What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Protection Center - for Home PC

14 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 10:03:17 AM, on 6/8/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16981)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\Hunter\LOCALS~1\Temp\mscdexnt.exe
C:\Program Files\PowerISO\SCDEmuApp.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\DOCUME~1\Hunter\LOCALS~1\Temp\wscsvc32.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\msiexec.exe
C:\DOCUME~1\Hunter\LOCALS~1\Temp\mscdexnt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\DOCUME~1\Hunter\LOCALS~1\Temp\mscdexnt.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.firstinterstatebank.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.5126.1836\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SCDEmuApp.exe] C:\Program Files\PowerISO\SCDEmuApp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ADUserMon] C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" –force_start_minimized
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Protection Center] "C:\Program Files\Protection Center\cntprot.exe" -noscan
O4 - Startup: Sid Registration.lnk = D:\ATR1.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm080YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187741060125
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1187741047218
O16 - DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} (Hybrid WebView) - http://209.181.6.25/WebViewS.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

–
End of file - 8188 bytes



Started last week with a web re-direct, then became more invasive. Thanks,
Post #2
Hello coldsmoke and welcome to WhatTheTech. Please follow these guidelines:
  • Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
  • Please do not run any scans or install/uninstall any applications without being directed to do so.
  • Please follow my instructions carefully and in the order they are posted.
  • Any underlined text in my posts indicates a clickable link.
  • You should print any instructions I give you for ease of use and reference.
  • If you have any questions at all, please stop and ask before proceeding.
🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.
🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.
  • Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)a
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:
  • Make sure that your security software is disabled
  • Uncheck the box next to "Files" this time also
  • If you still can't run it, try in the Safe Mode
Please include the following in your next post:
  • DDS and Attach.txt logs
  • GMER log
Post #3
DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 8:34:26.40 on Wed 06/09/2010
Internet Explorer: 7.0.5730.11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.406 [GMT -6:00]

AV: Protection Center *On-access scanning enabled* (Outdated) {28e00e3b-806e-4533-925c-f4c3d79514b9}

============== Running Processes ===============

c:\windows\system32\svchost -k dcomlaunch
svchost.exe
c:\windows\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
c:\windows\system32\svchost.exe -k imgsvc
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUME~1\Hunter\LOCALS~1\Temp\mscdexnt.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\PowerISO\SCDEmuApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\DOCUME~1\Hunter\LOCALS~1\Temp\wscsvc32.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Protection Center\cntprot.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Hunter\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Hunter\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = https://www.firstinterstatebank.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.5126.1836\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [BitTorrent] "c:\program files\bittorrent\bittorrent.exe" –force_start_minimized
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Sonic RecordNow!]
uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
uRun: [Google Update] "c:\documents and settings\hunter\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [Protection Center] "c:\program files\protection center\cntprot.exe" -noscan
mRun: [SCDEmuApp.exe] c:\program files\poweriso\SCDEmuApp.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe
mRun: [SoundMAX] "c:\program files\analog devices\soundmax\Smax4.exe" /tray
mRun: [ADUserMon] c:\program files\iomega\autodisk\ADUserMon.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\hunter\startm~1\programs\startup\sidreg~1.lnk - d:\ATR1.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-system: DisableTaskMgr = 1 (0x1)
IE: &Search - http://edits.mywebsearch.com/toolbaredits/…?p=ZUxdm080YYUS
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
Trusted Zone: customdining.com\www
DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - hxxp://ak.exe.imgfarm.com/images/nocache/funwebproducts/ei/MyFunCardsFWBInitialSetup1.0.0.15-3.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1187741060125
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187741047218
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_08-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R3 s3m;s3m;c:\windows\system32\drivers\s3m.sys [2009-9-7 166720]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-9-23 133104]

============== File Associations ===============

.exe=secfile

=============== Created Last 30 ================

2010-06-08 16:01:44 0 d—–w- c:\program files\Trend Micro
2010-06-08 15:13:28 0 d—–w- c:\program files\Protection Center
2010-06-07 14:39:08 0 d—–w- c:\docume~1\hunter\applic~1\Office Genuine Advantage

==================== Find3M ====================

2010-06-07 22:24:07 2188 —-a-w- c:\windows\system32\d3d9caps.dat
2003-07-31 09:53:28 147456 —-a-w- c:\windows\inf\EL2K_XP.sys
2003-07-31 09:50:16 448768 —-a-w- c:\windows\inf\EL2K_N64.sys
2003-07-31 09:43:00 147456 —-a-w- c:\windows\inf\EL2K_2K.sys
2009-09-24 00:59:52 32768 –sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009092320090924\index.dat

============= FINISH: 8:34:57.18 ===============






Tried to run GMER three times - the last time in Safe Mode without Networking. Scan is never allowed to complete without system shutdown. Please advise. Thanks

Attachments:

Post #4
coldsmoke,

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (BitTorrent & Limewire) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Malware authors use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

Please include the following in your next post:
  • ComboFix log
Post #5
ComboFix 10-06-09.04 - Hlacey 06/10/2010 10:40:04.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.745 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Hunter\LOCALS~1\Temp\install_flash_player.exe
c:\docume~1\Hunter\LOCALS~1\Temp\wscsvc32.exe
c:\documents and settings\All Users\Application Data\pragmamfeklnmal.dll
c:\documents and settings\All Users\Favorites\_favdata.dat
c:\documents and settings\Hunter\Desktop\nudetube.com.lnk
c:\documents and settings\Hunter\Desktop\pornotube.com.lnk
c:\documents and settings\Hunter\Desktop\spam001.exe
c:\documents and settings\Hunter\Desktop\spam003.exe
c:\documents and settings\Hunter\Desktop\troj000.exe
c:\documents and settings\Hunter\Desktop\youporn.com.lnk
c:\documents and settings\Hunter\g2ax_customer_downloadhelper_win32_x86.exe
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\About.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Activate.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Buy.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Protection Center Support.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Protection Center.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Scan.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Settings.lnk
c:\documents and settings\Hunter\Start Menu\Programs\Protection Center\Update.lnk
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search2
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\program files\Protection Center
c:\program files\Protection Center\about.ico
c:\program files\Protection Center\activate.ico
c:\program files\Protection Center\buy.ico
c:\program files\Protection Center\cnt.db
c:\program files\Protection Center\cntext.dll
c:\program files\Protection Center\cnthook.dll
c:\program files\Protection Center\cntprot.exe
c:\program files\Protection Center\help.ico
c:\program files\Protection Center\scan.ico
c:\program files\Protection Center\settings.ico
c:\program files\Protection Center\splash.mp3
c:\program files\Protection Center\Uninstall.exe
c:\program files\Protection Center\update.ico
c:\program files\Protection Center\virus.mp3
c:\windows\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf
c:\windows\Downloaded Program Files\LiveView
c:\windows\Downloaded Program Files\LiveView\disable.jpg
c:\windows\Downloaded Program Files\LiveView\down.jpg
c:\windows\Downloaded Program Files\LiveView\Logo.tif
c:\windows\Downloaded Program Files\LiveView\mask.jpg
c:\windows\Downloaded Program Files\LiveView\normal.jpg
c:\windows\Downloaded Program Files\LiveView\over.jpg
c:\windows\Downloaded Program Files\LiveView\skin.ini
c:\windows\PRAGMAwwkibcjixt
c:\windows\PRAGMAwwkibcjixt\pragmabbr.dll
c:\windows\PRAGMAwwkibcjixt\PRAGMAc.dll
c:\windows\PRAGMAwwkibcjixt\PRAGMAcfg.ini
c:\windows\PRAGMAwwkibcjixt\PRAGMAd.sys
c:\windows\PRAGMAwwkibcjixt\pragmaserf.dll
c:\windows\PRAGMAwwkibcjixt\PRAGMAsrcr.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_PRAGMAwwkibcjixt
——-\Legacy_PRAGMAwwkibcjixt


((((((((((((((((((((((((( Files Created from 2010-05-10 to 2010-06-10 )))))))))))))))))))))))))))))))
.

2010-06-08 16:01 . 2010-06-08 16:01 388096 —-a-r- c:\documents and settings\Hunter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-08 16:01 . 2010-06-08 16:01 ——– d—–w- c:\program files\Trend Micro
2010-06-07 22:13 . 2010-06-07 22:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-06-07 14:39 . 2010-06-07 14:39 ——– d—–w- c:\documents and settings\Hunter\Application Data\Office Genuine Advantage
2010-05-22 22:22 . 2010-05-22 22:22 503808 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\msvcp71.dll
2010-05-22 22:22 . 2010-05-22 22:22 499712 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\jmc.dll
2010-05-22 22:22 . 2010-05-22 22:22 348160 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\msvcr71.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-07 22:24 . 2009-09-07 20:25 2188 —-a-w- c:\windows\system32\d3d9caps.dat
2010-03-21 01:04 . 2010-03-21 01:04 79488 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Google Update"="c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-07 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SCDEmuApp.exe"="c:\program files\PowerISO\SCDEmuApp.exe" [2005-10-16 167936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-07 149280]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-2 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 s3m;s3m;c:\windows\system32\drivers\s3m.sys [9/7/2009 12:56 PM 166720]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [9/23/2009 7:11 PM 133104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/8/2006 11:35 AM 611064]
.
Contents of the 'Scheduled Tasks' folder

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 19:53]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 19:53]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-1972579041-725345543-1003Core.job
- c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-07 19:53]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-1972579041-725345543-1003UA.job
- c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-07 19:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.firstinterstatebank.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-BitTorrent - c:\program files\BitTorrent\bittorrent.exe
HKCU-Run-Sonic RecordNow! - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKCU-Run-Protection Center - c:\program files\Protection Center\cntprot.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-10 10:48
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: >>UNKNOWN [0x804D7000]<< >>UNKNOWN [0xF795B000]<< >>UNKNOWN [0xF7643000]<< >>UNKNOWN [0xF7633000]<< >>UNKNOWN [0xF787B000]<< >>UNKNOWN [0x806FF000]<< >>UNKNOWN [0xF7594000]<< >>UNKNOWN [0xF7526000]<< >>UNKNOWN [0xF7BAB000]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> 0xf7647f28
\Driver\ACPI -> 0xf759acb8
\Driver\atapi -> 0xf752c852
IoDeviceObjectType -> DeleteProcedure -> 0x805e668e
ParseProcedure -> 0x8057b6b1
\Device\Harddisk0\DR0 -> DeleteProcedure -> 0x805e668e
ParseProcedure -> 0x8057b6b1
NDIS: 3Com Gigabit LOM (3C940) -> SendCompleteHandler -> 0xf7438bb0
PacketIndicateHandler -> 0xf7445a21
SendHandler -> 0xf742387b
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-583907252-1972579041-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2010-06-10 10:50:20
ComboFix-quarantined-files.txt 2010-06-10 16:50

Pre-Run: 51,491,594,240 bytes free
Post-Run: 55,739,240,448 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - 50B0B5507394E5428F658AC65F77FD90




RE: Bittorrent and Limewire - thanks for the reminder. I haven't used those programs in years - after bad experiences of course. I will remove as soon as you give me the all clear.

Also, Combofix seemed to have cured the major symptoms, but perhaps you have more diagnostics.


Thanks.
Post #6
coldsmoke,

We still have work to do; this machine is pretty heavily infected.

🖼Click to load external image (Posted Image) You are infected with a Rootkit. I recommend that you limit your online activity until we have your system clean and change all your passwords from a different, clean computer.

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

MBR::

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) Download Pragmafix by Noahdfear from here and save it in a place you can remember such as, your desktop.
  • Click on Pragmafix.exe to run it
  • It shall produce PragmaFix.log in the C:\ folder.
  • Please post the results here.
Please include the following in your next post:
  • ComboFix log
  • PragmaFix log
Post #7
ComboFix 10-06-10.03 - Hlacey 06/10/2010 19:20:27.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.769 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Hunter\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2010-05-11 to 2010-06-11 )))))))))))))))))))))))))))))))
.

2010-06-08 16:01 . 2010-06-08 16:01 ——– d—–w- c:\program files\Trend Micro
2010-06-07 22:13 . 2010-06-07 22:13 ——– d—–w- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2010-06-07 14:39 . 2010-06-07 14:39 ——– d—–w- c:\documents and settings\Hunter\Application Data\Office Genuine Advantage

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-08 16:01 . 2010-06-08 16:01 388096 —-a-r- c:\documents and settings\Hunter\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-06-07 22:24 . 2009-09-07 20:25 2188 —-a-w- c:\windows\system32\d3d9caps.dat
2010-05-22 22:22 . 2010-05-22 22:22 503808 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\msvcp71.dll
2010-05-22 22:22 . 2010-05-22 22:22 499712 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\jmc.dll
2010-05-22 22:22 . 2010-05-22 22:22 348160 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-2e8c853b-n\msvcr71.dll
2010-03-21 01:04 . 2010-03-21 01:04 79488 —-a-w- c:\documents and settings\Hunter\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-06-10_16.48.45 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-06-11 01:27 . 2010-06-11 01:27 16384 c:\windows\Temp\Perflib_Perfdata_6e0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-27 68856]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"Google Update"="c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-07 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SCDEmuApp.exe"="c:\program files\PowerISO\SCDEmuApp.exe" [2005-10-16 167936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-09-07 149280]
"SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-05-29 790528]
"ADUserMon"="c:\program files\Iomega\AutoDisk\ADUserMon.exe" [2002-09-24 147456]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-2 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 s3m;s3m;c:\windows\system32\drivers\s3m.sys [9/7/2009 12:56 PM 166720]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [9/23/2009 7:11 PM 133104]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/8/2006 11:35 AM 611064]
.
Contents of the 'Scheduled Tasks' folder

2010-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 19:53]

2010-06-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-09-24 19:53]

2010-06-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-1972579041-725345543-1003Core.job
- c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-07 19:53]

2010-06-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-1972579041-725345543-1003UA.job
- c:\documents and settings\Hunter\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-07 19:53]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://www.firstinterstatebank.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki… - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_2EC7709873947E87.dll/cmsidewiki.html
Trusted Zone: customdining.com\www
DPF: {7451D317-862C-45DA-8C28-1B21ADF95877} - hxxp://209.181.6.25/WebViewS.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-10 19:27
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-583907252-1972579041-725345543-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(3556)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\brss01a.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\Iomega\System32\AppServices.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Iomega\AutoDisk\ADService.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-06-10 19:32:13 - machine was rebooted
ComboFix-quarantined-files.txt 2010-06-11 01:32
ComboFix2.txt 2010-06-10 16:50

Pre-Run: 55,720,751,104 bytes free
Post-Run: 55,695,204,352 bytes free

- - End Of File - - F858A5A84D0E40F97BC1BB109E6079D1








>>Pragmafix log below<<


Thu 06/10/2010 19:32:56.31

No embedded null keys found
Post #8
coldsmoke,

That looks much better! How is it running? Please run this for me next:

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.
3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.
  • Once the update is complete, click on Settings.
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
    • Spyware, adware, dialers, and other riskware
    • Archives
    • E-mail databases
  • Click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View report… at the bottom.
  • Click the Save report… button.

    [external image: Posted Image]

  • Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply
Please include the following in your next post:
  • Kaspersky log
  • How is your computer running?
Post #9
Computer seems to be running much better. Report follows: ——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Friday, June 11, 2010 Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Friday, June 11, 2010 05:14:58 Records in database: 4255519 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: A:\ C:\ D:\ E:\ Z:\ Scan statistics: Objects scanned: 118638 Threats found: 10 Infected objects found: 23 Suspicious objects found: 0 Scan duration: 03:20:57 File name / Threat / Threats count C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002 Crack.rar Infected: not-a-virus:Porn-Dialer.Win32.Star 1 C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002. crack.rar Infected: not-a-virus:Porn-Dialer.Win32.Star 1 C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD LT 2000-2002 Symbols Architektur crack.rar Infected: not-a-virus:Porn-Dialer.Win32.Star 1 C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\LimeWireWin3.69.0010.exe Infected: not-a-virus:AdWare.Win32.TopMoxie.c 1 C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\To clean Desktop[\AutoCad Plans\Cad_Blocks\AutoCAD LT 2000-2002 Symbols Architektur crack.rar Infected: not-a-virus:Porn-Dialer.Win32.Star 1 C:\Qoobox\Quarantine\C\Program Files\Protection Center\cntext.dll.vir Infected: Trojan.Win32.Tdss.bfci 1 C:\Qoobox\Quarantine\C\Program Files\Protection Center\cnthook.dll.vir Infected: Trojan.Win32.Tdss.bfch 1 C:\Qoobox\Quarantine\C\Program Files\Protection Center\cntprot.exe.vir Infected: Trojan.Win32.Tdss.beea 1 C:\Qoobox\Quarantine\C\Program Files\Protection Center\Uninstall.exe.vir Infected: Trojan.Win32.Tdss.beea 1 C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAwwkibcjixt\pragmabbr.dll.vir Infected: Trojan.Win32.Tdss.besv 1 C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAwwkibcjixt\PRAGMAc.dll.vir Infected: Trojan.Win32.Tdss.beyj 1 C:\Qoobox\Quarantine\C\WINDOWS\PRAGMAwwkibcjixt\pragmaserf.dll.vir Infected: Trojan.Win32.Tdss.besx 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP585\A0050204.dll Infected: Trojan.Win32.Tdss.beyj 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050294.dll Infected: Trojan.Win32.Tdss.bfci 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050295.dll Infected: Trojan.Win32.Tdss.bfch 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050296.exe Infected: Trojan.Win32.Tdss.beea 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050300.exe Infected: Trojan.Win32.Tdss.beea 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050302.dll Infected: Trojan.Win32.Tdss.besv 1 C:\System Volume Information\_restore{16E84DD1-4AD5-4AC6-BD5C-A9CD9A2151C9}\RP586\A0050304.dll Infected: Trojan.Win32.Tdss.besx 1 Z:\Hunter\Old LapTop Data to sort\kf151\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1 Z:\Hunter\Old LapTop Data to sort\kf151\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1 Z:\Hunter\Old LapTop Data to sort\kf151.zip Infected: not-a-virus:PSWTool.Win32.RAS.g 1 Z:\Hunter\Old LapTop Data to sort\kf151.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 1 Selected area has been scanned.
Post #10
Unlikely this has anything to do with it, but I have been getting tons of spam since this happened. I suspect that it is just coincidence. But I thought that I would mention it.
Post #11
coldsmoke,

🖼Click to load external image (Posted Image)Your logs indicate that you are using cracks and/or keygens. We don't support software piracy on this forum so, while I’ll deal with your current problem, any further help will be based on you not being seen to involve yourself with such practices in the future. This is the main reason your computer is infected. Using cracked software and visiting cracksites/warezsites - and other questionable/illegal sites is always a risk. If you install the cracked software, you are running executable files from dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.

🖼Click to load external image (Posted Image) Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    :Files
C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002 Crack.rar
C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002. crack.rar
C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD LT 2000-2002 Symbols Architektur crack.rar
C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\LimeWireWin3.69.0010.exe
C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\To clean Desktop[\AutoCad Plans\Cad_Blocks\AutoCAD LT 2000-2002 Symbols Architektur crack.rar

:Commands
[EmptyFlash]
[EmptyTemp]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Please include the following in your next post:
  • OTM log
Post #12
All processes killed ========== FILES ========== C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002 Crack.rar moved successfully. C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD 2002. crack.rar moved successfully. C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\AutoCAD LT 2000-2002 Symbols Architektur crack.rar moved successfully. C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\Burn to CD and Delete\Lime wire programs\LimeWireWin3.69.0010.exe moved successfully. C:\Documents and Settings\Hunter\Desktop\Old Computer Files to Sort\Desktop\To clean Desktop[\AutoCad Plans\Cad_Blocks\AutoCAD LT 2000-2002 Symbols Architektur crack.rar moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator User: All Users User: Bobbie ->Temp folder emptied: 791550247 bytes ->Temporary Internet Files folder emptied: 255342522 bytes ->Java cache emptied: 16394 bytes ->Flash cache emptied: 8742 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Hunter ->Temp folder emptied: 109397415 bytes ->Temporary Internet Files folder emptied: 27621902 bytes ->Java cache emptied: 92968383 bytes ->Google Chrome cache emptied: 54371539 bytes ->Flash cache emptied: 25454 bytes User: Lia ->Temp folder emptied: 77236 bytes ->Temporary Internet Files folder emptied: 71988406 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1138618 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 663 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,340.00 mb OTM by OldTimer - Version 3.1.12.2 log created on 06122010_100746 Files moved on Reboot… Registry entries deleted on Reboot… RE: - Cracks etc. You are right. As I have become older and more mature I no longer engage in those types of practices. Those files were likely downloaded 5 or 6 years ago and haven't been touched since. I assume OTM removed them. If not, can they just be deleted or must some other action be taken? Thanks,
Post #13
I only removed the cracks that were flagged as infected; you will have to take care of any others that may be in there. Otherwise your logs look good! Now I have some important cleanup and updating for you to take care of:

🖼Click to load external image (Posted Image) Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
  • Scroll down to where it says "Java SE Runtime Environment (JRE) 6 Update 20. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: " I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Now go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java version.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u20-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked
      Applications and AppletsTrace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.
🖼Click to load external image (Posted Image) Your Adobe reader needs to be updated. Please visit Adobe's site and grab the newest version.

Go HERE to scan for any other out of date and/or vulnerable applications on your computer and follow the instructions given for updating them.

🖼Click to load external image (Posted Image) Uninstall ComboFix
  • Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
    Combofix /Uninstall
🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
Pragmafix -cleanup

🖼Click to load external image (Posted Image) Cleanup with OTM
  • Double-click OTM.exe to start the program.
  • Close all other programs apart from OTM as this step will require a reboot
  • On the OTM main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.
  • Manually delete any remaining tools or logs from our work
🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:
  • Restart any anti-malware programs that we disabled while we were cleaning your machine.
  • Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
  • Avoid using P2P programs, cracks and keygens! Refer back to my earlier post for more information.
  • Consider running in a limited user account. See this post for more information.
  • Please carefully review the information in our Security - Best Practices and Prevention forum located HERE
Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI