What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Bankerfox.A

8 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
I keep getting pornographic sites popping up no matter what I'm doing. I can't open anythng because it says its infected. I can't download anything because then it says it'll get infected. and I'm getting messages about threats from Bankerfox.A, but then somtimes it changes to Win32/Nuqel.E. And in the task bar is an AV Security Suit which I don't remember having. And it says it scans my computer, but it doesn't really. Please help. I can't do the DDS thing either because it says it's infected.
Post #2
Hi and Welcome,

Please do the following:


Please download and run the following tool to help allow other programs to run. (courtesy of BleepingComputer.com)
There are 3 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click and choose Run as Admin
You only need to get one of them to run, not all of them.


http://download.bleepingcomputer.com/grinler/rkill.exe
http://download.bleepingcomputer.com/grinler/rkill.com
http://download.bleepingcomputer.com/grinler/rkill.scr



Note:

You will likely see a message from this rogue telling you the file is infected. Ignore the message. Leave the message OPEN, do not close the message. Run rkill repeatedly until it's able to do it's job. This may take a few tries. You'll be able to tell rkill has done it's job when your desktop (explorer.exe) cycles off and then on again.

At this point, you should now be able to run analysis tools.

Once the tool has run, do NOT reboot the machine, and then try to run DDS and GMER.

If for some reason the machine reboots, repeat the process. Again, try not to restart the machine.


Please download DDS from either of these links

LINK 1
LINK 2

and save it to your desktop.
  • Disable any script blocking protection
  • Double click dds.pif to run the tool.
  • When done, two DDS.txt's will open.
  • Save both reports to your desktop.
—————————————————
Please include the contents of the following in your next reply:

DDS.txt
Attach.txt.


NEXT




Download GMER Rootkit Scanner from here to your desktop. It will be a randomly named executable.
  • Double click the exe file.
  • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO, then use the following settings for a more complete scan.


    [external image: Posted Image]
    Click the image to enlarge it


  • In the right panel, you will see several boxes that have been checked. Ensure the following are unchecked
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries
Post #3
Here's the two DDS things.

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 9:58:25.08 on Mon 06/28/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.128.8 [GMT -5:00]

AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Dain Neuharth\My Documents\Downloads\dds.com

============== Pseudo HJT Report ===============

uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride =
BHO: Gamevance: {0ed403e8-470a-4a8a-85a4-d7688cfe39a3} - c:\program files\gamevance\gamevancelib32.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: kikin Plugin: {e601996f-e400-41ca-804b-cd6373a7eee2} - c:\program files\kikin\ie_kikin.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [oodwprvk] c:\documents and settings\dain neuharth\local settings\application data\yqkbsubps\kudiysftssd.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [Gamevance] c:\program files\gamevance\gamevance32.exe a
mRun: [oodwprvk] c:\documents and settings\dain neuharth\local settings\application data\yqkbsubps\kudiysftssd.exe
StartupFolder: c:\docume~1\dainne~1\startm~1\programs\startup\imtooy~1.lnk - c:\program files\imtoo\youtube video converter\YoutubeVideoConverter.exe
IE: Download with ImTOO YouTube Video Converter - c:\program files\imtoo\youtube video converter\upod_link.HTM
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {00000162-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/0/B/B/0BB06A5C-8611-4840-86B3-54DDDD0344B9/wma9dmo.cab
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {33564D57-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/D/0/D/D0DD87DA-994F-4334-8B55-AF2E4D98ED0C/wmv9dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dainne~1\applic~1\mozilla\firefox\profiles\fw94j1zx.default\
FF - component: c:\documents and settings\dain neuharth\application data\mozilla\firefox\profiles\fw94j1zx.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\dain neuharth\application data\mozilla\firefox\profiles\fw94j1zx.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\documents and settings\dain neuharth\my documents\bin\npbyond.dll
FF - plugin: c:\documents and settings\dain neuharth\my documents\byond\bin\npbyond.dll
FF - plugin: c:\program files\byond\bin\npbyond.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbyond.dll
FF - plugin: c:\program files\pando networks\media booster\npPandoWebPlugin.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");

============= SERVICES / DRIVERS ===============

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [2009-10-4 22360]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [2009-10-4 45416]

=============== Created Last 30 ================

2010-06-25 15:23:12 0 d—–w- c:\program files\MSXML 4.0
2010-06-25 05:16:54 0 d—–w- c:\windows\system32\PreInstall
2010-06-25 05:16:49 0 d–h–w- c:\windows\$hf_mig$
2010-06-24 21:05:13 0 d—–w- c:\program files\Dofus 2
2010-06-23 22:05:54 0 d—–w- c:\docume~1\dainne~1\applic~1\LolClient
2010-06-23 21:43:02 68616 —-a-w- c:\windows\system32\XAPOFX1_1.dll
2010-06-23 21:43:02 509448 —-a-w- c:\windows\system32\XAudio2_2.dll
2010-06-23 21:42:44 467984 —-a-w- c:\windows\system32\d3dx10_39.dll
2010-06-23 21:42:44 1493528 —-a-w- c:\windows\system32\D3DCompiler_39.dll
2010-06-23 21:42:10 3851784 —-a-w- c:\windows\system32\D3DX9_39.dll
2010-06-23 21:09:23 0 d—–w- C:\Riot Games
2010-06-23 20:43:04 0 d—–w- c:\docume~1\alluse~1\applic~1\PMB Files
2010-06-23 20:42:20 0 d—–w- c:\program files\Pando Networks
2010-06-17 20:39:42 0 d—–w- c:\windows\system32\appmgmt
2010-06-09 18:11:25 177664 -c—-w- c:\windows\system32\dllcache\wintrust.dll

==================== Find3M ====================

2010-06-22 15:20:55 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-06-04 00:46:59 2608 —-a-w- c:\windows\system32\d3d9caps.dat
2010-05-31 02:41:37 87 —-a-w- c:\documents and settings\dain neuharth\jagex_runescape_preferences2.dat
2010-05-31 02:34:12 42 —-a-w- c:\documents and settings\dain neuharth\jagex_runescape_preferences.dat
2010-05-02 05:56:34 1850880 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:51:20 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-16 15:36:49 662016 —-a-w- c:\windows\system32\wininet.dll
2010-04-16 15:36:45 81920 ——w- c:\windows\system32\ieencode.dll
2010-04-03 01:34:12 0 -c–a-w- c:\documents and settings\dain neuharth\jagex__preferences3.dat

============= FINISH: 10:00:00.61 ===============


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 10/3/2009 8:26:38 PM
System Uptime: 6/28/2010 9:37:19 AM (1 hours ago)

Motherboard: Compaq | | 0550h
Processor: Intel Pentium III processor | XU1 | 730/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 13 GiB total, 6.415 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Intel® PRO/100+ Management Adapter with Alert On LAN*
Device ID: PCI\VEN_8086&DEV_1229&SUBSYS_000E8086&REV_08\4&24AB0D93&0&40F0
Manufacturer: Intel
Name: Intel® PRO/100+ Management Adapter with Alert On LAN*
PNP Device ID: PCI\VEN_8086&DEV_1229&SUBSYS_000E8086&REV_08\4&24AB0D93&0&40F0
Service: E100B

Class GUID: {4D36E96F-E325-11CE-BFC1-08002BE10318}
Description: PS/2 Compatible Mouse
Device ID: ACPI\PNP0F13\4&264480D3&0
Manufacturer: Microsoft
Name: PS/2 Compatible Mouse
PNP Device ID: ACPI\PNP0F13\4&264480D3&0
Service: i8042prt

==== System Restore Points ===================

RP232: 6/8/2010 8:02:38 PM - System Checkpoint
RP233: 6/9/2010 8:33:13 PM - System Checkpoint
RP234: 6/10/2010 9:02:32 PM - System Checkpoint
RP235: 6/11/2010 9:33:18 PM - System Checkpoint
RP236: 6/12/2010 11:14:16 PM - System Checkpoint
RP237: 6/13/2010 11:34:13 PM - System Checkpoint
RP238: 6/15/2010 12:23:59 AM - System Checkpoint
RP239: 6/16/2010 12:38:45 AM - System Checkpoint
RP240: 6/17/2010 1:38:43 AM - System Checkpoint
RP241: 6/17/2010 3:38:33 PM - Removed Bonjour
RP242: 6/18/2010 4:38:32 PM - System Checkpoint
RP243: 6/19/2010 5:38:38 PM - System Checkpoint
RP244: 6/20/2010 9:35:14 PM - System Checkpoint
RP245: 6/21/2010 11:11:04 PM - System Checkpoint
RP246: 6/22/2010 11:52:31 PM - System Checkpoint
RP247: 6/23/2010 4:09:06 PM - Installed League of Legends
RP248: 6/23/2010 6:05:27 PM - Removed League of Legends
RP249: 6/25/2010 12:16:27 AM - Software Distribution Service 3.0
RP250: 6/25/2010 10:21:47 AM - Software Distribution Service 3.0
RP251: 6/25/2010 11:02:05 PM - Software Distribution Service 3.0
RP252: 6/27/2010 11:03:52 PM - Software Distribution Service 3.0

==== Installed Programs ======================

µTorrent
Adobe AIR
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Belkin 54g USB Network Adapter
Build Your Own Net Dream (remove only)
Counter-Strike 2D 0.1.1.7
Free NaturalReader
Gamevance
Halo Zero Final V1.8.3
Hotfix for Windows XP (KB952287)
ImTOO YouTube Video Converter
iTunes
Java™ 6 Update 17
kikin plugin (CounterStrike2D Edition) 2.0
League of Legends
Microsoft .NET Framework 2.0
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.5.10)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Pando Media Booster
QuickTime
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981350)
Security Update for Windows XP (KB982381)
SnagIt 5
Update for Windows XP (KB898461)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows XP Service Pack 2
WinRAR archiver


==== Event Viewer Messages From Past Week ========

6/27/2010 11:04:23 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
6/25/2010 10:30:50 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0xd0000135: Update for Windows XP (KB981793).
6/25/2010 10:21:59 AM, error: Windows Update Agent [20] - Installation Failure: Windows failed to install the following update with error 0xf00b0004: Update for Windows XP (KB968389).
6/24/2010 6:21:58 PM, information: Windows File Protection [64005] - The protected system file rundll32.exe was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is Dain Neuharth. The file version of the bad file is unknown.
6/24/2010 6:00:07 PM, error: Service Control Manager [7022] - The Avira AntiVir Guard service hung on starting.
6/24/2010 5:58:45 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.nist.gov,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
6/24/2010 5:57:57 PM, error: ACPI [5] - AMLI: ACPI BIOS is attempting to write to an illegal IO port address (0x70), which lies in the 0x70 - 0x71 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.
6/24/2010 5:57:57 PM, error: ACPI [4] - AMLI: ACPI BIOS is attempting to read from an illegal IO port address (0x71), which lies in the 0x70 - 0x71 protected address range. This could lead to system instability. Please contact your system vendor for technical assistance.
6/24/2010 4:01:17 PM, error: Dhcp [1001] - Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 001150BB7625. The following error occurred: The operation was canceled by the user. . Your computer will continue to try and obtain an address on its own from the network address (DHCP) server.
6/21/2010 10:30:49 AM, error: Service Control Manager [7000] - The Application Layer Gateway Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/21/2010 10:30:34 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Application Layer Gateway Service service to connect.

==== End Of File ===========================

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-06-28 10:27:16
Windows 5.1.2600 Service Pack 2
Running: lt2upb8s.exe; Driver: C:\DOCUME~1\DAINNE~1\LOCALS~1\Temp\kxtdapog.sys


—- System - GMER 1.0.15 —-

SSDT FCB2571E ZwCreateKey
SSDT FCB25714 ZwCreateThread
SSDT FCB25723 ZwDeleteKey
SSDT FCB2572D ZwDeleteValueKey
SSDT FCB25732 ZwLoadKey
SSDT FCB25700 ZwOpenProcess
SSDT FCB25705 ZwOpenThread
SSDT FCB2573C ZwReplaceKey
SSDT FCB25737 ZwRestoreKey
SSDT FCB25728 ZwSetValueKey
SSDT FCB2570F ZwTerminateProcess

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)
AttachedDevice \FileSystem\Fastfat \Fat avgntmgr.sys (Avira AntiVir File Filter Driver Manager/Avira GmbH)

—- EOF - GMER 1.0.15 —-

And you'll probably notice something not too smart I did. I'm not too smart when it comes to this kind of stuff.
Post #4
Hi,

Please do the following:

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
  • Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
Post #5
ComboFix 10-06-27.06 - Dain Neuharth 06/28/2010 12:43:23.1.1 - x86
Running from: c:\documents and settings\[removed]\My Documents\Downloads\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Dain Neuharth\Local Settings\Application Data\yqkbsubps
c:\documents and settings\Dain Neuharth\Local Settings\Application Data\yqkbsubps\kudiysftssd.exe
c:\program files\SelectRebates
c:\program files\SelectRebates\FFToolbar(2)\chrome\sahtoolbar.jar
c:\program files\SelectRebates\FFToolbar(2)\defaults\preferences\sahtoolbar.js
c:\program files\SelectRebates\FFToolbar(2)\install.rdf
c:\program files\SelectRebates\SelectAlerts.dat
c:\program files\SelectRebates\SelectRebatesA.dat
c:\program files\SelectRebates\SelectRebatesB.dat
c:\program files\SelectRebates\SelectRebatesBT.dat
c:\program files\SelectRebates\Toolbar\AddtoList.bmp
c:\program files\SelectRebates\Toolbar\basis.xml
c:\program files\SelectRebates\Toolbar\Basis.xml.dym
c:\program files\SelectRebates\Toolbar\Blank.bmp
c:\program files\SelectRebates\Toolbar\CashBack.bmp
c:\program files\SelectRebates\Toolbar\Coupons.bmp
c:\program files\SelectRebates\Toolbar\GroceryCoupon.bmp
c:\program files\SelectRebates\Toolbar\i_magnifying.bmp
c:\program files\SelectRebates\Toolbar\icons.bmp
c:\program files\SelectRebates\Toolbar\logo.bmp
c:\program files\SelectRebates\Toolbar\logo_24.bmp
c:\program files\SelectRebates\Toolbar\logo_HotSpots.bmp
c:\program files\SelectRebates\Toolbar\ReviewSite.bmp
c:\program files\SelectRebates\Toolbar\RightControls.dym
c:\program files\SelectRebates\Toolbar\Scissors.bmp

.
((((((((((((((((((((((((( Files Created from 2010-05-28 to 2010-06-28 )))))))))))))))))))))))))))))))
.

