What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Wor.win32.net sky virus detected

25 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hi,

Please do the following:

Hi,
Please do the following:

Download Combofix from either of the links below but rename it to dave.exe before saving it to your desktop.


Link 1
Link 2


——————————————————————–

Double click on the renamed ComboFix.exe & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt so we can continue cleaning the system.
NOTE: Very Important! - Please disable all your security programs before running ComboFix as they will interfere
Post #17
it says norton antivirus is active….the virus disabled the only access to it (through the windows task menu) cant unistall norton either
Post #22
Hi, Please rerun exeHelper, which should still be on your desktop you may need to go back into task manager and end process on the listed exe's then re-run ComboFix - see if you can download a fresh copy - renaming it again before saving it to your desktop. make sure all other programs are closed and give it lots of time to run, even if it appears to be stalled. It's probably remnants of norton interfering, but we can't do anything about that at this point. If there are Norton/Symantec processes running in task manager - end them.
Post #26
ComboFix 10-01-13.07 - Paul 01/13/2010 22:14:45.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1499 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\Dave.exe.exe
AV: Norton AntiVirus *On-access scanning enabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Paul\Application Data\SystemProc
c:\documents and settings\Paul\Application Data\SystemProc\lsass.exe
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\windows\system32\5-J_J9ZdLq3.dll
c:\windows\system32\6to4v32.dll
c:\windows\system32\certstore.dat
c:\windows\system32\drivers\H8SRTdcdomyndpq.sys
c:\windows\system32\FastNetSrv.exe
c:\windows\system32\FInstall.sys
c:\windows\system32\flags.ini
c:\windows\system32\H8SRTbakyaupupv.dat
c:\windows\system32\H8SRTjawyltodea.dll
c:\windows\system32\H8SRTjkyfrmoemx.dll
c:\windows\system32\h8srtkrl32mainweq.dll
c:\windows\system32\h8srtshsyst.dll
c:\windows\system32\H8SRTtymppfnxun.dll
c:\windows\system32\H8SRTxttoytusek.dll
c:\windows\system32\helper32.dll
c:\windows\system32\Install.txt
c:\windows\system32\IS15.exe
c:\windows\system32\kbdsock.dll
c:\windows\system32\mshlps.dll
c:\windows\system32\net.net
c:\windows\system32\sbp2fp.dll
c:\windows\system32\smss32.exe
c:\windows\system32\uses32.dat
c:\windows\system32\warning.html
c:\windows\system32\winlogon32.exe
c:\windows\system32\winsts.sys
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job
c:\windows\TEMP\lsass.exe
c:\windows\TEMP\services.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_H8SRTd.sys
——-\Legacy_H8SRTd.sys
——-\Legacy_BTWSRV
——-\Legacy_FASTNETSRV
——-\Legacy_IAS
——-\Legacy_SSHNAS
——-\Legacy_WINSTS
——-\Service_BtwSrv
——-\Service_fastnetsrv
——-\Service_Ias
——-\Service_SSHNAS
——-\Service_winsts


((((((((((((((((((((((((( Files Created from 2009-12-14 to 2010-01-14 )))))))))))))))))))))))))))))))
.

2010-01-14 04:58 . 2010-01-14 05:01 ——– d—–w- C:\Dave.exe11613D
2010-01-14 01:27 . 2010-01-14 01:27 ——– d—–w- C:\Dave.exe
2010-01-13 21:39 . 2010-01-13 21:39 129469 —-a-w- C:\autoexec.exe
2010-01-13 00:38 . 2010-01-13 00:38 27911 —-a-w- c:\windows\system32\49900LU80R.dat
2010-01-13 00:38 . 2010-01-13 00:38 1860 —-a-w- c:\windows\system32\KV9Y0L0ZJ.dat
2010-01-11 01:16 . 2010-01-11 01:16 ——– d—–w- C:\!KillBox
2010-01-11 00:03 . 2010-01-11 00:03 118256 —-a-w- c:\windows\system32\fp8-Te2XpIX_-.exe
2010-01-11 00:01 . 2010-01-11 00:01 ——– d-sh–w- c:\documents and settings\Paul\.COMMgr
2010-01-11 00:00 . 2010-01-11 00:00 204800 —-a-w- C:\eddc.exe
2010-01-10 18:06 . 2010-01-10 18:53 ——– d—–w- c:\documents and settings\Paul\Local Settings\Application Data\WMTools Downloaded Files
2010-01-07 07:24 . 2010-01-07 07:24 ——– d—–w- c:\documents and settings\All Users\Application Data\RoboForm
2009-12-17 01:36 . 2009-12-17 01:36 ——– d—–w- c:\documents and settings\Paul\Local Settings\Application Data\Help
2009-12-16 01:04 . 2009-12-16 01:04 ——– d—–w- c:\documents and settings\Paul\Application Data\WaterProof
2009-12-15 14:46 . 2009-12-15 14:46 ——– d—–w- c:\documents and settings\All Users\Application Data\WEngineLite
2009-12-15 14:40 . 2009-12-15 14:40 ——– d—–w- c:\program files\Novatel Wireless

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-14 04:43 . 2009-10-07 02:14 ——– d—–w- c:\documents and settings\Paul\Application Data\uTorrent
2010-01-13 22:41 . 2009-09-22 00:18 ——– d—–w- c:\documents and settings\All Users\Application Data\Lavasoft
2010-01-13 05:07 . 2009-12-10 22:30 ——– d—–w- c:\program files\Call of Duty Single Player Demo
2010-01-11 00:34 . 2008-04-14 12:00 96512 —-a-w- c:\windows\system32\drivers\atapi.sys
2010-01-07 06:43 . 2009-10-14 02:41 ——– d—–w- c:\documents and settings\Paul\Application Data\U3
2009-12-26 21:42 . 2010-01-09 05:26 110592 —-a-w- c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\cjntr7m9.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
2009-12-15 14:34 . 2009-12-15 14:27 37931808 —-a-w- c:\documents and settings\Paul\Application Data\Smith Micro\Updates\VZAM_7.2.1_2420b_USB760.exe
2009-12-15 14:27 . 2009-10-06 05:51 ——– d—–w- c:\documents and settings\Paul\Application Data\Smith Micro
2009-12-15 03:10 . 2009-09-22 02:27 27880 —-a-w- c:\documents and settings\Paul\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-12-14 23:20 . 2009-12-14 23:20 ——– d—–w- c:\program files\Microsoft Games
2009-12-14 07:11 . 2009-11-18 07:33 224472 —-a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-12-12 01:07 . 2009-12-12 01:07 ——– d—–w- c:\program files\Apache Software Foundation
2009-12-11 22:07 . 2009-09-21 22:38 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-12-10 23:24 . 2009-11-14 23:20 ——– d—–w- c:\program files\MySQL
2009-12-09 09:00 . 2010-01-10 06:01 2747440 —-a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20100109.006\CCERASER.DLL
2009-12-07 21:41 . 2009-12-07 21:41 ——– d—–w- c:\documents and settings\Paul\Application Data\SystemRequirementsLab
2009-12-07 21:41 . 2009-12-07 21:41 ——– d—–w- c:\program files\SystemRequirementsLab
2009-12-07 21:41 . 2009-12-07 21:41 290816 —-a-w- c:\documents and settings\Paul\Application Data\SystemRequirementsLab\SRLProxy_nvd_4.dll
2009-12-07 21:41 . 2009-12-07 21:41 290816 —-a-w- c:\documents and settings\Paul\Application Data\SystemRequirementsLab\SRLProxy_nvd_3.dll
2009-12-07 21:41 . 2009-12-07 21:41 290816 —-a-w- c:\documents and settings\Paul\Application Data\SystemRequirementsLab\SRLProxy_nvd_2.dll
2009-12-07 21:41 . 2009-12-07 21:41 290816 —-a-w- c:\documents and settings\Paul\Application Data\SystemRequirementsLab\SRLProxy_nvd_1.dll
2009-12-07 03:24 . 2009-12-07 03:24 ——– d—–w- c:\program files\owl
2009-12-05 00:17 . 2009-12-05 00:17 108144 —-a-w- c:\windows\system32\CmdLineExt.dll
2009-12-04 00:19 . 2009-10-25 06:33 ——– d—–w- c:\documents and settings\Paul\Application Data\Canon
2009-12-03 01:42 . 2009-12-03 01:42 ——– d—–w- c:\program files\RADVideo
2009-12-03 01:35 . 2009-12-03 01:35 ——– d—–w- c:\documents and settings\Paul\Application Data\Ubisoft
2009-12-03 00:47 . 2009-12-02 23:54 ——– d—–w- c:\program files\Ubisoft
2009-12-03 00:03 . 2009-12-03 00:03 ——– d—–w- c:\documents and settings\All Users\Application Data\Ubisoft
2009-12-02 22:03 . 2009-10-27 02:48 ——– d—–w- c:\documents and settings\Paul\Application Data\NeroDCTemplates
2009-11-30 02:56 . 2009-11-30 02:56 ——– dc—-w- c:\documents and settings\All Users\Application Data\{C4C0E335-EDDF-46A0-A57D-F3802AE44275}
2009-11-24 06:11 . 2009-10-25 06:08 ——– d—–w- c:\documents and settings\All Users\Application Data\CanonIJPLM
2009-11-21 15:51 . 2008-04-14 12:00 471552 —-a-w- c:\windows\AppPatch\aclayers.dll
2009-11-17 23:21 . 2009-11-17 23:21 ——– d—–w- c:\documents and settings\Paul\Application Data\uniblue
2009-10-31 21:56 . 2009-10-31 21:56 5 —-a-w- c:\windows\system32\YoItzVlad.tmp
2009-10-31 17:10 . 2009-10-31 17:10 319488 —-a-w- c:\windows\win-get.exe
2009-10-31 17:10 . 2009-10-31 17:10 324608 —-a-w- c:\windows\wget.exe
2009-10-29 07:45 . 2008-04-14 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-10-27 19:53 . 2009-11-04 22:32 108544 –s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll
2009-10-27 19:53 . 2009-11-04 22:32 167936 –s-a-r- c:\documents and settings\All Users\Application Data\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll
2009-10-21 05:38 . 2008-04-14 12:00 75776 —-a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2008-04-14 12:00 25088 —-a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2008-04-14 12:00 265728 —-a-w- c:\windows\system32\drivers\http.sys
2009-05-01 21:02 . 2009-05-01 21:02 1044480 —-a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 —-a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPage.dll" [2009-10-27 2325528]

[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{9565115d-c7d6-46d3-bd63-b67b481a4368}"= "c:\program files\PageRage\tbPage.dll" [2009-10-27 2325528]

[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{9565115D-C7D6-46D3-BD63-B67B481A4368}"= "c:\program files\PageRage\tbPage.dll" [2009-10-27 2325528]

[HKEY_CLASSES_ROOT\clsid\{9565115d-c7d6-46d3-bd63-b67b481a4368}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2010-01-10 289584]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 2363392]
"OpAgent"="c:\program files\ScanSoft\OmniPage15.0\OpAgent.exe" [2006-02-03 159744]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-21 149280]
"Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360]
"DrvLsnr"="c:\program files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 69632]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"AdobeCS4ServiceManager"="c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" [2008-08-14 611712]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 56080]
"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 45056]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-09-05 417792]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"WrtMon.exe"="c:\windows\system32\spool\drivers\w32x86\3\WrtMon.exe" [2006-09-20 20480]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-30 155648]
"Opware15"="c:\program files\ScanSoft\OmniPage15.0\Opware15.exe" [2006-02-03 69632]
"ScanSoft OmniPage 15.0-reminder"="c:\program files\ScanSoft\OmniPage15.0\Ereg\ereg.exe" [2005-06-03 729088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-19 7700480]
"nwiz"="nwiz.exe" [2007-04-19 1626112]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-19 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048]
Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-22 734872]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-10-13 692224]
Privoxy.lnk - c:\program files\Vidalia Bundle\Privoxy\privoxy.exe [2006-11-20 250368]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\Verizon Wireless\\VZAccess Manager\\VZAccess Manager.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Adobe\\Adobe Flash CS4\\Flash.exe"=
"c:\\xampp\\MercuryMail\\mercury.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Google\\Google SketchUp 7\\SketchUp.exe"=
"c:\\Program Files\\Starcraft\\StarCraft.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"24078:TCP"= 24078:TCP:*:Disabled:BitComet 24078 TCP
"24078:UDP"= 24078:UDP:*:Disabled:BitComet 24078 UDP
"5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4
"3306:TCP"= 3306:TCP:*:Disabled:MySQL Server

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAV\1007020.00B\SymEFA.sys [9/22/2009 8:47 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NAV\1007020.00B\BHDrvx86.sys [9/22/2009 8:47 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NAV\1007020.00B\cchpx86.sys [9/22/2009 8:46 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20100106.001\IDSXpx86.sys [1/8/2010 4:59 PM 329592]
R2 Apache2.2;Apache2.2;c:\xampp\apache\bin\httpd.exe [12/10/2009 8:33 PM 24640]
R2 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe [9/22/2009 8:46 PM 117640]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/9/2009 8:58 PM 102448]
R3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [6/3/2009 10:01 AM 174720]
R3 NWVNDIS;Novatel Wireless Virtual Network Adapter;c:\windows\system32\drivers\NWVNdis.sys [6/3/2009 10:01 AM 341504]
S2 gupdate1ca47b5aa865164;Google Update Service (gupdate1ca47b5aa865164);c:\program files\Google\Update\GoogleUpdate.exe [10/7/2009 6:21 PM 133104]
S2 Mercury;Mercury;c:\xampp\xampp_service_mercury.exe [12/10/2009 8:33 PM 73728]
S3 ndisdrv;ndisdrv;c:\windows\system32\ndisdrv.sys [4/14/2008 5:00 AM 2304]
S3 NWUSBCDFIL;Novatel Wireless Installation CD;c:\windows\system32\drivers\NwUsbCdFil.sys [6/15/2009 3:21 PM 20480]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [9/23/2009 9:22 PM 709248]
S3 SMSIVZAM5;SMSIVZAM5 NDIS Protocol Driver;c:\progra~1\VERIZO~1\VZACCE~1\SMSIVZAM5.SYS [5/25/2009 3:43 PM 32408]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 19:24 451872 —-a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-01-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-08 01:20]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid;=CT2418376
IE: &ieSpell; Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling; - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
FF - ProfilePath - c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\cjntr7m9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT840126&SearchSource;=3&q;={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT840126&SearchSource;=2&q;=
FF - component: c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\cjntr7m9.default\extensions\{81BF1D23-5F17-408D-AC6B-BD6DF7CAF670}\components\XpcomOpusConnector.dll
FF - component: c:\documents and settings\Paul\Application Data\Mozilla\Firefox\Profiles\cjntr7m9.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}\components\FFExternalAlert.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{b0410fca-f0cd-3ae6-f27c-ccdab925b073}\components\aV-pnGf3_.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-AdobeBridge - (no file)
HKCU-Run-settdebugx.exe - c:\docume~1\Paul\LOCALS~1\Temp\settdebugx.exe
HKCU-Run-LREC75DND7 - c:\docume~1\Paul\LOCALS~1\Temp\c.exe
HKLM-Run-igfxtray - c:\windows\system32\igfxtray.exe
HKLM-Run-igfxhkcmd - c:\windows\system32\hkcmd.exe
HKLM-Run-HotKeysCmds - c:\windows\system32\hkcmd.exe
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-OpScheduler - c:\program files\ScanSoft\OmniPage15.0\OpScheduler.exe
HKLM-Explorer_Run-RTHDBPL - c:\documents and settings\Paul\Application Data\SystemProc\lsass.exe
AddRemove-PCuSoftonics - c:\program files\PCuSoftonics\uninst.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-13 22:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run
RTHDBPL = c:\documents and settings\Paul\Application Data\SystemProc\lsass.exe????? ??????????????????????????????????????????????????????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus]
"ImagePath"="\"c:\program files\Norton AntiVirus\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(1312)
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll

- - - - - - - > 'explorer.exe'(2244)
c:\windows\system32\WININET.dll
c:\program files\ScanSoft\OmniPage15.0\OpHook15.dll
c:\program files\Logitech\SetPoint\GameHook.dll
c:\program files\Logitech\SetPoint\lgscroll.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\mshtml.dll
c:\windows\system32\msls31.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Common Files\Adobe\Adobe Drive CS4\AdobeDriveCS4_NP.dll
c:\program files\Common Files\Nero\SMC\NeroDigitalExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_b77cec8e\MFC80.DLL
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
.
———————— Other Running Processes ————————
.
c:\xampp\FileZillaFTP\FileZilla server.exe
c:\program files\Canon\IJPLM\IJPLMSVC.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\spool\drivers\w32x86\3\WrtProc.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
c:\windows\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2010-01-13 22:39:26 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-14 05:39

Pre-Run: 145,929,625,600 bytes free
Post-Run: 160,331,067,392 bytes free

- - End Of File - - F780DD29A41F1C04972EE1122818BA98
Post #28
Hi,

ComboFix is a very powerful tool, and must never be used without the assistance of a trained helper, as you can see there are important follow-up steps to take with it. It is not just a matter of running the tool. If used incorrectly it can damage your computer.


Please do the following.


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

http://forums.whatthetech.com/Wor_win32_net_sky_virus_detected_t109437.html&view=findpost&p=624262#entry624262

Collect::
C:\autoexec.exe
c:\windows\system32\49900LU80R.dat
c:\windows\system32\KV9Y0L0ZJ.dat
c:\windows\system32\fp8-Te2XpIX_-.exe
C:\eddc.exe
c:\documents and settings\Paul\Application Data\SystemProc\lsass.exe

DirLook::
c:\documents and settings\Paul\.COMMgr

Registry::
[HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run]
"RTHDBPL"=-

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

**Note**
When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI