Need help with Sirefef.DA [Closed]

I got a laptop that I'd like to pass to my parents. I figured out that no antivirus was installed (o_O), and installed ESET Smart Security, but its services are prevented from starting. After some workaround I was able to run it, and it reported that memory is infected with Win32/Sirefef.DA, but ESET cannot clear it.

Could you please help me to get rid of it?
Thank you very much!

DDS log:


.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 18:28:31.68 on Sun 09/23/2012
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1033.18.1022.606 [GMT -7:00]
.
AV: ESET Smart Security 5.2 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\184393290:3043033845.exe
svchost.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Wave Systems Corp\Common\DataServer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\SciTegic\apps\scitegic\core\packages_win32\apache\httpd-2.0.55\bin\apache.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Ally\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe
C:\Program Files\Apoint\HidFind.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Apoint\Apntex.exe
c:\progra~1\common~1\instal~1\update~1\isuspm.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
E:\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = proxy-server.hpw.pri.bms.com:8080
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
BHO: 1 (0x1): {02478d38-c3f9-4efb-9b51-7695eca05670} - Yahoo! Toolbar Helper
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
uRun: [Google Update] "c:\documents and settings\ally\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [NvCplDaemon] "RUNDLL32.EXE" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] "nwiz.exe" /installquiet
mRun: [NVHotkey] "rundll32.exe" nvHotkey.dll,Start
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe"
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [SigmatelSysTrayApp] stsystra.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [Document Manager] c:\program files\wave systems corp\services manager\docmgr\bin\docmgr.exe
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\embass~1.lnk - c:\program files\wave systems corp\services manager\secure update\AutoUpdate.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
LSP: mswsock.dll
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab
DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} - hxxp://stus3.bms.com/sametime/stmeetingroomclient/STJNILoader.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://genego.webex.com/client/v_mywebex-t20/webex/ieatgpc.cab
TCP: {DE102038-EEE8-471F-8B13-372648ECA3EF} = 66.78.210.254,66.78.202.254
AppInit_DLLs: wxvault.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Authentication Packages = msv1_0 wvauth
LSA: Notification Packages = scecli scecli
.
============= SERVICES / DRIVERS ===============
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2012-3-14 120152]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2006-6-28 28952920]
R2 scitegic_apache_1;scitegic_apache_6_1_5;c:\program files\scitegic\apps\scitegic\core\packages_win32\apache\httpd-2.0.55\bin\Apache.exe [2006-2-15 13824]
S2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2012-3-7 913144]
S2 SPService;SPService;c:\windows\system32\svchost.exe -k netsvc [2004-8-11 14336]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-4-30 257696]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [2005-8-3 4736]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys –> c:\windows\system32\drivers\motodrv.sys [?]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [2005-8-3 8960]
S3 PortAcc;Spearit Port Access;c:\program files\laplink\pcmover\PortAcc.sys [2007-11-1 16176]
S3 SirefefRemover;SirefefRemover;\??\c:\docume~1\ally\locals~1\temp\559c268d.tmp –> c:\docume~1\ally\locals~1\temp\559c268d.tmp [?]
.
=============== Created Last 30 ================
.
.
==================== Find3M ====================
.
2008-05-31 01:39:22 14613912 -c–a-w- c:\program files\Install_ICQ6.exe
2008-03-05 23:34:32 28668101 -c–a-w- c:\program files\R-2.3.1-win32.exe
2007-12-30 00:56:02 8759168 -c–a-w- c:\program files\winamp551_full_emusic-7plus_en-us.exe
2007-12-04 00:57:55 6820528 -c–a-w- c:\program files\FirefoxGoogleToolbarSetup.exe
2007-11-16 22:56:49 2155208 -c–a-w- c:\program files\total_commander702a.exe
2007-10-26 18:34:36 23876904 -c–a-w- c:\program files\SkypeSetup.exe
2007-08-29 00:25:31 1421234 -c–a-w- c:\program files\VNCNavigatorFree.exe
2007-08-27 22:24:36 471216 -c–a-w- c:\program files\msgr8us.exe
2007-08-27 21:44:40 50009400 -c–a-w- c:\program files\iTunesSetup.exe
2007-05-22 17:52:02 11552256 -c–a-w- c:\program files\AudioConverter5-4.exe
2007-05-04 22:03:26 3225088 -c–a-w- c:\program files\1ClickNew.msi
2006-11-29 00:10:23 18695520 -c–a-w- c:\program files\cdpn901.exe
2006-11-28 21:58:32 2387480 -c–a-w- c:\program files\SVGView.exe
2006-10-26 22:31:44 1645320 -c–a-w- c:\program files\gdiplus.dll
2006-10-26 22:31:14 1779200 -c–a-w- c:\program files\dchip2006.exe
2006-09-26 20:34:56 16230664 -c–a-w- c:\program files\j2re-1_4_2_12-windows-i586-p.exe
2006-09-18 18:34:31 1531784 -c–a-w- c:\program files\googletalk-setup.exe
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST9100824AS rev.8.03 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8719CCA0]<<
_asm { MOV EAX, [ESP+0x4]; MOV ECX, [EAX+0x28]; PUSH EBP; MOV EBP, [ECX+0x4]; PUSH ESI; MOV ESI, [ESP+0x10]; PUSH EDI; MOV EDI, [ESI+0x60]; MOV AL, [EDI]; CMP AL, 0x16; JNZ 0x36; PUSH ESI; }
1 ntkrnlpa!IofCallDriver[0x804EF1B0] -> \Device\Harddisk0\DR0[0x8736AAB8]
3 CLASSPNP[0xF7592FD7] -> ntkrnlpa!IofCallDriver[0x804EF1B0] -> [0x87170AC8]
\Driver\00000666[0x87242030] -> IRP_MJ_CREATE -> 0x8719CCA0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8732631B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 18:30:50.82 ===============

Hello Alexey Guryanov and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

I see that Conspire offered to help you recently but you did not reply.

We are very busy here and I would be grateful if you would be courteous enough to let me know if you are going to be away for any length of time or are unable to respond.

Please read the following guidelines which will help to make cleaning your machine easier:

• please follow all instructions in the order posted
• please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear
• all logs/reports, etc. must be posted in Notepad. Please ensure that word wrap is unchecked. In Notepad click Format, uncheck Word wrap if it is checked
• if you don't understand something, please don't hesitate to ask for clarification before proceeding
• the fixes are specific to your problem and should only be used for this issue on this machine.
• please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!

IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested


======================================================

Please run these in the order requested.

Run TDSSKiller

Please download TDSSKiller.zip

• extract it to your desktop
• double click TDSSKiller.exe
• press Start Scan
  
  • only if Malicious objects are found then ensure Cure is selected. Do not change it to Delete or Quarantine as it may delete infected files that are required for Windows to operate properly.
  • then click Continue > Reboot now
• copy and paste the log in your next reply
  • A copy of the log will be saved automatically to the root of the drive (typically C:\) called TDSSKiller_*** (*** denotes version & date)

======================================================

Download and run ComboFix

Download ComboFix from the following location:

Link

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• see this Link for programs that need to be disabled and instruction on how to disable them.
• remember to re-enable them when we're done.
• double click on ComboFix.exe & follow the prompts.
  
• as part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue its malware removal procedures.
  
  

  🖼Click to load external image (Posted Image)

  
  Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
  
  

  🖼Click to load external image (Posted Image)

  
  Click on Yes, to continue scanning for malware.

Note: Do not mouse-click combofix's window while it is running. That may cause it to stall.

When finished, it will produce a log. Please include the ComboFix.txt in your next reply. It can be found at C:\ComboFix.txt

Please also remember to include the TDSSKiller log

Thanks

Satchfan

Thank you much for your help! I'm not sure should I attach logs or insert them into reply. This time I will attache them as they seem to be pretty big, please let me know if it's intended way to do it. One thing: I cannot open ESET GUI because of "cannot communicate with a core" error, ESET service is not started either, but ComboFix gave me an alert that ESET smart security is still running. I couldn't figure out how to switch it off. ComboFix finished working without errors though (two reboots were performed as a part of it's work).

- R was installed several years ago I guess
- I'm not aware of what ports are open. I got this computer from other person, and didn't check it extensively as it was obviously infected, and I couldn't fix it. I guess i need to go over it after computer is clean
- Most likely this proxy was configured deliberately. The person I got a laptop from visits pharma companies which BMS is one of. I don't need this proxy

I still couldn't switch off ESET smart protections, but it still didn't cause any error messages from tools you told ne to run

LOGS:

—————————————————————————————————————–
ComboFix:


ComboFix 12-09-23.03 - Ally 09/24/2012 11:25:03.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1251.7.1033.18.1022.664 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Ally\Desktop\CFScript.txt
AV: ESET Smart Security 5.2 *Enabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *Disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
.
FILE ::
"c:\program files\1ClickNew.msi"
"c:\program files\Install_ICQ6.exe"
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\1ClickNew.msi
c:\program files\Install_ICQ6.exe
c:\windows\EventSystem.log
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\ST6UNST.000
c:\windows\system32\drivers\etc\hosts.ics
.
.
((((((((((((((((((((((((( Files Created from 2012-08-24 to 2012-09-24 )))))))))))))))))))))))))))))))
.
.
2012-09-24 09:03 . 2012-09-24 09:03 ——– d—–w- C:\TDSSKiller_Quarantine
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-24 09:04 . 2009-01-13 09:53 52480 —-a-w- c:\windows\system32\drivers\i8042prt.sys
2008-03-05 23:34 . 2008-03-05 23:33 28668101 -c–a-w- c:\program files\R-2.3.1-win32.exe
2007-12-30 00:56 . 2007-12-30 00:55 8759168 -c–a-w- c:\program files\winamp551_full_emusic-7plus_en-us.exe
2007-12-04 00:57 . 2007-12-04 00:56 6820528 -c–a-w- c:\program files\FirefoxGoogleToolbarSetup.exe
2007-11-16 22:56 . 2007-11-16 22:55 2155208 -c–a-w- c:\program files\total_commander702a.exe
2007-10-26 18:34 . 2007-10-26 18:33 23876904 -c–a-w- c:\program files\SkypeSetup.exe
2007-08-29 00:25 . 2007-08-29 00:25 1421234 -c–a-w- c:\program files\VNCNavigatorFree.exe
2007-08-27 22:24 . 2007-08-27 22:24 471216 -c–a-w- c:\program files\msgr8us.exe
2007-08-27 21:44 . 2007-08-27 21:41 50009400 -c–a-w- c:\program files\iTunesSetup.exe
2007-05-22 17:52 . 2007-05-22 17:50 11552256 -c–a-w- c:\program files\AudioConverter5-4.exe
2006-11-29 00:10 . 2006-11-29 00:10 18695520 -c–a-w- c:\program files\cdpn901.exe
2006-11-28 21:58 . 2006-11-28 21:57 2387480 -c–a-w- c:\program files\SVGView.exe
2006-10-26 22:31 . 2006-10-26 22:31 1645320 -c–a-w- c:\program files\gdiplus.dll
2006-09-26 20:34 . 2006-09-26 20:34 16230664 -c–a-w- c:\program files\j2re-1_4_2_12-windows-i586-p.exe
2006-09-18 18:34 . 2006-09-18 18:33 1531784 -c–a-w- c:\program files\googletalk-setup.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-19 7401472]
"nwiz"="nwiz.exe" [2006-01-19 1519616]
"NVHotkey"="nvHotkey.dll" [2006-01-19 73728]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 282624]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]
"Document Manager"="c:\program files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 98304]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2012-03-07 3117344]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-8-7 24576]
EMBASSY Trust Suite Secure Update.lnk - c:\program files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 192512]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [N/A]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\system32\wxvault.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 wvauth
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\msiexec.exe"=
"c:\\Program Files\\QIP\\qip7981\\qip.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\WINWORD.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\OFFICE11\\EXCEL.EXE"=
"c:\\Program Files\\totalcmd\\TOTALCMD.EXE"=
"c:\\Program Files\\SciTegic\\apps\\scitegic\\core\\packages_win32\\apache\\httpd-2.0.55\\bin\\Apache.exe"=
"c:\\Program Files\\Laplink\\PCmover\\PCmover.exe"=
"c:\\Documents and Settings\\Lilia&Roman\\Local Settings\\Temp\\ImInstaller\\incredimail_installer.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"25:TCP"= 25:TCP:SMTP
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"24370:TCP"= 24370:TCP:spport
"17758:TCP"= 17758:TCP:spport
"10868:TCP"= 10868:TCP:spport
"27942:TCP"= 27942:TCP:spport
"7880:TCP"= 7880:TCP:spport
"27313:TCP"= 27313:TCP:spport
"5166:TCP"= 5166:TCP:spport
"24025:TCP"= 24025:TCP:spport
"12134:TCP"= 12134:TCP:spport
"24191:TCP"= 24191:TCP:spport
"12442:TCP"= 12442:TCP:spport
"24062:TCP"= 24062:TCP:spport
"25021:TCP"= 25021:TCP:spport
"24964:TCP"= 24964:TCP:spport
"29518:TCP"= 29518:TCP:spport
"19950:TCP"= 19950:TCP:spport
"12700:TCP"= 12700:TCP:spport
"10945:TCP"= 10945:TCP:spport
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [3/14/2012 8:40 AM 120152]
R2 MSSQL$ACT7;SQL Server (ACT7);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [6/28/2006 5:48 PM 28952920]
R2 scitegic_apache_1;scitegic_apache_6_1_5;c:\program files\SciTegic\apps\scitegic\core\packages_win32\apache\httpd-2.0.55\bin\Apache.exe [2/15/2006 11:54 AM 13824]
S2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [3/7/2012 3:40 PM 913144]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [4/30/2012 2:53 PM 257696]
S3 LLUSBFLT;LLUSBFLT;c:\windows\system32\drivers\llusbflt.sys [8/3/2005 3:59 PM 4736]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\DRIVERS\motodrv.sys –> c:\windows\system32\DRIVERS\motodrv.sys [?]
S3 PLUsbbc2;High-Speed USB Bridge Cable Driver;c:\windows\system32\drivers\usbbc2.sys [8/3/2005 3:59 PM 8960]
S3 PortAcc;Spearit Port Access;c:\program files\Laplink\PCmover\PortAcc.sys [11/1/2007 6:49 AM 16176]
S3 SirefefRemover;SirefefRemover;\??\c:\docume~1\Ally\LOCALS~1\Temp\559c268d.tmp –> c:\docume~1\Ally\LOCALS~1\Temp\559c268d.tmp [?]
.
Contents of the 'Scheduled Tasks' folder
.
2012-07-30 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-30 03:50]
.
2012-07-29 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-628675745-202786943-3935879584-1005Core.job
- c:\documents and settings\Ally\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-29 09:24]
.
2012-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-628675745-202786943-3935879584-1005UA.job
- c:\documents and settings\Ally\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-29 09:24]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyServer = proxy-server.hpw.pri.bms.com:8080
uInternet Settings,ProxyOverride =
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{DE102038-EEE8-471F-8B13-372648ECA3EF}: NameServer = 66.78.210.254,66.78.202.254
DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} - hxxp://stus3.bms.com/sametime/stmeetingroomclient/STJNILoader.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-09-24 11:35
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SirefefRemover]
"ImagePath"="\??\c:\docume~1\Ally\LOCALS~1\Temp\559c268d.tmp"
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'lsass.exe'(1052)
c:\windows\system32\wvauth.dll
c:\windows\system32\biolsp.dll
.
Completion time: 2012-09-24 11:36:55
ComboFix-quarantined-files.txt 2012-09-24 18:36
.
Pre-Run: 51,960,025,088 bytes free
Post-Run: 51,945,775,104 bytes free
.
- - End Of File - - 84CF342922AB4B69602D8C3845562B86









—————————————————————————————————————–
mbam-log-2012-09-24 (12-01-25).txt

Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Database version: v2012.09.24.09

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
Ally :: ALLA [administrator]

9/24/2012 12:01:25 PM
mbam-log-2012-09-24 (12-01-25).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 238592
Time elapsed: 10 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCR\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully.

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)




Just a comment:
- first time I ran ComboFix it gave an alert that RootKit is detected. And there was the same alert during second run from which the log above came.

I rebooted computer (mbam did'n require it), and checked if ESET is working. It doesn't seem to start (there is no splash scree and icon in tray), windows service is not started, and there is no ESET group in program files.

Thank you very much for your help!

Dear Satchfan,

Sorry for the delay.

Here is the results:

———————–

RKreport: (no reboot was performed, nothing was deleted, two items were suggested for deletion)

RogueKiller V8.1.0 [09/28/2012] by Tigzy
mail: tigzyRKgmailcom
Feedback: http://www.geekstogo.com/forum/files/file/413-roguekiller/
Website: http://tigzy.geekstogo.com/roguekiller.php
Blog: http://tigzyrk.blogspot.com

Operating System: Windows XP (5.1.2600 Service Pack 3) 32 bits version
Started in : Normal mode
User : Ally [Admin rights]
Mode : Scan – Date : 09/29/2012 14:37:05

¤¤¤ Bad processes : 0 ¤¤¤

¤¤¤ Registry Entries : 5 ¤¤¤
[PROXY IE] HKCU\[…]\Internet Settings : ProxyServer (proxy-server.hpw.pri.bms.com:8080) -> FOUND
[DNS] HKLM\[…]\ControlSet001\Services\Interfaces\{DE102038-EEE8-471F-8B13-372648ECA3EF} : NameServer (66.78.210.254,66.78.202.254) -> FOUND
[DNS] HKLM\[…]\ControlSet003\Services\Interfaces\{DE102038-EEE8-471F-8B13-372648ECA3EF} : NameServer (66.78.210.254,66.78.202.254) -> FOUND
[HJPOL] HKLM\[…]\System : DisableRegistryTools (0) -> FOUND
[HJ DESK] HKLM\[…]\NewStartPanel : {20D04FE0-3AEA-1069-A2D8-08002B30309D} (1) -> FOUND

¤¤¤ Particular Files / Folders: ¤¤¤

¤¤¤ Driver : [LOADED] ¤¤¤

¤¤¤ HOSTS File: ¤¤¤
–> C:\WINDOWS\system32\drivers\etc\hosts

127.0.0.1 localhost


¤¤¤ MBR Check: ¤¤¤

+++++ PhysicalDrive0: ST9100824AS +++++
— User —
[MBR] c0378afef214212309da4c169885f68e
[BSP] 11d467b9f31927f29d49c85858b51038 : Windows XP MBR Code
Partition table:
0 - [XXXXXX] DELL-UTIL (0xde) [VISIBLE] Offset (sectors): 63 | Size: 39 Mo
1 - [ACTIVE] NTFS (0x07) [VISIBLE] Offset (sectors): 80325 | Size: 95346 Mo
User = LL1 … OK!
User = LL2 … OK!

+++++ PhysicalDrive1: JetFlash TS8GJFV10 USB Device +++++
— User —
[MBR] 6740d39fd251ddbef39af20f05b71ee1
[BSP] 4b8b702b557e3455c4e0f1b634afd5c4 : MBR Code unknown
Partition table:
0 - [XXXXXX] FAT32 (0x0b) [VISIBLE] Offset (sectors): 32 | Size: 7799 Mo
User = LL1 … OK!
Error reading LL2 MBR!

Finished : << RKreport[1].txt >>
RKreport[1].txt

——-

MGADiag Log:

Diagnostic Report (1.9.0027.0):
—————————————–
Windows Validation Data–>
Validation Status: Genuine
Validation Code: 0
Cached Validation Code: N/A
Windows Product Key: *****-*****-xxxxx-xxxxx-xxxxx
Windows Product Key Hash: 3g4CZGFEDgbKmn/oB4pa2FZsssU=
Windows Product ID: 76487-OEM-2211906-00102
Windows Product ID Type: 2
Windows License Type: OEM SLP
Windows OS version: 5.1.2600.2.00010100.3.0.pro
ID: {4692E668-DF68-441C-959F-B8A048919B81}(3)
Is Admin: Yes
TestCab: 0x0
LegitcheckControl ActiveX: Registered, 1.9.40.0
Signed By: Microsoft
Product Name: N/A
Architecture: N/A
Build lab: N/A
TTS Error: N/A
Validation Diagnostic: 025D1FF3-230-1
Resolution Status: N/A

Vista WgaER Data–>
ThreatID(s): N/A
Version: N/A

Windows XP Notifications Data–>
Cached Result: 0
File Exists: Yes
Version: 1.9.40.0
WgaTray.exe Signed By: Microsoft
WgaLogon.dll Signed By: Microsoft

OGA Notifications Data–>
Cached Result: N/A, hr = 0x80070002
Version: N/A, hr = 0x80070002
OGAExec.exe Signed By: N/A, hr = 0x80070002
OGAAddin.dll Signed By: N/A, hr = 0x80070002

OGA Data–>
Office Status: 100 Genuine
Microsoft Office Standard Edition 2003 - 100 Genuine
OGA Version: N/A, 0x80070002
Signed By: N/A, hr = 0x80070002
Office Diagnostics: 025D1FF3-230-1_E2AD56EA-765-d003_E2AD56EA-766-0_E2AD56EA-134-80004005_E2AD56EA-765-8009_E2AD56EA-766-2ee7_E2AD56EA-148-80004005_16E0B333-89-80004005_B4D0AA8B-1029-80004005

Browser Data–>
Proxy settings: N/A
User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)
Default Browser: C:\Program Files\Internet Explorer\iexplore.exe
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disabled
Run ActiveX controls and plug-ins: Allowed
Initialize and script ActiveX controls not marked as safe: Disabled
Allow scripting of Internet Explorer Webbrowser control: Disabled
Active scripting: Allowed
Script ActiveX controls marked as safe for scripting: Allowed

File Scan Data–>

Other data–>
Office Details: {4692E668-DF68-441C-959F-B8A048919B81}1.9.0027.05.1.2600.2.00010100.3.0.prox32*****-*****-*****-*****-YD4YT76487-OEM-2211906-001022S-1-5-21-628675745-202786943-3935879584Dell Inc.Latitude D620 Dell Inc.A0220060411000000.000000+000Dell System,Dell Computer,Dell System,Dell System0AC23C07018400EE04090409Pacific Standard Time(GMT-08:00)02Dell Latitude D620100

Licensing Data–>
N/A

Windows Activation Technologies–>
N/A

HWID Data–>
N/A

OEM Activation 1.0 Data–>
BIOS string matches: yes
Marker string from BIOS: 4000:Dell Inc|4000:Microsoft Corporation
Marker string from OEMBIOS.DAT: Dell System,Dell Computer,Dell System,Dell System

OEM Activation 2.0 Data–>
N/A






I don't reboot computer, and waiting for further instructions.

Thank you much for your help!