What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

MSE hung up removing trojan [Solved]

44 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi again. 'Bout what it says in the title. Can I boot MSE into action? Probably need the full treatment anyhow, if the downloaders are downloading anything… Any instant action to stop them? Thanks denno
Post #2
Ran another scan. This time only one of the 4 items showed up, and I deleted it. Maybe MSE took care of the others even though it appeared to be hung up. Anyway, if I didn't say so clearly, would like guidance for a cleanup. I have other questions, never really answered. Mainly, if I have antivirus/malware, and it can be run and detect stuff and deal with it, how come it doesn't stop it from entering my computer in the first place? What more can I do to block malware, and to be apprised of dangerous sites? thanks
Post #3
Hello denno and :welcome:

My name is JonTom

  • Malware Logs can sometimes take a lot of time to research and interpret.
  • Please be patient while I try to assist with your problem. If at any time you do not understand what is required, please ask for further explanation.
  • Please note that there is no "Quick Fix" to modern malware infections and we may need to use several different approaches to get your system clean.
  • Read every reply you receive carefully and thoroughly before carrying out the instructions. You may also find it helpful to print out the instructions you receive, as in some instances you may have to disconnect your computer from the Internet.
  • PLEASE NOTE: If you do not reply after 3 days your thread will be closed.

You have asked some very important questions, but before we get around to answering them lets make sure that your machine is okay:


  • Please perform the following scan


    • Please download DDS from here and save it to your desktop.
    • Disable any script blocking protection (How to Disable your Security Programs)
    • Double click on the DDS icon to run the tool (may take up to 3 minutes to run).
    • When done, DDS.txt will open.
    • After a few moments, attach.txt will open in a second window.
    • Save both reports to your desktop.
    • Please post the contents of the DDS.txt and Attach.txt logs in your next reply.

  • aswMBR


    • Download aswMBR.exe to your desktop.
    • Double click the aswMBR.exe to run it.
    • When asked if you want to download Avast's virus definitions please select Yes.
    • Click the "Scan" button to start scan.

    [external image: Posted Image]

    • On completion of the scan click save log, save it to your desktop and post in your next reply.

    [external image: Posted Image]

    Please post both DDS logs and the aswMBR log in your next reply. Along with the logs let me know exactly how the machine is running now.
Post #4
Hello JonTom and thank you.

Here are the first 2 logs. I have just been commanded to appear for lunch, so next scan in awhile….

DDS (Ver_2012-11-20.01) - NTFS_x86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 10.17.2
Run by [removed] at 15:25:05 on 2013-04-21
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1013.268 [GMT -4:00]
.
AV: Microsoft Security Essentials Prerelease *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
============== Running Processes ================
.
c:\Program Files\Microsoft Security Client\MsMpEng.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
C:\Program Files\Fighters\Tray\FightersTray.exe
C:\Program Files\Fighters\SPAMfighter\sfagent.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\IDrive\IDriveE Service.exe
C:\Program Files\Java\jre7\bin\jqs.exe
C:\Program Files\Fighters\SPAMfighter\sfus.exe
C:\Program Files\Fighters\FighterSuiteService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\IDrive\IDriveETray.exe
C:\Program Files\IDrive\IDrivePlugin.exe
C:\Program Files\IDrive\IDriveEBackground.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k NetworkService
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k LocalService
C:\WINDOWS\System32\svchost.exe -k imgsvc
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10043&barid={4BBE5FC5-9B20-11E2-AEBF-001D098C2B91}
mStart Page = hxxp://start.sweetpacks.com/?src=10&st=12&crg=3.5000006.10043&barid={4BBE5FC5-9B20-11E2-AEBF-001D098C2B91}
uProxyOverride =
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre7\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre7\bin\jp2ssv.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} -
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [IDriveE Startup] "c:\program files\idrive\IDrvieEStartup.exe" Hide
mRun: [MSC] "c:\program files\microsoft security client\msseces.exe" -hide -runkey
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [EPSON Stylus Photo RX620 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620"
mRun: [CommonToolkitTray] c:\program files\fighters\tray\FightersTray.exe
mRun: [sfagent] c:\program files\fighters\spamfighter\sfagent.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
StartupFolder: c:\docume~1\denno\startm~1\programs\startup\idrive~1.lnk - c:\program files\idrive\IDriveEReg2ini.exe
StartupFolder: c:\docume~1\denno\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
uPolicies-Explorer: NoDriveTypeAutoRun = dword:145
mPolicies-Windows\System: Allow-LogonScript-NetbiosDisabled = dword:1
mPolicies-Explorer: NoDriveTypeAutoRun = dword:145
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1361254869718
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 64.22.32.8 64.22.32.9
TCP: Interfaces\{6C210370-FF0F-404C-A510-43343D733ACB} : DHCPNameServer = [removed] [removed]
Notify: igfxcui - igfxdev.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\denno\application data\mozilla\firefox\profiles\veaes6fa.default\
FF - prefs.js: browser.search.defaulturl -
FF - prefs.js: browser.search.selectedEngine - Bing
FF - prefs.js: browser.startup.homepage - hxxp://google.com
FF - prefs.js: network.proxy.type - 0
FF - plugin: c:\program files\adobe\reader 11.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\foxit software\foxit reader\plugins\npFoxitReaderPlugin.dll
FF - plugin: c:\program files\java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\program files\microsoft silverlight\5.1.20125.0\npctrlui.dll
FF - plugin: c:\windows\system32\macromed\flash\NPSWF32_11_7_700_169.dll
FF - plugin: c:\windows\system32\npDeployJava1.dll
FF - plugin: c:\windows\system32\npptools.dll
FF - ExtSQL: 2013-04-20 23:51; {a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}; c:\documents and settings\denno\application data\mozilla\firefox\profiles\veaes6fa.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
.
============= SERVICES / DRIVERS ===============
.
R0 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2012-11-7 195296]
R2 IDriveE Service;IDriveE Service;c:\program files\idrive\IDriveE Service.exe [2013-2-26 157128]
R2 SPAMfighter Update Service;SPAMfighter Update Service;c:\program files\fighters\spamfighter\sfus.exe [2013-2-28 216608]
R2 Suite Service;Suite Service;c:\program files\fighters\FighterSuiteService.exe [2012-11-12 1270376]
RUnknown MpKsla63729e9;MpKsla63729e9; [x]
.
=============== Created Last 30 ================
.
2013-04-21 15:43:49 6906960 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{a7b59ff4-d476-42c2-94c4-9d63af296f06}\mpengine.dll
2013-04-21 05:55:42 6906960 —-a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\backup\mpengine.dll
2013-04-19 14:14:56 ——– d—–w- c:\documents and settings\denno\application data\azzCardfile
2013-04-19 14:14:54 ——– d—–w- c:\program files\azzCardfile
2013-04-12 22:04:51 15104 -c–a-w- c:\windows\system32\dllcache\usbscan.sys
2013-04-12 22:04:51 15104 —-a-w- c:\windows\system32\drivers\usbscan.sys
2013-04-12 15:41:20 ——– d—–w- c:\windows\pss
2013-04-12 14:51:14 ——– d—–w- c:\documents and settings\denno\local settings\application data\Sun
2013-04-12 08:50:59 ——– d—–w- c:\windows\SendTo
2013-04-12 08:49:40 ——– d—–w- c:\windows\forms
2013-04-12 08:49:39 ——– d—–w- c:\program files\Windows Messaging
2013-04-12 01:01:54 478616 —-a-w- c:\program files\mozilla firefox\libGLESv2.dll
2013-04-12 01:01:54 115608 —-a-w- c:\program files\mozilla firefox\maintenanceservice.exe
2013-04-12 01:01:53 920472 —-a-w- c:\program files\mozilla firefox\firefox.exe
2013-04-12 01:01:53 59288 —-a-w- c:\program files\mozilla firefox\libEGL.dll
2013-04-12 01:01:53 2989464 —-a-w- c:\program files\mozilla firefox\gkmedias.dll
2013-04-12 01:01:53 279448 —-a-w- c:\program files\mozilla firefox\freebl3.dll
2013-04-12 01:01:53 2106216 —-a-w- c:\program files\mozilla firefox\D3DCompiler_43.dll
2013-04-12 01:01:53 1998168 —-a-w- c:\program files\mozilla firefox\d3dx9_43.dll
2013-04-12 01:01:52 116120 —-a-w- c:\program files\mozilla firefox\crashreporter.exe
2013-04-12 01:01:51 74136 —-a-w- c:\program files\mozilla firefox\breakpadinjector.dll
2013-04-12 01:01:51 263064 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
2013-04-12 01:01:51 19352 —-a-w- c:\program files\mozilla firefox\AccessibleMarshal.dll
2013-04-11 10:28:12 ——– d—–w- c:\documents and settings\all users\application data\FreeRIP
2013-04-11 10:28:03 ——– d—–w- c:\program files\FreeRIP
2013-04-11 10:15:04 ——– d—–w- c:\documents and settings\denno\application data\DSite
2013-04-11 10:15:00 ——– d—–w- c:\program files\AudioConverter
2013-04-11 10:10:59 ——– d—–w- c:\program files\Ffmpeg For Audacity
2013-04-11 10:05:00 ——– d—–w- c:\program files\Lame For Audacity
2013-04-11 01:37:12 306688 —-a-w- c:\windows\IsUninst.exe
2013-04-08 16:17:35 ——– d—–w- c:\program files\Foxit Software
2013-04-08 15:08:32 782240 —-a-w- c:\windows\system32\deployJava1.dll
2013-04-08 15:08:32 143872 —-a-w- c:\windows\system32\javacpl.cpl
2013-04-08 15:08:31 861088 —-a-w- c:\windows\system32\npDeployJava1.dll
2013-04-08 15:08:24 94112 —-a-w- c:\windows\system32\WindowsAccessBridge.dll
2013-04-02 01:46:57 ——– d—–w- c:\documents and settings\denno\.thumbnails
2013-04-02 01:45:13 ——– d—–w- c:\documents and settings\denno\.gimp-2.6
2013-03-30 21:25:42 ——– d—–w- c:\documents and settings\denno\application data\LiveKit
2013-03-30 19:29:31 ——– d—–w- c:\documents and settings\denno\application data\Fighters
2013-03-30 19:29:26 ——– d—–w- c:\program files\Fighters
2013-03-30 19:29:03 ——– d—–w- c:\documents and settings\all users\application data\Fighters
2013-03-30 05:22:12 ——– d—–w- c:\program files\Audacity
2013-03-29 04:14:23 ——– d—–w- c:\program files\WS_FTP Pro
2013-03-24 16:30:53 ——– d—–w- c:\program files\MSECache
2013-03-23 06:19:49 ——– d—–w- c:\program files\Macromedia
.
==================== Find3M ====================
.
2013-04-12 21:44:52 691592 —-a-w- c:\windows\system32\FlashPlayerApp.exe
2013-04-12 21:44:51 71048 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2013-04-02 10:33:22 237088 ——w- c:\windows\system32\MpSigStub.exe
2013-03-08 08:36:22 293376 —-a-w- c:\windows\system32\winsrv.dll
2013-03-07 01:32:25 2149888 —-a-w- c:\windows\system32\ntoskrnl.exe
2013-03-07 00:50:30 2028544 —-a-w- c:\windows\system32\ntkrnlpa.exe
2013-03-02 02:06:31 916480 —-a-w- c:\windows\system32\wininet.dll
2013-03-02 02:06:30 43520 ——w- c:\windows\system32\licmgr10.dll
2013-03-02 02:06:30 1469440 ——w- c:\windows\system32\inetcpl.cpl
2013-03-02 01:25:02 1867264 —-a-w- c:\windows\system32\win32k.sys
2013-03-02 01:08:47 385024 ——w- c:\windows\system32\html.iec
2013-02-27 07:56:51 2067456 —-a-w- c:\windows\system32\mstscax.dll
2013-02-20 16:13:39 315392 —-a-w- c:\windows\HideWin.exe
2013-02-12 00:32:23 12928 —-a-w- c:\windows\system32\drivers\usb8023.sys
2013-02-12 00:32:23 12928 ——w- c:\windows\system32\drivers\usb8023x.sys
2013-01-26 03:55:44 552448 —-a-w- c:\windows\system32\oleaut32.dll
2003-04-25 10:32:56 1562624 —-a-w- c:\program files\AZZ Cardfile.exe
.
============= FINISH: 15:26:25.02 ===============





.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 2/18/2013 6:13:22 PM
System Uptime: 4/20/2013 11:29:25 AM (28 hours ago)
.
Motherboard: Dell Inc. | | 0CU409
Processor: Intel® Pentium® Dual CPU E2180 @ 2.00GHz | Socket 775 | 1995/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 298 GiB total, 239.138 GiB free.
D: is FIXED (NTFS) - 233 GiB total, 195.916 GiB free.
E: is Removable
F: is CDROM (CDFS)
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP1: 2/18/2013 7:07:39 PM - System Checkpoint
RP2: 2/18/2013 9:34:39 PM - Installed Dell Resource CD.
RP3: 2/18/2013 11:21:02 PM - Installed Intel® PRO Network Connections
RP4: 2/19/2013 12:57:21 AM - Installed Windows XP Service Pack 3.
RP5: 2/19/2013 1:11:59 AM - Software Distribution Service 3.0
RP6: 2/19/2013 1:24:42 AM - Software Distribution Service 3.0
RP7: 2/19/2013 1:48:14 AM - Software Distribution Service 3.0
RP8: 2/19/2013 3:00:13 AM - Software Distribution Service 3.0
RP9: 2/19/2013 10:09:18 AM - Installed Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
RP10: 2/19/2013 10:10:16 AM - Installed OpenOffice.org 3.4.1
RP11: 2/19/2013 11:19:05 PM - Installed Microsoft Fix it 50530
RP12: 2/20/2013 12:42:59 AM - Installed Microsoft Fix it 50530
RP13: 2/20/2013 12:44:50 AM - Installed %1 %2.
RP14: 2/20/2013 10:21:43 AM - Installed Akamai NetSession Interface
RP15: 2/20/2013 11:13:45 AM - Installed Realtek High Definition Audio Driver
RP16: 2/20/2013 6:58:52 PM - Software Distribution Service 3.0
RP17: 2/20/2013 7:23:39 PM - Software Distribution Service 3.0
RP18: 2/20/2013 7:33:47 PM - Software Distribution Service 3.0
RP19: 2/21/2013 3:16:05 PM - Software Distribution Service 3.0
RP20: 2/22/2013 3:30:06 PM - System Checkpoint
RP21: 2/22/2013 4:06:23 PM - Software Distribution Service 3.0
RP22: 2/23/2013 4:10:21 PM - Software Distribution Service 3.0
RP23: 2/24/2013 2:24:20 AM - Software Distribution Service 3.0
RP24: 2/24/2013 4:04:32 PM - Software Distribution Service 3.0
RP25: 2/25/2013 4:04:54 PM - Software Distribution Service 3.0
RP26: 2/26/2013 4:05:10 PM - System Checkpoint
RP27: 2/26/2013 4:05:29 PM - Software Distribution Service 3.0
RP28: 2/27/2013 4:04:22 PM - Software Distribution Service 3.0
RP29: 2/28/2013 4:04:21 PM - Software Distribution Service 3.0
RP30: 3/7/2013 1:12:52 PM - Software Distribution Service 3.0
RP31: 3/8/2013 1:17:30 PM - System Checkpoint
RP32: 3/8/2013 1:23:36 PM - Software Distribution Service 3.0
RP33: 3/9/2013 1:22:29 PM - Software Distribution Service 3.0
RP34: 3/10/2013 2:30:50 AM - Software Distribution Service 3.0
RP35: 3/10/2013 2:22:17 PM - Software Distribution Service 3.0
RP36: 3/11/2013 2:22:48 PM - Software Distribution Service 3.0
RP37: 3/12/2013 2:44:34 PM - System Checkpoint
RP38: 3/13/2013 10:52:40 AM - Software Distribution Service 3.0
RP39: 3/14/2013 10:52:59 AM - Software Distribution Service 3.0
RP40: 3/15/2013 10:51:37 AM - Software Distribution Service 3.0
RP41: 3/16/2013 10:51:29 AM - Software Distribution Service 3.0
RP42: 3/17/2013 2:29:33 AM - Software Distribution Service 3.0
RP43: 3/17/2013 10:51:33 AM - Software Distribution Service 3.0
RP44: 3/18/2013 10:51:38 AM - Software Distribution Service 3.0
RP45: 3/18/2013 10:29:21 PM - Software Distribution Service 3.0
RP46: 3/19/2013 10:51:01 PM - System Checkpoint
RP47: 3/20/2013 9:24:40 AM - Software Distribution Service 3.0
RP48: 3/21/2013 4:22:00 AM - Software Distribution Service 3.0
RP49: 3/22/2013 4:29:53 AM - System Checkpoint
RP50: 3/22/2013 4:37:10 AM - Software Distribution Service 3.0
RP51: 3/23/2013 4:37:11 AM - Software Distribution Service 3.0
RP52: 3/24/2013 1:56:35 AM - Software Distribution Service 3.0
RP53: 3/24/2013 4:36:48 AM - Software Distribution Service 3.0
RP54: 3/25/2013 4:37:21 AM - Software Distribution Service 3.0
RP55: 3/26/2013 4:37:13 AM - Software Distribution Service 3.0
RP56: 3/27/2013 4:37:17 AM - Software Distribution Service 3.0
