Hi ran ran SRENG and there was one entry with an ERROR which was repaired , however COMBOfix.EXE would not open on the infected computer, I kept getting that Security warning message that I am getting for every EXE file. Should I rename COMBOFIX to a .COM extension and try that/
Hello
babbagene Should I rename COMBOFIX to a .COM extension and try that/
Please do. If that does not work you may have to drop into Safe Mode and try again.
Let me know how you get on
Hi thanks again for all your help! when trying to runthe FIX about 20 windoews opened up saying CONNECTING , finally I was able to get it to run. I got a message saying "could not find HIDEC.exe.
Here is the LOG:
ComboFix 11-02-22.01 - babbagene 02/22/2011 19:16:50.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.2168 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.Com
AV: Norton Security Suite *Disabled/Updated* {88C95A36-8C3B-2F2C-1B8B-30FCCFDC4855}
FW: Norton Security Suite *Disabled* {B0F2DB13-C654-2E74-30D4-99C9310F0F2E}
SP: Norton Security Suite *Enabled/Updated* {33A8BBD2-AA01-20A2-213B-0B8EB45B02E8}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\install.exe
c:\users\babbagene\AppData\Local\{6AC1BE8D-DE20-4042-B500-D30D6C6708A8}
c:\users\babbagene\AppData\Local\{6AC1BE8D-DE20-4042-B500-D30D6C6708A8}\chrome.manifest
c:\users\babbagene\AppData\Local\{6AC1BE8D-DE20-4042-B500-D30D6C6708A8}\chrome\content\_cfg.js
c:\users\babbagene\AppData\Local\{6AC1BE8D-DE20-4042-B500-D30D6C6708A8}\chrome\content\overlay.xul
c:\users\babbagene\AppData\Local\{6AC1BE8D-DE20-4042-B500-D30D6C6708A8}\install.rdf
c:\windows\system32\jusched.exe
c:\windows\system32\Nagasoft
.
((((((((((((((((((((((((( Files Created from 2011-01-23 to 2011-02-23 )))))))))))))))))))))))))))))))
.
2011-02-23 00:21 . 2011-02-23 00:21 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-02-23 00:21 . 2011-02-23 00:21 ——– d—–w- c:\users\babbagene\AppData\Local\temp
2011-02-22 20:09 . 2011-02-22 20:09 63115 —-a-w- c:\progra~2\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2011-02-22 00:51 . 2011-02-22 00:51 ——– d—–w- C:\_OTL
2011-02-20 04:57 . 2011-02-20 04:57 ——– d–h–w- c:\windows\PIF
2011-02-18 07:06 . 2011-01-13 09:41 5890896 —-a-w- c:\progra~2\Microsoft\Windows Defender\Definition Updates\{C8AC04E0-7493-4FE5-86AF-13B9501D324B}\mpengine.dll
2011-02-12 05:40 . 2011-02-12 05:40 ——– d—–w- c:\users\babbagene\AppData\Roaming\Friday's games
2011-02-09 19:43 . 2010-12-31 13:57 2039808 —-a-w- c:\windows\system32\win32k.sys
2011-02-09 19:43 . 2010-10-15 14:08 3602320 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-02-09 19:43 . 2010-10-15 13:48 1205080 —-a-w- c:\windows\system32\ntdll.dll
2011-02-09 19:43 . 2010-10-15 14:08 3550096 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-02-09 19:43 . 2011-01-06 10:51 2409784 —-a-w- c:\program files\Windows Mail\OESpamFilter.dat
2011-01-31 02:04 . 2011-01-31 02:04 ——– d—–w- c:\users\babbagene\AppData\Roaming\SpinTop Games
2011-01-27 19:11 . 2011-01-27 19:11 ——– d—–w- c:\users\babbagene\AppData\Roaming\CyberLink
2011-01-27 19:11 . 2011-01-27 19:11 ——– d—–w- c:\progra~2\CyberLink
2011-01-27 18:45 . 2011-01-31 03:54 ——– d—–w- c:\users\babbagene\AppData\Roaming\BitZipper
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-28 15:55 . 2011-01-12 11:45 413696 —-a-w- c:\windows\system32\odbc32.dll
2010-12-20 23:09 . 2009-06-15 00:02 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2009-06-15 00:02 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-12-14 14:49 . 2011-01-12 11:45 1169408 —-a-w- c:\windows\system32\sdclt.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2009-01-12 972344]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"cdloader"="c:\users\babbagene\AppData\Roaming\mjusbsp\cdloader2.exe" [2010-12-03 50592]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
"nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2008-12-14 467240]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2010-03-09 202256]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2009-12-18 40368]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Snapfish Media Detector.lnk]
backup=c:\windows\pss\Snapfish Media Detector.lnk.CommonStartup
backupExtension=.CommonStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-06-05 17:39 292136 —-a-w- c:\program files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPAP]
2010-04-26 09:09 185800 —-a-w- c:\program files\Common Files\PPLiveNetwork\ppap.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\N360\0308000.029\SYMEFA.SYS [2010-03-02 310320]
S1 BHDrvx86;Symantec Heuristics Driver;c:\windows\System32\Drivers\N360\0308000.029\BHDrvx86.sys [2010-03-02 259632]
S1 ccHP;Symantec Hash Provider;c:\windows\System32\Drivers\N360\0308000.029\ccHPx86.sys [2010-03-02 482432]
S1 IDSVix86;IDSVix86;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\ipsdefs\20110218.003\IDSvix86.sys [2010-11-09 353912]
S2 iWinTrusted;iWinTrusted;c:\program files\iWin Games\iWinTrusted.exe [2010-09-27 176408]
S2 N360;Norton Security Suite;c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe [2010-03-02 117640]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-07-26 102448]
S3 SYMNDISV;Symantec Network Filter Driver;c:\windows\System32\Drivers\N360\0308000.029\SYMNDISV.SYS [2010-03-02 48688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
2011-02-08 c:\windows\Tasks\HPCeeScheduleForbabbagene.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-06-19 03:03]
2011-02-22 c:\windows\Tasks\User_Feed_Synchronization-{4F74C39B-E843-46E1-9C70-C9134C90FBF5}.job
- c:\windows\system32\msfeedssync.exe [2011-02-09 04:47]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://search.foxtab.com/?s=0&chnl=irn&cd=2XzutCtN2Y1L1QzutDtDtBtBtCyDtByDzyyBtDyCtN0C0Czu0U0StN0D0TzutBtDtCtCtDtBt
CtA&cr=1294908807
mSearch Bar = hxxp://www.google.com
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {75A6AEA3-F26E-4608-AE9B-8DA78C87576E} - hxxps://kingsisle.hs.llnwd.net/e1/static/themes/wizard101A/activex/Wizard101GameLauncher.CAB
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{9D425283-D487-4337-BAB6-AB8354A81457} - (no file)
SafeBoot-mcmscsvc
SafeBoot-MCODS
AddRemove-vShare - c:\program files\vShare\UNINSTALL.exe
**************************************************************************
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files:
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\N360]
"ImagePath"="\"c:\program files\Norton Security Suite\Engine\3.8.0.41\ccSvcHst.exe\" /s \"N360\" /m \"c:\program files\Norton Security Suite\Engine\3.8.0.41\diMaster.dll\" /prefetch:1"
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-02-22 19:27:37
ComboFix-quarantined-files.txt 2011-02-23 00:27
Pre-Run: 254,350,598,144 bytes free
Post-Run: 253,433,720,832 bytes free
- - End Of File - - C15E37FD04CBEB7DBB678152D6333AEA
Hi , I was able to get mban to run by giving it a .com extension, here is the log:
Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 6.0.6002 Service Pack 2
2/22/2011 9:53:48 PM
mbam-log-2011-02-22 (21-53-38).txt
Scan type: Full Scan (C:\|)
Objects scanned: 241020
Time elapsed: 1 hour(s), 43 minute(s), 26 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8ca5ed52-f3fb-4414-a105-2e3491156990} (Adware.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{df780f87-ff2b-4df8-92d0-73db16a1543a} (Adware.PopCap) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1a93c934-025b-4c3a-b38e-9654a7003239} (Adware.Gamesbar) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6f282b65-56bf-4bd1-a8b2-a4449a05863d} (Adware.Gamesbar) -> No action taken.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
C:\Users\babbagene\Desktop\WiNlOgOn.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
C:\Users\babbagene\Desktop\eXplorer.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
C:\Users\babbagene\Desktop\uSeRiNiT.exe (Heuristics.Reserved.Word.Exploit) -> No action taken.
Note: the MALAWARE version that I ran was old , because my computer would not allow the updates to download.
JONTOM,I took the liberty of running the3 programs you initailly instructed me to run in your first post ,since they all run now ,here is the current LOGS for all 3 , hope I did not screw you up by doing this:This log file is located at C:\rkill.log. DDS (Ver_10-12-12.02) - NTFSx86 UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
Hello
babbagene
Thank you for the log.
my computer would not allow the updates to download
Strange? Please run MBAM again and allow it to remove what it finds.
Please un-install Java™ SE Runtime Environment 6 Update 1 Click on "Start" then on "Control Panel" and then on "Add or remove programs" . Click on "remove a program" . A list of currently installed programs will be displayed. Find the "Java™ SE Runtime Environment 6 Update 1" program, click on it once and then click on the "uninstall" button. NOTE DO NOT uninstall Java™ 6 Update 18.If you are prompted to re-boot your computer to complete the uninstall please do so. Please update your Java To update your Java, Click on "Start" then on "Control Panel" and then on the Java icon (looks like a coffee cup). In the window that opens, click on the "Update" tab, and then on "Update Now" . Your Java should begin to update. Please follow any prompts that you receive. Clean out your temporary files Please download ATF Cleaner by Atribune here Run the program by double clicking the ATF-Cleaner.exe icon located on your desktop. Check the boxes to the left of the following: Windows Temp Current User Temp All Users Temp Temporary Internet Files Java Cache The rest are optional . If you want to remove everything check the "Select All" box.Click on "Empty Selected" to begin cleaning. Once the "Done Cleaning" message appears, click OK . If you use Firefox , Click on the Firefox tab and repeat the above process. When you have finished cleaning, click on the "Exit" button in the main menu. Please run the following scan Note: Note for Vista/Windows 7 Users: ESET is compatible but Internet Explorer must be run as Administrator. To do this, right-click on your Internet Explorer icon and select "Run as Administrator" . Please disable your real time security programs before performing the scan. Scan your system with Eset Online Scanner Place a check mark in the box YES, I accept the Terms Of Use. Click the [external image: Posted Image] button. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps). Click on [external image: Posted Image] to download the ESET Smart Installer. Save it to your desktop. Double click on the [external image: Posted Image] icon on your desktop. Check [external image: Posted Image] Click the [external image: Posted Image] button. Accept any security warnings from your browser. Check [external image: Posted Image] Make sure that the option to "Remove Found Threats" is UN checked. Push the "Start" button. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time. When the scan completes, push [external image: Posted Image] Push [external image: Posted Image] , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply. Push the [external image: Posted Image] button. Push [external image: Posted Image]
Here is theMban LOG:C:\System Volume Information\SystemRestore\FRStaging\Users\babbagene\AppData\Local\Temp\del48522207.exe probably a variant of Win32/SweetIM.B application cleaned by deleting - quarantined
I restarted myinfected computer,and the computer still triedtoopen up 17 different files, with each of the files it tried to open I received the following message File Download-Security WarningDo you want to RUN or ave this file , here are thefiles that were trying to open :
Hello
babbagene
MBAM runs clean and ESET has removed some infected restore points and an infected Java cache.
Please work your way through the following steps:
Please create a new System Restore point Click on the "Windows Orb" and then Right click on "Computer" and select "Properties" Click on the “System Protection” link on the left hand side. Now select the “System Protection” tab to get to the System Restore section. Click the “Create” button to create a new restore point. You’ll be prompted for a name, and you might want to give it a useful name that you’ll be able to easily identify later (such as todays date). Click the Create button, and then the system will create the restore point. Please Clear Your Sun Java Cache Click on "Windows Orb" , then on "Control Panel" and then on the Java icon (looks like a coffee cup). If you do not see the icon, look to your left and click "Switch to Classic View" . On the "General" tab, under "Temporary Internet Files" , click the "Settings" button. Next, click on the "Delete Files" button. There are two options in the window to clear the cache - ("Applications and Applets" and "Trace and Log Files") . Leave BOTH Checked Click "OK" on Delete Temporary Files Window. Note: all of the Downloaded Applications and Applets from the Cache.Click "OK" to leave the Temporary Files Window. Click "OK" to leave the Java Control Panel. Foistware I can see from your log that you have Viewpoint Media Player and installed. Viewpoint Manager is considered as foistware rather than malware since it is installed without user's approval but doesn't spy or do anything "bad".It is recommended that you remove Viewpoint products. However, this choice is up to you. To remove these programs, Click on the "Windows Orb" (bottom left hand corner of your screen), then on "Computer" and then on the "Uninstall or Change a Program" tab. A list of currently installed programs will be displayed. Find the "Viewpoint Media Player" program, click on it once and then click on the "Uninstall" button. If you are prompted to re-boot your computer to complete the uninstall please do so.
Hi,I did what you instructed in the preceding post,Please keepin mind that the MBAM that I am running is NOT up tpo date because for some reason it will notupdate to the current version ,it is scanning with version 1.34 I believe.
When I started the computer up again I again receved the 17 files trying to open , I also see that if I try to open Realplayer or Ebay thru my desktop I get the same Message about Security Download, and they will not open.
I AM able to get on the internet. Here is the log you asked for:
DDS (Ver_10-12-12.02) - NTFSx86 http://www.gmer.net
Here is also an ATTACH.TXT report:
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
Hello
babbagene
Is this a neworked machine? If so, please disconnect it from the network while we try and get it cleaned.
Please keepin mind that the MBAM that I am running is NOT up tpo date because for some reason it will notupdate to the current version
Do you receive any error messages when trying to update MBAM?
Malwarebytes' Anti-Malware 1.34
Not sure why your MBAM is not updating but
1.34 is a very old version of the program, and I suspect that the database has not been updated for some considerable time (the current dastabase version is 5871).
Before we try and sort out the MBAM issue, I would like to check on something with the following tools:
TDSS Killer Please read carefully and follow these steps. Download TDSSKiller Extract its contents to your desktop. Once extracted, open the TDSSKiller folder and Right click on TDSSKiller.exe and select "Run as Administrator" to run the application. Click on Start Scan. If an infected file is detected, the default action will be Cure , click on Continue. If a suspicious file is detected, the default action will be Skip , click on Continue. It may ask you to reboot the computer to complete the process. Click on Reboot Now . If no reboot is require, click on Report . A log file should appear. Please copy and paste the contents of that file here. If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt ". Please copy and paste the contents of that file here. MBRCheck Please download MBRCheck here Be sure to disable your security programs. Double click on the file to run it (Vista and Windows 7 users will have to confirm the UAC prompt). A window will open on your desktop. If an unknown bootcode is found you will have further options available to you, at this time press N then press Enter If nothing unusual is found just press Enter A .txt file named MBRCheck_mm.dd.yy_hh.mm.ss should appear on your desktop. Please post the contents of that file in your next reply.
Hi here is the TDS Report:2011/02/24 18:30:16.0238 3116 TDSS rootkit removing tool 2.4.18.0 Feb 21 2011 11:08:08 MBRCheck, version 1.2.3
After running the above programs I restarted my computer with the same results.As a last chance effort I ran a program called called
File association fixes for Windows Vista ,which can be found here:
http://www.winhelponline.com/articles/105/…dows-Vista.html
As soon as I ran this program and restarted the computer everything worked fine.
Thank You for your help.
Regards
Sam
