Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Malware removal


  • Please log in to reply

#1
Orbbie

Orbbie

    New Member

  • Member
  • Pip
  • 9 posts
Hello, miekiemoes assisted me with my last posting and cleaned my PC, however, before I had a chance to purchase Norton antivirus my partner infected my computer again when going on celebrity gossip sites. I have ran Combofix and that log is below along with a HJT log. Any assistance is greatly appreciated (particularly from miekiemoes). Thank you and my apologies to miekiemoes.

ComboFix 08-02.01.6 - Windows User 2008-02-07 23:56:35.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.76 [GMT -4:00]
Running from: C:\Documents and Settings\Windows User\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtqrrq.dll
C:\WINDOWS\system32\ddawu.dll
C:\WINDOWS\system32\wavnsxaa.dll
C:\Documents and Settings\Windows User\My Documents\DOBE~1
C:\WINDOWS\b151.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\awtqrrq.dll
C:\WINDOWS\system32\bnnegjny.ini
C:\WINDOWS\system32\ddawu.dll
C:\WINDOWS\system32\lcflhokd.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qpapushn.dll
C:\WINDOWS\system32\uwadd.ini
C:\WINDOWS\system32\uwadd.ini2
C:\WINDOWS\system32\wavnsxaa.dll
C:\WINDOWS\system32\wavnsxaa.dllbox
C:\WINDOWS\system32\ynjgennb.dll
C:\WINDOWS\system32\ytvykxpb.dll

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-06 05:18 . 2008-02-06 05:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-05 20:57 . 2008-02-05 20:57 <DIR> d-------- C:\Program Files\Drmupgds
2008-02-05 20:53 . 2008-02-05 20:53 <DIR> d-------- C:\Temp\isgTi19
2008-02-01 20:17 . 2008-02-01 20:17 <DIR> d--h----- C:\WINDOWS\PIF
2008-02-01 19:51 . 2008-02-01 19:51 <DIR> d-------- C:\WINDOWS\system32\43444C4449494
2008-02-01 19:51 . 2007-12-14 08:40 120,832 --a------ C:\WINDOWS\system32\1F20282025252.exe
2008-02-01 17:52 . 2008-02-05 21:05 15,086 --a------ C:\WINDOWS\system32\FreePokerBonus.ico
2008-01-28 20:47 . 2008-01-28 20:47 <DIR> d---s---- C:\Documents and Settings\NetworkService\UserData
2008-01-28 20:45 . 2008-02-05 20:53 <DIR> d-------- C:\WINDOWS\system32\up5
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\Temp\gTiis19
2008-01-28 20:45 . 2008-01-28 20:45 <DIR> d-------- C:\Temp\cXzz9
2008-01-24 19:37 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-01-21 22:47 . 2002-08-29 01:05 245,920 --a------ C:\cmldr
2008-01-21 22:47 . 2005-11-24 12:19 194 --a------ C:\Boot.bak
2008-01-16 19:55 . 2008-01-16 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-15 18:35 . 2008-02-06 05:08 <DIR> d-------- C:\Temp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-03 17:35 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-01-31 04:00 --------- d-----w C:\Program Files\PokerStars
2008-01-27 22:24 --------- d-----w C:\Program Files\Full Tilt Poker
2008-01-27 22:24 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-25 00:51 --------- d-----w C:\Program Files\SymNetDrv
2008-01-25 00:51 --------- d-----w C:\Program Files\QuickTime
2008-01-17 12:24 --------- d-----w C:\Program Files\PokerStars.NET
2007-12-10 02:58 --------- d-----w C:\Program Files\DIFX
2007-12-08 19:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kodak
2007-12-08 19:19 --------- d-----w C:\Program Files\Kodak
2007-12-08 19:17 --------- d-----w C:\Program Files\Common Files\Kodak
2007-11-26 03:43 245,408 ----a-w C:\WINDOWS\system32\unicows.dll
2007-08-02 13:43 282,624 ----a-w C:\Program Files\Common Files\hole4444.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18E26C4C-27CF-4319-948C-33A33D8248B1}]
2007-08-02 09:43 282624 --a------ C:\Program Files\Common Files\hole4444.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe" [ ]
"Pzq"="C:\Documents and Settings\Windows User\My Documents\A?pPatch\t?skmgr.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-15 07:26 171448]
"Gfzvyvb"="C:\Program Files\??pPatch\?hkntfs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"F9FA03FAFFFF020"="1F20282025252.exe" [2007-12-14 08:40 120832 C:\WINDOWS\system32\1F20282025252.exe]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-02-18 22:22 180269]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-02-15 07:26 171448]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-06-21 22:56:14 282624]
KODAK Software Updater.lnk - C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe [2004-02-13 14:12:08 16423]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 16:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\nvtztitn]
nvtztitn.dll


.
Contents of the 'Scheduled Tasks' folder
"2008-02-06 02:43:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-19 20:23:40 C:\WINDOWS\Tasks\EasyShare Registration Task.job"
- C:\WINDOWS\System32\rundll32.exelC:\DOCUME~1\ALLUSE~1\APPLIC~1\Kodak\EasyShareSetup\$REGIS~1\Registration_7.4.20.2.sxt [email protected]
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 00:06:53
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\1F20282025252.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
.
**************************************************************************
.
Completion time: 2008-02-08 0:10:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-08 04:09:42
ComboFix2.txt 2008-02-06 09:17:34
ComboFix3.txt 2008-02-02 00:37:17
ComboFix4.txt 2008-01-29 02:27:07



Logfile of HijackThis v1.99.1
Scan saved at 12:11:01 AM, on 2/8/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\1F20282025252.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\crusty.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {18E26C4C-27CF-4319-948C-33A33D8248B1} - C:\Program Files\Common Files\hole4444.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [F9FA03FAFFFF020] 1F20282025252.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster .exe /S
O4 - HKCU\..\Run: [Pzq] "C:\Documents and Settings\Windows User\My Documents\A?pPatch\t?skmgr.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Gfzvyvb] "C:\Program Files\??pPatch\?hkntfs.exe"
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: KODAK Software Updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebo...toUploader3.cab
O20 - Winlogon Notify: nvtztitn - nvtztitn.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP