What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] "trojan"

11 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
estelle,

What is this?

That is in your system restore file. We will be cleaning it out as a final step

COMBOFIX-Script

  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    KILLALL::

File::
C:\Documents and Settings\Virginia Northington\Desktop\divx.exe
  • Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

    [external image: Posted Image]
  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Post #19
ComboFix 08-10-30.09 - Virginia Northington 2008-10-30 20:35:01.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.421 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\My Documents\ComboFix.exe
Command switches used :: C:\Documents and Settings\Virginia Northington\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-09-28 to 2008-10-31 )))))))))))))))))))))))))))))))
.

2008-10-30 15:54 . 2008-10-30 15:54 d——– C:\WINDOWS\Sun
2008-10-30 15:51 . 2008-10-30 15:51 d——– C:\Program Files\Sun
2008-10-30 15:51 . 2008-10-30 15:51 410,976 –a—— C:\WINDOWS\system32\deploytk.dll
2008-10-30 15:51 . 2008-10-30 15:51 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-10-30 15:50 . 2008-10-30 15:50 d——– C:\Program Files\Java
2008-10-30 12:52 . 2008-10-30 14:27 d——– C:\WINDOWS\system32\CatRoot_bak
2008-10-30 11:52 . 2008-10-30 11:52 d——– C:\WINDOWS\LastGood
2008-10-29 18:57 . 2008-10-29 18:57 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-29 18:57 . 2008-10-29 18:57 d——– C:\Documents and Settings\Virginia Northington\Application Data\Malwarebytes
2008-10-29 18:57 . 2008-10-29 18:57 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-29 18:57 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-29 18:57 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-27 20:43 . 2008-10-27 20:43 d——– C:\Program Files\Trend Micro
2008-10-20 11:13 . 2008-10-22 15:12 d——– C:\Program Files\AOL 9.1

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-27 15:09 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-10-26 19:53 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-20 18:24 ——— d—–w C:\Documents and Settings\Virginia Northington\Application Data\AOL
2008-10-20 18:23 ——— d—–w C:\Program Files\Common Files\AOL
2008-10-20 18:23 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL
2008-10-20 18:20 ——— d—–w C:\Program Files\Common Files\aolshare
2008-10-20 18:14 210,439 —-a-w C:\WINDOWS\Aolunins_us.exe
2008-10-20 16:16 ——— d—–w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2008-10-17 19:37 ——— d—–w C:\Program Files\McAfee
2008-10-17 16:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\McAfee
2008-10-17 04:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2003-12-30 05:24 0 —h–w C:\Documents and Settings\LocalService\hpothb07.dat
2003-11-24 03:12 0 —h–w C:\Documents and Settings\NetworkService\hpothb07.dat
.

((((((((((((((((((((((((((((( snapshot@2008-10-29_20.43.28.00 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-30 21:46:35 22,426 —-a-w C:\WINDOWS\SoftwareDistribution\EventCache\{E66CE157-622E-4763-9766-DED73D6B43E2}.bin
- 2008-10-30 00:39:04 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-10-30 23:24:02 32,768 —-a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-10-30 00:39:04 32,768 ——w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-10-30 23:24:02 32,768 ——w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-10-30 22:51:01 144,792 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-10-30 22:51:01 144,792 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-10-30 22:51:01 148,888 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2008-10-30 22:51:20 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_564.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DesignerSECommuni.exe"="C:\3DEmbroidery\DesignerSECommuni.exe" [2004-12-14 69632]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"AOL Fast Start"="C:\Program Files\AOL 9.1\AOL.EXE" [2008-06-02 50528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 7700480]
"SiSUSBRG"="C:\WINDOWS\SiSUSBrg.exe" [2002-07-12 106496]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2002-11-02 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-01-05 98304]
"Pure Networks Port Magic"="C:\PROGRA~1\PURENE~1\PORTMA~1\PortAOL.exe" [2004-05-07 99480]
"PE2CKFNT SE"="C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\ChkFont.exe" [1998-07-03 25088]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 86016]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-05-06 188416]
"HostManager"="C:\Program Files\Common Files\AOL\1138043337\ee\AOLSoftware.exe" [2007-10-08 41824]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-10-01 5367608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-10-30 136600]
"SoundMan"="SOUNDMAN.EXE" [2002-09-10 C:\WINDOWS\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2006-10-22 C:\WINDOWS\system32\nwiz.exe]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
HotSync Manager.lnk - C:\Program Files\Sony Handheld\HOTSYNC.EXE [2002-08-09 299008]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2002-11-01 98304]
Photo Express Calendar Checker SE.lnk - C:\Program Files\Ulead Systems\Ulead Photo Express 2 SE\CalCheck.exe [2002-11-02 55296]
Quicken Scheduled Updates.lnk - C:\QUICKENW\bagent.exe [2003-10-02 57344]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-04-28 415072]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\America Online 9.0a\\waol.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\AOL 9.1\\waol.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"1393:UDP"= 1393:UDP:Windows Media Format SDK (iexplore.exe)
"1392:UDP"= 1392:UDP:Windows Media Format SDK (iexplore.exe)

R1 SSHDRV64;SSHDRV64;C:\WINDOWS\System32\drivers\SSHDRV64.sys [2004-03-13 109568]
R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-30 152984]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;C:\Program Files\McAfee\SiteAdvisor\McSACore.exe [2008-09-08 198944]
R2 SemLPT;SemLPT;C:\WINDOWS\system32\drivers\SemLPT.sys [1997-11-26 41984]
R3 EPPSCSIx;EPPSCSI Driver;C:\WINDOWS\system32\DRIVERS\EPPSCAN.sys [2002-03-06 105124]
S3 PinnacleMovieBox;Pinnacle Systems MovieBox USB Device;C:\WINDOWS\system32\DRIVERS\PcleMBox.sys [2003-04-03 995456]
S3 SetupNTGLM7X;SetupNTGLM7X;D:\NTGLM7X.sys [ ]

*Newly Created Service* - ATWPKT2
*Newly Created Service* - JAVAQUICKSTARTERSERVICE
.
Contents of the 'Scheduled Tasks' folder

2008-10-20 C:\WINDOWS\Tasks\Automatic Full Backup.job
- C:\Program Files\Stomp\Backup MyPC\System\bestart.exe [2003-10-30 05:10]

2007-03-27 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

2008-01-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]

2008-10-27 C:\WINDOWS\Tasks\wrSpySweeper_24265D721A6D44C1A7C213487765B889.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-01 17:40]

2008-10-27 C:\WINDOWS\Tasks\wrSpySweeper_24265D721A6D44C1A7C213487765B889.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-01 17:40]

2008-10-27 C:\WINDOWS\Tasks\wrSpySweeper_24265D721A6D44C1A7C213487765B889.job
- A:\","C:\","D:\","E:\" []
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-30 20:38:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\McAfee\SiteAdvisor\saHook.dll
.
Completion time: 2008-10-30 20:41:59
ComboFix-quarantined-files.txt 2008-10-31 03:41:45
ComboFix2.txt 2008-10-30 03:48:43

Pre-Run: 44,293,517,312 bytes free
Post-Run: 44,338,774,016 bytes free

151 — E O F — 2008-04-14 14:30:58
Post #20
estelle,

My Documents\sspsetup1_.exe is a legitimate file. It is your spysweeper. It is a false positive from your McAfee.

Log looks good :D


Time for some housekeeping
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK
  • Note the space between the X and the U, it needs to be there.
  • [external image: Posted Image]
The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.

Please re-enable any security that was disabled.

Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls

Keep Microsoft Windows Updated - This will ensure your computer has always the latest security updates available installed on your computer. The easiest way to do this is to turn on Automatic Updates. Do this by:
  • From your desktop, right-click on My Computer,
  • click on Properties
  • Select the Automatic Updates tab
  • Click on Automatic
  • Click on Apply button
  • Click on OK to exit.
If there are new updates to install, install them immediately, until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer
settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware

Download and install the free version of WinPatrol - This program protects your computer in a variety of ways and will work well with your existing security software.
Winpatrol


Update all these programs regularly - Make sure you update all the programs I have listed regularly.
Without regular updates you WILL NOT be protected when new malicious programs are released.


Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
by miekiemoes

Please respond back that you understand the above and let me know if you have any questions. Otherwise, this thread will be closed Resolved. :thumbup:
Post #21
Tomk–First of all THANK YOU for all your help and putting up with my lack of knowledge about computers! I do have a couple of questions 1. In McAfee I moved the firewall from "automatic" to "stealth – is this a better setting? I also set "apply Smart Recommendations". There is also an area "Security Settings" a. Enable protection during Windows startup b. Allow ICMP ping requests c. Enable UDP tracking Do I check any of these? I have no idea what the last 2 items are. 2.At the end you say run only one Anti-Virus and Firewall program however you mentioned a couple of other programs to install. Is SpywareBlaster to be used instead of Spysweeper or in addition to it? Is the McAfee Firewall ok? Does it conflict with Windows Firewall? 3. On my laptop I am using TrendMicro instead of McAfee –should I also install SpywareBlaster and Winpatrol on it,too? Thanks Again
Post #22
Oops, one more question When McAfee notifys me that there is a change to something – is there a "rule" to follow as to whether to allow or block the change?
Post #23
estelle, My rule is, if you don't recognize it, don't allow it. Obviously is you are installing something, something will try to install and you will need to allow it. I'm no expert but I believe that stealth is better than automatic but both are reasonable settings. I would apply the smart recommendations and leave it at that. Only one firewall. McAffee is better than windows. Don't run windows firewall. Just McAffee. Those other programs are all different and should not cause conflicts. Those programs would be good for your laptop. Any other questions?
Post #26
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI