What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

perfs.exe found - need help to remove - hjt log

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Greetings,

Have a Win XP Pro SP3 box with Charter Security Suite (F-Prot), MSSE and SG installed. Was experiencing the Admin account on login screen with other account, guest account is disabled. Logged in to Admin account and found that Firefox was open and had been updated to 3.6.13 with several bookmarks that I didn't save and several addons installed that I didn't install. Some of the bookmarks and addons had Asian characters.

F-Prot scan found perfs Trojan and removed it…I think. Next day, started to get cookie prompts without any browser open??? Admin account showing on login screen again. I looked in the system32 folder for newly dated files and found fiplock.dll, fhpatch.dll, msiecon.nls, idecon.nls, and others. Don't know if all are virus related? Please find my hjt output below - thanks!

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 6:26:33 PM, on 2/22/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe
C:\Program Files\Charter Security Suite\Common\FSMA32.EXE
C:\Program Files\Charter Security Suite\Anti-Virus\FSGK32.EXE
C:\Program Files\Charter Security Suite\Common\FSHDLL32.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\UPHClean\uphclean.exe
C:\Program Files\Charter Security Suite\FWES\Program\fsdfwd.exe
C:\Program Files\Charter Security Suite\Anti-Virus\fssm32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RunDll32.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Citrix\ICA Client\concentr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Charter Security Suite\Common\FSM32.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\Citrix\ICA Client\wfcrun32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Charter Security Suite\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Documents and Settings\k7s5a\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\PROGRAM FILES\SPYWAREGUARD\DLPROTECT.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
O2 - BHO: LitmusBHO - {C6867EB7-8350-4856-877F-93CF8AE3DC9C} - C:\Program Files\Charter Security Suite\NRS\iescript\baselitmus.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Charter Security Suite\NRS\iescript\baselitmus.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [ConnectionCenter] "C:\Program Files\Citrix\ICA Client\concentr.exe" /startup
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Charter Security Suite\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Charter Security Suite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\RunOnce: [DELDIR0.EXE] "C:\DOCUME~1\k7s5a\LOCALS~1\Temp\DELDIR0.EXE" "C:\Program Files\McAfee\McAfee Shared Components\Guardian\"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O8 - Extra context menu item: &Search - ?p=ZJ
O8 - Extra context menu item: Google Sidewiki… - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://www.installengine.com/engine/isetup.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Charter Security Suite\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Charter Security Suite\Common\FSMA32.EXE
O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Charter Security Suite\ORSP Client\fsorsp.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe
O24 - Desktop Component 0: (no name) - http://img70.imageshack.us/img70/5217/lodgebw0qk.jpg

–
End of file - 8504 bytes
Post #2
Hi SnapDaddy,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. Logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Let's get a more thorough scan:

Please download DDS by sUBs from one of the following links and save it to your desktop.
    • DDS.scr
    • DDS.pif
  • Disable any script blocking protection (How to Disable your Security Programs)
  • Double click DDS icon to run the tool (may take up to 3 minutes to run)
  • When done, DDS.txt will open.
  • After a few moments, attach.txt will open in a second window.
  • Save both reports to your desktop.
—————————————————
  • Post the contents of the DDS.txt report in your next reply
  • Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.
Post #3
Greetings Tomk, Thank you for helping me with this, much appreciated! As instructed, please find the pasted dds.txt content and attached attached.zip file from dds.scr. DDS (Ver_10-12-12.02) - FAT32x86 Run by [removed] at 21:15:53.32 on Thu 02/24/2011 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_24 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.511.158 [GMT -8:00] AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095} AV: Charter Security Suite 9.01 *Disabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15} FW: Charter Security Suite 9.01 *Disabled* ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch SVCHOST.EXE c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup SVCHOST.EXE SVCHOST.EXE C:\WINDOWS\system32\brsvc01a.exe C:\WINDOWS\system32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe SVCHOST.EXE C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe C:\Program Files\Charter Security Suite\Common\FSMA32.EXE C:\Program Files\Charter Security Suite\Anti-Virus\FSGK32.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Norton SystemWorks\Norton Utilities\NPROTECT.EXE C:\Program Files\Google\Update\GoogleUpdate.exe C:\PROGRA~1\NORTON~1\SPEEDD~1\nopdb.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\UPHClean\uphclean.exe C:\Program Files\Charter Security Suite\Anti-Virus\fssm32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RunDll32.exe C:\Program Files\Canon\MyPrinter\BJMyPrt.exe C:\Program Files\Citrix\ICA Client\concentr.exe C:\Program Files\Citrix\ICA Client\wfcrun32.exe C:\Program Files\Microsoft Security Client\msseces.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SpywareGuard\sgmain.exe C:\Program Files\SpywareGuard\sgbhp.exe C:\PROGRA~1\MICROS~1\OFFICE\OUTLOOK.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Charter Security Suite\Common\FSLAUNCH.EXE C:\Documents and Settings\k7s5a\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank uSearch Bar = hxxp://www.google.com/ie uSearch Page = hxxp://www.google.com mLocal Page = c:\windows\system\blank.htm uInternet Connection Wizard,ShellNext = iexplore uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: SpywareGuardDLBLOCK.CBrowserHelper: {4a368e80-174f-4872-96b5-0b27ddd11db2} - c:\program files\spywareguard\DLPROTECT.DLL BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll BHO: Browsing Protection Class: {c6867eb7-8350-4856-877f-93cf8ae3dc9c} - c:\program files\charter security suite\nrs\iescript\baselitmus.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - c:\program files\charter security suite\nrs\iescript\baselitmus.dll TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [SystemTray] SysTray.Exe mRun: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [CanonMyPrinter] c:\program files\canon\myprinter\BJMyPrt.exe /logon mRun: [CanonSolutionMenu] c:\program files\canon\solutionmenu\CNSLMAIN.exe /logon mRun: [ConnectionCenter] "c:\program files\citrix\ica client\concentr.exe" /startup mRun: [F-Secure Manager] "c:\program files\charter security suite\common\FSM32.EXE" /splash mRun: [F-Secure TNB] "c:\program files\charter security suite\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe" mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey mRunOnce: [DELDIR0.EXE] "c:\docume~1\k7s5a\locals~1\temp\deldir0.exe" "c:\program files\mcafee\mcafee shared components\guardian\" StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spywareguard\sgmain.exe IE: &Search - ?p=ZJ IE: Google Sidewiki… - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe LSP: c:\program files\charter security suite\fsps\program\FSLSP.DLL DPF: DirectAnimation Java Classes - file://c:\windows\system\dajava.cab DPF: Internet Explorer Classes for Java - file://c:\windows\system\iejava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc.cab DPF: {597C45C2-2D39-11D5-8D53-0050048383FE} - hxxp://office.microsoft.com/productupdates/content/opuc.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} - hxxp://www.installengine.com/engine/isetup.cab DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} - hxxp://v4.windowsupdate.microsoft.com/CAB/x86/ansi/iuctl.CAB?37865.7582175926 DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SpywareGuard.Handler: {81559c35-8464-49f7-bb0e-07a383bef910} - c:\program files\spywareguard\SPYWAREGUARD.DLL mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore - rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C} mASetup: {44BBA840-CC51-11CF-AAFA-00AA00B6015C}.Restore - rundll32.exe advpack.dll,UserUnInstStubWrapper {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "c:\progra~1\outloo~1\setup50.exe" /APP:OE /CALLER:IE50 /user /uninstall mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install mASetup: {7790769C-0471-11d2-AF11-00C04FA35D02} - "c:\progra~1\outloo~1\setup50.exe" /app:wab /caller:win9x /user /install - "c:\progra~1\outloo~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install mASetup: {9EF0045A-CDD9-438e-95E6-02B9AFEC8E11} - c:\windows\system32\updcrl.exe -e -u c:\windows\system\verisignpub1.crl Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\k7s5a\applic~1\mozilla\firefox\profiles\5z2hs5dq.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.thistlenrye.com/ FF - component: c:\program files\charter security suite\nrs\[removed]\components\litmus-ff.dll FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\mozilla firefox\plugins\npicaN.dll FF - plugin: c:\program files\real\realone player\netscape6\nppl3260.dll FF - plugin: c:\program files\real\realone player\netscape6\nprjplug.dll FF - plugin: c:\program files\real\realone player\netscape6\nprpjplug.dll FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} FF - Ext: Browsing Protection: [removed] - c:\program files\charter security suite\nrs\[removed] FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - %profile%\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b} ============= SERVICES / DRIVERS =============== R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2010-6-12 42664] R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2010-6-12 82120] R1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\drivers\ctxusbm.sys [2009-9-8 65584] R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\charter security suite\hips\drivers\fshs.sys [2010-6-12 68064] R1 GhPciScan;GhostPciScanner;c:\program files\symantec\norton ghost 2003\GhPciScan.sys [2002-8-14 5632] R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-10-24 165264] R1 MpKsl46d1d715;MpKsl46d1d715;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0ea78943-abde-4fc1-9656-f912b4416866}\MpKsl46d1d715.sys [2011-2-24 28752] R2 F-Secure Gatekeeper Handler Starter;FSGKHS;c:\program files\charter security suite\anti-virus\fsgk32st.exe [2010-6-12 215648] R2 NProtectService;Norton Unerase Protection;c:\program files\norton systemworks\norton utilities\NPROTECT.EXE [2007-1-5 135168] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\charter security suite\anti-virus\minifilter\fsgk.sys [2010-6-12 130728] S1 MpKsl029bad8f;MpKsl029bad8f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{58f3642a-986a-4c30-b349-f938f8647bcf}\mpksl029bad8f.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{58f3642a-986a-4c30-b349-f938f8647bcf}\MpKsl029bad8f.sys [?] S1 MpKsl2f80d370;MpKsl2f80d370;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5a4fc1a9-cb60-4d19-8dcc-1e57ab9b5969}\mpksl2f80d370.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{5a4fc1a9-cb60-4d19-8dcc-1e57ab9b5969}\MpKsl2f80d370.sys [?] S1 MpKsl6d02059d;MpKsl6d02059d;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\mpksl6d02059d.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\MpKsl6d02059d.sys [?] S1 MpKsl981471cf;MpKsl981471cf;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\mpksl981471cf.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\MpKsl981471cf.sys [?] S1 MpKslc2952402;MpKslc2952402;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{58f3642a-986a-4c30-b349-f938f8647bcf}\mpkslc2952402.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{58f3642a-986a-4c30-b349-f938f8647bcf}\MpKslc2952402.sys [?] S1 MpKsleac41939;MpKsleac41939;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\mpksleac41939.sys –> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{cf4d081a-e0c2-40a4-bd1f-f67932f509b0}\MpKsleac41939.sys [?] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-8 135664] S3 FSORSPClient;F-Secure ORSP Client;c:\program files\charter security suite\orsp client\fsorsp.exe [2010-6-12 63992] S4 F-Secure Filter;F-Secure File System Filter;c:\program files\charter security suite\anti-virus\win2k\fsfilter.sys [2010-6-12 39776] S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\charter security suite\anti-virus\win2k\fsrec.sys [2010-6-12 25184] =============== Created Last 30 ================ 2011-02-24 15:46:25 28752 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{0ea78943-abde-4fc1-9656-f912b4416866}\MpKsl46d1d715.sys 2011-02-24 15:44:18 5943120 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\{0ea78943-abde-4fc1-9656-f912b4416866}\mpengine.dll 2011-02-23 02:16:55 190032 —-a-w- c:\windows\system32\drivers\tmcomm.sys 2011-02-19 18:47:43 762352 —-a-w- C:\NTDETBCT.COM 2011-02-19 16:04:38 5890896 —-a-w- c:\docume~1\alluse~1\applic~1\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll 2011-02-19 15:59:57 ——– d—–w- c:\program files\Microsoft Security Client 2011-02-18 20:45:40 3 —-a-w- c:\windows\system32\fhpatch.dll 2011-02-18 20:45:40 0 —-a-w- c:\windows\system32\fiplock.dll 2011-02-18 20:44:36 12 —-a-w- c:\windows\system32\iphy.dll 2011-02-18 20:44:35 6680576 —-a-w- c:\docume~1\alluse~1\applic~1\win32.tdl 2011-01-30 22:57:00 103864 —-a-w- c:\program files\mozilla firefox\plugins\nppdf32.dll 2011-01-30 22:57:00 103864 —-a-w- c:\program files\internet explorer\plugins\nppdf32.dll ==================== Find3M ==================== 2011-02-03 05:40:24 472808 —-a-w- c:\windows\system32\deployJava1.dll 2011-02-03 03:19:40 73728 —-a-w- c:\windows\system32\javacpl.cpl 2011-01-21 14:44:38 439296 —-a-w- c:\windows\system32\shimgvw.dll 2011-01-07 14:09:02 290048 —-a-w- c:\windows\system32\atmfd.dll 2010-12-31 13:10:34 1854976 —-a-w- c:\windows\system32\win32k.sys 2010-12-22 12:34:28 301568 —-a-w- c:\windows\system32\kerberos.dll 2010-12-20 22:15:52 81920 —-a-w- c:\windows\system32\ieencode.dll 2010-12-20 22:15:52 667136 —-a-w- c:\windows\system32\wininet.dll 2010-12-20 22:15:52 61952 —-a-w- c:\windows\system32\tdc.ocx 2010-12-20 17:26:00 730112 —-a-w- c:\windows\system32\lsasrv.dll 2010-12-20 15:30:30 369664 —-a-w- c:\windows\system32\html.iec 2010-12-09 15:15:10 718336 —-a-w- c:\windows\system32\ntdll.dll 2010-12-09 14:30:22 33280 —-a-w- c:\windows\system32\csrsrv.dll 2010-12-09 13:38:48 2192768 —-a-w- c:\windows\system32\ntoskrnl.exe 2010-12-09 13:07:06 2069376 —-a-w- c:\windows\system32\ntkrnlpa.exe ============= FINISH: 21:17:15.49 ===============

Attachments:

Post #4
SnapDaddy,

The most serious issue I'm seeing in there is that you're running two anti-Virus programs. Charter Security Suite and MSSE. This is a bad thing. They are conflicting with each other. One of them must be uninstalled. Seeing as Charter is also providing your firewall, you may want to keep it. If you choose to keep MSSE, then when you remove Charter, it's important that you make sure to turn the windows firewall back on.

You've got some old Java on there.

Please download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.

After you've completed all the above-

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5
OK Tomk, JavaRa removed outdated java runtimes and CombFix installed the Microsoft Windows Recovery Console, found and removed the fhpatch.dll, fiplock.dll and iphy.dll file I had first noticed. Please find the attached CombFix.txt file. I installed MSSE after the Charter security suite found the first round of perfs files. Then MSSE found more remnants. I will most likely uninstall MSSE since I get free support and update for the Charter security suite and it has a firewall. Been noticing that my computer has been running a bit slower today…otherwise, nothing as obvious as before. Thanks again! :thumbup:

Attachments:

Post #6
SnapDaddy,

Open notepad and copy/paste the text in the quotebox below into it:

http://forums.whatthetech.com/index.php?showtopic=117293

Collect::
c:\documents and settings\All Users\Application Data\win32.tdl


Save this as CFScript.txt


[external image: Posted Image]


Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box–do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
Post #7
Well Tomk, I pasted the scipt into a text file with the filename of CFScript.txt and dragged it on to ComboFix. ComboFix ran, but produced no log or error? The inital small ComboFix progress window just closed after the green status bars reached the end??? I tried it twice… Did it send any info? What do you suggest? Thanks!
Post #8
SnapDaddy,

Please scan the following files

  • Please go to VirusTotal
  • On the page you'll find a "Browse" button.
  • Click on the Browse button.
  • In the Choose File to Upload window which opens, copy and paste this into the File Name box.
c:\documents and settings\All Users\Application Data\win32.tdl
  • Next, click the Open button.
  • Then click the "Send File" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.
Post #10
SnapDaddy,

Let's get an online scan.

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here then click on: [external image: Posted Image]

    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.

  • Select the option YES, I accept the Terms of Use then click on: [external image: Posted Image]
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:
    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology
  • Now click on: [external image: Posted Image]
  • The virus signature database… will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on: [external image: Posted Image]
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!
Post #11
Tomk, Here's the output log from ESET. Looks like it found something… C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch1.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MyWayMyWebSearch3.zip Win32/Bagle.gen.zip worm C:\Documents and Settings\Administrator\Local Settings\Application Data\Mozilla\Firefox\Profiles\9990yc9q.default\Cache\DA91B6A7d01 JS/Exploit.Agent.NBX trojan C:\System Volume Information\_restore{0C34E7F6-11D7-4F46-BCF3-2E8C275DD7DD}\RP801\A0335946.dll Win32/Delf.PWG trojan C:\System Volume Information\_restore{0C34E7F6-11D7-4F46-BCF3-2E8C275DD7DD}\RP801\A0335947.dll Win32/Delf.PWG trojan
Post #12
SnapDaddy,

Most everything is already quarantined.

Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon. [external image: Posted Image]
  • Under Temporary Internet Files, click the Settings… button
  • click the Delete Files button.
  • There are two options in the window to clear the cache - Leave both Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Settings
  • Click OK to leave the Java Control Panel.

How are things running now?
Post #13
Hi Tomk, Seems to be running OK. Sometimes the HD just seems to be doing something when no programs are open…maybe background scanning? I do run CCleaner often and it seems to help speed things up a bit. I cleared the java cache as you outlined. What about the two Win32/Delf.PWG trojan's shown under the System Volume Information folder? The FF admin profile cache folder with the JS/Exploit.Agent.NBX trojan seems to be gone… There are a lot of zip files in the Spybot - Search & Destroy\Recovery folder…I have uninstalled Spybot - Search & Destroy a while back, can I delete the Spybot - Search & Destroy folder and sub folders from C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy? Thank you, SnapDaddy
Post #14
SnapDaddy,

Seems to be running OK. Sometimes the HD just seems to be doing something when no programs are open…maybe background scanning?

Most likely. You really need to get MSSE uninstalled and just run one Anti-Virus. That should cut down on errors.

I do run CCleaner often and it seems to help speed things up a bit.

That is fine.. but… never, never, NEVER use the registry cleaner component in CCleaner.

What about the two Win32/Delf.PWG trojan's shown under the System Volume Information folder?

Those are restore points that we will reset before I let you go.

There are a lot of zip files in the Spybot - Search & Destroy\Recovery folder…I have uninstalled Spybot - Search & Destroy a while back, can I delete the Spybot - Search & Destroy folder and sub folders from C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy?

Yes you can.


Now… just because the script didn't run earlier… I'd like you to run ComboFix again. Just double click on the icon per original instructions. There is a good chance that it will ask if you want to update it. If it asks… Yes you do want to update.

Please post the resultant log.
Post #15
OK, I uninstalled MSSE. I deleted the C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy folder. Ran CCleaner (not the reg part. never do!) Then launched ComboFix.exe with same results as when I dragged the script over it. It opened with the small status window…the green status bars progressed to end, then closed with no log or other notification windows as when I first ran it. What next Tomk? Thanks…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI