiVir 7.9.1.102 2009.12.07 TR/Dropper.Gen Antiy-AVL 2.0.3.7 2009.12.07 - Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.06 - AVG 8.5.0.426 2009.12.07 - BitDefender 7.2 2009.12.07 - CAT-QuickHeal 10.00 2009.12.07 - ClamAV 0.94.1 2009.12.07 - Comodo 3103 2009.12.01 - DrWeb 5.0.0.12182 2009.12.07 - eSafe 7.0.17.0 2009.12.07 - eTrust-Vet 35.1.7162 2009.12.07 - F-Prot 4.5.1.85 2009.12.07 - F-Secure 9.0.15370.0 2009.12.07 - Fortinet 4.0.14.0 2009.12.07 - GData 19 2009.12.07 - Ikarus T3.1.1.74.0 2009.12.07 - Jiangmin 13.0.900 2009.12.02 - K7AntiVirus 7.10.913 2009.12.07 - Kaspersky 7.0.0.125 2009.12.07 - McAfee 5825 2009.12.07 - McAfee+Artemis 5825 2009.12.07 - McAfee-GW-Edition 6.8.5 2009.12.07 Trojan.Dropper.Gen Microsoft 1.5302 2009.12.07 - NOD32 4667 2009.12.07 - Norman 6.03.02 2009.12.07 - nProtect 2009.1.8.0 2009.12.07 - Panda 10.0.2.2 2009.12.06 - PCTools 7.0.3.5 2009.12.07 - Prevx 3.0 2009.12.07 - Rising 22.25.00.09 2009.12.07 - Sophos 4.48.0 2009.12.07 Mal/Scribble-C Sunbelt 3.2.1858.2 2009.12.06 - Symantec 1.4.4.12 2009.12.07 - TheHacker 6.5.0.2.086 2009.12.05 - TrendMicro 9.100.0.1001 2009.12.07 PAK_Generic.007 VBA32 3.12.12.0 2009.12.07 - ViRobot 2009.12.7.2074 2009.12.07 - VirusBuster 5.0.21.0 2009.12.07 - Additional information File size: 22016 bytes MD5…: b3d72ecc640af87f719aac59978c1f8c SHA1..: ef20cb62c577c48d3945c4694dc80016cdef7b10 SHA256: fd41998a0edb2e6f71b95aadfc8241bf6a36ff86ebbb22d41c282c3ad84dca2f ssdeep: 12:enGSGYPtRlWqduzTNBvKi6CerC7TBOGro3O:enGSJtTWhBBvKiTiGro
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1000
timedatestamp…..: 0x15294023 (Thu Apr 02 02:02:11 1981)
machinetype…….: 0x14c (I386)

( 2 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0xe 0x200 0.16 99ffb534f20f71c07c95abf8bf5bb547
.rdata 0x2000 0x5200 0x5000 0.12 eab3d78d545eef7eedcd5682c70a9a77

( 1 imports )
> KERNEL32.dll: ExitProcess

( 0 exports )
RDS…: NSRL Reference Data Set
- pdfid.: - trid..: Win32 Executable Generic (68.0%)
Generic Win/DOS Executable (15.9%)
DOS Executable Generic (15.9%) sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned

ken545

Post #20December 7, 2009, 6:47 PM UTC

Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\ijoe.exe
C:\load.exe
c:\windows\system32\bda5A9.tmp
c:\windows\S06D23318.tmp


Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\drivers\\svchost.exe"=-

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

I am concerned about this, go ahead an run the CF script and in the meantime I will be looking into this
malicious code @ sector 0x0950E4C4 !

jmaxxx

Post #21December 8, 2009, 11:11 AM UTC

ComboFix 09-12-06.A3 - The User 08/12/2009 10:34.6.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.606 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\The User\Desktop\CFScript.txt

FILE ::
"C:\ijoe.exe"
"C:\load.exe"
"c:\windows\S06D23318.tmp"
"c:\windows\system32\bda5A9.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ijoe.exe
C:\load.exe
c:\windows\S06D23318.tmp
c:\windows\system32\bda5A9.tmp

.
((((((((((((((((((((((((( Files Created from 2009-11-08 to 2009-12-08 )))))))))))))))))))))))))))))))
.

2016-04-12 00:29 . 2016-04-12 00:46 ——– d—–w- C:\ComboFfffix
2016-04-12 00:12 . 2016-04-12 00:12 ——– d—–w- c:\documents and settings\The User\Local Settings\Application Data\Grubby Games
2009-12-03 09:38 . 2009-12-03 09:38 ——– d—–w- c:\documents and settings\The User\Application Data\Malwarebytes
2009-12-03 09:37 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 09:37 . 2009-12-03 09:37 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-12-03 09:37 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-03 09:37 . 2009-12-03 09:38 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-03 01:22 . 2016-04-12 00:49 ——– d—–w- c:\program files\trend micro
2009-12-03 01:22 . 2009-12-03 01:22 ——– d—–w- C:\rsit
2009-12-01 20:50 . 2009-12-01 02:00 65024 —-a-w- C:\ejikego.exe
2009-12-01 19:52 . 2009-12-01 22:43 ——– d—–w- c:\documents and settings\LocalService\Application Data\EndNote
2009-12-01 19:50 . 2009-12-01 11:35 ——– d—–w- c:\program files\My Tribe
2009-12-01 15:20 . 2009-12-01 15:20 ——– d—–w- c:\windows\Virtual Villagers - The Secret City
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\WINSETUP
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\UserData
2009-12-01 11:39 . 2009-12-01 09:15 ——– d—–w- c:\documents and settings\HelpAssistant\Tracing
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\REDIST
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\Phone Browser
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\Patch
2009-12-01 11:39 . 2009-12-01 11:39 ——– d—–w- c:\documents and settings\HelpAssistant\NTI-Shadow
2009-12-01 11:27 . 1997-12-19 12:12 832000 —-a-r- c:\documents and settings\HelpAssistant\Ip.exe
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\HOSP
2009-12-01 11:27 . 2009-11-27 19:33 103784 —-a-w- c:\documents and settings\HelpAssistant\GoToAssistDownloadHelper.exe
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\gateway
2009-12-01 11:27 . 2009-12-01 11:27 ——– d—–w- c:\documents and settings\HelpAssistant\ereg
2009-12-01 11:18 . 2009-12-08 10:31 ——– d—–w- c:\documents and settings\HelpAssistant
2009-11-30 17:53 . 2009-11-30 17:53 ——– d—–w- c:\documents and settings\All Users\Application Data\Merscom
2009-11-30 17:53 . 2009-11-30 17:53 ——– d—–w- c:\program files\Common Files\SWF Studio
2009-11-30 17:53 . 2009-12-01 11:41 ——– d-sh–w- c:\documents and settings\The User\Local Settings\Application Data\.#
2009-11-30 17:52 . 2009-11-30 17:52 ——– d—–w- c:\program files\Merscom
2009-11-30 17:21 . 2009-11-30 17:21 ——– d—–w- c:\program files\BFG
2009-11-30 16:03 . 2009-11-30 16:03 ——– d—–w- c:\documents and settings\All Users\Application Data\BigFishGamesCache
2009-11-30 15:03 . 2009-11-30 15:03 ——– d—–w- c:\windows\Virtual Families
2009-11-28 14:51 . 2009-11-28 14:51 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-11-25 08:53 . 2009-10-26 10:21 94208 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayAccessComponent.dll
2009-11-25 08:53 . 2009-10-26 10:21 50176 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\ebayShortcutMaker.dll
2009-11-25 08:53 . 2009-10-20 13:33 545280 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\PicLensHelper.exe
2009-11-25 08:53 . 2009-10-20 13:33 4716544 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\components\cooliris.dll
2009-11-25 08:53 . 2009-10-20 13:33 344064 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\LaunchCooliris.exe
2009-11-25 08:53 . 2009-10-20 13:33 153600 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\plugins\npcoolirisplugin.dll
2009-11-25 08:53 . 2009-10-20 13:33 103424 —-a-w- c:\documents and settings\The User\Application Data\Mozilla\Firefox\Profiles\qftgx7ko.default\extensions\[removed]\libs\pixomatic.dll
2009-11-23 17:41 . 2009-11-23 22:49 ——– d—–w- c:\documents and settings\The User\Local Settings\Application Data\rdalaw
2009-11-20 21:25 . 2009-11-20 21:25 77592 —ha-w- c:\windows\system32\mlfcache.dat
2009-11-15 21:44 . 2009-11-15 21:44 ——– d–h–w- c:\windows\PIF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2016-04-12 00:45 . 2009-02-04 13:00 ——– d—–w- c:\documents and settings\The User\Application Data\EndNote
2009-12-08 10:58 . 2008-05-03 21:42 ——– d—–w- c:\documents and settings\All Users\Application Data\Kontiki
2009-12-05 10:04 . 2009-06-24 13:08 81984 —-a-w- c:\windows\system32\bdod.bin
2009-12-04 10:01 . 2007-08-07 22:02 ——– d—–w- c:\program files\Microsoft SQL Server
2009-12-03 01:23 . 2008-05-07 14:04 ——– d—–w- c:\documents and settings\The User\Application Data\uTorrent
2009-12-01 11:41 . 2009-03-17 16:26 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-11-27 19:33 . 2009-10-17 13:54 103784 —-a-w- c:\documents and settings\The User\GoToAssistDownloadHelper.exe
2009-11-23 22:19 . 2008-07-28 11:12 8224 —-a-w- c:\windows\system32\GDIPFONTCACHEV1.DAT
2009-11-14 16:29 . 2007-08-07 21:58 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-11-13 12:42 . 2008-04-14 19:07 ——– d—–w- c:\program files\MediaMonkey
2009-11-07 15:45 . 2008-04-02 06:41 96528 —-a-w- c:\documents and settings\The User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-07 15:34 . 2007-08-07 21:57 ——– d—–w- c:\program files\Microsoft Works
2009-11-07 15:13 . 2008-05-03 17:49 ——– d—–w- c:\program files\Doblon
2009-11-02 09:46 . 2009-11-02 09:43 3532 —-a-w- C:\drmHeader.bin
2009-10-22 19:02 . 2009-10-08 14:28 ——– d—–w- c:\program files\ResumeMaker
2009-10-22 18:46 . 2009-10-22 18:46 ——– d—–w- c:\program files\CV Writer
2009-10-17 13:54 . 2009-10-17 13:54 ——– d—–w- c:\documents and settings\All Users\Application Data\Citrix
2009-10-17 11:10 . 2009-10-17 11:10 3638 —-a-r- c:\documents and settings\The User\Application Data\Microsoft\Installer\{DFC6573E-124D-4026-BFA4-B433C9D3FF21}\_2cd672ae.exe
2009-10-17 11:10 . 2009-10-17 11:10 ——– d—–w- c:\program files\Alex Feinman
2009-10-17 08:58 . 2009-10-17 08:58 1924440 —-a-w- c:\documents and settings\The User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-10-07 11:19 . 2009-10-07 11:19 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.1.8\SetupAdmin.exe
2009-09-11 18:13 . 2009-09-11 18:13 143736 —-a-w- c:\documents and settings\All Users\Application Data\BigFishGamesCache\Upgrade\stub\plantasia_s1_l1_gF868T1L1_d708080832.exe
2009-09-11 14:03 . 2004-08-05 03:00 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-12-01 09:44 . 2008-08-13 18:02 65536 —-a-w- c:\program files\mozilla firefox\components\FFComm.dll
.

((((((((((((((((((((((((((((( SnapShot_2009-12-03_09.13.33 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-12-08 10:31 . 2009-12-08 10:31 16384 c:\windows\Temp\Perflib_Perfdata_2d0.dat
+ 2007-08-07 22:49 . 2009-12-05 09:55 91394 c:\windows\system32\perfc009.dat
- 2007-08-07 22:49 . 2009-12-03 08:53 91394 c:\windows\system32\perfc009.dat
+ 2007-08-07 22:49 . 2009-12-05 09:55 493374 c:\windows\system32\perfh009.dat
- 2007-08-07 22:49 . 2009-12-03 08:53 493374 c:\windows\system32\perfh009.dat
+ 2009-12-04 09:58 . 2009-12-04 09:58 817152 c:\windows\Installer\5eaeda.msi
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2008-11-24 2356088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Preload"="c:\windows\RUNXMLPL.exe" [2007-04-21 20480]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-28 16132608]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-06-12 53248]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-05 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-05 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-05 455168]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-01-08 68640]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-13 142104]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-13 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-13 138008]
"Acer ePresentation HPD"="c:\acer\Empowering Technology\ePresentation\ePresentation.exe" [2007-03-02 208896]
"ePower_DMC"="c:\acer\Empowering Technology\ePower\ePower_DMC.exe" [2007-07-04 475136]
"Boot"="c:\acer\Empowering Technology\ePower\Boot.exe" [2006-03-15 579584]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-05-28 342528]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2007-07-11 421888]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2007-10-17 858632]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"SamsungPCSuiteTrayApplication"="c:\program files\Samsung\Samsung PC Studio 7\LaunchApplication.exe" [2008-08-07 278016]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"BDAgent"="c:\program files\BitDefender\BitDefender 2009\bdagent.exe" [2009-11-12 782336]
"BitDefender Antiphishing Helper"="c:\program files\BitDefender\BitDefender 2009\IEShow.exe" [2009-06-24 69632]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-05 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096]
"Samsung.PCSync"="c:\program files\Samsung\Samsung PC Studio 7\PcSync2.exe" [2007-12-04 1241088]

c:\documents and settings\The User\Start Menu\Programs\Startup\
MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2009-7-20 576000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acer Empowering Technology.lnk - c:\acer\Empowering Technology\Acer.Empowering.Framework.Launcher.exe [2008-4-2 45056]
Update Agent.lnk - c:\program files\3\3Connect\AutoUpdateSrv.exe [2009-2-28 479232]

[HKLM\~\startupfolder\C:^Documents and Settings^The User^Start Menu^Programs^Startup^Microsoft Office Groove.lnk]
path=c:\documents and settings\The User\Start Menu\Programs\Startup\Microsoft Office Groove.lnk
backup=c:\windows\pss\Microsoft Office Groove.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^The User^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\The User\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]
2009-08-13 14:51 177440 ——w- c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-04-01 09:39 486856 ——w- c:\program files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-09-21 15:36 305440 ——w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2008-03-28 10:20 1079296 —-a-w- c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ——w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SamsungPCSuiteTrayApplication]
2008-08-07 17:10 278016 ——w- c:\program files\Samsung\Samsung PC Studio 7\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 7.0.1.321\\English\\setup.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Huawei technologies\\Huawei UMTS Data Card\\3 USB Modem.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6346:TCP"= 6346:TCP:limewire
"3389:TCP"= 3389:TCP:Remote Desktop

R2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2009\BDVEDISK.sys [02/07/2008 12:07 82696]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [18/03/2009 00:40 55152]
R3 bdfm;BDFM;c:\windows\system32\drivers\bdfm.sys [12/08/2008 17:40 111112]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [14/08/2008 17:54 104456]
S2 BTWSp50;BTWSp50 NDIS Protocol Driver;c:\windows\system32\Drivers\BTWSp50.sys –> c:\windows\system32\Drivers\BTWSp50.sys [?]
S3 AdobeActiveFileMonitor7.0;Adobe Active File Monitor V7;c:\program files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe [16/09/2008 12:03 169312]
S3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe [17/07/2008 12:06 118784]
S3 fsssvc;Windows Live Family Safety;c:\program files\Windows Live\Family Safety\fsssvc.exe [06/02/2009 18:08 533360]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [13/01/2009 13:32 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [13/01/2009 13:32 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [13/01/2009 13:32 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [13/01/2009 13:32 12288]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [07/05/2008 15:21 717296]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bdx REG_MULTI_SZ scan
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.mywebsearch.com/mywebsearch/default.jhtml?ptnrS=ZUxdm567YYGB&ptb=uG5WZHpD41TBpwebEtyzJQ
uSearchMigratedDefaultURL = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
uInternet Connection Wizard,ShellNext = hxxp://en.uk.acer.yahoo.com/
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
IE: &Search
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
FF - ProfilePath -
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-08 10:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x85B26F30]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf7761fc3
\Driver\ACPI -> 0x85b26f30
\Driver\atapi -> atapi.sys @ 0xf73e97b4
\Driver\iaStor -> iaStor.sys @ 0xf7435918
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
SecurityProcedure -> ntkrnlpa.exe @ 0x80582be6
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80582544
SecurityProcedure -> ntkrnlpa.exe @ 0x80582be6
NDIS: Broadcom NetLink ™ Gigabit Ethernet -> SendCompleteHandler -> 0x85b63480
PacketIndicateHandler -> NDIS.sys @ 0xf728ca0b
SendHandler -> NDIS.sys @ 0xf72a0b31
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0950E4C1
malicious code @ sector 0x0950E4C4 !
PE file found in sector at 0x0950E4DA !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************
.
Completion time: 2009-12-08 11:01
ComboFix-quarantined-files.txt 2009-12-08 11:00
ComboFix2.txt 2009-12-07 18:14
ComboFix3.txt 2009-12-03 09:18
ComboFix4.txt 2009-06-24 15:32

Pre-Run: 2,493,349,888 bytes free
Post-Run: 2,435,092,480 bytes free

- - End Of File - - B633FADE10C80AFF3D90086ADAFC741F

jmaxxx

Post #22December 8, 2009, 11:13 AM UTC

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:04:13, on 08/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16915)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Kontiki\KService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.mywebsearch.com/mywebsearch/…D41TBpwebEtyzJQ
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://en.uk.acer.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: EndNote Web - {82D2E569-25A7-4E4D-9FA3-C5025B4B7912} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\WINDOWS\system32\eDStoolbar.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EndNote Web - {945C8270-A848-11D5-A805-00B0D092F45B} - C:\Program Files\EndNote Web\ENWIEPlug.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2009\IEToolbar.dll
O4 - HKLM\..\Run: [Preload] C:\Windows\RUNXMLPL.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Acer ePresentation HPD] C:\Acer\Empowering Technology\ePresentation\ePresentation.exe
O4 - HKLM\..\Run: [ePower_DMC] C:\Acer\Empowering Technology\ePower\ePower_DMC.exe
O4 - HKLM\..\Run: [Boot] C:\Acer\Empowering Technology\ePower\Boot.exe
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SamsungPCSuiteTrayApplication] C:\Program Files\Samsung\Samsung PC Studio 7\LaunchApplication.exe -startup
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\BitDefender\BitDefender 2009\bdagent.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2009\IEShow.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Global Startup: Acer Empowering Technology.lnk = ?
O4 - Global Startup: Update Agent.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Plant%20Tycoon/Images/stg_drm.ocx
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1208204733746
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Plant%20Tycoon/Images/armhelper.ocx
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Adobe Active File Monitor V7 (AdobeActiveFileMonitor7.0) - Adobe Systems Incorporated - C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: BitDefender Arrakis Server (Arrakis3) - BitDefender S.R.L. http://www.bitdefender.com - C:\Program Files\Common Files\BitDefender\BitDefender Arrakis Server\bin\Arrakis3.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: eLock Service (eLockService) - - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Imapi Helper - Alex Feinman - C:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S. R. L. - C:\Program Files\BitDefender\BitDefender 2009\vsserv.exe

–
End of file - 12124 bytes

jmaxxx

Post #23December 8, 2009, 11:18 AM UTC

My computer is running a lot faster. Thanks!

ken545

Post #24December 8, 2009, 12:04 PM UTC

Hi,

Your MBR (Master Boot Record ) is fine , just a couple of files related to it have to be replaced.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
iastor.sys
atapi.sys
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

jmaxxx

Post #25December 8, 2009, 10:05 PM UTC

ISystemLook v1.0 by jpshortstuff (29.08.09) Log created at 22:00 on 08/12/2009 by The User (Administrator - Elevation successful) ========== filefind ========== Searching for "iastor.sys" C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys –a–c 381720 bytes [19:59 21/03/2007] [19:59 21/03/2007] 9D7ED4275702E2FC409F2CC563245740 C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys –a–c 304920 bytes [19:58 21/03/2007] [19:58 21/03/2007] 997E8F5939F2D12CD9F2E6B395724C16 C:\WINDOWS\system32\drivers\iaStor.sys –a— 304920 bytes [19:58 21/03/2007] [19:58 21/03/2007] 997E8F5939F2D12CD9F2E6B395724C16 C:\WINDOWS\system32\ReinstallBackups\0013\DriverFiles\iaStor.sys –a–c 304920 bytes [19:58 21/03/2007] [19:58 21/03/2007] 997E8F5939F2D12CD9F2E6B395724C16 Searching for "atapi.sys" C:\WINDOWS\ERDNT\cache\atapi.sys –a— 95360 bytes [09:16 03/12/2009] [05:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\atapi.sys –a–c 96512 bytes [15:13 18/09/2008] [18:40 13/04/2008] 9F3A2F5AA6875C72BF062C712CFA2674 C:\WINDOWS\system32\dllcache\atapi.sys –a— 95360 bytes [05:59 04/08/2004] [05:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 C:\WINDOWS\system32\drivers\atapi.sys —— 95360 bytes [05:59 04/08/2004] [05:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 C:\WINDOWS\system32\ReinstallBackups\0005\DriverFiles\i386\atapi.sys –a–c 95360 bytes [05:59 04/08/2004] [05:59 04/08/2004] CDFE4411A69C224BD1D11B2DA92DAC51 -=End Of File=-

jmaxxx

Post #26December 8, 2009, 10:08 PM UTC

I have just identfied some malware C:\ejikego.exe will combofix remove this? Thanks again! File ejikego.exe received on 2009.12.08 21:15:06 (UTC) Antivirus Version Last Update Result a-squared 4.5.0.43 2009.12.08 Packed.Win32.Krap!IK AhnLab-V3 5.0.0.2 2009.12.08 Win-Trojan/Zbot.65024.Q AntiVir 7.9.1.102 2009.12.08 TR/Agent.AH.193 Antiy-AVL 2.0.3.7 2009.12.08 Packed/Win32.Krap.gen Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.08 Win32:Malware-gen AVG 8.5.0.426 2009.12.08 Generic15.BYJA BitDefender 7.2 2009.12.08 - CAT-QuickHeal 10.00 2009.12.08 Trojan.Krap.ah ClamAV 0.94.1 2009.12.08 - Comodo 3103 2009.12.01 - DrWeb 5.0.0.12182 2009.12.08 Trojan.PWS.Panda.114 eSafe 7.0.17.0 2009.12.08 Win32.PWSZbot.Pg eTrust-Vet 35.1.7165 2009.12.08 - F-Prot 4.5.1.85 2009.12.08 - F-Secure 9.0.15370.0 2009.12.07 Suspicious:W32/Malware!Online Fortinet 4.0.14.0 2009.12.08 W32/Krap.AH GData 19 2009.12.08 Win32:Malware-gen Ikarus T3.1.1.74.0 2009.12.08 Packed.Win32.Krap Jiangmin 13.0.900 2009.12.02 - K7AntiVirus 7.10.915 2009.12.08 Packed.Win32.Krap.ah Kaspersky 7.0.0.125 2009.12.08 Packed.Win32.Krap.ah McAfee 5826 2009.12.08 - McAfee+Artemis 5826 2009.12.08 Artemis!E087BB90DC9B McAfee-GW-Edition 6.8.5 2009.12.08 Trojan.Agent.AH.193 Microsoft 1.5302 2009.12.08 PWS:Win32/Zbot.PG NOD32 4671 2009.12.08 a variant of Win32/Kryptik.BCR Norman 6.03.02 2009.12.08 - nProtect 2009.1.8.0 2009.12.08 - Panda 10.0.2.2 2009.12.08 Trj/Zlob.KH PCTools 7.0.3.5 2009.12.08 Trojan-PSW.Banker Prevx 3.0 2009.12.08 Medium Risk Malware Rising 22.25.01.09 2009.12.08 Packer.Win32.Agent.GEN Sophos 4.48.0 2009.12.08 Mal/EncPk-LT Sunbelt 3.2.1858.2 2009.12.08 Trojan.Win32.Generic!BT Symantec 1.4.4.12 2009.12.08 Infostealer.Banker.C TheHacker 6.5.0.2.088 2009.12.07 - TrendMicro 9.100.0.1001 2009.12.08 TSPY_ZBOT.CID VBA32 3.12.12.0 2009.12.08 - ViRobot 2009.12.8.2076 2009.12.08 Trojan.Win32.Krap.65024.E VirusBuster 5.0.21.0 2009.12.08 Trojan.Agent.QSTX Additional information File size: 65024 bytes MD5…: e087bb90dc9b261fe992bc1936e6003e SHA1..: 4f11d20cfddc9b364df61517507573a7cc169fa0 SHA256: b63bfc301e8534ba93bdf8f913a81c56f138dcfdd86e26ff6949b6bd096e4125 ssdeep: 1536:feTpOIkNONd3ZeXzP4u/mlKodDs63fQkIPuHE0ud:29RkMNdJjsmlTdD5fQ
kIHBd
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3a87
timedatestamp…..: 0x460f1007 (Sun Apr 01 01:51:03 2007)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2bd8 0x2c00 7.92 584f72ab5a1452ebbc8f40470e53d5d1
.data 0x4000 0x11ce 0x600 4.23 473433a78eaab2577b27b3d64f9bf8da
.idata 0x6000 0x139bd 0xc600 7.98 14842e3f02f3784f21f7a73477352386

( 6 imports )
> KERNEL32.DLL: ReadFile, SetStdHandle, GetFileSize, GlobalFree, GetACP, RaiseException, GetStartupInfoA, lstrlenW, CreateThread, HeapAlloc, GetFileType, GetStdHandle, GetCommandLineW, SetFileTime, ExitProcess, GetEnvironmentStrings, WriteConsoleA, VirtualProtect, GetCurrentThreadId, WideCharToMultiByte, GetLocalTime, UnhandledExceptionFilter, GetLocaleInfoA, GetTickCount, LocalFree, GlobalAlloc, GetCommandLineA, Sleep, LoadLibraryA, InitializeCriticalSection, SetConsoleCP, IsValidLocale, GetModuleHandleA, GetTempFileNameW, GetEnvironmentStringsW, GetOEMCP
> MSVCRT.DLL: _XcptFilter, isdigit, _wtoi, _amsg_exit
> ADVAPI32.DLL: RegQueryValueExA, RegQueryInfoKeyW, EqualSid
> LZ32.DLL: LZClose
> OLE32.DLL: CoCancelCall
> USER32.DLL: RegisterClassW, GetCursorPos

( 0 exports )
RDS…: NSRL Reference Data Set
- pdfid.: - trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=e087bb90dc9b261fe992bc1936e6003e' target='_blank'>http://www.threatexpert.com/report.aspx?md5=e087bb90dc9b261fe992bc1936e6003e</a> sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=906A5328006BF647FE3D00AC95799700AAC12722' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=906A5328006BF647FE3D00AC95799700AAC12722</a> Antivirus Version Last Update Result a-squared 4.5.0.43 2009.12.08 Packed.Win32.Krap!IK AhnLab-V3 5.0.0.2 2009.12.08 Win-Trojan/Zbot.65024.Q AntiVir 7.9.1.102 2009.12.08 TR/Agent.AH.193 Antiy-AVL 2.0.3.7 2009.12.08 Packed/Win32.Krap.gen Authentium 5.2.0.5 2009.12.02 - Avast 4.8.1351.0 2009.12.08 Win32:Malware-gen AVG 8.5.0.426 2009.12.08 Generic15.BYJA BitDefender 7.2 2009.12.08 - CAT-QuickHeal 10.00 2009.12.08 Trojan.Krap.ah ClamAV 0.94.1 2009.12.08 - Comodo 3103 2009.12.01 - DrWeb 5.0.0.12182 2009.12.08 Trojan.PWS.Panda.114 eSafe 7.0.17.0 2009.12.08 Win32.PWSZbot.Pg eTrust-Vet 35.1.7165 2009.12.08 - F-Prot 4.5.1.85 2009.12.08 - F-Secure 9.0.15370.0 2009.12.07 Suspicious:W32/Malware!Online Fortinet 4.0.14.0 2009.12.08 W32/Krap.AH GData 19 2009.12.08 Win32:Malware-gen Ikarus T3.1.1.74.0 2009.12.08 Packed.Win32.Krap Jiangmin 13.0.900 2009.12.02 - K7AntiVirus 7.10.915 2009.12.08 Packed.Win32.Krap.ah Kaspersky 7.0.0.125 2009.12.08 Packed.Win32.Krap.ah McAfee 5826 2009.12.08 - McAfee+Artemis 5826 2009.12.08 Artemis!E087BB90DC9B McAfee-GW-Edition 6.8.5 2009.12.08 Trojan.Agent.AH.193 Microsoft 1.5302 2009.12.08 PWS:Win32/Zbot.PG NOD32 4671 2009.12.08 a variant of Win32/Kryptik.BCR Norman 6.03.02 2009.12.08 - nProtect 2009.1.8.0 2009.12.08 - Panda 10.0.2.2 2009.12.08 Trj/Zlob.KH PCTools 7.0.3.5 2009.12.08 Trojan-PSW.Banker Prevx 3.0 2009.12.08 Medium Risk Malware Rising 22.25.01.09 2009.12.08 Packer.Win32.Agent.GEN Sophos 4.48.0 2009.12.08 Mal/EncPk-LT Sunbelt 3.2.1858.2 2009.12.08 Trojan.Win32.Generic!BT Symantec 1.4.4.12 2009.12.08 Infostealer.Banker.C TheHacker 6.5.0.2.088 2009.12.07 - TrendMicro 9.100.0.1001 2009.12.08 TSPY_ZBOT.CID VBA32 3.12.12.0 2009.12.08 - ViRobot 2009.12.8.2076 2009.12.08 Trojan.Win32.Krap.65024.E VirusBuster 5.0.21.0 2009.12.08 Trojan.Agent.QSTX Additional information File size: 65024 bytes MD5…: e087bb90dc9b261fe992bc1936e6003e SHA1..: 4f11d20cfddc9b364df61517507573a7cc169fa0 SHA256: b63bfc301e8534ba93bdf8f913a81c56f138dcfdd86e26ff6949b6bd096e4125 ssdeep: 1536:feTpOIkNONd3ZeXzP4u/mlKodDs63fQkIPuHE0ud:29RkMNdJjsmlTdD5fQ
kIHBd
PEiD..: - PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x3a87
timedatestamp…..: 0x460f1007 (Sun Apr 01 01:51:03 2007)
machinetype…….: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x2bd8 0x2c00 7.92 584f72ab5a1452ebbc8f40470e53d5d1
.data 0x4000 0x11ce 0x600 4.23 473433a78eaab2577b27b3d64f9bf8da
.idata 0x6000 0x139bd 0xc600 7.98 14842e3f02f3784f21f7a73477352386

( 6 imports )
> KERNEL32.DLL: ReadFile, SetStdHandle, GetFileSize, GlobalFree, GetACP, RaiseException, GetStartupInfoA, lstrlenW, CreateThread, HeapAlloc, GetFileType, GetStdHandle, GetCommandLineW, SetFileTime, ExitProcess, GetEnvironmentStrings, WriteConsoleA, VirtualProtect, GetCurrentThreadId, WideCharToMultiByte, GetLocalTime, UnhandledExceptionFilter, GetLocaleInfoA, GetTickCount, LocalFree, GlobalAlloc, GetCommandLineA, Sleep, LoadLibraryA, InitializeCriticalSection, SetConsoleCP, IsValidLocale, GetModuleHandleA, GetTempFileNameW, GetEnvironmentStringsW, GetOEMCP
> MSVCRT.DLL: _XcptFilter, isdigit, _wtoi, _amsg_exit
> ADVAPI32.DLL: RegQueryValueExA, RegQueryInfoKeyW, EqualSid
> LZ32.DLL: LZClose
> OLE32.DLL: CoCancelCall
> USER32.DLL: RegisterClassW, GetCursorPos

( 0 exports )
RDS…: NSRL Reference Data Set
- pdfid.: - trid..: Win32 Executable Generic (42.3%)
Win32 Dynamic Link Library (generic) (37.6%)
Generic Win/DOS Executable (9.9%)
DOS Executable Generic (9.9%)
Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%) ThreatExpert info: <a href='http://www.threatexpert.com/report.aspx?md5=e087bb90dc9b261fe992bc1936e6003e' target='_blank'>http://www.threatexpert.com/report.aspx?md5=e087bb90dc9b261fe992bc1936e6003e</a> sigcheck:
publisher….: n/a
copyright….: n/a
product……: n/a
description..: n/a
original name: n/a
internal name: n/a
file version.: n/a
comments…..: n/a
signers……: -
signing date.: -
verified…..: Unsigned
<a href='http://info.prevx.com/aboutprogramtext.asp?PX5=906A5328006BF647FE3D00AC95799700AAC12722' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=906A5328006BF647FE3D00AC95799700AAC12722</a>

ken545

Post #27December 8, 2009, 10:41 PM UTC

Yep, I was concerned about your MBR and missed that….good call

Please download OTM by OldTimer.

Save it to your desktop.
Please click OTM and then click >> run.
Copy the lines inside the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

:Processes
explorer.exe

:Services

:Reg

:Files
C:\ejikego.exe


:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Return to OTM, right click in the "Paste Instructions for items to be Moved" window (under the yellow bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTM

Note: If an item cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

I am looking over your System look log, be back in a bit

jmaxxx

Post #28December 8, 2009, 11:25 PM UTC

All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== SERVICES/DRIVERS ========== ========== REGISTRY ========== ========== FILES ========== C:\ejikego.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 208896 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: Guest ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 78991 bytes ->FireFox cache emptied: 2183228 bytes User: HelpAssistant ->Temp folder emptied: 60407182 bytes ->Temporary Internet Files folder emptied: 12591436 bytes ->Java cache emptied: 12877691 bytes ->FireFox cache emptied: 62499853 bytes ->Apple Safari cache emptied: 160951 bytes User: LocalService ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 88134 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: The User ->Temp folder emptied: 990679 bytes ->Temporary Internet Files folder emptied: 16923133 bytes ->Java cache emptied: 17471721 bytes ->FireFox cache emptied: 36144798 bytes ->Apple Safari cache emptied: 160951 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 3432977 bytes Windows Temp folder emptied: 344620 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 11670784 bytes RecycleBin emptied: 7392800 bytes Total Files Cleaned = 234.38 mb OTM by OldTimer - Version 3.1.2.2 log created on 12082009_224535 Files moved on Reboot… File move failed. C:\WINDOWS\temp\$$$dq3e scheduled to be moved on reboot. File move failed. C:\WINDOWS\temp\$67we.$ scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_d08.dat moved successfully. Registry entries deleted on Reboot…

ken545

Post #29December 8, 2009, 11:49 PM UTC

Great

We are dealing with the MBR, be back in a bit with a fix

ken545

Post #30December 9, 2009, 1:11 AM UTC last edited December 9, 2009, 8:58 AM UTC

Take your time and read through this

Copy all the text in the quote box and save it as Fix.bat to Notepad, as file type save it as All Files and save it to your desktop, then click on Fix.bat to run

@echo off
copy "C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\IaStor.sys" c:\iastor.sys
copy "C:\WINDOWS\ERDNT\cache\atapi.sys" c:\atapi.sys
exit

Now we need to boot to the Recovery Console

1. Reboot your computer and as Windows starts it will present you with your startup options for exactly two seconds - you'll have to be quick - which in your case will be Microsoft Windows XP Professional and Microsoft Windows Recovery Console

2. With the arrows keys on your keyboard select the option listed as Microsoft Windows Recovery Console and press the enter key on your keyboard.

3. The Recovery Console will start and ask you which Windows installation you would like to log on to. If you have multiple Windows installations, it will list each one, and you would enter the number associated with the installation you would like to work on and press enter. If you have just one Windows installation, type 1 and press enter.

4. It will then prompt you for the Administrator's password. If there is no password, simply press enter. Otherwise type in the password and then press enter.

5. You should now be presented with a C:\Windows> prompt

At that prompt, type in the following bolded text:

cd system32\drivers

Press Enter (you should now be at C:\windows\system32\drivers> prompt)

ren atapi.sys atapi.old

Press Enter - If you receive a message similar to 'invalid parameter or bad command, ensure you have a space between ren and atapi.sys and another space between atapi.sys and atapi.old

Next, type in the following bolded text:

ren iastor.sys iastor.old

Press Enter

Next type in the following

copy c:\atapi.sys c:\windows\system32\drivers\atapi.sys

You should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.

If you did see '1 file copied', continue with the next command:

copy c:\iastor.sys c:\windows\system32\drivers\iastor.sys

Press Enter.

Again, you should see a message '1 file copied'. If you did not see that message, try again and ensure there is a space after the word copy and another space between the file paths.

If you did see '1 file copied', type in exit, press Enter, and the system will reboot.

Let me know how it went ??

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] I need help removing an infection

✨ Ask AI

Ask AI