I got trojan not sure where. I noticed my computer would run slow and I usually run Spybot S&D every couple of days. This time it found trojan. I tried to fix it but at the start-up it says missing .dll files and computer still runs slow. It won't let me do system restore in safe mode. I did HIJackThis and these are results:
Did Malwarebytes
Malwarebytes' Anti-Malware 1.43
Database version: 3485
Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13
1/2/2010 8:30:14 PM
mbam-log-2010-01-02 (20-30-14).txt
Scan type: Quick Scan
Objects scanned: 109774
Time elapsed: 2 minute(s), 50 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Documents and Settings\Max\Start Menu\Programs\Startup\scandisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Max\ntload.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Max\Start Menu\Programs\Startup\scandisk.lnk (Trojan.Downloader) -> Quarantined and deleted successfully.
MER 1.0.15.15281 -
http://www.gmer.net
Rootkit scan 2010-01-02 20:58:29
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\Max\LOCALS~1\Temp\ugddypog.sys
—- Registry - GMER 1.0.15 —-
Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{1ADE0C3A-D23B-ADDA-5677-8A9B61481DBD}
—- EOF - GMER 1.0.15 —-
DDS (Ver_09-06-26.01) - NTFSx86 NETWORK
Run by [removed] at 21:24:03.85 on Sat 01/02/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.730 [GMT -8:00]
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Max\My Documents\Downloads\dds(3).scr
============== Pseudo HJT Report ===============
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [RegistryMechanic] c:\program files\registry mechanic\RegMech.exe /H
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [Nikon Transfer Monitor] c:\program files\common files\nikon\monitor\NkMonitor.exe
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear wg311v2 adapter\wlancfg5.exe
mPolicies-system: EnableLUA = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {B863453A-26C3-4e1f-A54D-A2CD196348E9}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {33564D57-0000-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~2\office12\GR99D3~1.DLL
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~2\office12\GRA8E1~1.DLL
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\max\applic~1\mozilla\firefox\profiles\o0a1bhy8.default\
FF - plugin: c:\documents and settings\max\application data\mozilla\firefox\profiles\o0a1bhy8.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
============= SERVICES / DRIVERS ===============
S2 PCToolsSSDMonitorSvc;PC Tools Startup and Shutdown Monitor service;c:\program files\common files\pc tools\smonitor\StartManSvc.exe [2009-12-30 583640]
S3 getPlusHelper;getPlus® Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2008-4-14 14336]
=============== Created Last 30 ================
2010-01-02 20:25 –d—– c:\docume~1\max\applic~1\Malwarebytes
2010-01-02 20:25 38,224 a——- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-02 20:25 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-01-02 20:25 19,160 a——- c:\windows\system32\drivers\mbam.sys
2010-01-02 20:25 –d—– c:\program files\Malwarebytes' Anti-Malware
2010-01-02 17:29 –d—– c:\program files\Trend Micro
2009-12-31 14:23 –d—– c:\program files\RegistryFix7
2009-12-30 22:23 1,101,824 a——- c:\windows\system32\UniBox210.ocx
2009-12-30 22:23 212,992 a——- c:\windows\system32\UniBoxVB12.ocx
2009-12-30 22:23 880,640 a——- c:\windows\system32\UniBox10.ocx
2009-12-30 22:23 –d—– c:\program files\common files\PC Tools
2009-12-29 20:43 118,784 a——- c:\windows\system32\MSSTDFMT.DLL
2009-12-29 20:43 –d—– c:\program files\SpywareBlaster
2009-12-29 19:43 -cd-h— c:\docume~1\alluse~1\applic~1\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
2009-12-29 16:34 359 a——- c:\windows\wininit.ini
2009-12-22 18:44 –d—– c:\program files\VideoLAN
2009-12-21 19:05 552 a——- c:\windows\system32\d3d8caps.dat
2009-12-17 17:31 664 a——- c:\windows\system32\d3d9caps.dat
2009-12-16 17:48 –d—– c:\program files\Realtek AC97
==================== Find3M ====================
2009-12-29 20:38 20 —-h— c:\docume~1\alluse~1\applic~1\PKP_DLdu.DAT
2009-11-28 20:41 106,496 a——- c:\windows\system32\ATL71.DLL
2009-10-25 08:24 411,368 a——- c:\windows\system32\deploytk.dll
2004-07-02 12:19 40,960 a——- c:\windows\inf\wg311v2\imdinst.exe
2004-06-17 23:41 386,688 a——- c:\windows\inf\wg311v2\netwg311_XP.sys
2004-04-04 13:07 84,912 a——- c:\windows\inf\wg311v2\FwRad17.bin
2004-04-04 13:07 83,320 a——- c:\windows\inf\wg311v2\FwRad16.bin
2004-02-04 12:53 62,865 a——- c:\windows\inf\wg311v2\odysseyIM3.sys
2004-02-04 12:53 12,739 a——- c:\windows\inf\wg311v2\odNetInstall.dll
2007-01-01 16:49 16,384 a–sh— c:\windows\system32\config\systemprofile\cookies\index.dat
2007-01-01 16:49 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\index.dat
2007-01-01 16:49 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012007010120070102\index.dat
2007-01-01 16:49 32,768 a–sh— c:\windows\system32\config\systemprofile\local settings\temporary internet files\content.ie5\index.dat
============= FINISH: 21:24:23.70 ===============
Just so you know, our helpers look for logs to respond to with Zero replies and when you kept replying to your own topic it removed you from that category, thats why this post has gone unanswerd.
Please download
RootRepeal from one of these locations and save it to your desktop
Here Here Here Open [external image: Posted Image] on your desktop. Click the [external image: Posted Image] tab. Click the [external image: Posted Image] button. Check just these boxes: [external image: Posted Image] Push Ok Check the box for your main system drive (Usually C:, and press Ok. Allow RootRepeal to run a scan of your system. This may take some time. Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post. ESET Online Scanner I'd like us to scan your machine with ESET OnlineScan
*Note It is recommended to disable onboard antivirus program and antispyware programs while performing scans so there are no conflicts and it will speed up scan time. Hold down Control and click on the following link to open ESET OnlineScan in a new window. Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the [external image: Posted Image] button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option "Remove found threats" is Unchecked Push the Start button. ESET will then download updates for itself, install itself, and begin When the scan completes, push [external image: Posted Image] Push [external image: Posted Image] , and save the file to your desktop using a unique name, such as Push the [external image: Posted Image] button. Push [external image: Posted Image] Please make sure you include the following items in your next post:
The log that was produced after running ESET Online Scanner.
ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/01/09 11:08
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================
Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xAE537000 Size: 98304 File Visible: No Signed: -
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF79B1000 Size: 8192 File Visible: No Signed: -
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xABBD8000 Size: 49152 File Visible: No Signed: -
Status: -
==EOF==
C:\Documents and Settings\Max\Application Data\Sun\Java\Deployment\cache\6.0\15\8df5f4f-5c23d4c9 probably a variant of Win32/Agent trojan
C:\Documents and Settings\Max\Application Data\Sun\Java\Deployment\cache\6.0\3\12a49b83-744e57d6 probably a variant of Win32/Agent trojan
C:\Documents and Settings\Max\Local Settings\Temp\.tt8B.tmp a variant of Win32/Kryptik.BMW trojan
C:\Documents and Settings\Max\Local Settings\Temporary Internet Files\Content.IE5\MW32NSIF\eH9d228484V03007f35002R9e63f1c1102Td665ff9eQ00000000901801F002a000aJ1000060
1l0409318U391c0c450[1] probably a variant of Win32/TrojanDownloader.FakeAlert.DR trojan
C:\Documents and Settings\Max\My Documents\Downloads\RegistryFix 7.1(trees)\RegistryFix 7.1(trees).rar a variant of Win32/Adware.ErrorClean application
C:\Documents and Settings\Max\My Documents\Downloads\RegistryFix 7.1(trees)\RegistryFix 7.1(trees)\RegistryFix 7.1(trees).exe a variant of Win32/Adware.ErrorClean application
C:\Program Files\RegistryFix7\RegistryFix.exe a variant of Win32/Adware.ErrorClean application
C:\WINDOWS\system32\ls3a5mlqutnkd.exe probably a variant of Win32/TrojanDownloader.FakeAlert.DR trojan
Hi,
You have rogue security program running along with a few other nasties.
Download
ComboFix from one of these locations:
Link 1 Link 2 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our toolsSee this Link Remember to re-enable them when we're done. Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
[external image: Posted Image]
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
[external image: Posted Image]
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the
C:\ComboFix.txt in your next reply along with a
New Hijackthis log.
*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
