newolympus16
Topic Starter
About two days ago, i noticed that my IE became very slow. Also, random popups would occur even if IE was closed. A few days before that I was infected with Antivirus XP 2008, but i cleaned that up following the instructions on the Norton website (using Malwarebytes' Anti-Malware and performing a scan with new definitions). That problem appears to have resolved as I no longer receive those popups. This problem, however, appears to be related to process called 7gSQV44l.exe. Searching the forums, i noticed a very similar problem here:
http://forums.whatthetech.com/IE_opens_up_…nts_t93773.html
the process would randomly start up by itself even after I stop it
Here is the Hijack file. I also went ahead and did the other steps as outlined in the thread above, and don't know what to do next. Any help is greatly appreciated.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:44 PM, on 8/15/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\SSL VPN Client\agent.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\CF14668.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\7gSQV44L.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200310…llInstaller.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://www.survival.com.my/tech/xmlsetup/msxml4.cab
O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) - http://scpwbc.ops.placeware.com/etc/place/…quicksilver.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5Beta\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Cisco Systems, Inc. STC Agent (STCAgent) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\SSL VPN Client\agent.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
–
End of file - 6765 bytes
Here's the combo file:
ComboFix 08-08-14.05 - Jason Chang 2008-08-15 19:44:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.671 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason Chang\Desktop\WinXP_EN_PRO_BF.EXE
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\#SharedObjects\5NBTK9H2\interclick.com
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\#SharedObjects\5NBTK9H2\interclick.com\ud.sol
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Jason Chang\Cookies\jason chang@2o7[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@antispywaremaster[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@buycostumes[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@circuitcity[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@nytimes[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@revsci[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@serving-sys[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@statcounter[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@topix[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@trafficmp[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@tribalfusion[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@walmart[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@web.checkm8[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@www.content4reprint[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@zedo[2].txt
C:\WINDOWS\system32\components
C:\WINDOWS\system32\MSINET.oca
.
((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 )))))))))))))))))))))))))))))))
.
2008-08-15 19:03 . 2008-08-15 19:03 d——– C:\Program Files\Trend Micro
2008-08-15 03:05 . 2008-08-15 19:12 80,898 –a—— C:\WINDOWS\system32\7gSQV44L.exe
2008-08-15 03:05 . 2008-08-15 03:05 0 –a—— C:\WINDOWS\system32\7gSQV44L.exe.a_a
2008-08-14 21:34 . 2008-08-14 21:36 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-14 18:59 . 2008-08-14 18:59 29,760 –a—— C:\WINDOWS\system32\HgRX6xYy.exe
2008-08-14 18:34 . 2008-08-14 18:34 d——– C:\Program Files\Common Files\xing shared
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Documents and Settings\Jason Chang\Application Data\Malwarebytes
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-12 15:59 . 2008-07-30 20:14 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-12 15:59 . 2008-07-30 20:14 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-12 15:56 . 2008-08-12 15:58 d——– C:\Program Files\RogueRemover FREE
2008-08-10 23:30 . 2008-08-10 23:31 d——– C:\Netgear
2008-07-25 08:45 . 2008-07-25 08:45 d—s—- C:\WINDOWS\system32\Microsoft
2008-07-20 20:54 . 2008-07-20 21:20 d——– C:\Documents and Settings\Jason Chang\Application Data\DivX
2008-07-20 20:53 . 2008-06-10 16:07 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2008-07-20 20:53 . 2008-06-10 16:07 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-07-20 20:53 . 2008-06-10 16:07 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-07-20 20:45 . 2008-07-20 20:46 d——– C:\Documents and Settings\Jason Chang\Application Data\Media Player Classic
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 05:34 ——— d—–w C:\Program Files\Lavasoft
2008-08-15 05:34 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-15 02:35 ——— d—–w C:\Program Files\Real
2008-08-15 02:34 ——— d—–w C:\Program Files\Common Files\Real
2008-08-13 06:13 ——— d—–w C:\Documents and Settings\Jason Chang\Application Data\Azureus
2008-08-13 02:16 ——— d—–w C:\Program Files\Warcraft
2008-07-21 04:53 ——— d—–w C:\Program Files\DivX
2008-07-15 22:05 ——— d—–w C:\Program Files\World of Warcraft
2008-06-18 17:52 161,096 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-06-11 00:07 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-06-11 00:07 120,056 ——w C:\WINDOWS\system32\pxcpyi64.exe
2008-06-11 00:07 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2008-06-11 00:04 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:18 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-16 19:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2005-09-13 04:21 25,768 —-a-w C:\Documents and Settings\Jason Chang\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-23 04:00 13312]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-15 17:39 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44 32881]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 02:50 155648]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-05-14 10:41 3784704]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-05-14 10:41 81920]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 11:58 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-08 16:28 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-08-14 18:34 180269]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 57344 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2004-05-14 10:41 831488 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2001-08-23 04:00 51200 C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 00:19:50 217193]
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-06-17 21:01:16 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll
"msacm.l3acm"= L3codecp.acm
"vidc.asv2"= asusasv2.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.ap41"= DivXc32f.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.rud0"= rududu.dll
"vidc.xvid"= xvid.dll
"vidc.mj2c"= M3JP2K32.dll
"vidc.mmes"= DigiVCap.dll
"vidc.vixl"= Miroxl32.dll
"vidc.sony"= sonydv.dll
"vidc.dv25"= DigiVCap.dll
"vidc.dv50"= DigiVCap.dll
"vidc.msmc"= DigiVCap.dll
"vidc.mmjp"= DigiVCap.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.vssv"= vsscodec.dll
"vidc.pim1"= pclepim1.dll
"vidc.advs"= Dvc.dll
"vidc.asv1"= asusasv1.dll
"vidc.vcr1"= ativcr1.dll
"vidc.vcr2"= ativcr2.dll
"vidc.aflc"= flccodec32.dll
"vidc.aasc"= Aasc32.dll
"vidc.avrn"= AvidAVICodec.dll
"VIDC.mszh"= avimszh.dll
"vidc.zlib"= avizlib.dll
"vidc.mwv1"= icmw_32.dll
"vidc.bt20"= btvvc32.drv
"vidc.y41p"= btvvc32.drv
"vidc.cscd"= camcodec.dll
"vidc.cdvc"= CSCCDVC.DLL
"vidc.ddvc"= CSCdvsd.DLL
"vidc.dps0"= DpsAviCC.dll
"MSVideo"= DPSVidCap.drv
"vidc.dvx4"= divx4.dll
"vidc.em2v"= EtxCodec.dll
"vidc.frwd"= frwd.dll
"vidc.frwt"= frwt.dll
"vidc.frwu"= frwu.dll
"vidc.glzw"= GLZW.dll
"vidc.gpeg"= GPEG.dll
"vidc.hfyu"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.ir21"= IR21_R.DLL
"vidc.rt21"= IR21_R.DLL
"vidc.dcmj"= MCMJPG32.DLL
"vidc.tvmj"= MMTVMJ.dll
"vidc.fljp"= MMTVMJ.dll
"vidc.nt00"= NTCodec.dll
"vidc.vp31"= vp31vfw.dll
"vidc.pdvc"= idvcodec.dll
"vidc.ipdv"= idvcodec.dll
"vidc.sjpg"= pmjpeg32.dll
"vidc.pvw2"= pvwv220.dll
"vidc.pimj"= pvljpg20.dll
"vidc.mjpx"= pvmjpg21.dll
"vidc.miro"= mirodv2avi.dll
"vidc.mjpa"= rtmjpgcdc.dll
"msacm.qmpeg"= qmpeg.acm
"vidc.qpeg"= Qpeg32.dll
"vidc.rmp4"= rmp4.dll
"vidc.s422"= tekyuv.dll
"vidc.wnv1"= WNVPLAY1.DLL
"msacm.pcdv"= pcdv.acm
"msacm.imc"= IMC32.ACM
"msacm.wrpr"= aviwrap.dll
"vidc.wrpr"= aviwrap.dll
"msacm.divxa32"= DivXa32.acm
"vidc.png1"= CorePNG_vfw.dll
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-08-15 C:\WINDOWS\Tasks\At31.job
- C:\WINDOWS\System32\7gSQV44L.exe [2008-08-15 19:12]
2008-08-16 C:\WINDOWS\Tasks\At45.job
- C:\WINDOWS\System32\7gSQV44L.exe [2008-08-15 19:12]
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Jason Chang\Application Data\Mozilla\Firefox\Profiles\okhq6uft.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 19:55:55
Windows 5.1.2600 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69
,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00
,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69
,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00
,79,00,73,00,00,00"
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\NavLogon.dll
.
Completion time: 2008-08-15 20:32:44
ComboFix-quarantined-files.txt 2008-08-16 04:27:38
Pre-Run: 43,951,099,904 bytes free
Post-Run: 51,861,549,056 bytes free
WinXP_EN_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
226
Hijack uninstall list:
AC3Filter (remove only)
Ad-Aware
Ad-aware 6 Personal
Adobe Acrobat 6.0 Professional
Adobe Flash Player ActiveX
Adobe Photoshop 6.0
Adobe Reader 7.1.0
AnswerWorks 4.0 Runtime - English
AOL Instant Messenger
Azureus
Canon Camera Support Core Library
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon Utilities ZoomBrowser EX
Cisco SSL VPN Client
DAEMON Tools
dBpowerAMP Music Converter
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Fireplace
Google Toolbar for Internet Explorer
Guitar Pro 4 Demo
HijackThis 2.0.2
Hummingbird Exceed V8.0
iTunes
Java 2 Runtime Environment, SE v1.4.2_04
LiveUpdate 1.7 (Symantec Corporation)
Macromedia Flash 5
Macromedia Flash Player 8
Macromedia Generator 2
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
MATLAB 6.5
MATLAB Family of Products Release 12
Microsoft .NET Framework 2.0
Microsoft Money 2006
Microsoft Office Live Meeting
Microsoft Office XP Professional with FrontPage
Microsoft XML Parser and SDK
ML-1200 Series
Mozilla Firefox (2.0.0.16)
MSXML 4.0 SP2 Parser and SDK
Nero - Burning Rom
Nic's XviD Decoder
NJWIN - NJStar CJK Viewer
NVIDIA Drivers
Outlook Express Q823353
Overture 3.5 Demo
Pdf995
PdfEdit995
QuickTime
RealPlayer
Realtek AC'97 Audio
Rhapsody Player Engine
Rose Online
Safety Bar
SSH Secure Shell
Starcraft
Symantec AntiVirus Client
TaxCut Premium 2006
TurboTax Premier 2007
Ventrilo Client
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WildTangent Web Driver
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player Hotfix [See wm828026 for more information]
Windows XP Application Compatibility Update[Q319580]
Windows XP Hotfix - KB821253
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823182
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB823980
Windows XP Hotfix - KB824105
Windows XP Hotfix - KB824141
Windows XP Hotfix - KB824146
Windows XP Hotfix - KB825119
Windows XP Hotfix - KB828028
Windows XP Hotfix - KB828035
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB837001
Windows XP Hotfix - KB840315
Windows XP Hotfix - KB840374
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB841873
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB887822
Windows XP Hotfix (SP1) [See Q307869 for more information]
Windows XP Hotfix (SP1) [See Q309521 for more information]
Windows XP Hotfix (SP1) [See Q310437 for more information]
Windows XP Hotfix (SP1) [See Q310510 for more information]
Windows XP Hotfix (SP1) [See Q311542 for more information]
Windows XP Hotfix (SP1) [See Q311889 for more information]
Windows XP Hotfix (SP1) [See Q311967 for more information]
Windows XP Hotfix (SP1) [See Q313450 for more information]
Windows XP Hotfix (SP1) [See Q314862 for more information]
Windows XP Hotfix (SP1) [See Q315000 for more information]
Windows XP Hotfix (SP1) [See Q315403 for more information]
Windows XP Hotfix (SP1) [See Q317277 for more information]
Windows XP Hotfix (SP1) [See Q318138 for more information]
Windows XP Hotfix (SP1) [See Q318966 for more information]
Windows XP Hotfix (SP1) [See Q319322 for more information]
Windows XP Hotfix (SP1) [See Q319949 for more information]
Windows XP Hotfix (SP1) [See Q320174 for more information]
Windows XP Hotfix (SP1) [See Q320552 for more information]
Windows XP Hotfix (SP1) [See Q320678 for more information]
Windows XP Hotfix (SP1) [See Q323172 for more information]
Windows XP Hotfix (SP1) [See Q324096 for more information]
Windows XP Hotfix (SP1) [See Q324380 for more information]
Windows XP Hotfix (SP1) [See Q326830 for more information]
Windows XP Hotfix (SP1) [See Q328940 for more information]
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q328310
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q811493
Windows XP Hotfix (SP1) Q815021
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP1) Q819696
Windows XP Hotfix (SP2) [See Q329115 for more information]
WinRAR archiver
WinZip
World of Warcraft
and finallya a jotti scan:
Service load:
0% 100%
File: 7gSQV44l.exe
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 27c916afa6ee3bdc238da286659e20ba
Packers detected:
-
Scanner results
Scan taken on 16 Aug 2008 03:17:17 (GMT)
A-Squared
Found nothing
AntiVir
Found TR/Crypt.ULPM.Gen
ArcaVir
Found nothing
Avast
Found Win32:Trojan-gen {Other}
AVG Antivirus
Found Clicker.PIM
BitDefender
Found Trojan.Adclicker.HB
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found Trojan.DownLoad.3459
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found PossibleThreat (probable variant)
Ikarus
Found Trojan-Downloader.Win32.Agent.vvi
Kaspersky Anti-Virus
Found nothing
NOD32
Found a variant of Win32/TrojanClicker.Agent.NEB
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found Mal/HckPk-A
VirusBuster
Found nothing
VBA32
Found Win32.Trojan-Downloader (probable variant)
Powered by
images/asquared.png images/antivir.png images/arcabit.png images/avast.png images/avg.gif images/bitdefender.png images/clamav-logo1.png images/cpsecure.gif images/drweb.gif images/f-prot.png images/f-secure_logo.gif images/fortinet.gif images/ikarus.gif images/kaspersky.png images/nod32.gif images/norman.png images/panda.gif images/sophos.gif images/virusbuster.gif images/vba32.png
Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.
Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.
Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.
Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.
Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.
Sponsored by HotelScraper.com.
Statistics
Last file scanned at least one scanner reported something about: server.exe (MD5: 2d755f6a36208ca78891e2e17ec04701, size: 607998 bytes), detected by:
Scanner Malware name
A-Squared X
AntiVir TR/Dropper.Gen
ArcaVir X
Avast X
AVG Antivirus BackDoor.Bifrose.DD
BitDefender MemScan:Trojan.Dropper.VB.ASB
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus Trojan-Spy.Agent.NTN
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control SDBot.gen8
Panda Antivirus X
Sophos Antivirus Sus/ComPack
VirusBuster X
VBA32 X
I apologize if I was supposed to wait. I was trying to complete the steps on my own following the forum until I read that we should wait for an administrator or someone who knew what he/she was doing before running combofix and whatnot.
Thanks.
http://forums.whatthetech.com/IE_opens_up_…nts_t93773.html
the process would randomly start up by itself even after I stop it
Here is the Hijack file. I also went ahead and did the other steps as outlined in the thread above, and don't know what to do next. Any help is greatly appreciated.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:44 PM, on 8/15/2008
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Cisco Systems\SSL VPN Client\agent.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\cba\xfr.exe
C:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\CF14668.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\7gSQV44L.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/200310…llInstaller.exe
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://www.survival.com.my/tech/xmlsetup/msxml4.cab
O16 - DPF: {BF116476-3238-4EDA-A2D7-6D6814EF0DEC} (Quicksilver Class) - http://scpwbc.ops.placeware.com/etc/place/…quicksilver.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel File Transfer - Intel® Corporation - C:\WINDOWS\system32\cba\xfr.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5Beta\webserver\bin\win32\matlabserver.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Cisco Systems, Inc. STC Agent (STCAgent) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\SSL VPN Client\agent.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
–
End of file - 6765 bytes
Here's the combo file:
ComboFix 08-08-14.05 - Jason Chang 2008-08-15 19:44:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.671 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason Chang\Desktop\WinXP_EN_PRO_BF.EXE
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\#SharedObjects\5NBTK9H2\interclick.com
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\#SharedObjects\5NBTK9H2\interclick.com\ud.sol
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jason Chang\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Jason Chang\Cookies\jason chang@2o7[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@antispywaremaster[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@buycostumes[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@circuitcity[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@nytimes[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@revsci[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@serving-sys[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@statcounter[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@topix[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@trafficmp[2].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@tribalfusion[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@walmart[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason [removed][1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@web.checkm8[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@www.content4reprint[1].txt
C:\Documents and Settings\Jason Chang\Cookies\jason chang@zedo[2].txt
C:\WINDOWS\system32\components
C:\WINDOWS\system32\MSINET.oca
.
((((((((((((((((((((((((( Files Created from 2008-07-16 to 2008-08-16 )))))))))))))))))))))))))))))))
.
2008-08-15 19:03 . 2008-08-15 19:03 d——– C:\Program Files\Trend Micro
2008-08-15 03:05 . 2008-08-15 19:12 80,898 –a—— C:\WINDOWS\system32\7gSQV44L.exe
2008-08-15 03:05 . 2008-08-15 03:05 0 –a—— C:\WINDOWS\system32\7gSQV44L.exe.a_a
2008-08-14 21:34 . 2008-08-14 21:36 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-14 18:59 . 2008-08-14 18:59 29,760 –a—— C:\WINDOWS\system32\HgRX6xYy.exe
2008-08-14 18:34 . 2008-08-14 18:34 d——– C:\Program Files\Common Files\xing shared
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Documents and Settings\Jason Chang\Application Data\Malwarebytes
2008-08-12 15:59 . 2008-08-12 15:59 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-12 15:59 . 2008-07-30 20:14 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-12 15:59 . 2008-07-30 20:14 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-12 15:56 . 2008-08-12 15:58 d——– C:\Program Files\RogueRemover FREE
2008-08-10 23:30 . 2008-08-10 23:31 d——– C:\Netgear
2008-07-25 08:45 . 2008-07-25 08:45 d—s—- C:\WINDOWS\system32\Microsoft
2008-07-20 20:54 . 2008-07-20 21:20 d——– C:\Documents and Settings\Jason Chang\Application Data\DivX
2008-07-20 20:53 . 2008-06-10 16:07 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2008-07-20 20:53 . 2008-06-10 16:07 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-07-20 20:53 . 2008-06-10 16:07 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-07-20 20:45 . 2008-07-20 20:46 d——– C:\Documents and Settings\Jason Chang\Application Data\Media Player Classic
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-15 05:34 ——— d—–w C:\Program Files\Lavasoft
2008-08-15 05:34 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-08-15 02:35 ——— d—–w C:\Program Files\Real
2008-08-15 02:34 ——— d—–w C:\Program Files\Common Files\Real
2008-08-13 06:13 ——— d—–w C:\Documents and Settings\Jason Chang\Application Data\Azureus
2008-08-13 02:16 ——— d—–w C:\Program Files\Warcraft
2008-07-21 04:53 ——— d—–w C:\Program Files\DivX
2008-07-15 22:05 ——— d—–w C:\Program Files\World of Warcraft
2008-06-18 17:52 161,096 —-a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 —-a-w C:\WINDOWS\system32\DivXsm.exe
2008-06-11 00:07 3,596,288 —-a-w C:\WINDOWS\system32\qt-dx331.dll
2008-06-11 00:07 120,056 ——w C:\WINDOWS\system32\pxcpyi64.exe
2008-06-11 00:07 118,520 ——w C:\WINDOWS\system32\pxinsi64.exe
2008-06-11 00:04 200,704 —-a-w C:\WINDOWS\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 —-a-w C:\WINDOWS\system32\libdivx.dll
2008-05-22 22:18 12,288 —-a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-05-16 19:58 12,632 —-a-w C:\WINDOWS\system32\lsdelete.exe
2005-09-13 04:21 25,768 —-a-w C:\Documents and Settings\Jason Chang\Application Data\GDIPFONTCACHEV1.DAT
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-23 04:00 13312]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-15 17:39 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-22 22:44 32881]
"NeroCheck"="C:\WINDOWS\System32\\NeroCheck.exe" [2001-07-09 02:50 155648]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2004-05-14 10:41 3784704]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2004-05-14 10:41 81920]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2005-10-18 11:58 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-08 16:28 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-08-14 18:34 180269]
"SoundMan"="SOUNDMAN.EXE" [2003-08-14 23:34 57344 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2004-05-14 10:41 831488 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2001-08-23 04:00 51200 C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 00:19:50 217193]
Adobe Gamma Loader.exe.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-06-17 21:01:16 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll
"msacm.l3acm"= L3codecp.acm
"vidc.asv2"= asusasv2.dll
"vidc.div3"= DivXc32.dll
"vidc.div4"= DivXc32f.dll
"vidc.ap41"= DivXc32f.dll
"vidc.mjpg"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll
"vidc.rud0"= rududu.dll
"vidc.xvid"= xvid.dll
"vidc.mj2c"= M3JP2K32.dll
"vidc.mmes"= DigiVCap.dll
"vidc.vixl"= Miroxl32.dll
"vidc.sony"= sonydv.dll
"vidc.dv25"= DigiVCap.dll
"vidc.dv50"= DigiVCap.dll
"vidc.msmc"= DigiVCap.dll
"vidc.mmjp"= DigiVCap.dll
"vidc.3ivx"= 3ivxVfWCodec.dll
"vidc.vssv"= vsscodec.dll
"vidc.pim1"= pclepim1.dll
"vidc.advs"= Dvc.dll
"vidc.asv1"= asusasv1.dll
"vidc.vcr1"= ativcr1.dll
"vidc.vcr2"= ativcr2.dll
"vidc.aflc"= flccodec32.dll
"vidc.aasc"= Aasc32.dll
"vidc.avrn"= AvidAVICodec.dll
"VIDC.mszh"= avimszh.dll
"vidc.zlib"= avizlib.dll
"vidc.mwv1"= icmw_32.dll
"vidc.bt20"= btvvc32.drv
"vidc.y41p"= btvvc32.drv
"vidc.cscd"= camcodec.dll
"vidc.cdvc"= CSCCDVC.DLL
"vidc.ddvc"= CSCdvsd.DLL
"vidc.dps0"= DpsAviCC.dll
"MSVideo"= DPSVidCap.drv
"vidc.dvx4"= divx4.dll
"vidc.em2v"= EtxCodec.dll
"vidc.frwd"= frwd.dll
"vidc.frwt"= frwt.dll
"vidc.frwu"= frwu.dll
"vidc.glzw"= GLZW.dll
"vidc.gpeg"= GPEG.dll
"vidc.hfyu"= huffyuv.dll
"vidc.i263"= i263_32.drv
"vidc.ir21"= IR21_R.DLL
"vidc.rt21"= IR21_R.DLL
"vidc.dcmj"= MCMJPG32.DLL
"vidc.tvmj"= MMTVMJ.dll
"vidc.fljp"= MMTVMJ.dll
"vidc.nt00"= NTCodec.dll
"vidc.vp31"= vp31vfw.dll
"vidc.pdvc"= idvcodec.dll
"vidc.ipdv"= idvcodec.dll
"vidc.sjpg"= pmjpeg32.dll
"vidc.pvw2"= pvwv220.dll
"vidc.pimj"= pvljpg20.dll
"vidc.mjpx"= pvmjpg21.dll
"vidc.miro"= mirodv2avi.dll
"vidc.mjpa"= rtmjpgcdc.dll
"msacm.qmpeg"= qmpeg.acm
"vidc.qpeg"= Qpeg32.dll
"vidc.rmp4"= rmp4.dll
"vidc.s422"= tekyuv.dll
"vidc.wnv1"= WNVPLAY1.DLL
"msacm.pcdv"= pcdv.acm
"msacm.imc"= IMC32.ACM
"msacm.wrpr"= aviwrap.dll
"vidc.wrpr"= aviwrap.dll
"msacm.divxa32"= DivXa32.acm
"vidc.png1"= CorePNG_vfw.dll
*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-08-15 C:\WINDOWS\Tasks\At31.job
- C:\WINDOWS\System32\7gSQV44L.exe [2008-08-15 19:12]
2008-08-16 C:\WINDOWS\Tasks\At45.job
- C:\WINDOWS\System32\7gSQV44L.exe [2008-08-15 19:12]
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Jason Chang\Application Data\Mozilla\Firefox\Profiles\okhq6uft.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-15 19:55:55
Windows 5.1.2600 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69
,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00
,79,00,73,00,00,00"
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\ASPI32]
"ImagePath"="hex(2):53,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,64,00,72,00,69
,00,76,00,65,00,72,00,73,00,5c,00,61,00,73,00,70,00,69,00,33,00,32,00,2e,00,73,00
,79,00,73,00,00,00"
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\System32\NavLogon.dll
.
Completion time: 2008-08-15 20:32:44
ComboFix-quarantined-files.txt 2008-08-16 04:27:38
Pre-Run: 43,951,099,904 bytes free
Post-Run: 51,861,549,056 bytes free
WinXP_EN_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect
226
Hijack uninstall list:
AC3Filter (remove only)
Ad-Aware
Ad-aware 6 Personal
Adobe Acrobat 6.0 Professional
Adobe Flash Player ActiveX
Adobe Photoshop 6.0
Adobe Reader 7.1.0
AnswerWorks 4.0 Runtime - English
AOL Instant Messenger
Azureus
Canon Camera Support Core Library
Canon Camera Window for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon Utilities ZoomBrowser EX
Cisco SSL VPN Client
DAEMON Tools
dBpowerAMP Music Converter
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Fireplace
Google Toolbar for Internet Explorer
Guitar Pro 4 Demo
HijackThis 2.0.2
Hummingbird Exceed V8.0
iTunes
Java 2 Runtime Environment, SE v1.4.2_04
LiveUpdate 1.7 (Symantec Corporation)
Macromedia Flash 5
Macromedia Flash Player 8
Macromedia Generator 2
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Malwarebytes' RogueRemover
MATLAB 6.5
MATLAB Family of Products Release 12
Microsoft .NET Framework 2.0
Microsoft Money 2006
Microsoft Office Live Meeting
Microsoft Office XP Professional with FrontPage
Microsoft XML Parser and SDK
ML-1200 Series
Mozilla Firefox (2.0.0.16)
MSXML 4.0 SP2 Parser and SDK
Nero - Burning Rom
Nic's XviD Decoder
NJWIN - NJStar CJK Viewer
NVIDIA Drivers
Outlook Express Q823353
Overture 3.5 Demo
Pdf995
PdfEdit995
QuickTime
RealPlayer
Realtek AC'97 Audio
Rhapsody Player Engine
Rose Online
Safety Bar
SSH Secure Shell
Starcraft
Symantec AntiVirus Client
TaxCut Premium 2006
TurboTax Premier 2007
Ventrilo Client
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WildTangent Web Driver
Winamp (remove only)
Windows Installer 3.1 (KB893803)
Windows Media Format Runtime
Windows Media Player Hotfix [See wm828026 for more information]
Windows XP Application Compatibility Update[Q319580]
Windows XP Hotfix - KB821253
Windows XP Hotfix - KB821557
Windows XP Hotfix - KB823182
Windows XP Hotfix - KB823559
Windows XP Hotfix - KB823980
Windows XP Hotfix - KB824105
Windows XP Hotfix - KB824141
Windows XP Hotfix - KB824146
Windows XP Hotfix - KB825119
Windows XP Hotfix - KB828028
Windows XP Hotfix - KB828035
Windows XP Hotfix - KB828741
Windows XP Hotfix - KB833987
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB835732
Windows XP Hotfix - KB837001
Windows XP Hotfix - KB840315
Windows XP Hotfix - KB840374
Windows XP Hotfix - KB840987
Windows XP Hotfix - KB841356
Windows XP Hotfix - KB841533
Windows XP Hotfix - KB841873
Windows XP Hotfix - KB842773
Windows XP Hotfix - KB873376
Windows XP Hotfix - KB887822
Windows XP Hotfix (SP1) [See Q307869 for more information]
Windows XP Hotfix (SP1) [See Q309521 for more information]
Windows XP Hotfix (SP1) [See Q310437 for more information]
Windows XP Hotfix (SP1) [See Q310510 for more information]
Windows XP Hotfix (SP1) [See Q311542 for more information]
Windows XP Hotfix (SP1) [See Q311889 for more information]
Windows XP Hotfix (SP1) [See Q311967 for more information]
Windows XP Hotfix (SP1) [See Q313450 for more information]
Windows XP Hotfix (SP1) [See Q314862 for more information]
Windows XP Hotfix (SP1) [See Q315000 for more information]
Windows XP Hotfix (SP1) [See Q315403 for more information]
Windows XP Hotfix (SP1) [See Q317277 for more information]
Windows XP Hotfix (SP1) [See Q318138 for more information]
Windows XP Hotfix (SP1) [See Q318966 for more information]
Windows XP Hotfix (SP1) [See Q319322 for more information]
Windows XP Hotfix (SP1) [See Q319949 for more information]
Windows XP Hotfix (SP1) [See Q320174 for more information]
Windows XP Hotfix (SP1) [See Q320552 for more information]
Windows XP Hotfix (SP1) [See Q320678 for more information]
Windows XP Hotfix (SP1) [See Q323172 for more information]
Windows XP Hotfix (SP1) [See Q324096 for more information]
Windows XP Hotfix (SP1) [See Q324380 for more information]
Windows XP Hotfix (SP1) [See Q326830 for more information]
Windows XP Hotfix (SP1) [See Q328940 for more information]
Windows XP Hotfix (SP1) [See Q329048 for more information]
Windows XP Hotfix (SP1) [See Q329390 for more information]
Windows XP Hotfix (SP1) [See Q329441 for more information]
Windows XP Hotfix (SP1) [See Q329834 for more information]
Windows XP Hotfix (SP1) Q328310
Windows XP Hotfix (SP1) Q329170
Windows XP Hotfix (SP1) Q810577
Windows XP Hotfix (SP1) Q810833
Windows XP Hotfix (SP1) Q811493
Windows XP Hotfix (SP1) Q815021
Windows XP Hotfix (SP1) Q817606
Windows XP Hotfix (SP1) Q819696
Windows XP Hotfix (SP2) [See Q329115 for more information]
WinRAR archiver
WinZip
World of Warcraft
and finallya a jotti scan:
Service load:
0% 100%
File: 7gSQV44l.exe
Status:
INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5: 27c916afa6ee3bdc238da286659e20ba
Packers detected:
-
Scanner results
Scan taken on 16 Aug 2008 03:17:17 (GMT)
A-Squared
Found nothing
AntiVir
Found TR/Crypt.ULPM.Gen
ArcaVir
Found nothing
Avast
Found Win32:Trojan-gen {Other}
AVG Antivirus
Found Clicker.PIM
BitDefender
Found Trojan.Adclicker.HB
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found Trojan.DownLoad.3459
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found PossibleThreat (probable variant)
Ikarus
Found Trojan-Downloader.Win32.Agent.vvi
Kaspersky Anti-Virus
Found nothing
NOD32
Found a variant of Win32/TrojanClicker.Agent.NEB
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Sophos Antivirus
Found Mal/HckPk-A
VirusBuster
Found nothing
VBA32
Found Win32.Trojan-Downloader (probable variant)
Powered by
images/asquared.png images/antivir.png images/arcabit.png images/avast.png images/avg.gif images/bitdefender.png images/clamav-logo1.png images/cpsecure.gif images/drweb.gif images/f-prot.png images/f-secure_logo.gif images/fortinet.gif images/ikarus.gif images/kaspersky.png images/nod32.gif images/norman.png images/panda.gif images/sophos.gif images/virusbuster.gif images/vba32.png
Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.
Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.
Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.
Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.
Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.
Sponsored by HotelScraper.com.
Statistics
Last file scanned at least one scanner reported something about: server.exe (MD5: 2d755f6a36208ca78891e2e17ec04701, size: 607998 bytes), detected by:
Scanner Malware name
A-Squared X
AntiVir TR/Dropper.Gen
ArcaVir X
Avast X
AVG Antivirus BackDoor.Bifrose.DD
BitDefender MemScan:Trojan.Dropper.VB.ASB
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus Trojan-Spy.Agent.NTN
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control SDBot.gen8
Panda Antivirus X
Sophos Antivirus Sus/ComPack
VirusBuster X
VBA32 X
I apologize if I was supposed to wait. I was trying to complete the steps on my own following the forum until I read that we should wait for an administrator or someone who knew what he/she was doing before running combofix and whatnot.
Thanks.
