26 replies to this topic

[LDTate]

WeatherPulse by Tropic Designs is free of spyware/malware and is good replacement for anyone using Weatherbug. It's free.
http://www.tropicdes...ther_pulse.html

Open notepad and copy/paste the text in the Codebox below into it:

File::
C:\WINDOWS\system32\smart.dll
C:\WINDOWS\system32\windbg48.sys
C:\WINDOWS\System32\ntos.exe

Folder::
C:\Program Files\AWS

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Fly]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"=-

Save this as Save this as "CFScript"




Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.


Also please describe how your computer behaves at the moment.

[don3]

I went and uninstalled weatherbug the normal way first since I figured it would be safer to do that rather then just delete the folder. smart.dll was erased and not in the registery anymore but the alg process still runs at startup. I looked at services and it has the service that uses it listed as manual is that the default setting? I could just go and disable it and it wont run but I wanted to be sure on what is making it run in the first place. I had thought the dll was causing it but with that gone and it still running that means it wasn't. Is there some setting that the spyware could of changed so that it does run at startup even though the spyware itself might not of been using it that I could just change back. I stupidly ran sdfix when this first happened without rebooting first so I have no idea if that could of changed it to on either. Also I said I saw that there were 3 new files in the system32 folder when it happened and could only find 2,the lovefly and smart one both of which are deleted now but looking at the combo log I found that disk.dll is the third but I never could find it before because the modified date is 2001 but creation date is the same as the other 2. I havn't tried manually deleting it yet so I dont know if it can be done like the lovefly one was or is protected like smart.

I put it through the virus scanner site like the other one and it came back clean but I know it had never been in that folder before. The computer is acting fine with nothing going on except for that process running which I could probably just turn off but I just want to be sure that the act of the process running is just leftover stuff from the spyware or is something taking control of it. If its just leftovers then the disk dll might be something made because of the program being run. I had never made alg run before so im guessing that if disk.dll is really safe then it might of been a file created as a result of the alg process being run for the first time which would also be at the exact time of the infection.


ComboFix 08-05-21.2 - Owner 2008-05-24 16:55:43.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.0.1252.1.1033.18.265 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\System32\ntos.exe
C:\WINDOWS\system32\smart.dll
C:\WINDOWS\system32\windbg48.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\smart.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-24 to 2008-05-24 )))))))))))))))))))))))))))))))
.

2008-05-23 01:54 . 2008-05-23 01:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-23 01:54 . 2008-05-23 01:54 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-21 17:28 . 2008-05-21 17:28 <DIR> d-------- C:\Program Files\Alwil Software
2008-05-20 16:31 . 2008-05-20 15:57 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-20 16:31 . 2008-05-20 16:31 2,550 --a------ C:\WINDOWS\unins000.dat
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-17 20:30 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-17 20:30 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-09 13:55 . 2008-05-09 13:55 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-09 01:46 . 2008-05-09 01:46 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-09 01:43 . 2008-05-09 01:43 <DIR> d-------- C:\Documents and Settings\Administrator
2008-05-09 01:40 . 2008-05-09 01:40 <DIR> d-------- C:\SDfix
2008-05-08 20:46 . 2001-08-18 07:00 452,096 --a------ C:\WINDOWS\system32\disk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 21:42 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-19 06:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\U3
2008-04-09 18:49 --------- d-----w C:\Program Files\PuzzleMaker Version 3
2008-04-09 02:53 --------- d-----w C:\Program Files\McGraw-Hill
2007-05-07 00:04 1,010 ----a-w C:\Program Files\DivXPlayer.dbf
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-05-22_18.34.51.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-22 23:28:01 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-24 21:58:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-22 23:28:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-22 23:59:42 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-05-22 23:28:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-05-22 23:59:42 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-05-22 23:28:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-22 23:59:42 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-06-21 15:48 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-06-21 15:44 126976]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 03:19 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-06 16:08 98304]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-08 14:56 26112]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-05-29 13:57:06 323646]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-05-29 13:57:28 147456]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
--a------ 2004-03-19 14:17 78960 C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASM]
--a------ 2006-11-07 15:11 2500096 C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2007-10-08 16:50 41824 C:\Program Files\Common Files\AOL\1179228576\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft security adviser]
C:\Program Files\Microsoft Security Adviser\mssadv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msavsc.exe]
C:\Program Files\Microsoft Security Adviser\msavsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msctrl.exe]
C:\Program Files\Microsoft Security Adviser\msctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msfw.exe]
C:\Program Files\Microsoft Security Adviser\msfw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msiemon.exe]
C:\Program Files\Microsoft Security Adviser\msiemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2001-08-02 06:14 1077277 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mssadv.exe]
C:\Program Files\Microsoft Security Adviser\msfw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msscan.exe]
C:\Program Files\Microsoft Security Adviser\msscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
--a------ 2004-05-07 16:54 99480 C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunOnce2Upd]
C:\WINDOWS\System32\KB_963493.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2004-02-09 03:54 65024 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 17:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\userinit]
C:\WINDOWS\System32\ntos.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"dnlsvc"=2 (0x2)

R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-15 18:20]

.
Contents of the 'Scheduled Tasks' folder
"2007-08-06 22:23:18 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1178485382.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-24 16:58:43
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
"ServiceDll"="%SystemRoot%\System32\browser.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\C:]
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\WINDOWS\system32\rasautou.exe
.
**************************************************************************
.
Completion time: 2008-05-24 17:05:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-24 22:05:36
ComboFix2.txt 2008-05-22 23:35:06

Pre-Run: 32,254,808,064 bytes free
Post-Run: 32,273,575,936 bytes free

157




-----------------------------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:09:49 PM, on 5/24/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://fpdownload.macromedia.com
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://moneycentral.msn.com
O15 - Trusted Zone: http://sdc.shockwave.com
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4411 bytes

[LDTate]

I don't like where disk.dll is located. Lets do a online scan.

Using Internet Explorer, click on Kaspersky Online Scanner * You will be prompted to install an ActiveX component from Kaspersky, Click 'Yes'.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save as Text' button:
* Save the file to your desktop.
Please post the Kaspersky report and a new HijackThis log.

[don3]

The scan didn't pick up anything about disk.dll and I submitted it to there file scanner as well should I just go and see if I can delete it by hand since that would tell if its in use by something or not. The file is 441kb in size and listed as OLE32 Extentions for Win32 version 6.0.2600.0 if that helps.





Monday, May 26, 2008 5:42:38 PM
Operating System: Microsoft Windows XP Home Edition, (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 26/05/2008
Kaspersky Anti-Virus database records: 801091


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
A:\
C:\
D:\
E:\
F:\

Scan Statistics
Total number of scanned objects 62001
Number of viruses found 3
Number of infected objects 4
Number of suspicious objects 0
Duration of the scan process 01:05:53

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\ph Object is locked skipped

C:\Documents and Settings\All Users\Application Data\AOL\ACS\1.0\variable Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\History\History.IE5\MSHist012008052620080527\index.dat Object is locked skipped

C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Owner\My Documents\My Pictures\Pictures Downloaded from AOL\SavedFromMail\spaghettiMA11602921-0001.GIF Infected: Trojan-Spy.HTML.Bayfraud.in skipped

C:\Documents and Settings\Owner\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\Owner\ntuser.dat.LOG Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\log\selfdef.log Object is locked skipped

C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped

C:\System Volume Information\_restore{E292C599-C513-4978-9DA1-3C4D85B10D77}\RP367\A0116568.dll Infected: Trojan-PSW.Win32.WOW.arz skipped

C:\System Volume Information\_restore{E292C599-C513-4978-9DA1-3C4D85B10D77}\RP377\A0119093.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped

C:\System Volume Information\_restore{E292C599-C513-4978-9DA1-3C4D85B10D77}\RP383\change.log Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\APP71.LST Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\APP74.LST Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\Apps.Lst Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\Diction.lst Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\main.idx Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\sap.dat Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\spool.lst Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\STYLE.LST Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\sysnews.lst Object is locked skipped

C:\TI-Calculator\America Online 7.0\idb\Toolbar.lst Object is locked skipped

C:\TI-Calculator\America Online 7.0\organize\CACHE\donnied75 Object is locked skipped

C:\TI-Calculator\America Online 7.0\organize\donniedd3 Object is locked skipped

C:\TI-Calculator\America Online 7.0\organize\donniedd3.abi Object is locked skipped

C:\TI-Calculator\America Online 7.0\organize\donniedd3.aby Object is locked skipped

C:\WINDOWS\cpbrkpie.ocx Infected: not-a-virus:AdWare.Win32.Coupons.h skipped

C:\WINDOWS\Debug\oakley.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_484.dat Object is locked skipped

C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

D:\System Volume Information\_restore{E292C599-C513-4978-9DA1-3C4D85B10D77}\RP383\change.log Object is locked skipped

Scan process completed.



--------------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:53:36 PM, on 5/26/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\TI-Calculator\America Online 7.0\waol.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://fpdownload.macromedia.com
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://moneycentral.msn.com
O15 - Trusted Zone: http://sdc.shockwave.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{40E66073-8C5A-46A8-B36C-43A48833F7D3}: NameServer = 205.188.146.145
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4757 bytes

[LDTate]

Lets kill it this way.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\disk.dll

Folder::
C:\SDfix

Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

[don3]

For a minute it looked fixed it was able to delete the dll and after combofix restarted the computer I checked the process and alg was no longer running at startup. I rebooted the computer normally afterwards to double check and the process is back again. But the dll is gone as well as the sdfix folder so im thinking maybe this is something sdfix did. The three dlls that got put into the system32 folder are gone so I dont think there is anymore spyware that could be doing it. I memorize the number of files on the last row of the folder just to be safe and it was only one before the infection and after there was four so im pretty sure those three files were the only thing added that day. Somethine else that was strange is when I first ran sdfix for the first few reboots afterwards the wmiprvse process would run after connecting online then go away after about two minutes and I hadn't seen it do that since but after deleting that folder just now it started again then stopped. So should I just disable the alg process from running altogether because it might be possible that its only running because of something sdfix did.


ComboFix 08-05-21.2 - Owner 2008-05-27 18:13:47.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.0.1252.1.1033.18.298 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\disk.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\SDfix
C:\SDfix\SDFix\apps\assosfix.reg
C:\SDfix\SDFix\apps\cliptext.exe
C:\SDfix\SDFix\apps\download.exe
C:\SDfix\SDFix\apps\dummy.sys
C:\SDfix\SDFix\apps\Enable_Command_Prompt.reg
C:\SDfix\SDFix\apps\ERDNT.E_E
C:\SDfix\SDFix\apps\ERDNTDOS.LOC
C:\SDfix\SDFix\apps\ERDNTWIN.LOC
C:\SDfix\SDFix\apps\ERUNT.EXE
C:\SDfix\SDFix\apps\ERUNT.LOC
C:\SDfix\SDFix\apps\fix.reg
C:\SDfix\SDFix\apps\FixBH.reg
C:\SDfix\SDFix\apps\FixComponents.reg
C:\SDfix\SDFix\apps\FIXCU.reg
C:\SDfix\SDFix\apps\FIXLM.reg
C:\SDfix\SDFix\apps\FixPath.exe
C:\SDfix\SDFix\apps\FixRedir.reg
C:\SDfix\SDFix\apps\FixSchedule.reg
C:\SDfix\SDFix\apps\FixWebCheck.reg
C:\SDfix\SDFix\apps\fixXP.reg
C:\SDfix\SDFix\apps\FixXPsp2.reg
C:\SDfix\SDFix\apps\grep.exe
C:\SDfix\SDFix\apps\HPFix.reg
C:\SDfix\SDFix\apps\HPFix2.reg
C:\SDfix\SDFix\apps\HPFix3.reg
C:\SDfix\SDFix\apps\HPFix4.reg
C:\SDfix\SDFix\apps\HPFix5.reg
C:\SDfix\SDFix\apps\HPFix6.reg
C:\SDfix\SDFix\apps\HPFix7.reg
C:\SDfix\SDFix\apps\HPFix8.reg
C:\SDfix\SDFix\apps\isadmin.exe
C:\SDfix\SDFix\apps\leg2.txt
C:\SDfix\SDFix\apps\legacy.txt
C:\SDfix\SDFix\apps\legacybk.txt
C:\SDfix\SDFix\apps\locate.com
C:\SDfix\SDFix\apps\LS.exe
C:\SDfix\SDFix\apps\MD5File.exe
C:\SDfix\SDFix\apps\MyGcpvFix.reg
C:\SDfix\SDFix\apps\MyGkFix2.reg
C:\SDfix\SDFix\apps\Process.exe
C:\SDfix\SDFix\apps\procs.exe
C:\SDfix\SDFix\apps\psservice.exe
C:\SDfix\SDFix\apps\Rem.txt
C:\SDfix\SDFix\apps\Rem2.txt
C:\SDfix\SDFix\apps\Replace\regedit.exe
C:\SDfix\SDFix\apps\Replace\W2K.exe
C:\SDfix\SDFix\apps\Replace\w2k\beep.sys
C:\SDfix\SDFix\apps\Replace\w2k\null.sys
C:\SDfix\SDFix\apps\Replace\XP.exe
C:\SDfix\SDFix\apps\Replace\xp\beep.sys
C:\SDfix\SDFix\apps\Replace\xp\null.sys
C:\SDfix\SDFix\apps\Reset_AppInit_DLLs.reg
C:\SDfix\SDFix\apps\RestartIt!.exe
C:\SDfix\SDFix\apps\Restore_SecurityCenter.reg
C:\SDfix\SDFix\apps\Restore_SharedAccess.reg
C:\SDfix\SDFix\apps\sc.exe
C:\SDfix\SDFix\apps\sed.exe
C:\SDfix\SDFix\apps\SF.exe
C:\SDfix\SDFix\apps\shutdown.exe
C:\SDfix\SDFix\apps\srv2.txt
C:\SDfix\SDFix\apps\srv2bk.txt
C:\SDfix\SDFix\apps\svc.txt
C:\SDfix\SDFix\apps\svcbk.txt
C:\SDfix\SDFix\apps\swreg.exe
C:\SDfix\SDFix\apps\swsc.exe
C:\SDfix\SDFix\apps\unzip.exe
C:\SDfix\SDFix\apps\vfind.exe
C:\SDfix\SDFix\apps\WINMSG.EXE
C:\SDfix\SDFix\apps\winsec.reg
C:\SDfix\SDFix\apps\zip.exe
C:\SDfix\SDFix\backups\backupreg.zip
C:\SDfix\SDFix\backups\backups.zip
C:\SDfix\SDFix\backups\catchme.log
C:\SDfix\SDFix\backups\HOSTS
C:\SDfix\SDFix\catchme.exe
C:\SDfix\SDFix\dummy.sys
C:\SDfix\SDFix\Report.txt
C:\SDfix\SDFix\RunThis.bat
C:\SDfix\SDFix\SDFIX_ReadMe_Online.url
C:\WINDOWS\system32\disk.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.

2008-05-25 18:13 . 2008-05-25 18:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-25 18:13 . 2008-05-25 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-23 01:54 . 2008-05-23 01:54 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-23 01:54 . 2008-05-23 01:54 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-21 17:28 . 2008-05-21 17:28 <DIR> d-------- C:\Program Files\Alwil Software
2008-05-20 16:31 . 2008-05-20 15:57 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-20 16:31 . 2008-05-20 16:31 2,550 --a------ C:\WINDOWS\unins000.dat
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-05-17 20:30 . 2008-05-17 20:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-17 20:30 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-17 20:30 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-05-09 13:55 . 2008-05-09 13:55 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-09 01:46 . 2008-05-09 01:46 <DIR> d-------- C:\WINDOWS\ERUNT
2008-05-09 01:43 . 2008-05-09 01:43 <DIR> d-------- C:\Documents and Settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 21:42 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-19 06:01 --------- d-----w C:\Documents and Settings\Owner\Application Data\U3
2008-04-09 18:49 --------- d-----w C:\Program Files\PuzzleMaker Version 3
2008-04-09 02:53 --------- d-----w C:\Program Files\McGraw-Hill
2007-05-07 00:04 1,010 ----a-w C:\Program Files\DivXPlayer.dbf
.

------- Sigcheck -------

.
((((((((((((((((((((((((((((( snapshot@2008-05-22_18.34.51.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-22 23:28:01 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-27 05:19:32 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-22 23:28:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-05-22 23:59:42 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-05-22 23:28:03 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-05-22 23:59:42 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-05-22 23:28:03 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-05-22 23:59:42 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2008-05-27 05:19:45 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_49c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-06-21 15:48 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-06-21 15:44 126976]
"Share-to-Web Namespace Daemon"="C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 03:19 69632]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-05-06 16:08 98304]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2007-08-08 14:56 26112]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2002-05-29 13:57:06 323646]
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe [2002-05-29 13:57:28 147456]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online Tray Icon.lnk
backup=C:\WINDOWS\pss\America Online Tray Icon.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^AOL Companion.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AOL Companion.lnk
backup=C:\WINDOWS\pss\AOL Companion.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
--a------ 2004-03-19 14:17 78960 C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASM]
--a------ 2006-11-07 15:11 2500096 C:\Program Files\AOL\Active Security Monitor\ASMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
--a------ 2007-10-08 16:50 41824 C:\Program Files\Common Files\AOL\1179228576\ee\AOLSoftware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft security adviser]
C:\Program Files\Microsoft Security Adviser\mssadv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msavsc.exe]
C:\Program Files\Microsoft Security Adviser\msavsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msctrl.exe]
C:\Program Files\Microsoft Security Adviser\msctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msfw.exe]
C:\Program Files\Microsoft Security Adviser\msfw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msiemon.exe]
C:\Program Files\Microsoft Security Adviser\msiemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2001-08-02 06:14 1077277 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mssadv.exe]
C:\Program Files\Microsoft Security Adviser\msfw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msscan.exe]
C:\Program Files\Microsoft Security Adviser\msscan.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pure Networks Port Magic]
--a------ 2004-05-07 16:54 99480 C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunOnce2Upd]
C:\WINDOWS\System32\KB_963493.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-ra------ 2004-02-09 03:54 65024 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-05-22 17:39 32881 C:\Program Files\Java\j2re1.4.2_15\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\userinit]
C:\WINDOWS\System32\ntos.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"dnlsvc"=2 (0x2)

R1 aswSP;avast! Self Protection;C:\WINDOWS\System32\drivers\aswSP.sys [2008-05-15 18:20]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2007-08-06 22:23:18 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2100 series#1178485382.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-27 18:15:43
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
"ServiceDll"="%SystemRoot%\System32\browser.dll"

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\C:]
.
Completion time: 2008-05-27 18:18:38
ComboFix-quarantined-files.txt 2008-05-27 23:17:36
ComboFix2.txt 2008-05-24 22:05:41
ComboFix3.txt 2008-05-22 23:35:06

Pre-Run: 32,228,306,944 bytes free
Post-Run: 32,226,050,048 bytes free

224




--------------------------------------------------------------------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:26:12 PM, on 5/27/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_15\bin\npjpi142_15.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://fpdownload.macromedia.com
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://moneycentral.msn.com
O15 - Trusted Zone: http://sdc.shockwave.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 4597 bytes

[LDTate]

Are you saying the alg.dll is still there?

Run hijackthis. Hit None of the above, Click Do a System Scan Only. Put a checkmark/tick in the box on the left side on these:

O15 - Trusted Zone: http://fpdownload.macromedia.com
O15 - Trusted Zone: http://www.macromedia.com
O15 - Trusted Zone: http://moneycentral.msn.com
O15 - Trusted Zone: http://sdc.shockwave.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} - http://software-dl.r...ip/RdxIE601.cab

Close ALL windows and browsers except HijackThis and click "Fix checked"


You need to apply Service Pack 1a for Windows XP. Click here: http://www.microsoft...p1/default.mspx
Apply the update, reboot, and post a fresh Hijack This log.

[don3]

No I ment the alg.exe process is running which is a normal safe thing but I figured it was being hijacked by some spyware since it never ran before and all the bad dlls are gone now. I think I may of figured it out what is causing it. I was searching and found out it has to do with the Internet Connection - Firewall (ICF) / Sharing (ICS) Service I was certain I never had this on before and when I looked in services I found it was set to automatic and after looking around I saw that the default setting is manual so is it safe to change it. If im right then I think something may of turned that sevice on by itself and that is what caused alg to start running.

[LDTate]

If you have another Firewall running then disable it.

[don3]

Fixed and everything is back to normal now. I feel stupid for not seeing that earlier. My guess is that the spyware that got me needed the internet conection sharing on in order for it to work so it must of set the service to automatic in order to make it run and as a result that caused the alg process to run and even though all the spyware was now gone the setting still remained changed to automatic so by switching it back I now no longer have alg running. I dont see anything else strange so everything is fixed now. Is there anything else I should do like uninstall combofix before updating the system. Thanks for the help.

[LDTate]

Good job

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  • 
  
  
  Here's my usual all clean post
  
  Log looks good
  
  
  You need to create a new Clean restore point.
  
  Note: This will remove all previous Restore Points
  
  Click Start Menu > Run > copy and paste
  
  %SystemRoot%\System32\restore\rstrui.exe
  
  Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.
  
  Double-click My Computer.
  Click the Tools menu, and then click Folder Options.
  Click the View tab.
  Check "Hide file extensions for known file types."
  Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
  Check "Hide protected operating system files."
  Click Apply, and then click OK.
  
  
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialize and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
• Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
  (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
  Without a firewall your computer is succeptible to being hacked and taken over.
  I am very serious about this and see it happen almost every day with my clients.
  Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  Note: I no longer suggest Zone Alarm
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
  This will ensure your computer has always the latest security updates available installed on your computer.
  If there are new updates to install, install them immediately, reboot your computer, and revisit the site
  until there are no more critical updates.
  
  
• Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
  settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Winpatrol
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly.
  Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

[LDTate]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.