RP57: 3/28/2013 4:37:29 AM - Software Distribution Service 3.0
RP58: 3/29/2013 5:09:05 AM - System Checkpoint
RP59: 3/30/2013 12:17:45 AM - Software Distribution Service 3.0
RP60: 3/30/2013 3:29:22 PM - Installed DRIVERfighter.
RP61: 3/30/2013 3:36:32 PM - Installed SPAMfighter.
RP62: 3/30/2013 8:03:13 PM - Removed DRIVERfighter.
RP63: 3/31/2013 12:17:04 AM - Software Distribution Service 3.0
RP64: 4/1/2013 12:16:45 AM - Software Distribution Service 3.0
RP65: 4/1/2013 9:15:33 PM - Removed Internet Explorer Toolbar 4.7 by SweetPacks
RP66: 4/2/2013 9:18:24 PM - System Checkpoint
RP67: 4/2/2013 9:24:42 PM - Software Distribution Service 3.0
RP68: 4/3/2013 9:24:35 PM - Software Distribution Service 3.0
RP69: 4/4/2013 9:24:47 PM - Software Distribution Service 3.0
RP70: 4/5/2013 9:24:28 PM - Software Distribution Service 3.0
RP71: 4/6/2013 9:24:22 PM - Software Distribution Service 3.0
RP72: 4/7/2013 1:45:41 AM - Software Distribution Service 3.0
RP73: 4/7/2013 9:24:35 PM - Software Distribution Service 3.0
RP74: 4/8/2013 11:07:56 AM - Installed Java 7 Update 17
RP75: 4/8/2013 11:27:34 AM - Removed Adobe Reader XI (11.0.02).
RP76: 4/8/2013 9:25:05 PM - Software Distribution Service 3.0
RP77: 4/9/2013 9:24:55 PM - Software Distribution Service 3.0
RP78: 4/10/2013 9:26:33 PM - Software Distribution Service 3.0
RP79: 4/11/2013 9:25:17 PM - Software Distribution Service 3.0
RP80: 4/12/2013 10:59:26 AM - Software Distribution Service 3.0
RP81: 4/12/2013 6:04:51 PM - Update to an unsigned driver
RP82: 4/13/2013 5:52:54 PM - Software Distribution Service 3.0
RP83: 4/14/2013 2:16:42 AM - Software Distribution Service 3.0
RP84: 4/14/2013 5:52:51 PM - Software Distribution Service 3.0
RP85: 4/15/2013 5:52:58 PM - Software Distribution Service 3.0
RP86: 4/16/2013 5:54:09 PM - Software Distribution Service 3.0
RP87: 4/17/2013 5:54:35 PM - Software Distribution Service 3.0
RP88: 4/18/2013 6:38:08 PM - System Checkpoint
RP89: 4/18/2013 11:09:24 PM - Software Distribution Service 3.0
RP90: 4/20/2013 11:44:28 AM - Software Distribution Service 3.0
RP91: 4/21/2013 1:55:41 AM - Software Distribution Service 3.0
RP92: 4/21/2013 11:43:38 AM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
Adobe Flash Player 11 Plugin
Adobe Photoshop 7.0
Adobe Reader XI (11.0.02)
Akamai NetSession Interface
Audacity 2.0.3
azzCardfile 4.1
Dell Resource CD
EPSON Printer Software
EPSON Scan
FFmpeg v0.6.2 for Audacity
Foxit Reader
FreeRIP 4.1.1
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2779562)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
IDrive version 3.4.1 January 03, 2012
Intel® Graphics Media Accelerator Driver
Intel® PRO Network Connections 12.1.12.0
Java 7 Update 17
Java Auto Updater
LAME v3.99.3 (for Windows)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office 97, Professional Edition
Microsoft Security Client
Microsoft Security Essentials Prerelease
Microsoft Silverlight
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Works 6-9 Converter
Mozilla Firefox 20.0.1 (x86 en-US)
Mozilla Maintenance Service
OpenOffice.org 3.4.1
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2604111)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2736416)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB2744842)
Security Update for Windows Internet Explorer 8 (KB2792100)
Security Update for Windows Internet Explorer 8 (KB2797052)
Security Update for Windows Internet Explorer 8 (KB2809289)
Security Update for Windows Internet Explorer 8 (KB2817183)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2510581)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2585542)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB2653956)
Security Update for Windows XP (KB2655992)
Security Update for Windows XP (KB2659262)
Security Update for Windows XP (KB2661637)
Security Update for Windows XP (KB2676562)
Security Update for Windows XP (KB2686509)
Security Update for Windows XP (KB2691442)
Security Update for Windows XP (KB2698365)
Security Update for Windows XP (KB2705219-v2)
Security Update for Windows XP (KB2712808)
Security Update for Windows XP (KB2719985)
Security Update for Windows XP (KB2723135-v2)
Security Update for Windows XP (KB2727528)
Security Update for Windows XP (KB2753842-v2)
Security Update for Windows XP (KB2757638)
Security Update for Windows XP (KB2758857)
Security Update for Windows XP (KB2770660)
Security Update for Windows XP (KB2778344)
Security Update for Windows XP (KB2780091)
Security Update for Windows XP (KB2792100)
Security Update for Windows XP (KB2797052)
Security Update for Windows XP (KB2799494)
Security Update for Windows XP (KB2802968)
Security Update for Windows XP (KB2807986)
Security Update for Windows XP (KB2808735)
Security Update for Windows XP (KB2813170)
Security Update for Windows XP (KB2813345)
Security Update for Windows XP (KB2820917)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982665)
SPAMfighter
Update for Audio Converter
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB2598845)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2661254-v2)
Update for Windows XP (KB2736233)
Update for Windows XP (KB2749655)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB973815)
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 8
Windows PowerShell™ 1.0
Windows XP Service Pack 3
.
==== Event Viewer Messages From Past Week ========
.
4/20/2013 3:22:38 AM, error: Dhcp [1002] - The IP address lease 192.168.172.51 for the Network Card with network address 001D098C2B91 has been denied by the DHCP server 192.168.172.1 (The DHCP Server sent a DHCPNACK message).
4/20/2013 11:52:00 AM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147650955 Name: Trojan:Win32/Bamital!dat ID: 2147650955 Severity: Severe Category: Trojan Path: file:_D:\WINDOWS\system32\dll Detection Origin: Local machine Detection Type: Concrete Detection Source: System User: NT AUTHORITY\SYSTEM Process Name: Unknown Action: Clean Action Status: No additional actions required Error Code: 0x8007007f Error description: The specified procedure could not be found. Signature Version: AV: 1.149.240.0, AS: 1.149.240.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.9402.0, NIS: 0.0.0.0
4/19/2013 5:14:13 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147650955 Name: Trojan:Win32/Bamital!dat ID: 2147650955 Severity: Severe Category: Trojan Path: file:_D:\WINDOWS\system32\dll Detection Origin: Local machine Detection Type: Concrete Detection Source: Real-Time Protection User: NT AUTHORITY\SYSTEM Process Name: C:\WINDOWS\explorer.exe Action: Clean Action Status: No additional actions required Error Code: 0x8007007f Error description: The specified procedure could not be found. Signature Version: AV: 1.149.117.0, AS: 1.149.117.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.9402.0, NIS: 0.0.0.0
4/19/2013 4:00:50 PM, error: Microsoft Antimalware [1119] - Microsoft Antimalware has encountered a critical error when taking action on malware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=370…atid=2147650955 Name: Trojan:Win32/Bamital!dat ID: 2147650955 Severity: Severe Category: Trojan Path: file:_D:\WINDOWS\system32\dll Detection Origin: Local machine Detection Type: Concrete Detection Source: User User: SHERIFFJOHN\Denno Process Name: Unknown Action: Clean Action Status: No additional actions required Error Code: 0x8007007f Error description: The specified procedure could not be found. Signature Version: AV: 1.149.117.0, AS: 1.149.117.0, NIS: 0.0.0.0 Engine Version: AM: 1.1.9402.0, NIS: 0.0.0.0
.
==== End Of File ===========================
Post #5 last edited
FYI I've got the next scan running. Been going for a couple of hours so far. There was a drop-down and I chose C;\ Let me know if that was right!
Post #7
Hello denno

Did you take a note of what MSE detected? If so, please post the details in your next reply.

Along with the logs let me know exactly how the machine is running now

This is very important. Are you being redirected when you browse the net? Are you receiving popups or error messages? Please do let me know how your system is behaving.


If aswMBR is not running as it should, lets try this scan instead:

  • Please scan your system with GMER


    [external image: Posted Image]
    Download GMER Rootkit Scanner from here or here.
    • Extract the contents of the zipped file to desktop.
    • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent.
    • If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
    • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and post it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOTKIT" entries

Please post the GMER log in your next reply. If you encounter any problems with the scan come back and let me know.
Post #8
OK…
first off, I don't see a checkbox for Drives/Partition. There are boxes for Quick Scan, C and D. (I have my former HD in the computer as D:\ – I still occasionally copy something from it).
It was set for Quick, so I have left it that way and am running the scan.

Otherwise…at least two were java downloaders. I could pick the names off a list, but did not write them down. Foo!
I wonder if MSE has a record…
win32/bamital!.dat….4 copies, one on 4/7 (before I was aware of any problems or took any action), 2 on 4/19, one on 4/20
I think the others were Open Connection 5 or something like that. MSE lists several such downloaders, mostly in February, and doesn't indicate whether they were dealt with. Nothing noted from the past 3 days when I was aware of infection. ???

No, I am not apparently being redirected. I get occasional popups, ads, even though I've set the browser to block them; always have, I think.
Occasional error messages. Usually "a script on this page has stopped running."

There are a couple of other issues, dunno if they connect to anything else. I use AZZ Cardfile to keep various information organized. One file in particular will not open. This happened about the same time as the latest invasion.
The two files are
Dog Files and Litter Reservations_A.azz
Dog Files and Litter Reservations_A.azz.bak
I don't know if you can tell if they are corrupted in any of these scans.

The scan has finished.

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-04-21 20:38:05
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD3200AAKS-75L9A0 rev.01.03E01 298.09GB
Running: gmer.exe; Driver: C:\DOCUME~1\Denno\LOCALS~1\Temp\pxtyikob.sys


—- Kernel code sections - GMER 2.1 —-

? c:\Documents and Settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{0FEC0D96-ADBA-4A36-BF42-BDC8577DC806}\MpKsla63729e9.sys The system cannot find the path specified. !
? C:\DOCUME~1\Denno\LOCALS~1\Temp\mbr.sys The filename, directory name, or volume label syntax is incorrect. !
? C:\DOCUME~1\Denno\LOCALS~1\Temp\aswMBR.sys The filename, directory name, or volume label syntax is incorrect. !

—- User code sections - GMER 2.1 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[160] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 01546D70 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[160] kernel32.dll!lstrlenW + 43 7C809AEC 7 Bytes JMP 0189D736 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[160] kernel32.dll!MapViewOfFileEx + 6A 7C80B9A0 7 Bytes JMP 0189D713 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[160] kernel32.dll!ValidateLocale + B1C8 7C8449C8 7 Bytes JMP 01561C62 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[160] GDI32.dll!SetDIBitsToDevice + 20A 77F19E14 7 Bytes JMP 0189D694 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2040] USER32.dll!DefWindowProcA + 11A 7E42C298 7 Bytes JMP 108243E6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2040] USER32.dll!SetWindowLongA + 19 7E42C2B6 7 Bytes JMP 10824375 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2040] USER32.dll!GetWindowInfo 7E42C49C 5 Bytes JMP 1046E50D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[2040] USER32.dll!GetMenuContextHelpId + 1A 7E465319 7 Bytes JMP 1046E9FB C:\Program Files\Mozilla Firefox\xul.dll

—- Devices - GMER 2.1 —-

Device mrxsmb.sys
Device Fastfat.SYS

AttachedDevice fltmgr.sys

Device Cdfs.SYS

—- EOF - GMER 2.1 —-
Post #9 last edited
Also noted: sometimes programs open slowly. Notably Open Office. Also Firefox. Outlook express. Also that can close slowly. Sometimes a page opens but it takes a bit before I can scroll it. I note that the end of the dds file above logs some difficulties MSE had in disinfecting that bamital thing.
Post #10
Hello denno

Thank you for the logs and extra information.

Please do the following:


  • Combofix


  • Download ComboFix from one of the following locations:

    Link 1
    Link 2

  • VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

  • IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here .
  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
  • Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

  • Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

  • Click on Yes, to continue scanning for malware.
  • When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
  • Notes: Do not mouse-click Combofix's window while it is running. That may cause it to stall.
  • Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
  • Should there be issues with internet afterward:

    In IE: Tools Menu -> Internet Options -> Connections Tab -> Lan Settings -> uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

    In Firefox: Tools Menu -> Options… -> Advanced Tab -> Network Tab -> "Settings" under Connection and uncheck the proxyserver, set it to No Proxy.


    Please Note: After running Combofix you may receive the following message "illegal Operation attempted on a registry key that has been marked for deletion".

    Should you receive this message please reboot your machine.
Post #11 last edited
Good morning (or afternoon) JonTom Before I start the next job, here is what just happened: clicked on the WTT link in the e-mail notification, got a Firefox window that immediately became Not Responding. Took a minute or two to close it — when I have to force a close in FF all the open FF windows close. This is a not-uncommon occurrence. Not sure that is just since the past few days. Dunno if it is a FF thing or a computer problem w/mine. Also, about that AZZ program…when I try to open those two files it also goes into Not Responding mode.
Post #12
oh-oh!!!!!! during scan, computer blue-screen crashed. I am TERRIFIED…just went through this a couple months ago…hello Paws, if you are reading this
Post #13
Think the next thing is to pull out my Acronis disk and see about imaging my HD, eh? I have a version 11 or so, and I have an external HD I tried this with once.
Post #14
Hello denno

during scan, computer blue-screen crashed

Are you able to start the machine normally?

Please check on your C drive to see of a Combofix log was created (unlikely from what you describe but worth checking for nonetheless).

If present, it can be found here:

C:\ComboFix.txt


Think the next thing is to pull out my Acronis disk and see about imaging my HD, eh?

You should always backup your important files to be on the safe side.


Lets see if we can take a closer look at the following files before we continue:


  • Please scan the following files


  • Please go to VirusTotal


  • On the page you'll find a "Choose File" button.
  • Click on the Choose File button.
  • In the File Upload window which opens, copy and paste this into the File Name box.


c:\windows\system32\winlogon.exe


  • Next, click the Open button.
  • Then click the "Scan it" button just below.
  • This will scan the file. Please be patient.
  • If you get a message saying File has already been analyzed: click Reanalyze file now.
  • Once scanned, copy and paste the link to the results page in your next reply.
  • Repeat for the following file:

c:\windows\explorer.exe

Please post the links to the Virus Total results pages in your next reply,
Post #15
Yes, thank goodness I can start the computer with no more blue screen.

Btw, I have things backed up on iDrive; but it was a messy process getting my C drive reconstructed. I am advised that an image can simply copy the whole thing back again, and in the same configuration, programs included, e-mails intact, after wiping a crashed HD.

Bizarre thing:
I started looking in Windows Explorer for combofix.txt. (I have Search looking now)
What I see is under C:\ there is a combofix folder. Inside that are folders for A:\, C:\, D:\ and so forth. Inside that C:\ is another combofix folder, and inside that…..
I do not know how many layers this goes on for.

Here are scan results:

https://www.virustotal.com/en/file/45377cb8…29b1e/analysis/

https://www.virustotal.com/en/file/45377cb8…sis/1366668598/

let me know if those are the urls you need

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI