Spyware / Malware / Virus Removal

[Resolved] Got malware program 'Abundante'

9 min read

Looking for the outcome? Ask AI

Deleted Member Topic Starter

Post #1January 10, 2010, 3:23 AM UTC

-Get browser error every time I submit this page, hope it does not create duplicate thread:
-Got malware program 'Abundante'
-About same time lost internet connectivity
-Checked router, NIC, cables, etc.
-Ran Winsock diagnostics and repair programs.
-Regained connectivity for a few seconds, can PING router, not internet or external IP.
-removed abundante files (still see a games folder and a games executable however in logs below, c:\docume~1\jk.ns2\applic~1\GameNIR.exe, c:\docume~1\jk.ns2\applic~1\MyGames).
-ran procedures as directed in forum, logs as noted:

Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2

2010-01-09 19:22:52
mbam-log-2010-01-09 (19-22-52).txt

Scan type: Quick Scan
Objects scanned: 205482
Time elapsed: 5 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 19:33:57.95 on 2010-01-09
Internet Explorer: 6.0.2900.2180
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.640 [GMT -7:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Vivotek\ST3402\Launcher_VV.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Workstation\vmware-authd.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\VMware\VMware Workstation\vmware-tray.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\WINDOWS\eHome\ehmsas.exe
f:\PROGRA~1\POPFile\popfileib.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\wscntfy.exe
U:\gmer.exe
U:\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.ca/ig?hl=en&source=iglk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar3.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.4.4525.1752\swg.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &RoboForm: {724d43a0-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\roboform.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: KeePass Toolbar: {76222034-5cfa-4a43-aade-1e5dacb71469} - c:\program files\keepass toolbar\v3.2.0.0\KeePass_Toolbar.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [vmware-tray] "c:\program files\vmware\vmware workstation\vmware-tray.exe"
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
dRun: [RoboForm] "c:\program files\siber systems\ai roboform\RoboTaskBarIcon.exe"
StartupFolder: c:\docume~1\jk.ns2\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
StartupFolder: c:\docume~1\jk.ns2\startm~1\programs\startup\runpop~1.lnk - f:\program files\popfile\runpopfile.exe
IE: Customize Menu - file://c:\program files\siber systems\ai roboform\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\micros~1\office11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F46} - c:\program files\siber systems\ai roboform\RoboFormComFillForms.html
IE: {320AF880-6646-11D3-ABEE-C5DBF3571F49} - c:\program files\siber systems\ai roboform\RoboFormComSavePass.html
IE: {724d43aa-0d85-11d4-9908-00400523e39a} - c:\program files\siber systems\ai roboform\RoboFormComShowToolbar.html
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~1\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.1.cab
DPF: {5BDBA960-6534-11D3-97C7-00500422B550} - hxxps://portal.pc.gc.ca/download/dolcontrol.cab
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} - hxxps://portal.pc.gc.ca/InternalSite/WhlCompMgr.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.187:8080/plugin/client.cab
DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} - hxxp://143.180.144.33:8080/plugin/h263ctrl.cab
DPF: {CAFEEFAC-0014-0002-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: g7ps - {9EACF0FB-4FC7-436E-989B-3197142AD979} - c:\program files\common files\g7ps\shared files\g7psdll\G7PS.dll
SSODL: crash_report - {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll

============= SERVICES / DRIVERS ===============

R0 OfmLvDrv;OfmLvDrv;c:\windows\system32\drivers\ofmlvdrv.sys [2009-1-3 90515]
R0 snapman380;Acronis Snapshots Manager (Build 380);c:\windows\system32\drivers\snman380.sys [2009-1-9 134272]
R0 tdrpman140;Acronis Try&Decide and Restore Points filter (build 140);c:\windows\system32\drivers\tdrpm140.sys [2009-1-9 971168]
R1 PSFILEMON;PSFILEMON;c:\windows\system32\drivers\psfilemon.sys [2009-1-3 32256]
R2 MtxVideo;Matrox WDM capture/crossbar driver;c:\windows\system32\drivers\mtxvideo.sys [2007-5-26 103296]
R2 Vivotek_ST3402;Vivotek ST3402 Launcher;c:\program files\vivotek\st3402\Launcher_VV.exe [2008-6-26 335872]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-9-18 54960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-7-30 19160]
S2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2008-7-30 269648]
S3 hcwAVD2;Hauppauge PVR USB2 AVS Video Capture;c:\windows\system32\drivers\HCWUSB2AV.sys [2007-2-27 150784]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2007-2-22 320384]
S4 ASKService;ASKService;c:\program files\askbardis\bar\bin\AskService.exe [2008-12-9 464264]
S4 ASKUpgrade;ASKUpgrade;c:\program files\askbardis\bar\bin\ASKUpgrade.exe [2008-12-9 234888]
S4 FaxTalk Messenger Pro 7.0;FaxTalk Messenger Pro 7.0;f:\program files\faxtalk messenger pro 7.0\FTMSGSVC.exe [2006-1-4 147456]

=============== Created Last 30 ================

2010-01-07 16:43 –d—– c:\docume~1\jk.ns2\applic~1\MyGames
2010-01-07 14:54 77,312 a——- c:\windows\MBR.exe
2010-01-02 00:13 166,912 a——- c:\docume~1\jk.ns2\applic~1\GameNIR.exe
2009-12-30 15:31 22 a——- c:\windows\system32\crash_report.ini
2009-12-30 15:31 –d—– c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}
2009-12-30 14:08 359,040 a——- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-20 20:52 184,320 —shr– C:\3D53.exe
2009-12-11 02:37 536,576 a——- c:\windows\system32\crash_report.dll

==================== Find3M ====================

2010-01-09 18:31 4,900 a——- c:\windows\system32\d3d9caps.dat
2009-12-30 21:32 359,040 a——- c:\windows\system32\drivers\TCPIP.SYS
2009-12-09 22:54 261,632 a——- c:\windows\PEV.exe
2009-11-16 15:20 1,901 a——- c:\windows\panose.bin

============= FINISH: 19:34:51.71 ===============
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-01-09 20:09:22
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\JK.NS2\LOCALS~1\Temp\uxtdqpog.sys

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \FileSystem\Ntfs \Ntfs ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 VMkbd.sys (VMware keyboard filter driver (32-bit)/VMware, Inc.)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume3 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume4 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume5 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume6 tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume6 ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)

Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys (VMware USB monitor/VMware, Inc.)
Device \Driver\usbehci \Device\USBFDO-3 hcmon.sys (VMware USB monitor/VMware, Inc.)

AttachedDevice \FileSystem\Fastfat \Fat tdrpm140.sys (Acronis Try&Decide Volume Filter Driver/Acronis)
AttachedDevice \FileSystem\Fastfat \Fat ofmlvdrv.sys (Logical Volume Filter/St Bernard Software)

—- EOF - GMER 1.0.15 —-

Best regards, Tom

Tomk

Post #2January 15, 2010, 8:53 PM UTC

Hi Tom Sellers,

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for the issues on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Deleted Member

Post #3January 15, 2010, 11:04 PM UTC

Thanks TomK,

Since that post I had installed a new switch and reconfigured my settings and my Internet connection came bacl. ALong with it, the 'Abundante' game changed to 'Luxor', and I see the log contains entries for it. Also note 'portal.pc.gc.ca' is known to me and is safe.

So here is the log of the Combofix run:

ComboFix 10-01-15.01 - JK 2010-01-15 15:46:40.7.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.590 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\winlogon.bak

.
((((((((((((((((((((((((( Files Created from 2009-12-15 to 2010-01-15 )))))))))))))))))))))))))))))))
.

2010-01-15 22:43 . 2010-01-15 22:43 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-11 02:21 . 2010-01-11 02:21 ——– d—–w- C:\$WINDOWS.~BT
2010-01-10 02:08 . 2010-01-10 02:08 ——– d—–w- c:\program files\ERUNT
2010-01-07 23:43 . 2010-01-14 23:18 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\MyGames
2010-01-02 07:13 . 2010-01-14 23:18 166912 —-a-w- c:\documents and settings\JK.NS2\Application Data\GameNIR.exe
2009-12-30 22:31 . 2009-12-30 22:31 ——– d—–w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}
2009-12-21 03:52 . 2009-12-21 03:52 184320 –sh–r- C:\3D53.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-15 16:15 . 2008-07-14 20:48 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2010-01-14 23:18 . 2010-01-14 23:18 11772928 —-a-w- c:\documents and settings\JK.NS2\Application Data\MyGames\SetupGame.dll
2010-01-14 21:48 . 2008-10-19 23:29 ——– d—–w- c:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\VMware
2010-01-14 21:48 . 2008-10-19 23:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\VMware
2010-01-10 01:34 . 2008-10-20 01:45 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\VMware
2010-01-10 01:31 . 2007-02-22 20:57 4900 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-31 04:32 . 2004-08-04 12:00 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-12-30 21:08 . 2009-12-30 21:08 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-11 09:37 . 2009-12-11 09:37 536576 —-a-w- c:\windows\system32\crash_report.dll
2009-12-03 04:18 . 2010-01-14 23:18 326656 —-a-w- c:\documents and settings\JK.NS2\Application Data\Luxor\Luxor.exe
2009-12-02 06:30 . 2008-07-18 16:50 67520 —-a-w- c:\documents and settings\JK.NS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 19:35 . 2009-11-30 00:57 ——– d—–w- c:\program files\XYplorer
2009-11-17 01:16 . 2009-01-29 03:21 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\System
2009-11-16 22:20 . 2009-11-16 21:54 1901 —-a-w- c:\windows\panose.bin
2009-10-23 08:00 . 2008-10-11 15:09 4045527 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

——- Sigcheck ——-

[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\erdnt\cache\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-10-22_04.36.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-14 21:48 . 2010-01-14 21:48 16384 c:\windows\temp\Perflib_Perfdata_968.dat
+ 2010-01-14 21:48 . 2010-01-14 21:48 16384 c:\windows\temp\Perflib_Perfdata_578.dat
+ 2001-08-17 15:30 . 2009-11-02 04:00 60912 c:\windows\system32\perfc009.dat
- 2001-08-17 15:30 . 2009-03-10 21:18 60912 c:\windows\system32\perfc009.dat
+ 2008-07-30 19:00 . 2009-09-10 20:54 38224 c:\windows\system32\drivers\mbamswissarmy.sys
+ 2008-07-30 19:00 . 2009-09-10 20:53 19160 c:\windows\system32\drivers\mbam.sys
+ 2004-08-04 12:00 . 2004-08-04 12:00 95360 c:\windows\system32\dllcache\atapi.sys
- 2007-02-22 20:53 . 2009-10-22 04:12 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-02-22 20:53 . 2010-01-07 21:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-05-12 01:24 . 2006-12-27 23:29 6656 c:\windows\system32\spool\drivers\w32x86\3\hpzbdi.dll
- 2007-05-26 21:49 . 2004-08-04 06:56 676864 c:\windows\system32\spool\drivers\w32x86\3\PCL5ERES.DLL
+ 2007-05-26 21:49 . 2004-08-04 07:56 676864 c:\windows\system32\spool\drivers\w32x86\3\PCL5ERES.DLL
+ 2008-07-23 23:50 . 2007-10-22 18:21 117248 c:\windows\system32\spool\drivers\w32x86\3\hpzpnp.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 139264 c:\windows\system32\spool\drivers\w32x86\3\hpzpi5k4.dll
+ 2009-05-12 01:24 . 2007-10-22 18:21 200704 c:\windows\system32\spool\drivers\w32x86\3\hpzpe5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 455680 c:\windows\system32\spool\drivers\w32x86\3\hpzev5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 250880 c:\windows\system32\spool\drivers\w32x86\3\hpzc35k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 152064 c:\windows\system32\spool\drivers\w32x86\3\hpzbr5k4.dll
+ 2009-05-12 01:24 . 2007-08-20 21:49 285184 c:\windows\system32\spool\drivers\w32x86\3\HPZBDI32.msi
+ 2009-05-12 01:24 . 2007-06-29 17:55 326144 c:\windows\system32\spool\drivers\w32x86\3\HPFIE5k4.DLL
+ 2001-08-17 15:30 . 2009-11-02 04:00 398654 c:\windows\system32\perfh009.dat
- 2001-08-17 15:30 . 2009-03-10 21:18 398654 c:\windows\system32\perfh009.dat
+ 2010-01-14 20:17 . 2010-01-14 20:17 200704 c:\windows\erdnt\AutoBackup\2010-01-14\Users\00000002\UsrClass.dat
+ 2010-01-14 20:17 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\2010-01-14\ERDNT.EXE
+ 2009-05-12 01:24 . 2007-10-22 17:58 3461632 c:\windows\system32\spool\drivers\w32x86\3\hpzur5k4.dll
+ 2009-05-12 01:24 . 2007-10-22 18:21 3380224 c:\windows\system32\spool\drivers\w32x86\3\hpzui5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 17:59 5734912 c:\windows\system32\spool\drivers\w32x86\3\hpzst5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:07 1012224 c:\windows\system32\spool\drivers\w32x86\3\hpzss5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 1568256 c:\windows\system32\spool\drivers\w32x86\3\hpzls5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 1526272 c:\windows\system32\spool\drivers\w32x86\3\hpz6r5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:24 2669568 c:\windows\system32\spool\drivers\w32x86\3\hpz3r5k4.dll
+ 2009-05-12 01:24 . 2007-10-15 22:52 1253376 c:\windows\system32\spool\drivers\w32x86\3\HPU5SNPL.DLL
+ 2009-05-12 01:24 . 2007-10-15 22:55 1261568 c:\windows\system32\spool\drivers\w32x86\3\HPU5SNP.DLL
+ 2007-02-22 07:43 . 2009-11-17 20:47 1531776 c:\windows\system32\FNTCACHE.DAT
+ 2010-01-14 20:17 . 2010-01-14 20:17 7925760 c:\windows\erdnt\AutoBackup\2010-01-14\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-11-25 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 68856]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]
"StartGame"="c:\docume~1\JK.NS2\APPLIC~1\GameNIR.exe" [2010-01-14 166912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2008-09-19 84528]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

c:\documents and settings\JK.NS2\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Run POPFile.lnk - f:\program files\POPFile\runpopfile.exe [2008-5-10 71160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"crash_report"= {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll [2009-12-11 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.sys

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\L:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Maxthon\\Maxthon.exe"=
"c:\\Program Files\\Webcam Zone Trigger 2\\ZoneTrigger.exe"=

R0 OfmLvDrv;OfmLvDrv;c:\windows\system32\drivers\ofmlvdrv.sys [2009-01-03 90515]
R0 tdrpman140;Acronis Try&Decide and Restore Points filter (build 140);c:\windows\system32\drivers\tdrpm140.sys [2009-01-09 971168]
R1 PSFILEMON;PSFILEMON;c:\windows\system32\drivers\psfilemon.sys [2009-01-03 32256]
R2 MtxVideo;Matrox WDM capture/crossbar driver;c:\windows\system32\drivers\mtxvideo.sys [2007-05-26 103296]
R2 Vivotek_ST3402;Vivotek ST3402 Launcher;c:\program files\Vivotek\ST3402\Launcher_VV.exe [2008-06-26 335872]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-09-18 54960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-07-30 19160]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 269648]
S3 hcwAVD2;Hauppauge PVR USB2 AVS Video Capture;c:\windows\system32\drivers\HCWUSB2AV.sys [2007-02-27 150784]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2007-02-22 320384]
S4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2008-12-09 464264]
S4 ASKUpgrade;ASKUpgrade;c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe [2008-12-09 234888]
S4 FaxTalk Messenger Pro 7.0;FaxTalk Messenger Pro 7.0;f:\program files\FaxTalk Messenger Pro 7.0\FTMSGSVC.exe [2006-01-04 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003Core.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003UA.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-15 c:\windows\Tasks\Malwarebytes' Scheduled Scan for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]

2010-01-15 c:\windows\Tasks\Malwarebytes' Scheduled Update for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/ig?hl=en&source=iglk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: {5BDBA960-6534-11D3-97C7-00500422B550} - hxxps://portal.pc.gc.ca/download/dolcontrol.cab
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.187:8080/plugin/client.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 15:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-01-15 15:56:55
ComboFix-quarantined-files.txt 2010-01-15 22:56
ComboFix2.txt 2010-01-07 22:14
ComboFix3.txt 2010-01-04 23:22
ComboFix4.txt 2009-10-24 01:33
ComboFix5.txt 2010-01-15 22:45

Pre-Run: 24,678,010,880 bytes free
Post-Run: 24,640,716,800 bytes free

- - End Of File - - 360E0A1753E61FA44FFBAD09C8EB4FC4

Tomk

Post #4January 16, 2010, 12:58 AM UTC

Tom Sellers,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\documents and settings\JK.NS2\Application Data\GameNIR.exe

Folder::
c:\documents and settings\JK.NS2\Application Data\Luxor
c:\program files\AskBarDis

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartGame"=-

Driver::
ASKService
ASKUpgrade

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Also let me know how it's running.

Deleted Member

Post #5January 16, 2010, 1:45 AM UTC

Thanks very much,

ComboFix executed the script, and returned the following report. Reconnected to internet and so far the Luxor malware has not reappeared.

ComboFix 10-01-15.01 - JK 2010-01-15 18:20:53.8.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.645 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt

FILE ::
"c:\documents and settings\JK.NS2\Application Data\GameNIR.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\JK.NS2\Application Data\GameNIR.exe
c:\documents and settings\JK.NS2\Application Data\Luxor
c:\documents and settings\JK.NS2\Application Data\Luxor\assets\splashscreen.jpg
c:\documents and settings\JK.NS2\Application Data\Luxor\assets\Thumbs.db
c:\documents and settings\JK.NS2\Application Data\Luxor\cgp.cgm
c:\documents and settings\JK.NS2\Application Data\Luxor\cgp.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\core.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\crash.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\data\data.mjz
c:\documents and settings\JK.NS2\Application Data\Luxor\data\english.mjz
c:\documents and settings\JK.NS2\Application Data\Luxor\data\memory.dat
c:\documents and settings\JK.NS2\Application Data\Luxor\data\scores.dat
c:\documents and settings\JK.NS2\Application Data\Luxor\dsetup.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\file.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\fmod.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\gfx2d.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\gfx2d_dd7.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\gfx2d_dx8.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\gfx2d_ogl.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\imglib.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\jpeg.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\logger.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\Luxor.exe
c:\documents and settings\JK.NS2\Application Data\Luxor\luxor.ini
c:\documents and settings\JK.NS2\Application Data\Luxor\luxor.log
c:\documents and settings\JK.NS2\Application Data\Luxor\net.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\snd3d.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\snd3d_fmod.dll
c:\documents and settings\JK.NS2\Application Data\Luxor\ui2.dll
c:\program files\AskBarDis
c:\program files\AskBarDis\bar\bin\askBar.dll
c:\program files\AskBarDis\bar\bin\askPopStp.dll
c:\program files\AskBarDis\bar\bin\AskService.exe
c:\program files\AskBarDis\bar\bin\AskSplash.exe
c:\program files\AskBarDis\bar\bin\AskTBApp.exe
c:\program files\AskBarDis\bar\bin\ASKUpgrade.exe
c:\program files\AskBarDis\bar\bin\psvince.dll
c:\program files\AskBarDis\bar\Cache\0460720B
c:\program files\AskBarDis\bar\Cache\0460917A
c:\program files\AskBarDis\bar\Cache\04609B00.bin
c:\program files\AskBarDis\bar\Cache\0460AD11.bin
c:\program files\AskBarDis\bar\Cache\0460BCC0.bin
c:\program files\AskBarDis\bar\Cache\0460C81A.bin
c:\program files\AskBarDis\bar\Cache\0460D3D2.bin
c:\program files\AskBarDis\bar\Cache\0460DE71.bin
c:\program files\AskBarDis\bar\Cache\0460E9DB.bin
c:\program files\AskBarDis\bar\Cache\files.ini
c:\program files\AskBarDis\bar\History\search
c:\program files\AskBarDis\bar\Settings\AskLogo.ico
c:\program files\AskBarDis\bar\Settings\config.dat
c:\program files\AskBarDis\bar\Settings\config.dat.bak
c:\program files\AskBarDis\bar\Settings\prevcfg.htm
c:\program files\AskBarDis\unins000.dat
c:\program files\AskBarDis\unins000.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ASKSERVICE
——-\Legacy_ASKUPGRADE
——-\Service_ASKService
——-\Service_ASKUpgrade

((((((((((((((((((((((((( Files Created from 2009-12-16 to 2010-01-16 )))))))))))))))))))))))))))))))
.

2010-01-15 22:43 . 2010-01-15 22:43 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-14 23:18 . 2010-01-14 23:18 11772928 —-a-w- c:\documents and settings\JK.NS2\Application Data\MyGames\SetupGame.dll
2010-01-11 02:21 . 2010-01-11 02:21 ——– d—–w- C:\$WINDOWS.~BT
2010-01-10 02:08 . 2010-01-10 02:08 ——– d—–w- c:\program files\ERUNT
2010-01-07 23:43 . 2010-01-14 23:18 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\MyGames
2009-12-30 22:31 . 2009-12-30 22:31 ——– d—–w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}
2009-12-21 03:52 . 2009-12-21 03:52 184320 –sh–r- C:\3D53.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-16 01:28 . 2008-10-19 23:29 ——– d—–w- c:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\VMware
2010-01-16 01:28 . 2008-10-19 23:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\VMware
2010-01-15 16:15 . 2008-07-14 20:48 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2010-01-10 01:34 . 2008-10-20 01:45 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\VMware
2010-01-10 01:31 . 2007-02-22 20:57 4900 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-31 04:32 . 2004-08-04 12:00 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-12-30 21:08 . 2009-12-30 21:08 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-11 09:37 . 2009-12-11 09:37 536576 —-a-w- c:\windows\system32\crash_report.dll
2009-12-02 06:30 . 2008-07-18 16:50 67520 —-a-w- c:\documents and settings\JK.NS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-30 19:35 . 2009-11-30 00:57 ——– d—–w- c:\program files\XYplorer
2009-11-16 22:20 . 2009-11-16 21:54 1901 —-a-w- c:\windows\panose.bin
2009-10-23 08:00 . 2008-10-11 15:09 4045527 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

——- Sigcheck ——-

[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\erdnt\cache\tcpip.sys
.
((((((((((((((((((((((((((((( SnapShot@2009-10-22_04.36.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-01-14 21:48 . 2010-01-14 21:48 16384 c:\windows\temp\Perflib_Perfdata_968.dat
+ 2010-01-16 01:28 . 2010-01-16 01:28 16384 c:\windows\temp\Perflib_Perfdata_5a4.dat
+ 2010-01-16 01:28 . 2010-01-16 01:28 16384 c:\windows\temp\Perflib_Perfdata_1f0.dat
- 2001-08-17 15:30 . 2009-03-10 21:18 60912 c:\windows\system32\perfc009.dat
+ 2001-08-17 15:30 . 2009-11-02 04:00 60912 c:\windows\system32\perfc009.dat
+ 2008-07-30 19:00 . 2009-09-10 20:54 38224 c:\windows\system32\drivers\mbamswissarmy.sys
+ 2008-07-30 19:00 . 2009-09-10 20:53 19160 c:\windows\system32\drivers\mbam.sys
+ 2004-08-04 12:00 . 2004-08-04 12:00 95360 c:\windows\system32\dllcache\atapi.sys
+ 2007-02-22 20:53 . 2010-01-07 21:49 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2007-02-22 20:53 . 2009-10-22 04:12 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-05-12 01:24 . 2006-12-27 23:29 6656 c:\windows\system32\spool\drivers\w32x86\3\hpzbdi.dll
+ 2007-05-26 21:49 . 2004-08-04 07:56 676864 c:\windows\system32\spool\drivers\w32x86\3\PCL5ERES.DLL
- 2007-05-26 21:49 . 2004-08-04 06:56 676864 c:\windows\system32\spool\drivers\w32x86\3\PCL5ERES.DLL
+ 2008-07-23 23:50 . 2007-10-22 18:21 117248 c:\windows\system32\spool\drivers\w32x86\3\hpzpnp.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 139264 c:\windows\system32\spool\drivers\w32x86\3\hpzpi5k4.dll
+ 2009-05-12 01:24 . 2007-10-22 18:21 200704 c:\windows\system32\spool\drivers\w32x86\3\hpzpe5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 455680 c:\windows\system32\spool\drivers\w32x86\3\hpzev5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 250880 c:\windows\system32\spool\drivers\w32x86\3\hpzc35k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 152064 c:\windows\system32\spool\drivers\w32x86\3\hpzbr5k4.dll
+ 2009-05-12 01:24 . 2007-08-20 21:49 285184 c:\windows\system32\spool\drivers\w32x86\3\HPZBDI32.msi
+ 2009-05-12 01:24 . 2007-06-29 17:55 326144 c:\windows\system32\spool\drivers\w32x86\3\HPFIE5k4.DLL
- 2001-08-17 15:30 . 2009-03-10 21:18 398654 c:\windows\system32\perfh009.dat
+ 2001-08-17 15:30 . 2009-11-02 04:00 398654 c:\windows\system32\perfh009.dat
+ 2010-01-16 01:28 . 2010-01-16 01:28 200704 c:\windows\erdnt\AutoBackup\2010-01-15\Users\00000002\UsrClass.dat
+ 2010-01-16 01:28 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\2010-01-15\ERDNT.EXE
+ 2010-01-14 20:17 . 2010-01-14 20:17 200704 c:\windows\erdnt\AutoBackup\2010-01-14\Users\00000002\UsrClass.dat
+ 2010-01-14 20:17 . 2005-10-20 19:02 163328 c:\windows\erdnt\AutoBackup\2010-01-14\ERDNT.EXE
+ 2009-05-12 01:24 . 2007-10-22 17:58 3461632 c:\windows\system32\spool\drivers\w32x86\3\hpzur5k4.dll
+ 2009-05-12 01:24 . 2007-10-22 18:21 3380224 c:\windows\system32\spool\drivers\w32x86\3\hpzui5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 17:59 5734912 c:\windows\system32\spool\drivers\w32x86\3\hpzst5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:07 1012224 c:\windows\system32\spool\drivers\w32x86\3\hpzss5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 1568256 c:\windows\system32\spool\drivers\w32x86\3\hpzls5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:21 1526272 c:\windows\system32\spool\drivers\w32x86\3\hpz6r5k4.DLL
+ 2009-05-12 01:24 . 2007-10-22 18:24 2669568 c:\windows\system32\spool\drivers\w32x86\3\hpz3r5k4.dll
+ 2009-05-12 01:24 . 2007-10-15 22:52 1253376 c:\windows\system32\spool\drivers\w32x86\3\HPU5SNPL.DLL
+ 2009-05-12 01:24 . 2007-10-15 22:55 1261568 c:\windows\system32\spool\drivers\w32x86\3\HPU5SNP.DLL
+ 2007-02-22 07:43 . 2009-11-17 20:47 1531776 c:\windows\system32\FNTCACHE.DAT
+ 2010-01-16 01:28 . 2010-01-16 01:28 7925760 c:\windows\erdnt\AutoBackup\2010-01-15\Users\00000001\NTUSER.DAT
+ 2010-01-14 20:17 . 2010-01-14 20:17 7925760 c:\windows\erdnt\AutoBackup\2010-01-14\Users\00000001\NTUSER.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 68856]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2008-09-19 84528]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

c:\documents and settings\JK.NS2\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Run POPFile.lnk - f:\program files\POPFile\runpopfile.exe [2008-5-10 71160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"crash_report"= {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll [2009-12-11 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.sys

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\L:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Maxthon\\Maxthon.exe"=
"c:\\Program Files\\Webcam Zone Trigger 2\\ZoneTrigger.exe"=

R0 OfmLvDrv;OfmLvDrv;c:\windows\system32\drivers\ofmlvdrv.sys [2009-01-03 90515]
R0 tdrpman140;Acronis Try&Decide and Restore Points filter (build 140);c:\windows\system32\drivers\tdrpm140.sys [2009-01-09 971168]
R1 PSFILEMON;PSFILEMON;c:\windows\system32\drivers\psfilemon.sys [2009-01-03 32256]
R2 MtxVideo;Matrox WDM capture/crossbar driver;c:\windows\system32\drivers\mtxvideo.sys [2007-05-26 103296]
R2 Vivotek_ST3402;Vivotek ST3402 Launcher;c:\program files\Vivotek\ST3402\Launcher_VV.exe [2008-06-26 335872]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-09-18 54960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-07-30 19160]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 269648]
S3 hcwAVD2;Hauppauge PVR USB2 AVS Video Capture;c:\windows\system32\drivers\HCWUSB2AV.sys [2007-02-27 150784]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2007-02-22 320384]
S4 FaxTalk Messenger Pro 7.0;FaxTalk Messenger Pro 7.0;f:\program files\FaxTalk Messenger Pro 7.0\FTMSGSVC.exe [2006-01-04 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-01-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003Core.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003UA.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-15 c:\windows\Tasks\Malwarebytes' Scheduled Scan for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]

2010-01-15 c:\windows\Tasks\Malwarebytes' Scheduled Update for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/ig?hl=en&source=iglk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: {5BDBA960-6534-11D3-97C7-00500422B550} - hxxps://portal.pc.gc.ca/download/dolcontrol.cab
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.187:8080/plugin/client.cab
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{3041D03E-FD4B-44E0-B742-2D9B88305F98} - c:\program files\AskBarDis\bar\bin\askBar.dll
AddRemove-Ask Toolbar_is1 - c:\program files\AskBarDis\unins000.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-15 18:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3560)
c:\windows\system32\crash_report.dll
.
———————— Other Running Processes ————————
.
c:\program files\Common Files\Acronis\Schedule2\schedul2.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\system32\vmnat.exe
c:\windows\system32\vmnetdhcp.exe
c:\program files\VMware\VMware Workstation\vmware-authd.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\windows\eHome\ehmsas.exe
f:\progra~1\POPFile\popfileib.exe
.
**************************************************************************
.
Completion time: 2010-01-15 18:33:22 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-16 01:33
ComboFix2.txt 2010-01-15 22:56
ComboFix3.txt 2010-01-07 22:14
ComboFix4.txt 2010-01-04 23:22
ComboFix5.txt 2010-01-16 01:20

Pre-Run: 24,656,228,352 bytes free
Post-Run: 24,564,748,288 bytes free

- - End Of File - - 433093C1976ABCBA275B8D403F1D1410

Tomk

Post #6January 16, 2010, 2:27 AM UTC

Tom Sellers,

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
  Mail databases
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As….
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply.

Deleted Member

Post #7January 16, 2010, 3:05 AM UTC

Thanks for that, Until this started I was running eSet NOD, but had to uninstall it it order to apply the TCPIP fixes, as I could not stop the service from running otherwise. I'll run Kaspersky and get back with the reults.

Deleted Member

Post #8January 16, 2010, 3:28 AM UTC

I'm wondering if there is still a problem or if perhaps the Kaspersky server is jammed. When I get to the Kaspersky Website the page stops responding and I cannot click the accept button. I closed it using task manager and rebooted, got the same thing. Kaspersky will not let me use Chrome as an alternative browser.

Tomk

Post #9January 16, 2010, 3:47 AM UTC

Tom Sellers,

Let's use a different one.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

Please go here then click on: [external image: Posted Image]

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

- Scan for potentially unwanted applications
- Scan for potentially unsafe applications
- Enable Anti-Stealth Technology
Now click on: [external image: Posted Image]
The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on: [external image: Posted Image]
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Deleted Member

Post #10January 17, 2010, 2:56 AM UTC

Thanks, took awhile to do the scan, here are the results: C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP444\A0084799.exe Win32/Injector.APE trojan C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP444\A0084801.dll probably a variant of Win32/Agent trojan C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP444\A0084819.exe Win32/Injector.APE trojan C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP444\A0084820.exe Win32/Spy.Zbot.UN trojan C:\System Volume Information\_restore{A50FA7F5-86D5-409A-AACB-4463F98E0FFE}\RP444\A0084821.dll probably a variant of Win32/Agent trojan

Tomk

Post #11January 17, 2010, 4:10 AM UTC

Tom Sellers,

Log looks good

Everything found there has already been dealt with and only exists as remnants in the saved restore points. Now we'll take care of that.

Time for some housekeeping

Click START then RUN
Now type ComboFix /Uninstall in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
[external image: Posted Image]

The above procedure will:

Implement some cleanup procedures.
Reset System Restore.

Please re-enable any security that was disabled.

Now to remove most of the tools that we have used in fixing your machine:

Make sure you have an Internet Connection.
Download OTC to your desktop and run it
A list of tool components used in the cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OTC to reach the Internet, please allow the application to do so.
Click Yes to begin the cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the cleanup process. If you are asked to reboot the machine choose Yes.

The following is my standard advice for the future. Use what you can and pat yourself on the back for what you're already doing.

Please take time to read Preventing Malware - Tools and Practices for Safe Computing. Very important information for your consideration is contained therein.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved.

Deleted Member

Post #12January 17, 2010, 7:48 AM UTC

Thanks again Tomk, Bad news it seems.

I just ran OTC and it didn't appear to do anything. I was about to manually reboot, and I see a suspicious icon in my tray, and it's that same game icon again!

Since the clean and the last scan I did not execute any programs, download anything, or go to any websites other than gmail and this site. However I go to gMail through iGoogle which has a bunch of gadgets in it. I wonder if this game could be attached to one of the gadgets, except I don't get it on my other computers when I go to iGoogle page.

I put the mouse over it and it took over and launched some game called 'Peggle' Deluxe. I had to pull the power to reboot. Next I see an icon for it on the desktop "PeggleDeluxe".

So it seems that somehow this thing is installing still once I'm reconnected to the internet.

Here is the Combofix text and you can see where it has installed itself:

ComboFix 10-01-16.03 - JK 2010-01-17 0:31.9.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.598 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2009-12-17 to 2010-01-17 )))))))))))))))))))))))))))))))
.

2010-01-17 07:19 . 2010-01-17 07:19 2383872 —h–w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\popcapgame1.exe
2010-01-16 23:26 . 2009-12-03 04:23 329216 —-a-w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\PeggleDeluxe.exe
2010-01-16 23:26 . 2006-04-11 19:53 94208 —-a-w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\j2k-codec.dll
2010-01-16 23:26 . 2007-03-01 02:47 4229104 —-a-w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cgp.dll
2010-01-16 23:26 . 2006-07-18 21:45 92216 —-a-w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\bass.dll
2010-01-16 23:26 . 2010-01-16 23:26 166912 —-a-w- c:\documents and settings\JK.NS2\Application Data\GameNIR.exe
2010-01-16 23:26 . 2010-01-17 07:19 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe
2010-01-15 22:43 . 2010-01-17 07:19 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-14 23:18 . 2010-01-16 23:26 27519488 —-a-w- c:\documents and settings\JK.NS2\Application Data\MyGames\SetupGame.dll
2010-01-11 02:21 . 2010-01-11 02:21 ——– d—–w- C:\$WINDOWS.~BT
2010-01-10 02:08 . 2010-01-10 02:08 ——– d—–w- c:\program files\ERUNT
2010-01-07 23:43 . 2010-01-16 23:26 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\MyGames
2009-12-30 22:31 . 2009-12-30 22:31 ——– d—–w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-17 07:22 . 2008-10-19 23:29 ——– d—–w- c:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\VMware
2010-01-17 07:22 . 2008-10-19 23:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\VMware
2010-01-17 07:21 . 2009-01-06 19:31 ——– d—–w- c:\program files\ESET
2010-01-16 19:11 . 2009-11-30 00:57 ——– d—–w- c:\program files\XYplorer
2010-01-16 17:15 . 2008-07-14 20:48 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2010-01-10 01:34 . 2008-10-20 01:45 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\VMware
2010-01-10 01:31 . 2007-02-22 20:57 4900 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-31 04:32 . 2004-08-04 12:00 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-12-30 21:08 . 2009-12-30 21:08 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-11 09:37 . 2009-12-11 09:37 536576 —-a-w- c:\windows\system32\crash_report.dll
2009-12-02 06:30 . 2008-07-18 16:50 67520 —-a-w- c:\documents and settings\JK.NS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-16 22:20 . 2009-11-16 21:54 1901 —-a-w- c:\windows\panose.bin
2009-10-23 08:00 . 2008-10-11 15:09 4045527 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

——- Sigcheck ——-

[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\erdnt\cache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 68856]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]
"StartGame"="c:\docume~1\JK.NS2\APPLIC~1\GameNIR.exe" [2010-01-16 166912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2008-09-19 84528]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

c:\documents and settings\JK.NS2\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Run POPFile.lnk - f:\program files\POPFile\runpopfile.exe [2008-5-10 71160]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"crash_report"= {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll [2009-12-11 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.sys

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\L:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Maxthon\\Maxthon.exe"=
"c:\\Program Files\\Webcam Zone Trigger 2\\ZoneTrigger.exe"=

R0 OfmLvDrv;OfmLvDrv;c:\windows\system32\drivers\ofmlvdrv.sys [2009-01-03 90515]
R0 tdrpman140;Acronis Try&Decide and Restore Points filter (build 140);c:\windows\system32\drivers\tdrpm140.sys [2009-01-09 971168]
R1 PSFILEMON;PSFILEMON;c:\windows\system32\drivers\psfilemon.sys [2009-01-03 32256]
R2 MtxVideo;Matrox WDM capture/crossbar driver;c:\windows\system32\drivers\mtxvideo.sys [2007-05-26 103296]
R2 Vivotek_ST3402;Vivotek ST3402 Launcher;c:\program files\Vivotek\ST3402\Launcher_VV.exe [2008-06-26 335872]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-09-18 54960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-07-30 19160]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 269648]
S3 hcwAVD2;Hauppauge PVR USB2 AVS Video Capture;c:\windows\system32\drivers\HCWUSB2AV.sys [2007-02-27 150784]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2007-02-22 320384]
S4 FaxTalk Messenger Pro 7.0;FaxTalk Messenger Pro 7.0;f:\program files\FaxTalk Messenger Pro 7.0\FTMSGSVC.exe [2006-01-04 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-01-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003Core.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003UA.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-16 c:\windows\Tasks\Malwarebytes' Scheduled Scan for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]

2010-01-16 c:\windows\Tasks\Malwarebytes' Scheduled Update for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/ig?hl=en&source=iglk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: {5BDBA960-6534-11D3-97C7-00500422B550} - hxxps://portal.pc.gc.ca/download/dolcontrol.cab
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.187:8080/plugin/client.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 00:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2860)
c:\windows\system32\crash_report.dll
.
Completion time: 2010-01-17 00:42:03
ComboFix-quarantined-files.txt 2010-01-17 07:42

Pre-Run: 31,704,113,152 bytes free
Post-Run: 31,803,031,552 bytes free

- - End Of File - - F0E5C0A51BF4C0CC8BA559EB4DB8DC0E

Tomk

Post #13January 17, 2010, 2:16 PM UTC

Tom Sellers,

COMBOFIX-Script

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

File::
c:\documents and settings\JK.NS2\Application Data\GameNIR.exe

Folder::
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartGame"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"crash_report"=-
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Maxthon\\Maxthon.exe"=-

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

[external image: Posted Image]
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

Deleted Member

Post #14January 17, 2010, 5:56 PM UTC

Thanks for that Tomk,

Just FYI, I ran another eSet online scan overnight just to see, and the results were the same as that previously posted for the restore point, nothing new.

Here is the Combofix log:

ComboFix 10-01-16.04 - JK 2010-01-17 10:33:46.10.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.593 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\CFScript.txt

FILE ::
"c:\documents and settings\JK.NS2\Application Data\GameNIR.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\JK.NS2\Application Data\GameNIR.exe
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\bass.dll
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\aah.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\applause.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\approval.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\AwardFanfareV2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\ball_add.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\bubbles.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\buckethit.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\button.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\button2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\cannonshot.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\coin_freeball_denied.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\coin_spin.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\cymbal.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\dinghi.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\explode.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\extraball.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\extraball2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\extraball3.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\extremefever2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\feverhit.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\fireballbounce.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\FireBallLoopV4.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\fireballshoot.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\FireworkPop.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\fireworks1.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\fireworks2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\flip.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\flip2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\flipperbounce.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\flipperdown.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\flipperup.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\freeball2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\gapbonus1.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\gong.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\guncock.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\Koka_morning_finaledit.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\miss.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\missile.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\MnE_Dia_n.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\MnE_Dia_neg.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\MnE_Dia_pos.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\mouseoverV1.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\multiball.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\peghit.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\peghit_low.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\peghit_plus_mega9.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\peghit_plus4b.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\pegpop.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\penalty.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_fireball3.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_flippers_4.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_flowerpower2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_guide.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_luckyspin.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_multiball.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_pyramid.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_spaceblast.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_spooky1.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_spooky2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_spooky3.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_spooky4.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\powerup_zen3.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\rainbow.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\scorecounter.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\sigh.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\timpaniroll.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\ting.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\tone.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\tonehi.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\tonelo.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\tonesuperhi.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\typing2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\ultra2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cached\sounds\xbump_mod2.wav
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cgp.cgm
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\cgp.dll
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\drm.xml
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\drm.xml.sig
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\_Arial10.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\_Arial10Bold.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\_Arial12Bold.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\_Arial9.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\_Arial9Bold.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\Arial10.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\Arial10Bold.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\Arial12Bold.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\Arial9.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\fonts\Arial9Bold.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\help.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\bbb.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_buynow.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_buynow2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_cancel.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_cancel2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_close.PNG
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_close2.PNG
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_continue.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_continue2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_finish.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_finish2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_help.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_help_main.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_help_main2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_help2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_mask.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_play.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_play2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_play3.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_privacy.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_privacy_main.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_privacy_main2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_privacy2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_register.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_register2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_retry.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_retry2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_security.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_security_main.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_security_main2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_security2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_sendreceipt.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\btn_sendreceipt2.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\buyitnowfor.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\ecomm_wrapper_background.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\ecomm_wrapper_background_centered.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\icon_complete.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\icon_connected.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\icon_connecting.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\ssframe.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\images\textlet.png
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\privacy.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Bullets.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\ClassLink.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Common.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Consts.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Default.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\DProps.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\DRMApp.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Game.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Layout.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\LuaApp.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\LuaCommonWidgets.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\LuaWidget.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\main.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\Screen.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\scripts\TextletWidget.luc
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\common\security.txt
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\drm.xml
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\drm.xml.sig
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet1.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet1_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet2.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet2_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet3.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet3_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet4.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\custom\images\bullet4_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\game.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\game_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\logo.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\logo_.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\price.gif
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\drm\Thumbs.db
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\j2k-codec.dll
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\main.pak
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\music\odetojoy.ogg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\music\opening.ogg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\music\PeggleBeats.mo3
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\PeggleDeluxe.exe
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\popcapgame1.exe
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\properties\partner.xml
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\properties\partner.xml.sig
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\properties\partner_logo.jpg
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\userdata\highscores.dat
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\userdata\stat_1_49b39e60.dat
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\userdata\user1.dat
c:\documents and settings\JK.NS2\Application Data\PeggleDeluxe\userdata\users.dat

.
((((((((((((((((((((((((( Files Created from 2009-12-17 to 2010-01-17 )))))))))))))))))))))))))))))))
.

2010-01-17 10:09 . 2010-01-17 10:09 ——– d—–w- c:\windows\LastGood
2010-01-15 22:43 . 2010-01-17 07:19 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-01-14 23:18 . 2010-01-16 23:26 27519488 —-a-w- c:\documents and settings\JK.NS2\Application Data\MyGames\SetupGame.dll
2010-01-11 02:21 . 2010-01-11 02:21 ——– d—–w- C:\$WINDOWS.~BT
2010-01-10 02:08 . 2010-01-10 02:08 ——– d—–w- c:\program files\ERUNT
2010-01-07 23:43 . 2010-01-16 23:26 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\MyGames
2009-12-30 22:31 . 2009-12-30 22:31 ——– d—–w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-17 10:09 . 2009-01-06 19:31 ——– d—–w- c:\program files\ESET
2010-01-17 07:22 . 2008-10-19 23:29 ——– d—–w- c:\documents and settings\LocalService.NT AUTHORITY.000\Application Data\VMware
2010-01-17 07:22 . 2008-10-19 23:22 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\VMware
2010-01-16 19:11 . 2009-11-30 00:57 ——– d—–w- c:\program files\XYplorer
2010-01-16 17:15 . 2008-07-14 20:48 ——– d—–w- c:\documents and settings\All Users.WINDOWS\Application Data\Google Updater
2010-01-10 01:34 . 2008-10-20 01:45 ——– d—–w- c:\documents and settings\JK.NS2\Application Data\VMware
2010-01-10 01:31 . 2007-02-22 20:57 4900 —-a-w- c:\windows\system32\d3d9caps.dat
2009-12-31 04:32 . 2004-08-04 12:00 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS
2009-12-30 21:08 . 2009-12-30 21:08 359040 —-a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
2009-12-11 09:37 . 2009-12-11 09:37 536576 —-a-w- c:\windows\system32\crash_report.dll
2009-12-02 06:30 . 2008-07-18 16:50 67520 —-a-w- c:\documents and settings\JK.NS2\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-16 22:20 . 2009-11-16 21:54 1901 —-a-w- c:\windows\panose.bin
2009-10-23 08:00 . 2008-10-11 15:09 4045527 —-a-w- c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
.

——- Sigcheck ——-

[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\drivers\TCPIP.SYS
[-] 2009-12-31 . 27A5959C94EE173A063CA06BD14F021A . 359040 . . [5.1.2600.2180] . . c:\windows\system32\dllcache\TCPIP.SYS
[-] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[-] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
[-] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
[-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\tcpip.sys
[7] 2004-08-04 . 9F4B36614A0FC234525BA224957DE55C . 359040 . . [5.1.2600.2180] . . c:\windows\erdnt\cache\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 68856]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"vmware-tray"="c:\program files\VMware\VMware Workstation\vmware-tray.exe" [2008-09-19 84528]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2009-09-10 420176]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 160592]

c:\documents and settings\JK.NS2\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
Run POPFile.lnk - f:\program files\POPFile\runpopfile.exe [2008-5-10 71160]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux2"=wdmaud.sys

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\L:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\VMware\\VMware Workstation\\vmware-authd.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Webcam Zone Trigger 2\\ZoneTrigger.exe"=

R0 OfmLvDrv;OfmLvDrv;c:\windows\system32\drivers\ofmlvdrv.sys [2009-01-03 90515]
R0 tdrpman140;Acronis Try&Decide and Restore Points filter (build 140);c:\windows\system32\drivers\tdrpm140.sys [2009-01-09 971168]
R1 PSFILEMON;PSFILEMON;c:\windows\system32\drivers\psfilemon.sys [2009-01-03 32256]
R2 MtxVideo;Matrox WDM capture/crossbar driver;c:\windows\system32\drivers\mtxvideo.sys [2007-05-26 103296]
R2 Vivotek_ST3402;Vivotek ST3402 Launcher;c:\program files\Vivotek\ST3402\Launcher_VV.exe [2008-06-26 335872]
R2 vmci;VMware vmci;c:\windows\system32\drivers\vmci.sys [2008-09-18 54960]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-07-30 19160]
S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 269648]
S3 hcwAVD2;Hauppauge PVR USB2 AVS Video Capture;c:\windows\system32\drivers\HCWUSB2AV.sys [2007-02-27 150784]
S3 mgau;mgau;c:\windows\system32\drivers\mgaum.sys [2007-02-22 320384]
S4 FaxTalk Messenger Pro 7.0;FaxTalk Messenger Pro 7.0;f:\program files\FaxTalk Messenger Pro 7.0\FTMSGSVC.exe [2006-01-04 147456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2010-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003Core.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-57989841-789336058-1957994488-1003UA.job
- c:\documents and settings\JK.NS2\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 02:57]

2010-01-17 c:\windows\Tasks\Malwarebytes' Scheduled Scan for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]

2010-01-17 c:\windows\Tasks\Malwarebytes' Scheduled Update for JK.job
- c:\program files\Malwarebytes' Anti-Malware\mbam.exe [2009-10-22 20:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.ca/ig?hl=en&source=iglk
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Customize Menu - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
IE: Fill Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - file://c:\program files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
DPF: {5BDBA960-6534-11D3-97C7-00500422B550} - hxxps://portal.pc.gc.ca/download/dolcontrol.cab
DPF: {66D393D5-4D80-497C-9F4F-F3839E090202} - hxxp://www.pysoft.com/Downloads/WebCamPlayerOCX.cab
DPF: {8FEED82A-42A6-4117-A803-7EC3EB9339E0} - hxxp://192.168.0.187:8080/plugin/client.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-17 10:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-01-17 10:44:17
ComboFix-quarantined-files.txt 2010-01-17 17:44
ComboFix2.txt 2010-01-17 07:54

Pre-Run: 31,729,577,984 bytes free
Post-Run: 31,778,267,136 bytes free

- - End Of File - - 8FFE1EDE43158A42C9A64FD706387BC7

Tomk

Post #15January 17, 2010, 6:02 PM UTC

Please have a look in this folder: c:\documents and settings\JK.NS2\Application Data\MyGames Is there anything you want in it?

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

You may be asked to choose drive. Choose C: At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Got malware program 'Abundante'

✨ Ask AI

Ask AI