Spyware / Malware / Virus Removal

Computer infected with Fakealert!grb

25 min read

Looking for the outcome? Ask AI

joeyfor

Post #16June 22, 2011, 9:53 PM UTC

Awesome! Combofix ran! What next?

ComboFix 11-06-22.02 - ClientB 06/22/2011 15:48:26.1.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1980.1699 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\explorer.com.exe
AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ClientB\0.781263767129598.exe
c:\documents and settings\ClientB\Application Data\PriceGong
c:\documents and settings\ClientB\Application Data\PriceGong\Data\1.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\a.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\b.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\c.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\d.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\e.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\f.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\g.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\h.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\i.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\J.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\k.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\l.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\m.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\n.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\o.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\p.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\q.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\r.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\s.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\t.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\u.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\v.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\w.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\x.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\y.xml
c:\documents and settings\ClientB\Application Data\PriceGong\Data\z.xml
c:\documents and settings\ClientB\GoToAssistDownloadHelper.exe
c:\documents and settings\ClientB\Local Settings\Application Data\lwu.exe
c:\documents and settings\ClientB\Local Settings\Application Data\o80ys.dll
c:\documents and settings\Pharmadmin\GoToAssistDownloadHelper.exe
C:\LOGC.tmp
.
.
((((((((((((((((((((((((( Files Created from 2011-05-22 to 2011-06-22 )))))))))))))))))))))))))))))))
.
.
2011-06-22 21:42 . 2011-06-22 21:42 ——– d—–w- C:\explorer.com
2011-06-22 20:12 . 2011-06-22 20:12 ——– d—–w- c:\documents and settings\Administrator\Application Data\Windows Search
2011-06-22 20:11 . 2011-06-22 20:11 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2011-06-20 14:09 . 2011-06-20 14:09 0 —ha-w- c:\documents and settings\ClientB\oxdcrkgbmw.tmp
2011-06-18 05:33 . 2011-06-18 05:33 169472 —-a-w- c:\windows\system32\moricons32.dll
2011-06-18 05:33 . 2011-06-18 05:33 349696 —-a-w- c:\windows\system32\AmRes_ro32.dll
2011-06-16 20:33 . 2011-04-21 13:37 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2011-06-16 17:04 . 2011-06-16 17:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-06-15 21:31 . 2011-06-15 21:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-06-15 21:31 . 2011-06-15 21:32 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-06-15 20:28 . 2011-06-15 20:28 102400 —-a-w- c:\windows\RegBootClean.exe
2011-06-15 20:16 . 2010-09-06 09:26 189520 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2011-06-15 20:07 . 2011-06-15 20:07 ——– d—–w- c:\documents and settings\ClientB\Application Data\Malwarebytes
2011-06-15 20:07 . 2011-06-15 20:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-06-15 20:07 . 2011-05-29 15:11 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-15 20:07 . 2011-06-15 20:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-06-15 13:55 . 2011-06-15 21:19 ——– d—–w- c:\documents and settings\ClientB\Application Data\Sammsoft
2011-06-15 13:55 . 2011-06-15 20:50 ——– d—–w- c:\documents and settings\ClientB\Local Settings\Application Data\AskToolbar
2011-06-15 13:55 . 2011-06-15 13:55 ——– d—–w- c:\program files\Ask.com
2011-06-15 13:55 . 2011-06-15 13:55 ——– d—–w- C:\Firefox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-22 21:52 . 2010-11-14 19:31 0 —-a-w- c:\documents and settings\ClientB\Local Settings\Application Data\WavXMapDrive.bat
2011-05-02 15:31 . 2008-04-25 21:27 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2008-04-25 16:16 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2008-04-25 16:16 916480 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2008-04-25 16:16 43520 ——w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2008-04-25 16:16 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2008-04-25 16:16 385024 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-04-25 16:16 105472 —-a-w- c:\windows\system32\drivers\mup.sys
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{018D0349-18BA-40B5-A01C-BA1CD7A107Df}]
2011-06-18 05:33 349696 —-a-w- c:\windows\system32\AmRes_ro32.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
2011-02-02 01:17 1487240 —-a-w- c:\program files\Ask.com\GenericAskToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5EBBA2A-83C0-7D2F-0E9B-290F17849D62}]
2011-06-18 05:33 169472 —-a-w- c:\windows\system32\moricons32.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"= "c:\program files\Ask.com\GenericAskToolbar.dll" [2011-02-02 1487240]
.
[HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UninitializedFdeIconOverlay]
@="{CF08DA3E-C97D-4891-A66B-E39B28DD270F}"
[HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
2010-03-29 16:45 62832 —-a-w- c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-28 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-28 142872]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2010-07-21 159616]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-06-22 34232]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2009-01-16 136512]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2009-04-30 124240]
"MPSUpg"="c:\autotask\update.vbs" [2010-10-25 38294]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\moricons32.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [8/25/2010 12:39 PM 24064]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [8/25/2010 9:03 AM 13336]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\engineserver.exe [4/29/2009 7:07 PM 21256]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/3/2010 7:35 AM 70216]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [8/25/2010 9:07 AM 2066968]
R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [8/25/2010 12:39 PM 168616]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/15/2011 2:07 PM 39984]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [11/3/2010 7:35 AM 65224]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 10:16 AM 14336]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - WUAUSERV
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-22 c:\windows\Tasks\Free File Viewer Update Checker.job
- c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2010-12-09 17:25]
.
2011-06-22 c:\windows\Tasks\Scheduled Update for Ask Toolbar.job
- c:\program files\Ask.com\UpdateTask.exe [2011-02-02 01:17]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
TCP: Interfaces\{D179768E-A390-42E7-80C9-3A6B7DBB09FC}: NameServer = 10.100.192.2
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-{E38FA08E-F56A-4169-ABF5-5C71E3C153A1} - (no file)
BHO-{1631550F-191D-4826-B069-D9439253D926} - (no file)
ShellIconOverlayIdentifiers-{30D3C2AF-9709-4D05-9CF4-13335F3C1E4A} - c:\documents and settings\ClientB\Local Settings\Application Data\o80ys.dll
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-22 15:52
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3148)
c:\windows\system32\WININET.dll
c:\windows\system32\igfxdo.dll
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmIconOverlay.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\vstskmgr.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\McAfee\VirusScan Enterprise\mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\mfeann.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\McAfee\Common Framework\McTray.exe
c:\documents and settings\All Users\Application Data\WeCareReminder\ReminderHelper.exe
c:\pharmsuite\Businfo.exe
.
**************************************************************************
.
Completion time: 2011-06-22 15:55:07 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-22 21:55
.
Pre-Run: 148,482,469,888 bytes free
Post-Run: 148,421,582,848 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 6EAB5A2FA716E87D520B92381681E9E1

LDTate

Post #17June 22, 2011, 10:05 PM UTC

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
c:\windows\system32\AmRes_ro32.dll
c:\windows\system32\moricons32.dll

Folder::
c:\program files\Ask.com

Registry::
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{00000000-6E41-4FD3-8538-502F5495E5FC}"=- 
[-HKEY_CLASSES_ROOT\clsid\{00000000-6e41-4fd3-8538-502f5495e5fc}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{018D0349-18BA-40B5-A01C-BA1CD7A107Df}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E5EBBA2A-83C0-7D2F-0E9B-290F17849D62}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=-
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{D4027C7F-154A-4066-A1AD-4243D8127440}"=- 
[-HKEY_CLASSES_ROOT\clsid\{d4027c7f-154a-4066-a1ad-4243d8127440}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd.1]
[-HKEY_CLASSES_ROOT\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}]
[-HKEY_CLASSES_ROOT\GenericAskToolbar.ToolbarWnd]
[-HKEY_CLASSES_ROOT\CLSID\{CF08DA3E-C97D-4891-A66B-E39B28DD270F}]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …

[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

joeyfor

Post #18June 22, 2011, 10:17 PM UTC

When I do that, as soon as combofix finishes initiating the computer blue screens saying its shutting down to prevent an error. The message mentions BAD_POOL_CALLER

LDTate

Post #19June 22, 2011, 10:19 PM UTC last edited June 22, 2011, 10:19 PM UTC

Lets just do it this way

Delete these two files
c:\windows\system32\AmRes_ro32.dll
c:\windows\system32\moricons32.dll

Use Add/Remove programs and uninstall: Ask.com

After that run a new MBAM scan

joeyfor

Post #20June 22, 2011, 10:33 PM UTC

I will rerun MWB now

I rebooted in safemode and ran CF heres the log:

ComboFix 11-06-22.02 - ClientB 06/22/2011 16:27:24.2.2 - x86 NETWORK
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1980.1704 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Desktop\explorer.com.exe
Command switches used :: c:\documents and settings\ClientB\Desktop\cfscript.txt
AV: McAfee VirusScan Enterprise *Enabled/Updated* {918A2B0B-2C60-4016-A4AB-E868DEABF7F0}
.
FILE ::
"c:\windows\system32\AmRes_ro32.dll"
"c:\windows\system32\moricons32.dll"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Ask.com
c:\program files\Ask.com\assets\oobe\b.png
c:\program files\Ask.com\assets\oobe\bl.png
c:\program files\Ask.com\assets\oobe\br.png
c:\program files\Ask.com\assets\oobe\l.png
c:\program files\Ask.com\assets\oobe\pointer.png
c:\program files\Ask.com\assets\oobe\r.png
c:\program files\Ask.com\assets\oobe\t.png
c:\program files\Ask.com\assets\oobe\tl.png
c:\program files\Ask.com\assets\oobe\tr.png
c:\program files\Ask.com\cobrand.ico
c:\program files\Ask.com\config.xml
c:\program files\Ask.com\favicon.ico
c:\program files\Ask.com\fv_41.ico
c:\program files\Ask.com\GenericAskToolbar.dll
c:\program files\Ask.com\mupcfg.xml
c:\program files\Ask.com\SaUpdate.exe
c:\program files\Ask.com\UpdateTask.exe
c:\windows\system32\AmRes_ro32.dll
c:\windows\system32\moricons32.dll
.
.
((((((((((((((((((((((((( Files Created from 2011-05-22 to 2011-06-22 )))))))))))))))))))))))))))))))
.
.
2011-06-22 21:42 . 2011-06-22 21:42 ——– d—–w- C:\explorer.com
2011-06-22 20:12 . 2011-06-22 20:12 ——– d—–w- c:\documents and settings\Administrator\Application Data\Windows Search
2011-06-22 20:11 . 2011-06-22 20:11 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2011-06-20 14:09 . 2011-06-20 14:09 0 —ha-w- c:\documents and settings\ClientB\oxdcrkgbmw.tmp
2011-06-16 20:33 . 2011-04-21 13:37 105472 -c—-w- c:\windows\system32\dllcache\mup.sys
2011-06-16 17:04 . 2011-06-16 17:04 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2011-06-15 21:31 . 2011-06-15 21:32 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-06-15 21:31 . 2011-06-15 21:32 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-06-15 20:28 . 2011-06-15 20:28 102400 —-a-w- c:\windows\RegBootClean.exe
2011-06-15 20:16 . 2010-09-06 09:26 189520 —-a-w- c:\windows\system32\drivers\tmcomm.sys
2011-06-15 20:07 . 2011-06-15 20:07 ——– d—–w- c:\documents and settings\ClientB\Application Data\Malwarebytes
2011-06-15 20:07 . 2011-06-15 20:07 ——– d—–w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-06-15 20:07 . 2011-05-29 15:11 39984 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-15 20:07 . 2011-06-15 20:41 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2011-06-15 13:55 . 2011-06-15 21:19 ——– d—–w- c:\documents and settings\ClientB\Application Data\Sammsoft
2011-06-15 13:55 . 2011-06-15 20:50 ——– d—–w- c:\documents and settings\ClientB\Local Settings\Application Data\AskToolbar
2011-06-15 13:55 . 2011-06-15 13:55 ——– d—–w- C:\Firefox
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-22 22:31 . 2010-11-14 19:31 0 —-a-w- c:\documents and settings\ClientB\Local Settings\Application Data\WavXMapDrive.bat
2011-05-02 15:31 . 2008-04-25 21:27 692736 —-a-w- c:\windows\system32\inetcomm.dll
2011-04-29 16:19 . 2008-04-25 16:16 456320 —-a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2008-04-25 16:16 916480 —-a-w- c:\windows\system32\wininet.dll
2011-04-25 16:11 . 2008-04-25 16:16 43520 ——w- c:\windows\system32\licmgr10.dll
2011-04-25 16:11 . 2008-04-25 16:16 1469440 ——w- c:\windows\system32\inetcpl.cpl
2011-04-25 12:01 . 2008-04-25 16:16 385024 —-a-w- c:\windows\system32\html.iec
2011-04-21 13:37 . 2008-04-25 16:16 105472 —-a-w- c:\windows\system32\drivers\mup.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2011-06-22_21.52.52 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-06-22 22:31 . 2011-06-22 22:31 16384 c:\windows\temp\Perflib_Perfdata_73c.dat
+ 2011-06-22 22:30 . 2011-06-22 22:30 16384 c:\windows\temp\Perflib_Perfdata_72c.dat
+ 2008-04-25 16:16 . 2011-06-22 22:32 79334 c:\windows\system32\perfc009.dat
- 2008-04-25 16:16 . 2011-06-22 21:53 79334 c:\windows\system32\perfc009.dat
+ 2008-04-25 16:16 . 2011-06-22 22:32 464250 c:\windows\system32\perfh009.dat
- 2008-04-25 16:16 . 2011-06-22 21:53 464250 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2009-06-22 1044480]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-07-28 141336]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-07-28 173592]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-07-28 142872]
"IAStorIcon"="c:\program files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe" [2010-03-04 284696]
"WavXMgr"="c:\program files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe" [2010-07-21 159616]
"USCService"="c:\program files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe" [2010-06-22 34232]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\udaterui.exe" [2009-01-16 136512]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2009-04-30 124240]
"MPSUpg"="c:\autotask\update.vbs" [2010-10-25 38294]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\McAfeeEngineService]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*:Disabled:Windows Remote Management
.
R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [8/25/2010 12:39 PM 24064]
R2 IAStorDataMgrSvc;Intel® Rapid Storage Technology;c:\program files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe [8/25/2010 9:03 AM 13336]
R2 McAfeeEngineService;McAfee Engine Service;c:\program files\McAfee\VirusScan Enterprise\engineserver.exe [4/29/2009 7:07 PM 21256]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [11/3/2010 7:35 AM 70216]
R2 UNS;Intel® Management and Security Application User Notification Service;c:\program files\Common Files\Intel\Privacy Icon\UNS\UNS.exe [8/25/2010 9:07 AM 2066968]
R3 e1kexpress;Intel® PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\drivers\e1k5132.sys [8/25/2010 12:39 PM 168616]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [6/15/2011 2:07 PM 39984]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [11/3/2010 7:35 AM 65224]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [4/25/2008 10:16 AM 14336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
WINRM REG_MULTI_SZ WINRM
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-22 c:\windows\Tasks\Free File Viewer Update Checker.job
- c:\program files\FreeFileViewer\FFVCheckForUpdates.exe [2010-12-09 17:25]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/?ilc=1
TCP: Interfaces\{D179768E-A390-42E7-80C9-3A6B7DBB09FC}: NameServer = 10.100.192.2
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{018D0349-18BA-40B5-A01C-BA1CD7A107Df} - (no file)
BHO-{1631550F-191D-4826-B069-D9439253D926} - (no file)
BHO-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
BHO-{E5EBBA2A-83C0-7D2F-0E9B-290F17849D62} - (no file)
ShellIconOverlayIdentifiers-{CF08DA3E-C97D-4891-A66B-E39B28DD270F} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-22 16:31
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(3540)
c:\windows\system32\WININET.dll
c:\windows\system32\igfxdo.dll
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
———————— Other Running Processes ————————
.
c:\program files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Intel\AMT\LMS.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\vstskmgr.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
c:\program files\McAfee\VirusScan Enterprise\mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\mfeann.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\program files\Internet Explorer\IEXPLORE.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\McAfee\Common Framework\McTray.exe
c:\documents and settings\All Users\Application Data\WeCareReminder\ReminderHelper.exe
c:\pharmsuite\Businfo.exe
.
**************************************************************************
.
Completion time: 2011-06-22 16:33:48 - machine was rebooted
ComboFix-quarantined-files.txt 2011-06-22 22:33
ComboFix2.txt 2011-06-22 21:55
.
Pre-Run: 148,409,618,432 bytes free
Post-Run: 148,401,311,744 bytes free
.
- - End Of File - - 523C4A1B699BD98EAE08CAB509D13BDD