2010-06-25 15:23 . 2010-06-25 15:23 ——– d—–w- c:\program files\MSXML 4.0
2010-06-25 05:16 . 2010-06-25 15:40 ——– d–h–w- c:\windows\$hf_mig$
2010-06-24 21:05 . 2010-06-24 21:05 ——– d—–w- c:\program files\Dofus 2
2010-06-23 22:05 . 2010-06-23 22:05 ——– d—–w- c:\documents and settings\Dain Neuharth\Application Data\LolClient
2010-06-23 21:43 . 2008-07-31 15:41 68616 —-a-w- c:\windows\system32\XAPOFX1_1.dll
2010-06-23 21:43 . 2008-07-31 15:40 509448 —-a-w- c:\windows\system32\XAudio2_2.dll
2010-06-23 21:42 . 2008-07-12 13:18 467984 —-a-w- c:\windows\system32\d3dx10_39.dll
2010-06-23 21:42 . 2008-07-12 13:18 1493528 —-a-w- c:\windows\system32\D3DCompiler_39.dll
2010-06-23 21:42 . 2008-07-12 13:18 3851784 —-a-w- c:\windows\system32\D3DX9_39.dll
2010-06-23 21:41 . 2010-06-23 21:19 38784 —-a-w- c:\documents and settings\Dain Neuharth\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-23 21:36 . 2010-06-23 21:19 38784 —-a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-06-23 21:35 . 2010-06-23 21:35 ——– d—–w- c:\program files\Common Files\Adobe AIR
2010-06-23 21:09 . 2010-06-23 23:06 ——– d—–w- C:\Riot Games
2010-06-23 20:43 . 2010-06-23 22:41 ——– d—–w- c:\documents and settings\Dain Neuharth\Local Settings\Application Data\PMB Files
2010-06-23 20:43 . 2010-06-23 20:43 ——– d—–w- c:\documents and settings\All Users\Application Data\PMB Files
2010-06-23 20:42 . 2010-06-23 20:42 ——– d—–w- c:\program files\Pando Networks
2010-06-09 18:11 . 2009-12-24 07:05 177664 -c—-w- c:\windows\system32\dllcache\wintrust.dll
2010-06-09 12:03 . 2010-06-09 12:03 503808 —-a-w- c:\documents and settings\Dain Neuharth\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-76d6941b-n\msvcp71.dll
2010-06-09 12:03 . 2010-06-09 12:03 348160 —-a-w- c:\documents and settings\Dain Neuharth\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-76d6941b-n\msvcr71.dll
2010-06-09 12:03 . 2010-06-09 12:03 499712 —-a-w- c:\documents and settings\Dain Neuharth\Application Data\Sun\Java\Deployment\cache\6.0\46\f84c6ae-76d6941b-n\jmc.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-06-28 17:48 . 2009-10-22 10:38 ——– d—–w- c:\documents and settings\Dain Neuharth\Application Data\uTorrent
2010-06-23 23:02 . 2010-05-15 23:12 ——– d—–w- c:\program files\Gamevance
2010-06-22 15:20 . 2009-10-04 17:58 2496 —-a-w- c:\windows\system32\d3d8caps.dat
2010-06-04 00:46 . 2009-10-04 17:39 2608 —-a-w- c:\windows\system32\d3d9caps.dat
2010-05-31 02:41 . 2010-04-03 01:34 87 —-a-w- c:\documents and settings\Dain Neuharth\jagex_runescape_preferences2.dat
2010-05-31 02:34 . 2010-04-03 00:42 42 —-a-w- c:\documents and settings\Dain Neuharth\jagex_runescape_preferences.dat
2010-05-24 17:39 . 2009-10-21 18:20 ——– d—–w- c:\documents and settings\Dain Neuharth\Application Data\kikin
2010-05-21 14:35 . 2010-05-21 14:35 ——– d—–w- c:\program files\Counter-Strike 2D
2010-05-02 05:56 . 2003-03-31 12:00 1850880 —-a-w- c:\windows\system32\win32k.sys
2010-04-20 05:51 . 2003-03-31 12:00 285696 —-a-w- c:\windows\system32\atmfd.dll
2010-04-16 15:36 . 2003-03-31 12:00 662016 —-a-w- c:\windows\system32\wininet.dll
2010-04-16 15:36 . 2010-02-02 02:59 81920 ——w- c:\windows\system32\ieencode.dll
2010-04-08 21:11 . 2010-04-08 21:11 73000 —-a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.1.0.79\SetupAdmin.exe
2010-04-03 01:34 . 2010-04-03 01:34 0 -c–a-w- c:\documents and settings\Dain Neuharth\jagex__preferences3.dat
2010-04-03 00:01 . 2010-04-03 00:01 699392 -c–a-w- c:\documents and settings\Dain Neuharth\Application Data\Mozilla\Firefox\Profiles\fw94j1zx.default\extensions\{AA994882-F391-4d2e-806F-8908DA4814ED}\components\kikin_updater_2.0.0.11.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E601996F-E400-41CA-804B-CD6373A7EEE2}]
2010-02-10 01:34 750256 —-a-w- c:\program files\kikin\ie_kikin.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2009-10-22 289072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2010-01-09 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-03-18 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-03-26 142120]
"Gamevance"="c:\program files\Gamevance\gamevance32.exe" [2010-05-15 222720]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\BYOND\\bin\\byond.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58684:TCP"= 58684:TCP:Pando Media Booster
"58684:UDP"= 58684:UDP:Pando Media Booster
"8378:TCP"= 8378:TCP:League of Legends Launcher
"8378:UDP"= 8378:UDP:League of Legends Launcher
"8393:TCP"= 8393:TCP:League of Legends Lobby
"8393:UDP"= 8393:UDP:League of Legends Lobby
"8390:TCP"= 8390:TCP:League of Legends Game Client
"8390:UDP"= 8390:UDP:League of Legends Game Client
"6984:TCP"= 6984:TCP:League of Legends Launcher
"6984:UDP"= 6984:UDP:League of Legends Launcher

R0 avgntmgr;avgntmgr;c:\windows\system32\drivers\avgntmgr.sys [10/4/2009 10:39 AM 22360]
R1 avgntdd;avgntdd;c:\windows\system32\drivers\avgntdd.sys [10/4/2009 10:39 AM 45416]

— Other Services/Drivers In Memory —

*NewlyCreated* - KXTDAPOG
*Deregistered* - kxtdapog

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2010-06-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyServer = http=127.0.0.1:5577
uInternet Settings,ProxyOverride =
IE: Download with ImTOO YouTube Video Converter - c:\program files\ImTOO\YouTube Video Converter\upod_link.HTM
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: {{0F7195C2-6713-4d93-A1BC-DA5FA33F0A65} - {E601996F-E400-41CA-804B-CD6373A7EEE2} - c:\program files\kikin\ie_kikin.dll
FF - ProfilePath - c:\documents and settings\Dain Neuharth\Application Data\Mozilla\Firefox\Profiles\fw94j1zx.default\
FF - component: c:\documents and settings\Dain Neuharth\Application Data\Mozilla\Firefox\Profiles\fw94j1zx.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Dain Neuharth\Application Data\Mozilla\Firefox\Profiles\fw94j1zx.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}\components\RadioWMPCore.dll
FF - plugin: c:\program files\BYOND\bin\npbyond.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbyond.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - truec:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr
ef", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-oodwprvk - c:\documents and settings\Dain Neuharth\Local Settings\Application Data\yqkbsubps\kudiysftssd.exe
HKLM-Run-oodwprvk - c:\documents and settings\Dain Neuharth\Local Settings\Application Data\yqkbsubps\kudiysftssd.exe
AddRemove-Gamevance - c:\program files\Gamevance\gvun.exe
AddRemove-Halo Zero Final V1.8.3 - c:\program files\Dobermann\Halozero\Uninstal.exe
AddRemove-ImTOO YouTube Video Converter - c:\program files\ImTOO\YouTube Video Converter\Uninstall.exe
AddRemove-vghd - c:\documents and settings\Dain Neuharth\Start Menu\Programs\VirtuaGirl HD\uninstall.lnk



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-06-28 12:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-06-28 12:59:27
ComboFix-quarantined-files.txt 2010-06-28 17:59

Pre-Run: 6,773,125,120 bytes free
Post-Run: 7,083,474,944 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - BAD4CAF412455F9C0189ABA4AC1B7B0E
Post #6 last edited
Hi

Please do the following:


  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below.
  • They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Copy/paste the text inside the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Copy all the text inside of the code box - Press Ctrl+C (or right click on the highlighted section and choose 'copy')

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5577

Now paste the copied text into the open notepad - press CTRL+V (or right click and choose 'paste')

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you.
  • Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.


NEXT


Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so.

NEXT

Using Internet Explorer or Firefox, visit Kaspersky Online Scanner:
1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
3. Click Run at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes.
  • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.
    [external image: Posted Image]
  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply
Post #7
I have a question. I did a system restore because I accidently deleted the run32dll.exe and it wouldn't let me run properly, so would I have to redo all this stuff? I system restored to a previous date before I got the virus.
Post #9
I can't do much. I got the run32.exe thing back but it eventually freezes and I my internet goes down. I try to open it up and it says "insufficient system resources." If I do a thing that wipes all the stuff on my computer and programs, would it fix the virus thing and the freezing of my computer? I could go without with all my files and such, and I can just re-download a lot of it.
Post #10
If you are talking about a complete reformat and reinstall - then yes, that should get rid of the infection.

We have an excellent tutorial on how to reformat here

At least if you do that, you can be assured of a clean machine.

Let me know what you decide to do.

You might want to try a repair install first to replace any missing files you have and continue cleaning the machine,

but it may be best in the long run to reformat if you have nothing that can't be replaced on the machine.
Post #12
Hi It may very well if the cause is malware related, if it is a hardware issue, then it may not. You might want to post a new thread in our hardware forum to get some advise from the expert techs there if you are considering a reformat.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI