[Closed] Baseline

Hi

The following programs became infected, you should uninstall them before running the CFScript below.

Click on Start, then Control Panel. Double click on Add or Remove Programs.

Please remove the following program(s):

Analogue Devices Software
Identity Management Suite DIRECT!
InterVideo
iTunes
LANDesk
Quicktime
SUPERAntiSpyware
Trend Micro OfficeScan Client
Sonic DLA

After running the CFScript you can reinstall them. Make sure Trend Micro OfficeScan Client is reinstalled immediately.

Step 1

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Courion Corporation\Identity Management Suite DIRECT!\direct.exe
C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\LANDesk\LDClient\WebPortal\sdclientmonitor.exe
C:\Program Files\QuickTime\qttask .exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\WINDOWS\system32\DLA\DLACTRLW.EXE
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp
C:\WINDOWS\system32\wscript.exe.tmp

Folder::

C:\WINDOWS\UHJlZmVycmVkIEN1c3RvbWVy
C:\WINDOWS\system32\no9
C:\WINDOWS\system32\jc2
C:\WINDOWS\system32\ineWc01
C:\WINDOWS\system32\hl9
C:\WINDOWS\system32\hd1
C:\WINDOWS\system32\ax1

Registry::

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIRECT!]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDClientMonitor]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Be sure to reinstall Trend Micro OfficeScan Client, and any other programs you want back.

Step 2

In your next reply, please post:

• the Combofix log (C:\Combofix.txt)
• a new HijackThis log

Simon…quick question…how do I reinstall the programs you want me to remove.???? thx miles

Simon…quick question…how do I reinstall the programs you want me to remove.???? thx miles

Programs like iTunes, QuickTime and SUPERAntiSpyware are freeware and can be downloaded from the internet. The other programs should be reinstalled by the person that put them on in the first place; that would probably be your IT department.

Simon….these I can't see on add/remove program..??? where would i find them.???? Analogue Devices Software LANDesk

For LanDesk, there are three programs you should remove:

LANDesk Advance Agent
LANDesk® Antivirus
LANDesk® Common Base Agent 8

It's normal you can't find Analogue Devices Software, I shouldn't have included it. However, this file: C:\Program Files\Analog Devices\Core\smax4pnp.exe got infected, and is installed alongside the Analogue Devices range of audio products. If your sound doesn't work after running the CFScript, you should reinstall your audio software.

Hi

You will need to reinstall Trend Micro OfficeScan Client before continuing, or install one of the free Anti-Virus programs below:

• avast! Home Edition (Registration Page)
• AVG Free
• Avira AntiVir

Post a new HijackThis log after doing so and we'll continue with the cleaning process.

Hi

Step 1

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINDOWS\system32\jkhhf.exe

Folder::

C:\Program Files\Trend Micro\OfficeScan Client

Registry::

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"=-

Driver::

TmProxy
tmlisten
ntrtscan

DirLook::

C:\Program Files\AREquityOptionOrderEntry

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 2

Open HijackThis, perform a scan and put a check next to the following items (if present):

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

Close all programs except HijackThis and click on Fix checked.

Step 3

In your next reply, please post:

• the Combofix log (C:\Combofix.txt)
• a new HijackThis log
• How is your computer currently running?

Hi

There's no need to install Trend Micro anymore, as you have AVG now. If you want to, you can install Trend Micro again, but be sure to uninstall AVG before you do so. Only one Anti-Virus program should be installed.

There's one thing I'd like to check before I let you go

Please go to VirusTotal or Jotti and upload C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe for scanning.

For VirusTotal:

• Please copy and paste C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe in the text box next to the Browse… button.
• Click on Send File.

For Jotti:

• Please copy and paste C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe in the text box next to the Browse… button.
• Click on Submit.

Copy/paste the results in your next reply.

Simon V…you are the man…thank you for all your help and patients with me….several questions…what should i keep that i down loaded.???? and what do you recommend to use to clean and check for viruses…i have spybot…..???? One thing is when I load a site and add info, it drops like a bad cell call….lol….and when i make a donation, do i specify that you helped me.????? thanks again for all you help….here is results of last check…. File MSConfig_.exe_ received on 12.29.2007 18:55:45 (CET) Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) Loading server information… Your file is queued in position: 8. Estimated start time is between 60 and 86 seconds. Do not close the window until scan is complete. The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result. If you are waiting for more than five minutes you have to resend your file. Your file is being scanned by VirusTotal in this moment, results will be shown as they're generated. Compact Print results Your file has expired or does not exists. Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time. You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished. Email: Antivirus Version Last Update Result AhnLab-V3 2007.12.29.11 2007.12.29 - AntiVir 7.6.0.46 2007.12.29 - Authentium 4.93.8 2007.12.29 - Avast 4.7.1098.0 2007.12.28 - AVG 7.5.0.516 2007.12.29 - BitDefender 7.2 2007.12.29 - CAT-QuickHeal 9.00 2007.12.29 - ClamAV 0.91.2 2007.12.29 - DrWeb 4.44.0.09170 2007.12.29 - eSafe 7.0.15.0 2007.12.27 - eTrust-Vet 31.3.5412 2007.12.29 - Ewido 4.0 2007.12.29 - FileAdvisor 1 2007.12.29 - Fortinet 3.14.0.0 2007.12.29 - F-Prot 4.4.2.54 2007.12.28 - F-Secure 6.70.13030.0 2007.12.28 - Ikarus T3.1.1.15 2007.12.29 - Kaspersky 7.0.0.125 2007.12.29 - McAfee 5195 2007.12.28 - Microsoft 1.3109 2007.12.29 - NOD32v2 2755 2007.12.29 - Norman 5.80.02 2007.12.28 - Panda 9.0.0.4 2007.12.29 - Prevx1 V2 2007.12.29 - Rising 20.24.52.00 2007.12.29 - Sophos 4.24.0 2007.12.29 - Sunbelt 2.2.907.0 2007.12.28 - Symantec 10 2007.12.29 - TheHacker 6.2.9.174 2007.12.28 - VBA32 3.12.2.5 2007.12.29 - VirusBuster 4.3.26:9 2007.12.29 - Webwasher-Gateway 6.6.2 2007.12.29 - Additional information File size: 158208 bytes MD5: 4fd22142f54692463a7b98b7de175573 SHA1: 21d079909eeffda4b79dace30eafa0860bbd4c62 PEiD: -

Hi

I'll give you a few tips to stay clean in the future when we're done.

One thing is when I load a site and add info, it drops like a bad cell call

I don't quite understand what you mean, can you explain this a little bit better?

when i make a donation, do i specify that you helped me.?????

There's no need for that.

You had a quite new infection, and I want to be 100% sure it's gone. Please do the following:

Download RenV (by sUBs) to your desktop.

• Double-click on RenV.exe to run the program.
• It will search your system drive looking for any modified .exe file and will produce a log (Log.txt) for you.
• Please attach this report to your reply (Do not copy and paste).

I uploaded the RenV report…. What I mean is I pull up a web site from internet explorer, a bank site for example, the site comes up to home page, and I go to look for their locations, and once I click on that link, the entire site drops, like I exited out of it…???? just curious…

Hi

the site comes up to home page, and I go to look for their locations

What do you mean by 'I go to look for their locations'?

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

C:\Program Files\Analog Devices\Core\smax4pnp .exe
C:\Program Files\Courion Corporation\Identity Management Suite DIRECT!\direct .exe
C:\Program Files\iTunes\iTunesHelper .exe
C:\Program Files\LANDesk\LDClient\WebPortal\sdclientmonitor .exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware .exe
C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
C:\WINDOWS\system32\DLA\DLACTRLW .EXE

Click on File > Save as….

In the File Name box, copy/paste Log.txt (Note: Do not change the filename!)

Click Save (Save Log.txt in the same location as RenV.exe)

[external image: Posted Image]

Refering to the picture above, drag Log.txt into RenV.exe.
When finished, it will produce a new log for you. Please post it in your next reply.