LDTate

Post #21June 22, 2011, 10:35 PM UTC

If MBAM doesn't remove this one, you do it
c:\documents and settings\ClientB\oxdcrkgbmw.tmp

We're not finished yet

joeyfor

Post #22June 22, 2011, 10:52 PM UTC last edited June 22, 2011, 10:58 PM UTC

I have MWB running a full scan and now it is coming up with an "on access scan message" name is "generic.brf.cf" while running mwb. I am going to have to shut down this computer after this Scan b/c i have to go to work. I will be up in the morning working on it so leave me instructions, and hope to see you tomorrow man. Thanks again! EDIT*** MWB LOG Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6922 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/22/2011 5:01:10 PM mbam-log-2011-06-22 (17-01-10).txt Scan type: Full scan (C:\|) Objects scanned: 218943 Time elapsed: 21 minute(s), 41 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 8 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: c:\Qoobox\quarantine\C\documents and settings\ClientB\local settings\application data\lwu.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\Qoobox\quarantine\C\documents and settings\ClientB\local settings\application data\o80ys.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\system volume information\_restore{45b5e8b9-949a-471e-999d-f381da56a2d3}\RP218\A0014558.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\system volume information\_restore{45b5e8b9-949a-471e-999d-f381da56a2d3}\RP218\A0014559.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. c:\WINDOWS\system32\020000000dc00c7d1270c.manifest (Malware.Trace) -> Quarantined and deleted successfully. c:\WINDOWS\system32\020000000dc00c7d1270o.manifest (Malware.Trace) -> Quarantined and deleted successfully. c:\WINDOWS\system32\020000000dc00c7d1270p.manifest (Malware.Trace) -> Quarantined and deleted successfully. c:\WINDOWS\system32\020000000dc00c7d1270s.manifest (Malware.Trace) -> Quarantined and deleted successfully.

LDTate

Post #23June 22, 2011, 11:05 PM UTC

Good job

The following will implement some cleanup procedures as well as reset System Restore points:

For XP:

Click START run
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

For Vista / Windows 7

Click START Search
Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.

Here's my usual all clean post

To be on the safe side, I would also change all my passwords.

This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.

Log looks good

Make your Internet Explorer more secure - This can be done by following these simple instructions:
- From within Internet Explorer click on the Tools menu and then click on Options.
- Click once on the Security tab
- Click once on the Internet icon so it becomes highlighted.
- Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt
- Change the Download unsigned ActiveX controls to Disable
- Change the Initialize and script ActiveX controls not marked as safe to Disable
- Change the Installation of desktop items to Prompt
- Change the Launching programs and files in an IFRAME to Prompt
- Change the Navigate sub-frames across different domains to Prompt
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
- Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.
Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.

•Free browser plug-in for Internet Explorer and Firefox
•Real-time safety ratings
•Ideal for Facebook, Twitter and LinkedIn
JAVA Click this link and click on the Free JAVA Download
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.

Only run one Anti-Virus and Firewall program.

I would suggest you read:
PC Safety and Security–What Do I Need?.
How to Prevent Malware:

joeyfor

Post #24June 23, 2011, 6:42 PM UTC

While trying to run the uninstall of combofix the program had an error message "Can't write C:\32788r22fwjfw\iexplore.exe" after the failure of trying to run the unistall the "catch me" notepad document came back up on the desktop.

joeyfor

Post #25June 23, 2011, 7:16 PM UTC last edited June 23, 2011, 7:31 PM UTC

HJT log, I don't feel like its completely clean…. That Textfile keeps on coming up on the desktop and the iexplore processes are poping up like crazy

**********EDIT**********

I was able to get combofix to run its install process in safemode. Sorry if I'm posting too much, I just keep on trying and re-trying to get the programs to run.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:18:39 PM, on 6/23/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\AMT\LMS.exe
C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
C:\WINDOWS\system32\mfevtps.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
C:\Program Files\McAfee\Common Framework\udaterui.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
C:\Documents and Settings\All Users\Application Data\WeCareReminder\ReminderHelper.exe
C:\Pharmsuite\Businfo.exe
C:\WINDOWS\system32\userinit.exe
C:\Documents and Settings\ClientB\Desktop\Computer cleanup\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?ilc=1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
O2 - BHO: (no name) - {018D0349-18BA-40B5-A01C-BA1CD7A107Df} - (no file)
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
O2 - BHO: WeCareReminder - {D824F0DE-3D60-4F57-9EB1-66033ECD8ABB} - C:\Documents and Settings\All Users\Application Data\WeCareReminder\IEHelperv2.5.0.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: (no name) - {E5EBBA2A-83C0-7D2F-0E9B-290F17849D62} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [IAStorIcon] C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorIcon.exe
O4 - HKLM\..\Run: [WavXMgr] C:\Program Files\Wave Systems Corp\Services Manager\Docmgr\bin\WavXDocMgr.exe
O4 - HKLM\..\Run: [USCService] C:\Program Files\Dell\Dell ControlPoint\Security Manager\BcmDeviceAndTaskStatusService.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\udaterui.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [MPSUpg] C:\Autotask\update.vbs
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - https://www.telepc.net/shamrockbank/arview2.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = D005992.local
O17 - HKLM\Software\..\Telephony: DomainName = D005992.local
O17 - HKLM\System\CCS\Services\Tcpip\..\{D179768E-A390-42E7-80C9-3A6B7DBB09FC}: NameServer = 10.100.192.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = D005992.local
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = D005992.local
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Intel® Rapid Storage Technology (IAStorDataMgrSvc) - Intel Corporation - C:\Program Files\Intel\Intel® Rapid Storage Technology\IAStorDataMgrSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel® Management and Security Application Local Management Service (LMS) - Intel Corporation - C:\Program Files\Intel\AMT\LMS.exe
O23 - Service: McAfee Engine Service (McAfeeEngineService) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\engineserver.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe
O23 - Service: McAfee Validation Trust Protection Service (mfevtp) - McAfee, Inc. - C:\WINDOWS\system32\mfevtps.exe
O23 - Service: SecureStorageService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Secure Storage Manager\SecureStorageService.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: NTRU TSS v1.2.1.29 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU TCG Software Stack\bin\tcsd_win32.exe
O23 - Service: TdmService - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Trusted Drive Manager\TdmService.exe
O23 - Service: Intel® Management and Security Application User Notification Service (UNS) - Intel Corporation - C:\Program Files\Common Files\Intel\Privacy Icon\UNS\UNS.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 9551 bytes

LDTate

Post #26June 23, 2011, 10:56 PM UTC

Please run a new MBAM scan being sure to update before scanning.

Post the scan results

Also please describe how your computer behaves at the moment.

Please don't attach the scans / logs, use "copy/paste".

joeyfor

Post #27June 24, 2011, 6:11 PM UTC last edited June 24, 2011, 6:13 PM UTC

The computer is running "fine" but there are still numerous suspiscious processes running when I check task manager. Also I ran MWB last night before I went to work and it came up clean, but this morning there are more infected files. Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6922 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/24/2011 12:11:35 PM mbam-log-2011-06-24 (12-11-24).txt Scan type: Full scan (C:\|) Objects scanned: 225672 Time elapsed: 22 minute(s), 10 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 3 Registry Data Items Infected: 3 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_XMLLookup (Hijacker.XMLLookup) -> Value: bak_XMLLookup -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_Application (Hijacker.Application) -> Value: bak_Application -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\bak_intl (Hijacker.intl) -> Value: bak_intl -> No action taken. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\XMLLookup (Hijacker.XMLLookup) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\Application (Hijacker.Application) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/%04x/xml/redir.asp?Ext=%s) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Associations\intl (Hijacker.intl) -> Bad: (http://www.helpmeopen.com/?n=app&l=%04x&ext=%s) Good: (http://shell.windows.com/fileassoc/fileassoc.asp?LangID=%04x&Ext=%s) -> No action taken. Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

LDTate

Post #28June 24, 2011, 6:16 PM UTC

If you didn't select to fix those, please run it again and remove what it finds. Also let me know how it's running

joeyfor

Post #29June 24, 2011, 7:38 PM UTC

Its running fine and I did remove those, I accidently saved the log before I finished cleaning it. Due to the initial problems, I still haven't ran TDSSkiller. Any other ideas?

LDTate

Post #30June 24, 2011, 7:40 PM UTC

You can run TDSSKiller if you want.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Computer infected with Fakealert!grb

✨ Ask AI

Ask AI