Spyware / Malware / Virus Removal

[Resolved] Help needed! All kinds symptoms on XP laptop (HJT log

32 min read

Looking for the outcome? Ask AI

seanakaforty

Post #31February 27, 2010, 11:08 PM UTC

I tried running Defogger, but Gmer still gave me the blue screen in the middle of its scan. Interestingly, though, Defogger never askedto restart the computer. Is that normal? I got the "Finished" message, and clicked OK, but nothing happened. So I ran Defogger again just in case it didn't work. But the same think happened; it never asked to restart. I did a manual restart just in case, but Gmer still didn't finish its scan.

LDTate

Post #32February 27, 2010, 11:14 PM UTC

Can you run the MBAM Quick scan and post the scan results? Don't run the full scan.

seanakaforty

Post #33March 1, 2010, 1:46 AM UTC

Malwarebytes' Anti-Malware 1.44 Database version: 3808 Windows 5.1.2600 Service Pack 3 Internet Explorer 7.0.5730.13 2/28/2010 7:52:18 PM mbam-log-2010-02-28 (19-52-18).txt Scan type: Quick Scan Objects scanned: 133368 Time elapsed: 12 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 1 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0\friendlyname (Trojan.FakeAlert) -> Delete on reboot. Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

LDTate

Post #34March 1, 2010, 2:00 AM UTC

Download TDSSKiller and save it to your Desktop.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Extract the file and run it.
Once completed it will create a log in your C:\ drive
Please post the contents of that log

After the above run a new combofix scan.

seanakaforty

Post #35March 2, 2010, 1:10 AM UTC

Currently running ComboFix. Here's the tdskiller log: 20:07:48:781 3024 TDSS rootkit removing tool [removed] Feb 27 2010 13:29:25 20:07:48:781 3024 ================================================================================ 20:07:48:781 3024 SystemInfo: 20:07:48:781 3024 OS Version: 5.1.2600 ServicePack: 3.0 20:07:48:781 3024 Product type: Workstation 20:07:48:781 3024 ComputerName: BRIT 20:07:48:781 3024 UserName: Brittany 20:07:48:781 3024 Windows directory: C:\WINDOWS 20:07:48:781 3024 Processor architecture: Intel x86 20:07:48:781 3024 Number of processors: 2 20:07:48:781 3024 Page size: 0x1000 20:07:48:781 3024 Boot type: Normal boot 20:07:48:781 3024 ================================================================================ 20:07:48:781 3024 UnloadDriverW: NtUnloadDriver error 2 20:07:48:781 3024 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2 20:07:48:890 3024 Initialize success 20:07:48:890 3024 20:07:48:890 3024 Scanning Services … 20:07:48:906 3024 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system 20:07:48:906 3024 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 20:07:48:906 3024 wfopen_ex: Trying to KLMD file open 20:07:48:906 3024 wfopen_ex: File opened ok (Flags 2) 20:07:48:906 3024 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software 20:07:48:906 3024 wfopen_ex: MyNtCreateFileW error 32 (C0000043) 20:07:48:906 3024 wfopen_ex: Trying to KLMD file open 20:07:48:906 3024 wfopen_ex: File opened ok (Flags 2) 20:07:49:734 3024 GetAdvancedServicesInfo: Raw services enum returned 362 services 20:07:49:734 3024 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system 20:07:49:734 3024 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software 20:07:49:734 3024 20:07:49:734 3024 Scanning Kernel memory … 20:07:49:734 3024 Devices to scan: 6 20:07:49:734 3024 20:07:49:734 3024 Driver Name: Disk 20:07:49:734 3024 IRP_MJ_CREATE : F76CABB0 20:07:49:734 3024 IRP_MJ_CREATE_NAMED_PIPE : 804F4562 20:07:49:734 3024 IRP_MJ_CLOSE : F76CABB0 20:07:49:734 3024 IRP_MJ_READ : F76C4D1F 20:07:49:734 3024 IRP_MJ_WRITE : F76C4D1F 20:07:49:734 3024 IRP_MJ_QUERY_INFORMATION : 804F4562 20:07:49:734 3024 IRP_MJ_SET_INFORMATION : 804F4562 20:07:49:734 3024 IRP_MJ_QUERY_EA : 804F4562 20:07:49:734 3024 IRP_MJ_SET_EA : 804F4562 20:07:49:734 3024 IRP_MJ_FLUSH_BUFFERS : F76C52E2 20:07:49:734 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 20:07:49:734 3024 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 20:07:49:734 3024 IRP_MJ_DIRECTORY_CONTROL : 804F4562 20:07:49:734 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 20:07:49:734 3024 IRP_MJ_DEVICE_CONTROL : F76C53BB 20:07:49:734 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 20:07:49:734 3024 IRP_MJ_SHUTDOWN : F76C52E2 20:07:49:734 3024 IRP_MJ_LOCK_CONTROL : 804F4562 20:07:49:734 3024 IRP_MJ_CLEANUP : 804F4562 20:07:49:734 3024 IRP_MJ_CREATE_MAILSLOT : 804F4562 20:07:49:734 3024 IRP_MJ_QUERY_SECURITY : 804F4562 20:07:49:734 3024 IRP_MJ_SET_SECURITY : 804F4562 20:07:49:734 3024 IRP_MJ_POWER : F76C6C82 20:07:49:734 3024 IRP_MJ_SYSTEM_CONTROL : F76CB99E 20:07:49:734 3024 IRP_MJ_DEVICE_CHANGE : 804F4562 20:07:49:734 3024 IRP_MJ_QUERY_QUOTA : 804F4562 20:07:49:734 3024 IRP_MJ_SET_QUOTA : 804F4562 20:07:49:734 3024 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 20:07:49:734 3024 sion 20:07:49:765 3024 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 20:07:49:765 3024 20:07:49:765 3024 Driver Name: USBSTOR 20:07:49:765 3024 IRP_MJ_CREATE : EB35E218 20:07:49:765 3024 IRP_MJ_CREATE_NAMED_PIPE : 804F4562 20:07:49:765 3024 IRP_MJ_CLOSE : EB35E218 20:07:49:765 3024 IRP_MJ_READ : EB35E23C 20:07:49:765 3024 IRP_MJ_WRITE : EB35E23C 20:07:49:765 3024 IRP_MJ_QUERY_INFORMATION : 804F4562 20:07:49:765 3024 IRP_MJ_SET_INFORMATION : 804F4562 20:07:49:765 3024 IRP_MJ_QUERY_EA : 804F4562 20:07:49:765 3024 IRP_MJ_SET_EA : 804F4562 20:07:49:765 3024 IRP_MJ_FLUSH_BUFFERS : 804F4562 20:07:49:765 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 20:07:49:765 3024 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 20:07:49:765 3024 IRP_MJ_DIRECTORY_CONTROL : 804F4562 20:07:49:765 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 20:07:49:765 3024 IRP_MJ_DEVICE_CONTROL : EB35E180 20:07:49:765 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : EB3599E6 20:07:49:765 3024 IRP_MJ_SHUTDOWN : 804F4562 20:07:49:765 3024 IRP_MJ_LOCK_CONTROL : 804F4562 20:07:49:765 3024 IRP_MJ_CLEANUP : 804F4562 20:07:49:765 3024 IRP_MJ_CREATE_MAILSLOT : 804F4562 20:07:49:765 3024 IRP_MJ_QUERY_SECURITY : 804F4562 20:07:49:765 3024 IRP_MJ_SET_SECURITY : 804F4562 20:07:49:765 3024 IRP_MJ_POWER : EB35D5F0 20:07:49:765 3024 IRP_MJ_SYSTEM_CONTROL : EB35BA6E 20:07:49:765 3024 IRP_MJ_DEVICE_CHANGE : 804F4562 20:07:49:765 3024 IRP_MJ_QUERY_QUOTA : 804F4562 20:07:49:765 3024 IRP_MJ_SET_QUOTA : 804F4562 20:07:49:765 3024 siohd: 0 20:07:49:781 3024 C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS - Verdict: Clean 20:07:49:781 3024 20:07:49:781 3024 Driver Name: Disk 20:07:49:781 3024 IRP_MJ_CREATE : F76CABB0 20:07:49:781 3024 IRP_MJ_CREATE_NAMED_PIPE : 804F4562 20:07:49:781 3024 IRP_MJ_CLOSE : F76CABB0 20:07:49:781 3024 IRP_MJ_READ : F76C4D1F 20:07:49:781 3024 IRP_MJ_WRITE : F76C4D1F 20:07:49:781 3024 IRP_MJ_QUERY_INFORMATION : 804F4562 20:07:49:781 3024 IRP_MJ_SET_INFORMATION : 804F4562 20:07:49:781 3024 IRP_MJ_QUERY_EA : 804F4562 20:07:49:781 3024 IRP_MJ_SET_EA : 804F4562 20:07:49:781 3024 IRP_MJ_FLUSH_BUFFERS : F76C52E2 20:07:49:781 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 20:07:49:781 3024 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 20:07:49:781 3024 IRP_MJ_DIRECTORY_CONTROL : 804F4562 20:07:49:781 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 20:07:49:781 3024 IRP_MJ_DEVICE_CONTROL : F76C53BB 20:07:49:781 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 20:07:49:781 3024 IRP_MJ_SHUTDOWN : F76C52E2 20:07:49:781 3024 IRP_MJ_LOCK_CONTROL : 804F4562 20:07:49:781 3024 IRP_MJ_CLEANUP : 804F4562 20:07:49:781 3024 IRP_MJ_CREATE_MAILSLOT : 804F4562 20:07:49:781 3024 IRP_MJ_QUERY_SECURITY : 804F4562 20:07:49:781 3024 IRP_MJ_SET_SECURITY : 804F4562 20:07:49:781 3024 IRP_MJ_POWER : F76C6C82 20:07:49:781 3024 IRP_MJ_SYSTEM_CONTROL : F76CB99E 20:07:49:781 3024 IRP_MJ_DEVICE_CHANGE : 804F4562 20:07:49:781 3024 IRP_MJ_QUERY_QUOTA : 804F4562 20:07:49:781 3024 IRP_MJ_SET_QUOTA : 804F4562 20:07:49:781 3024 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 20:07:49:781 3024 sion 20:07:49:796 3024 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 20:07:49:796 3024 20:07:49:796 3024 Driver Name: Disk 20:07:49:796 3024 IRP_MJ_CREATE : F76CABB0 20:07:49:796 3024 IRP_MJ_CREATE_NAMED_PIPE : 804F4562 20:07:49:796 3024 IRP_MJ_CLOSE : F76CABB0 20:07:49:796 3024 IRP_MJ_READ : F76C4D1F 20:07:49:796 3024 IRP_MJ_WRITE : F76C4D1F 20:07:49:796 3024 IRP_MJ_QUERY_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_SET_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_QUERY_EA : 804F4562 20:07:49:796 3024 IRP_MJ_SET_EA : 804F4562 20:07:49:796 3024 IRP_MJ_FLUSH_BUFFERS : F76C52E2 20:07:49:796 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_DIRECTORY_CONTROL : 804F4562 20:07:49:796 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 20:07:49:796 3024 IRP_MJ_DEVICE_CONTROL : F76C53BB 20:07:49:796 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 20:07:49:796 3024 IRP_MJ_SHUTDOWN : F76C52E2 20:07:49:796 3024 IRP_MJ_LOCK_CONTROL : 804F4562 20:07:49:796 3024 IRP_MJ_CLEANUP : 804F4562 20:07:49:796 3024 IRP_MJ_CREATE_MAILSLOT : 804F4562 20:07:49:796 3024 IRP_MJ_QUERY_SECURITY : 804F4562 20:07:49:796 3024 IRP_MJ_SET_SECURITY : 804F4562 20:07:49:796 3024 IRP_MJ_POWER : F76C6C82 20:07:49:796 3024 IRP_MJ_SYSTEM_CONTROL : F76CB99E 20:07:49:796 3024 IRP_MJ_DEVICE_CHANGE : 804F4562 20:07:49:796 3024 IRP_MJ_QUERY_QUOTA : 804F4562 20:07:49:796 3024 IRP_MJ_SET_QUOTA : 804F4562 20:07:49:796 3024 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 20:07:49:796 3024 sion 20:07:49:796 3024 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 20:07:49:796 3024 20:07:49:796 3024 Driver Name: Disk 20:07:49:796 3024 IRP_MJ_CREATE : F76CABB0 20:07:49:796 3024 IRP_MJ_CREATE_NAMED_PIPE : 804F4562 20:07:49:796 3024 IRP_MJ_CLOSE : F76CABB0 20:07:49:796 3024 IRP_MJ_READ : F76C4D1F 20:07:49:796 3024 IRP_MJ_WRITE : F76C4D1F 20:07:49:796 3024 IRP_MJ_QUERY_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_SET_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_QUERY_EA : 804F4562 20:07:49:796 3024 IRP_MJ_SET_EA : 804F4562 20:07:49:796 3024 IRP_MJ_FLUSH_BUFFERS : F76C52E2 20:07:49:796 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_SET_VOLUME_INFORMATION : 804F4562 20:07:49:796 3024 IRP_MJ_DIRECTORY_CONTROL : 804F4562 20:07:49:796 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 804F4562 20:07:49:796 3024 IRP_MJ_DEVICE_CONTROL : F76C53BB 20:07:49:796 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : F76C8F28 20:07:49:796 3024 IRP_MJ_SHUTDOWN : F76C52E2 20:07:49:796 3024 IRP_MJ_LOCK_CONTROL : 804F4562 20:07:49:812 3024 IRP_MJ_CLEANUP : 804F4562 20:07:49:812 3024 IRP_MJ_CREATE_MAILSLOT : 804F4562 20:07:49:812 3024 IRP_MJ_QUERY_SECURITY : 804F4562 20:07:49:812 3024 IRP_MJ_SET_SECURITY : 804F4562 20:07:49:812 3024 IRP_MJ_POWER : F76C6C82 20:07:49:812 3024 IRP_MJ_SYSTEM_CONTROL : F76CB99E 20:07:49:812 3024 IRP_MJ_DEVICE_CHANGE : 804F4562 20:07:49:812 3024 IRP_MJ_QUERY_QUOTA : 804F4562 20:07:49:812 3024 IRP_MJ_SET_QUOTA : 804F4562 20:07:49:812 3024 TDL3_StartIoLastChanceHookDetect: Unable to dump StartIo handler code 20:07:49:812 3024 sion 20:07:49:812 3024 C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean 20:07:49:812 3024 20:07:49:812 3024 Driver Name: atapi 20:07:49:812 3024 IRP_MJ_CREATE : 8575F618 20:07:49:812 3024 IRP_MJ_CREATE_NAMED_PIPE : 8575F618 20:07:49:812 3024 IRP_MJ_CLOSE : 8575F618 20:07:49:812 3024 IRP_MJ_READ : 8575F618 20:07:49:812 3024 IRP_MJ_WRITE : 8575F618 20:07:49:812 3024 IRP_MJ_QUERY_INFORMATION : 8575F618 20:07:49:812 3024 IRP_MJ_SET_INFORMATION : 8575F618 20:07:49:812 3024 IRP_MJ_QUERY_EA : 8575F618 20:07:49:812 3024 IRP_MJ_SET_EA : 8575F618 20:07:49:812 3024 IRP_MJ_FLUSH_BUFFERS : 8575F618 20:07:49:812 3024 IRP_MJ_QUERY_VOLUME_INFORMATION : 8575F618 20:07:49:812 3024 IRP_MJ_SET_VOLUME_INFORMATION : 8575F618 20:07:49:812 3024 IRP_MJ_DIRECTORY_CONTROL : 8575F618 20:07:49:812 3024 IRP_MJ_FILE_SYSTEM_CONTROL : 8575F618 20:07:49:812 3024 IRP_MJ_DEVICE_CONTROL : 8575F618 20:07:49:812 3024 IRP_MJ_INTERNAL_DEVICE_CONTROL : 8554D150 20:07:49:812 3024 IRP_MJ_SHUTDOWN : 8575F618 20:07:49:812 3024 IRP_MJ_LOCK_CONTROL : 8575F618 20:07:49:812 3024 IRP_MJ_CLEANUP : 8575F618 20:07:49:812 3024 IRP_MJ_CREATE_MAILSLOT : 8575F618 20:07:49:812 3024 IRP_MJ_QUERY_SECURITY : 8575F618 20:07:49:812 3024 IRP_MJ_SET_SECURITY : 8575F618 20:07:49:812 3024 IRP_MJ_POWER : 8575F618 20:07:49:812 3024 IRP_MJ_SYSTEM_CONTROL : 8575F618 20:07:49:812 3024 IRP_MJ_DEVICE_CHANGE : 8575F618 20:07:49:812 3024 IRP_MJ_QUERY_QUOTA : 8575F618 20:07:49:812 3024 IRP_MJ_SET_QUOTA : 8575F618 20:07:49:812 3024 Driver "atapi" StartIo handler infected by TDSS rootkit … 20:07:49:812 3024 cured 20:07:49:812 3024 siohd: 0 20:07:49:828 3024 C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean 20:07:49:828 3024 20:07:49:828 3024 Completed 20:07:49:828 3024 20:07:49:828 3024 Results: 20:07:49:828 3024 Memory objects infected / cured / cured on reboot: 1 / 1 / 0 20:07:49:828 3024 Registry objects infected / cured / cured on reboot: 0 / 0 / 0 20:07:49:828 3024 File objects infected / cured / cured on reboot: 0 / 0 / 0 20:07:49:828 3024 20:07:49:828 3024 KLMD(ARK) unloaded successfully

seanakaforty

Post #36March 2, 2010, 1:38 AM UTC last edited March 2, 2010, 1:38 AM UTC

…And here's the combofix log

ComboFix 10-03-01.01 - Brittany 03/01/2010 20:20:20.10.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.469 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-27 04:35 . 2010-02-27 04:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-02-19 03:17 . 2010-02-20 01:31 52224 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-19 03:16 . 2010-02-27 03:50 117760 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-19 03:15 . 2010-02-19 04:15 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com
2010-02-04 04:41 . 2010-02-04 04:43 ——– dc-h–w- c:\windows\ie8
2010-02-04 04:38 . 2010-02-04 04:38 ——– d—–w- C:\68c56d1c6c07c5dd1b
2010-02-04 03:35 . 2010-02-04 03:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-04 03:30 . 2010-02-04 03:30 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-21 23:58 . 2004-08-04 12:00 96512 ——w- c:\windows\system32\drivers\atapi.sys
2010-02-19 03:15 . 2008-09-26 20:33 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-19 01:19 . 2008-09-28 17:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 01:19 . 2008-09-28 17:48 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-04 03:30 . 2007-04-30 02:14 ——– d—–w- c:\program files\Google
2010-02-01 20:04 . 2007-05-12 13:22 5908 —-a-w- c:\documents and settings\Brittany\Application Data\wklnhst.dat
2010-01-27 18:05 . 2009-11-01 22:49 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-18 05:00 . 2007-05-05 15:46 ——– d—–w- c:\documents and settings\Brittany\Application Data\LimeWire
2010-01-08 02:49 . 2010-01-08 02:48 ——– d—–w- c:\program files\iTunes
2010-01-08 02:48 . 2010-01-08 02:48 ——– d—–w- c:\program files\iPod
2010-01-08 02:48 . 2009-10-18 00:55 ——– d—–w- c:\program files\Common Files\Apple
2010-01-08 02:45 . 2010-01-08 02:44 ——– d—–w- c:\program files\QuickTime
2010-01-08 02:40 . 2010-01-08 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2010-01-07 21:07 . 2008-09-28 17:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-09-28 17:46 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2004-08-04 12:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-04 12:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2004-08-10 18:01 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2004-08-04 12:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-21_22.57.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-02 01:02 . 2010-03-02 01:02 16384 c:\windows\Temp\Perflib_Perfdata_734.dat
+ 2007-04-30 01:58 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
- 2007-04-30 01:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2004-08-04 00:56 . 2009-11-27 17:11 17920 c:\windows\system32\msyuv.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 28672 c:\windows\system32\msvidc32.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 11264 c:\windows\system32\msrle32.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 11264 c:\windows\system32\msrle32.dll
+ 2004-08-04 00:56 . 2009-11-27 16:07 48128 c:\windows\system32\iyuv_32.dll
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\system32\dllcache\msyuv.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 28672 c:\windows\system32\dllcache\msvidc32.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 11264 c:\windows\system32\dllcache\msrle32.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\system32\dllcache\iyuv_32.dll
+ 2009-12-14 07:08 . 2009-12-14 07:08 33280 c:\windows\system32\dllcache\csrsrv.dll
- 2009-06-10 14:13 . 2009-06-10 14:13 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2009-06-10 14:13 . 2009-11-27 16:07 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-04 12:00 . 2009-12-12 15:06 96512 c:\windows\system32\dllcache\atapi.sys
+ 2004-08-04 12:00 . 2010-02-21 23:58 96512 c:\windows\system32\dllcache\atapi.sys
- 2007-05-05 03:03 . 2010-02-21 20:30 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-05 03:03 . 2010-03-02 01:07 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2010-02-26 01:26 . 2010-03-02 01:07 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 12:00 . 2009-11-27 16:07 84992 c:\windows\system32\avifil32.dll
- 2004-08-04 12:00 . 2009-06-10 14:13 84992 c:\windows\system32\avifil32.dll
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\Driver Cache\i386\msyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
+ 2001-08-17 22:36 . 2009-11-27 16:07 8704 c:\windows\system32\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\system32\dllcache\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 474112 c:\windows\system32\shlwapi.dll
+ 2004-08-04 12:00 . 2009-12-08 09:23 474112 c:\windows\system32\shlwapi.dll
+ 2008-12-24 14:35 . 2009-12-31 16:50 353792 c:\windows\system32\dllcache\srv.sys
+ 2009-12-08 09:23 . 2009-12-08 09:23 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-12-16 18:43 . 2009-12-16 18:43 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2008-12-24 14:34 . 2009-12-04 18:22 455424 c:\windows\system32\dllcache\mrxsmb.sys
+ 2008-12-24 14:34 . 2009-12-04 18:22 455424 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2004-08-04 12:00 . 2009-11-27 17:11 1291776 c:\windows\system32\quartz.dll
+ 2008-05-07 05:12 . 2009-11-27 17:11 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2007-05-05 16:20 . 2010-02-01 16:26 30364104 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 282624]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-05-10 15:12 90112 —-a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-08-23 21:14 1032192 —-a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 02:57 395776 —-a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-04-30 02:14 169984 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 —-a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2009-10-29 11:54 1218008 —-a-w- c:\program files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\modemonhold]
2003-09-10 07:24 20480 —-a-w- c:\program files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 16:10 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"4032:TCP"= 4032:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"3246:TCP"= 3246:TCP:Services
"5193:TCP"= 5193:TCP:Services
"8193:TCP"= 8193:TCP:Services

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 10:30 PM 135664]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/26/2009 9:47 PM 644096]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]

— Other Services/Drivers In Memory —

*Deregistered* - klmd21
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2009-10-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]

2009-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 20:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x8554D150]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76c8f28
\Driver\ACPI -> ACPI.sys @ 0xf755bcb8
\Driver\atapi -> atapi.sys @ 0xf7513852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x84eb4330
PacketIndicateHandler -> NDIS.sys @ 0xf73e3a0d
SendHandler -> NDIS.sys @ 0xf73f7b40
user & kernel MBR OK

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WlNotify.dll

- - - - - - - > 'lsass.exe'(940)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(1228)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-03-01 20:34:57
ComboFix-quarantined-files.txt 2010-03-02 01:34
ComboFix2.txt 2010-02-25 01:17
ComboFix3.txt 2010-02-25 00:05
ComboFix4.txt 2010-02-23 23:54
ComboFix5.txt 2010-03-02 01:18

Pre-Run: 28,458,459,136 bytes free
Post-Run: 28,448,620,544 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 9D2068218A2361D9827591121AA4F2CD

LDTate

Post #37March 2, 2010, 1:49 AM UTC

I'm not sure if we killed that rootkit. I'm going to ask one of the experts to have a look.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"=-
"52344:TCP"=-
"2479:TCP"=-
"4032:TCP"=-
"3389:TCP"=-
"3246:TCP"=-
"5193:TCP"=-
"8193:TCP"=-

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

seanakaforty

Post #38March 2, 2010, 2:19 AM UTC

ComboFix 10-03-01.01 - Brittany 03/01/2010 21:04:16.11.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.469 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Brittany\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *disabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2010-02-02 to 2010-03-02 )))))))))))))))))))))))))))))))
.

2010-02-27 04:35 . 2010-02-27 04:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
2010-02-19 03:17 . 2010-02-20 01:31 52224 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-02-19 03:16 . 2010-02-27 03:50 117760 —-a-w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2010-02-19 03:15 . 2010-02-19 04:15 ——– d—–w- c:\program files\SUPERAntiSpyware
2010-02-19 03:15 . 2010-02-19 03:15 ——– d—–w- c:\documents and settings\Brittany\Application Data\SUPERAntiSpyware.com
2010-02-04 04:41 . 2010-02-04 04:43 ——– dc-h–w- c:\windows\ie8
2010-02-04 04:38 . 2010-02-04 04:38 ——– d—–w- C:\68c56d1c6c07c5dd1b
2010-02-04 03:35 . 2010-02-04 03:35 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-02-04 03:30 . 2010-02-04 03:30 ——– d—–w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-21 23:58 . 2004-08-04 12:00 96512 ——w- c:\windows\system32\drivers\atapi.sys
2010-02-19 03:15 . 2008-09-26 20:33 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2010-02-19 01:19 . 2008-09-28 17:46 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-02-19 01:19 . 2008-09-28 17:48 5115824 —-a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-02-04 03:30 . 2007-04-30 02:14 ——– d—–w- c:\program files\Google
2010-02-01 20:04 . 2007-05-12 13:22 5908 —-a-w- c:\documents and settings\Brittany\Application Data\wklnhst.dat
2010-01-27 18:05 . 2009-11-01 22:49 664 —-a-w- c:\windows\system32\d3d9caps.dat
2010-01-18 05:00 . 2007-05-05 15:46 ——– d—–w- c:\documents and settings\Brittany\Application Data\LimeWire
2010-01-08 02:49 . 2010-01-08 02:48 ——– d—–w- c:\program files\iTunes
2010-01-08 02:48 . 2010-01-08 02:48 ——– d—–w- c:\program files\iPod
2010-01-08 02:48 . 2009-10-18 00:55 ——– d—–w- c:\program files\Common Files\Apple
2010-01-08 02:45 . 2010-01-08 02:44 ——– d—–w- c:\program files\QuickTime
2010-01-08 02:40 . 2010-01-08 02:40 79144 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2010-01-07 21:07 . 2008-09-28 17:46 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2008-09-28 17:46 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-05 10:00 . 2004-08-04 12:00 832512 ——w- c:\windows\system32\wininet.dll
2010-01-05 10:00 . 2004-08-04 12:00 78336 —-a-w- c:\windows\system32\ieencode.dll
2010-01-05 10:00 . 2004-08-04 12:00 17408 ——w- c:\windows\system32\corpol.dll
2009-12-31 16:50 . 2004-08-04 12:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-16 18:43 . 2004-08-10 18:01 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2004-08-04 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
2009-12-04 18:22 . 2004-08-04 12:00 455424 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-21_22.57.30 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-02 01:58 . 2010-03-02 01:58 16384 c:\windows\Temp\Perflib_Perfdata_258.dat
+ 2007-04-30 01:58 . 2010-01-23 08:11 46080 c:\windows\system32\tzchange.exe
- 2007-04-30 01:58 . 2009-10-28 15:07 46080 c:\windows\system32\tzchange.exe
+ 2004-08-04 00:56 . 2009-11-27 17:11 17920 c:\windows\system32\msyuv.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 28672 c:\windows\system32\msvidc32.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 11264 c:\windows\system32\msrle32.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 11264 c:\windows\system32\msrle32.dll
+ 2004-08-04 00:56 . 2009-11-27 16:07 48128 c:\windows\system32\iyuv_32.dll
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\system32\dllcache\msyuv.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 28672 c:\windows\system32\dllcache\msvidc32.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 11264 c:\windows\system32\dllcache\msrle32.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\system32\dllcache\iyuv_32.dll
+ 2009-12-14 07:08 . 2009-12-14 07:08 33280 c:\windows\system32\dllcache\csrsrv.dll
- 2009-06-10 14:13 . 2009-06-10 14:13 84992 c:\windows\system32\dllcache\avifil32.dll
+ 2009-06-10 14:13 . 2009-11-27 16:07 84992 c:\windows\system32\dllcache\avifil32.dll
- 2004-08-04 12:00 . 2009-12-12 15:06 96512 c:\windows\system32\dllcache\atapi.sys
+ 2004-08-04 12:00 . 2010-02-21 23:58 96512 c:\windows\system32\dllcache\atapi.sys
- 2007-05-05 03:03 . 2010-02-21 20:30 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2007-05-05 03:03 . 2010-03-02 01:07 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2004-08-04 12:00 . 2009-06-10 14:13 84992 c:\windows\system32\avifil32.dll
+ 2004-08-04 12:00 . 2009-11-27 16:07 84992 c:\windows\system32\avifil32.dll
+ 2009-11-27 17:11 . 2009-11-27 17:11 17920 c:\windows\Driver Cache\i386\msyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 48128 c:\windows\Driver Cache\i386\iyuv_32.dll
+ 2001-08-17 22:36 . 2009-11-27 16:07 8704 c:\windows\system32\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\system32\dllcache\tsbyuv.dll
+ 2009-11-27 16:07 . 2009-11-27 16:07 8704 c:\windows\Driver Cache\i386\tsbyuv.dll
- 2004-08-04 12:00 . 2008-04-14 00:12 474112 c:\windows\system32\shlwapi.dll
+ 2004-08-04 12:00 . 2009-12-08 09:23 474112 c:\windows\system32\shlwapi.dll
+ 2008-12-24 14:35 . 2009-12-31 16:50 353792 c:\windows\system32\dllcache\srv.sys
+ 2009-12-08 09:23 . 2009-12-08 09:23 474112 c:\windows\system32\dllcache\shlwapi.dll
+ 2009-12-16 18:43 . 2009-12-16 18:43 343040 c:\windows\system32\dllcache\mspaint.exe
+ 2008-12-24 14:34 . 2009-12-04 18:22 455424 c:\windows\system32\dllcache\mrxsmb.sys
+ 2008-12-24 14:34 . 2009-12-04 18:22 455424 c:\windows\Driver Cache\i386\mrxsmb.sys
+ 2004-08-04 12:00 . 2009-11-27 17:11 1291776 c:\windows\system32\quartz.dll
+ 2008-05-07 05:12 . 2009-11-27 17:11 1291776 c:\windows\system32\dllcache\quartz.dll
+ 2007-05-05 16:20 . 2010-02-01 16:26 30364104 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-10 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-09-22 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"SigmatelSysTrayApp"="stsystra.exe" [2006-09-22 282624]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-10-29 1218008]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"tscuninstall"="c:\windows\system32\tscupgrd.exe" [2004-08-04 44544]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 —-a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package Menu.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package Menu.lnk
backup=c:\windows\pss\Picture Package Menu.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Picture Package VCD Maker.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Picture Package VCD Maker.lnk
backup=c:\windows\pss\Picture Package VCD Maker.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
c:\windows\system32\dumprep 0 -u [X]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
2006-05-10 15:12 90112 —-a-w- c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 ——w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2006-08-23 21:14 1032192 —-a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
2006-08-29 02:57 395776 —-a-w- c:\program files\Dell Support\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2005-12-10 01:29 49152 —-a-w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-04-30 02:14 169984 —-a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
2006-11-13 17:39 1289000 —-a-w- c:\program files\Microsoft ActiveSync\wcescomm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcagent_exe]
2009-10-29 11:54 1218008 —-a-w- c:\program files\McAfee.com\Agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\modemonhold]
2003-09-10 07:24 20480 —-a-w- c:\program files\NetWaiting\netwaiting.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msmsgs]
2008-04-14 00:12 1695232 ——w- c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
2007-07-10 16:10 68856 —-a-w- c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"9569:TCP"= 9569:TCP:Services

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/26/2009 10:05 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/26/2009 10:05 AM 72944]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/3/2010 10:30 PM 135664]
S3 rt2870;Linksys 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [12/26/2009 9:47 PM 644096]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/26/2009 10:05 AM 7408]
.
Contents of the 'Scheduled Tasks' folder

2010-03-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2010-03-01 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-04 03:30]

2009-10-15 c:\windows\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]

2009-11-01 c:\windows\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-04-30 16:22]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uStart Page = hxxp://www.yahoo.com/
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-01 21:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x854C20C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf76c8f28
\Driver\ACPI -> ACPI.sys @ 0xf755bcb8
\Driver\atapi -> atapi.sys @ 0xf7513852
IoDeviceObjectType -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
NDIS: Broadcom 440x 10/100 Integrated Controller -> SendCompleteHandler -> 0x84ec6330
PacketIndicateHandler -> NDIS.sys @ 0xf73e3a0d
SendHandler -> NDIS.sys @ 0xf73f7b40
user & kernel MBR OK

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\WININET.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(940)
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3232)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2010-03-01 21:17:57
ComboFix-quarantined-files.txt 2010-03-02 02:17
ComboFix2.txt 2010-03-02 01:35
ComboFix3.txt 2010-02-25 01:17
ComboFix4.txt 2010-02-25 00:05
ComboFix5.txt 2010-03-02 02:02

Pre-Run: 28,463,120,384 bytes free
Post-Run: 28,421,996,544 bytes free

Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
- - End Of File - - 8DCADC22653F96534B80BE9EDA5025CF

LDTate

Post #39March 2, 2010, 2:25 AM UTC

Try this.

Please not the space mbr.ex e -t

Go to Start > Run and type: cmd.exe
press Ok.
At the command prompt type: c:\mbr.exe -t >>"C:\mbr.log"
press Enter.
A "DOS" box will open and quickly disappear. That is normal.
A log file named mbr.log will be created and saved to the root of the system drive (usually C:\).
Copy and paste the results of the mbr.log in your next reply.

seanakaforty

Post #40March 2, 2010, 2:30 AM UTC

when I try typing: c:\mbr.exe -t >>"C:\mbr.log" I get the following message: 'c:\mbr.exe is not recognized as an internal or external command, operable proram or batch file.

LDTate

Post #41March 2, 2010, 2:36 AM UTC

Please download mbr.exe and save it to your root directory, usually C:\ <- (Important!).

Now try it.

seanakaforty

Post #42March 2, 2010, 2:40 AM UTC

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe catchme.sys CLASSPNP.SYS disk.sys >>UNKNOWN [0x854C20C8]<<
kernel: MBR read successfully
user & kernel MBR OK

LDTate

Post #43March 2, 2010, 2:42 AM UTC

Click Start>Run
Type in

mbr.exe -f
Note the space between the e -f

seanakaforty

Post #44March 2, 2010, 2:47 AM UTC

OK, I did it. Was it supposed to genrate a log or something? The last mbr.log on her C drive is from 9:38pm, which would be the one that I posted above.

LDTate

Post #45March 2, 2010, 2:48 AM UTC

No log with that one. Run a new Combofix scan.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Help needed! All kinds symptoms on XP laptop (HJT log

✨ Ask AI

Ask AI