Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

W32.TROJAN.AGENT removal PLEASE HELP asap ! [RESOLVED]

Started by btdcrazyj , May 24 2008 09:22 PM

  • This topic is locked This topic is locked

#16
RatHat
Posted 25 May 2008 - 05:33 AM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts
After you have installed the AV, allow it to update the latest definitions, then run a full system scan, let me know if it finds anything.
  • 0

Advertisements

#17
btdcrazyj
Posted 25 May 2008 - 05:34 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Ahhh thanks, mate.
Actually it's gone. It was just negligable objects.
Thanks alot, RatHat. Appreciate it =)
I'm installing the AV now. Thanks once again, mate. You've been a real help.

Jason.
  • 0

#18
RatHat
Posted 25 May 2008 - 05:37 AM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts
Well let me know how the AV scan goes, then if all is OK, I'll give you some pointers for additional protection.

Regards,
RatHat
  • 0

#19
btdcrazyj
Posted 25 May 2008 - 08:24 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Yep, it's gone on the laptop.
But after a scan on MY computer.
I've got the same problem.
I'm guessing all I have to do is put the file path that is infected into MoveIt, detected from Kaspersky - like I did on the laptop. I'll just try that myself now.
  • 0

#20
RatHat
Posted 25 May 2008 - 08:54 AM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts
It would be better if you could post me the Kaspersky log and a HijackThis log from the other computer so I can check it and make sure you don't delete something legitimate by mistake.

Regards,
RatHat
  • 0

#21
btdcrazyj
Posted 25 May 2008 - 09:02 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Okay, no worries.
Here's the HijackThis log.
I'll post the Kaspersky one later in a seperate comment as it's still scanning. Over 1 hr now !

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:04:16 AM, on 26/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\TCAUDIAG.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\D-Link\AirPremier AG Utility\AirPMCFG.exe
C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.news.com.au/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -on
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinFoxV2] C:\WINDOWS\System32\WF2K.EXE
O4 - HKLM\..\Run: [WinFast2KLoadDefault] rundll32.exe wf2kcpl.dll,DllLoadDefaultSettings
O4 - HKLM\..\Run: [D-Link AirPremier AG Utility] C:\Program Files\D-Link\AirPremier AG Utility\AirPMCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft] aim.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [NSLauncher] C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe /startup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [css] C:\Program Files\Comodo\Css\cssurf.exe /s
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunServices: [Microsoft] aim.exe
O4 - HKLM\..\RunOnce: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfpconfg.exe" -z -o
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zon...kr.cab56986.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zon...wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zon...1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zon...nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{67FB17FF-CD25-4574-9223-9880C95125A6}: NameServer = 192.168.1.1,192.168.1.2
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll C:\PROGRA~1\Comodo\Css\cssdll32.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 9438 bytes
  • 0

#22
btdcrazyj
Posted 25 May 2008 - 09:36 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
KASPERSKY ONLINE SCANNER REPORT
Monday, May 26, 2008 1:39:29 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 25/05/2008
Kaspersky Anti-Virus database records: 800188


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target Folders
C:\

Scan Statistics
Total number of scanned objects 89564
Number of viruses found 3
Number of infected objects 4
Number of suspicious objects 0
Duration of the scan process 01:26:30

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\comodo\Firewall Pro\cfplogdb.sdb Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Lavasoft\MiniMessage\2 Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\fou\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\pending.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_167C_D569_7CD5_4461\dfsr.db Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_167C_D569_7CD5_4461\fsr.log Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_167C_D569_7CD5_4461\fsrtmp.log Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Messenger\[email protected]\SharingMetadata\Working\database_167C_D569_7CD5_4461\tmp.edb Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\real\members.stg Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Application Data\Microsoft\Windows Live Contacts\[email protected]\shadow\members.stg Object is locked skipped

C:\Documents and Settings\fou\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\History\History.IE5\MSHist012008052620080527\index.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temp\~DF6F32.tmp Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temp\~DFC48B.tmp Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temp\~DFC544.tmp Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temp\~DFF8DB.tmp Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temp\~DFF8ED.tmp Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\fou\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\fou\My Documents\My Chat Logs\May 2008\[email protected] Object is locked skipped

C:\Documents and Settings\fou\My Documents\My Chat Logs\May 2008\[email protected] Object is locked skipped

C:\Documents and Settings\fou\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\fou\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\hpcmerr.log Object is locked skipped

C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL Infected: not-a-virus:AdWare.Win32.MySearch.i skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\chandir.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\chandir.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\chn.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\chn.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\D0000000.FCS Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\inuse.txt Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\L0000002.FCS Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\main.log Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_die.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_die.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_dnd.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_dnd.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_ext.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_ext.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_rcv.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\prs_rcv.idx Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\storydb.dat Object is locked skipped

C:\Program Files\Logitech\Desktop Messenger\8876480\Users\fou\Data\storydb.idx Object is locked skipped

C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{F889474A-5792-4940-A9F9-AEC99F54CFF9}\RP391\A0137532.inf Infected: Trojan.Win32.Agent.abt skipped

C:\System Volume Information\_restore{F889474A-5792-4940-A9F9-AEC99F54CFF9}\RP393\change.log Object is locked skipped

C:\WINDOWS\CSC\00000001 Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{368B0621-3CE8-4555-8B6C-10855E448FC1}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\EventCache\{816CAFE6-9FB6-48CF-B56E-51199131ED6B}.bin Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\Antiviru.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped

C:\WINDOWS\system32\config\OSession.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_5a0.dat Object is locked skipped

C:\WINDOWS\Temp\Perflib_Perfdata_6ec.dat Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

C:\_OTMoveIt\MovedFiles\05252008_231317\AutoRun.inf Infected: Trojan.Win32.Agent.abt skipped

Scan process completed.
  • 0

#23
btdcrazyj
Posted 25 May 2008 - 09:38 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Ummm. What the...?
I can't even double click my C drive.
It comes up with the "open with" pop up!!
HELP ?
I can click on the address bar and select C drive from there.
But if i double click it will come up with the open with pop up box to choose from a list of programs.
But it will have strange letters where "Open" and "Open With" would be on the right click pop up menu.

Edited by btdcrazyj, 25 May 2008 - 09:41 AM.

  • 0

#24
RatHat
Posted 25 May 2008 - 05:37 PM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts
Please read this Combofix tutorial before continuing, then follow the instructions below.

Please ensure you read this guide carefully and install the Recovery Console first.

Next, download ComboFix from Here or Here to your Desktop.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.

Posted Image

Download the file & save it as it's originally named, next to ComboFix.exe.

Posted Image

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click Yes to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you. Save this log to your desktop as Combofix.txt and post it in your next reply.

(Note: Combofix will also save the report to C:\Combofix.txt)

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Download Flash_Disinfector.exe by sUBs from here and save it to your desktop.
  • Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.
  • The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well.
  • Wait until it has finished scanning and then exit the program.
  • Reboot your computer when done.
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.[/list]
Regards,
RatHat
  • 0

#25
btdcrazyj
Posted 25 May 2008 - 11:36 PM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Thanks RatHat, but what do those steps fix?
My C Drives can be read now, I turned off my computer last night and got back to school and it's fine.
But I still have the w32.trojan.agent
How do I get rid of this?
  • 0

Advertisements

#26
RatHat
Posted 26 May 2008 - 05:52 AM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts

How do I get rid of this?

That's what I'm trying to do, but I need you to follow the steps above, install the recovery console, and run Combofix so that we can see what is hiding away in your system, as you have additional bad files showing.
  • 0

#27
btdcrazyj
Posted 26 May 2008 - 06:11 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Oh, okay. Sorry, I thought that was for the C drive menu problem.
Anyway, here's my ComboFix Log.

ComboFix 08-05-25.4 - fou 2008-05-26 22:01:38.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.560 [GMT -7:00]
Running from: C:\Documents and Settings\fou\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fou\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\svchost.ini
C:\WINDOWS\system32\mdm.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF


((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.

2008-05-26 01:04 . 2008-05-26 01:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-25 23:21 . 2008-05-25 23:21 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-25 23:21 . 2008-05-25 23:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-25 23:19 . 2008-05-25 23:19 410,976 --a------ C:\WINDOWS\system32\deploytk.dll
2008-05-25 23:19 . 2008-05-25 23:19 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-25 23:13 . 2008-05-25 23:13 <DIR> d-------- C:\_OTMoveIt
2008-05-25 22:14 . 2008-05-25 22:14 <DIR> d-------- C:\Program Files\AskSBar
2008-05-25 22:13 . 2008-05-26 22:06 <DIR> d-------- C:\Program Files\COMODO
2008-05-25 22:13 . 2008-05-26 22:06 <DIR> d-------- C:\Documents and Settings\fou\Application Data\Comodo
2008-05-25 21:58 . 2008-05-25 21:58 <DIR> d-------- C:\Program Files\Alwil Software
2008-05-25 21:57 . 2008-05-25 21:57 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-25 21:57 . 2008-05-25 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-18 22:30 . 2001-08-17 14:55 382,592 --a--c--- C:\WINDOWS\system32\dllcache\atidrab.dll
2008-05-18 22:30 . 2001-08-17 12:48 289,664 --a--c--- C:\WINDOWS\system32\dllcache\atimpab.sys
2008-05-18 22:30 . 2001-08-17 14:56 268,160 --a--c--- C:\WINDOWS\system32\dllcache\atidvai.dll
2008-05-18 22:30 . 2001-08-17 14:56 137,216 --a--c--- C:\WINDOWS\system32\dllcache\atidrae.dll
2008-05-18 22:30 . 2001-08-17 14:55 96,128 --a--c--- C:\WINDOWS\system32\dllcache\ati.dll
2008-05-18 22:30 . 2001-08-17 13:57 77,568 --a--c--- C:\WINDOWS\system32\dllcache\ati.sys
2008-05-18 22:30 . 2001-08-17 12:49 46,464 --a--c--- C:\WINDOWS\system32\dllcache\atibt829.sys
2008-05-18 22:30 . 2001-08-17 22:36 37,376 --a--c--- C:\WINDOWS\system32\dllcache\atievxx.exe
2008-05-18 22:27 . 2001-08-17 13:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-05-18 22:26 . 2004-08-03 23:20 2,180,992 --a--c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-05-18 22:26 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-09 16:02 . 2008-05-09 16:02 <DIR> d-------- C:\Program Files\Common Files\LogiShared
2008-05-09 16:02 . 2008-05-09 16:02 <DIR> d-------- C:\Documents and Settings\fou\Application Data\Logitech
2008-05-09 16:01 . 2008-05-09 16:01 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-05-09 16:00 . 2008-05-09 16:00 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-09 16:00 . 2008-05-09 16:00 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-05-09 15:59 . 2007-04-11 15:33 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
2008-05-09 15:59 . 2007-04-11 15:32 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe
2008-05-09 15:59 . 2007-04-11 15:32 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
2008-05-09 15:59 . 2007-04-11 15:32 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
2008-05-09 15:58 . 2008-05-09 15:58 <DIR> d-------- C:\Documents and Settings\fou\Application Data\InstallShield
2008-05-09 15:58 . 2008-05-09 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-09 15:58 . 2007-04-23 04:00 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2008-05-09 15:58 . 2007-04-23 04:00 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2008-05-09 15:58 . 2007-04-23 04:00 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2008-05-09 15:58 . 2007-04-23 04:00 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2008-05-09 15:57 . 2008-05-09 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 04:11 --------- d-----w C:\Program Files\Warcraft III
2008-05-27 02:09 --------- d-----w C:\Program Files\Steam
2008-05-26 06:18 --------- d-----w C:\Program Files\Java
2008-05-26 04:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-26 03:27 25,585 ----a-w C:\aem8.dat
2008-05-18 20:58 --------- d-----w C:\Documents and Settings\fou\Application Data\mIRC
2008-05-18 20:13 --------- d-----w C:\Program Files\mIRC
2008-05-14 15:34 --------- d-----w C:\Documents and Settings\fou\Application Data\uTorrent
2008-05-09 23:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 23:01 --------- d-----w C:\Program Files\Logitech
2008-05-09 22:58 --------- d-----w C:\Program Files\Common Files\Logitech
2008-05-03 05:28 --------- d-----w C:\Documents and Settings\fou\Application Data\dvdcss
2008-04-27 01:06 --------- d-----w C:\Program Files\Google
2008-04-25 02:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-25 00:36 --------- d-----w C:\Documents and Settings\fou\Application Data\LimeWire
2008-04-03 04:14 --------- d-----w C:\Program Files\Image-Line
2008-04-03 04:08 --------- d-----w C:\Program Files\iPod
2008-04-03 04:06 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-28 02:20 --------- d-----w C:\Program Files\AltoMP3 Gold
2007-06-29 02:32 109,528 ----a-w C:\Documents and Settings\fou\Application Data\GDIPFONTCACHEV1.DAT
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-05-25 23:19 34816 --a------ C:\Program Files\Java\jre6\bin\jp2ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-05-25 23:19 73728 --a------ C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= "C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL" [2008-05-25 22:14 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"= C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL [2008-05-25 22:14 262144]

[HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"TCASUTIEXE"="TCAUDIAG.exe" [2003-02-12 02:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 03:15 631362]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 02:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"WinFoxV2"="C:\WINDOWS\System32\WF2K.EXE" [ ]
"WinFast2KLoadDefault"="wf2kcpl.dll" []
"D-Link AirPremier AG Utility"="C:\Program Files\D-Link\AirPremier AG Utility\AirPMCFG.exe" [2005-11-04 10:46 1724416]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12 2658304]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"css"="C:\Program Files\Comodo\Css\cssurf.exe" [2008-05-22 16:16 188160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-05-25 23:19 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 00:56 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\fou\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-05-09 16:01:54 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-05-09 15:58:43 692224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\PROGRA~1\Comodo\Css\cssdll32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\__STUFF__\\_DOWNLOADS\\utorrent.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"C:\\Program Files\\Warcraft III\\war3.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Steam\\steamapps\\jason_so\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\ftx951\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:warcraft
"6113:TCP"= 6113:TCP:warcraft
"6114:TCP"= 6114:TCP:warcraft
"6115:TCP"= 6115:TCP:warcraft
"6116:TCP"= 6116:TCP:warcraft
"6117:TCP"= 6117:TCP:warcraft
"6118:TCP"= 6118:TCP:warcraft
"6119:TCP"= 6119:TCP:warcraft

R2 JavaQuickStarterService;Java Quick Starter;"C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" []
R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-06 11:08]
R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\system32\DRIVERS\TCAITDI.sys [2001-09-04 04:22]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-08-25 15:00]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys [2002-11-08 02:50]
S2 nvTUNEP;nVidia WDM TVTuner;C:\WINDOWS\system32\DRIVERS\nvtunep.sys [2003-04-09 16:47]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [2003-04-09 16:47]
S3 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2003-09-16 17:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0728601e-d157-11dc-babf-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e790ff3-6710-11dc-b9d5-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d37dde0-58e7-11db-b789-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{919bfd61-fc61-11dc-bb20-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-09 07:42:07 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 2300 series#1160375904.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 2300 series#1160375904
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 22:10:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\hpzipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.exe
.
**************************************************************************
.
Completion time: 2008-05-26 22:13:19 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-27 05:13:16

Pre-Run: 36,190,945,280 bytes free
Post-Run: 36,084,158,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

234
  • 0

#28
btdcrazyj
Posted 26 May 2008 - 06:26 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Um on the computer, kaspersky found these files.
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL Infected: not-a-virus:AdWare.Win32.MySearch.i skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 skipped
but i deleted mirc just now,
:\System Volume Information\_restore{F889474A-5792-4940-A9F9-AEC99F54CFF9}\RP391\A0137532.inf Infected: Trojan.Win32.Agent.abt skipped
C:\_OTMoveIt\MovedFiles\05252008_231317\AutoRun.inf Infected: Trojan.Win32.Agent.abt skipped

Can i use the same process as i did on the laptop using MoveIt but using these file paths?
Would that work or rather have no effect?

Edited by btdcrazyj, 26 May 2008 - 06:26 AM.

  • 0

#29
RatHat
Posted 26 May 2008 - 06:32 AM

RatHat

    Ex Malware Expert

  • Expert
  • 7,829 posts
Good, now you have the recovery console installed which will help should you ever get infected in the future.

Did you run the Flash_Disinfector? That will help you from transferring any infections between computers you have at home, or that you connect your flash drives into.

Now lets run a Combofix script to clean up here (this was part of the reason I wanted you to run Combofix, it allows me more options for cleaning your machine).

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Folder::
C:\Program Files\AskSBar

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"=-

[-HKEY_CLASSES_ROOT\clsid\{f0d4b239-da4b-4daf-81e4-dfee4931a4aa}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F0D4B239-DA4B-4DAF-81E4-DFEE4931A4AA}"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinFoxV2"=-
"WinFast2KLoadDefault"=-


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the new Combofix log, and let me know if you are still having problems with this machine.

Regards,
RatHat
  • 0

#30
btdcrazyj
Posted 26 May 2008 - 06:44 AM

btdcrazyj

    Member

  • Topic Starter
  • Member
  • PipPip
  • 47 posts
Thanks. Here is the latest log.

ComboFix 08-05-25.4 - fou 2008-05-26 22:44:11.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.550 [GMT -7:00]
Running from: C:\Documents and Settings\fou\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\fou\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AskSBar
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2FFXTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2HIGHIN.EXE
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.JAR
C:\Program Files\AskSBar\bar\1.bin\A2NTSTBR.MANIFEST
C:\Program Files\AskSBar\bar\1.bin\A2PLUGIN.DLL
C:\Program Files\AskSBar\bar\1.bin\ASKSBAR.DLL
C:\Program Files\AskSBar\bar\1.bin\NPASKSBR.DLL
C:\Program Files\AskSBar\bar\Cache\01A77AA5
C:\Program Files\AskSBar\bar\Cache\01A78294
C:\Program Files\AskSBar\bar\Cache\01A7865D.bin
C:\Program Files\AskSBar\bar\Cache\01A78AE1.bin
C:\Program Files\AskSBar\bar\Cache\01A78E8A.bin
C:\Program Files\AskSBar\bar\Cache\01A79205.bin
C:\Program Files\AskSBar\bar\Cache\01A79531.bin
C:\Program Files\AskSBar\bar\Cache\01A798AC.bin
C:\Program Files\AskSBar\bar\Cache\01A79CE2.bin
C:\Program Files\AskSBar\bar\Cache\01A7A0CA.bin
C:\Program Files\AskSBar\bar\Cache\files.ini
C:\Program Files\AskSBar\bar\History\search2
C:\Program Files\AskSBar\bar\Settings\prevcfg2.htm

.
((((((((((((((((((((((((( Files Created from 2008-04-27 to 2008-05-27 )))))))))))))))))))))))))))))))
.

2008-05-26 01:04 . 2008-05-26 01:04 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-25 23:21 . 2008-05-25 23:21 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-25 23:21 . 2008-05-25 23:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-25 23:19 . 2008-05-25 23:19 410,976 --a------ C:\WINDOWS\system32\deploytk.dll
2008-05-25 23:19 . 2008-05-25 23:19 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-05-25 23:13 . 2008-05-25 23:13 <DIR> d-------- C:\_OTMoveIt
2008-05-25 22:13 . 2008-05-26 22:06 <DIR> d-------- C:\Program Files\COMODO
2008-05-25 22:13 . 2008-05-26 22:06 <DIR> d-------- C:\Documents and Settings\fou\Application Data\Comodo
2008-05-25 21:58 . 2008-05-25 21:58 <DIR> d-------- C:\Program Files\Alwil Software
2008-05-25 21:57 . 2008-05-25 21:57 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-25 21:57 . 2008-05-25 22:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-18 22:30 . 2001-08-17 14:55 382,592 --a--c--- C:\WINDOWS\system32\dllcache\atidrab.dll
2008-05-18 22:30 . 2001-08-17 12:48 289,664 --a--c--- C:\WINDOWS\system32\dllcache\atimpab.sys
2008-05-18 22:30 . 2001-08-17 14:56 268,160 --a--c--- C:\WINDOWS\system32\dllcache\atidvai.dll
2008-05-18 22:30 . 2001-08-17 14:56 137,216 --a--c--- C:\WINDOWS\system32\dllcache\atidrae.dll
2008-05-18 22:30 . 2001-08-17 14:55 96,128 --a--c--- C:\WINDOWS\system32\dllcache\ati.dll
2008-05-18 22:30 . 2001-08-17 13:57 77,568 --a--c--- C:\WINDOWS\system32\dllcache\ati.sys
2008-05-18 22:30 . 2001-08-17 12:49 46,464 --a--c--- C:\WINDOWS\system32\dllcache\atibt829.sys
2008-05-18 22:30 . 2001-08-17 22:36 37,376 --a--c--- C:\WINDOWS\system32\dllcache\atievxx.exe
2008-05-18 22:27 . 2001-08-17 13:28 762,780 --a--c--- C:\WINDOWS\system32\dllcache\3cwmcru.sys
2008-05-18 22:26 . 2004-08-03 23:20 2,180,992 --a--c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-05-18 22:26 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-09 16:02 . 2008-05-09 16:02 <DIR> d-------- C:\Program Files\Common Files\LogiShared
2008-05-09 16:02 . 2008-05-09 16:02 <DIR> d-------- C:\Documents and Settings\fou\Application Data\Logitech
2008-05-09 16:01 . 2008-05-09 16:01 127,034 -r------- C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2008-05-09 16:00 . 2008-05-09 16:00 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-05-09 16:00 . 2008-05-09 16:00 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-05-09 15:59 . 2007-04-11 15:33 1,419,024 --a------ C:\WINDOWS\system32\WdfCoInstaller01005.dll
2008-05-09 15:59 . 2007-04-11 15:32 56,080 --a------ C:\WINDOWS\KHALMNPR.Exe
2008-05-09 15:59 . 2007-04-11 15:32 36,112 --a------ C:\WINDOWS\system32\drivers\LMouFilt.Sys
2008-05-09 15:59 . 2007-04-11 15:32 34,832 --a------ C:\WINDOWS\system32\drivers\LHidFilt.Sys
2008-05-09 15:58 . 2008-05-09 15:58 <DIR> d-------- C:\Documents and Settings\fou\Application Data\InstallShield
2008-05-09 15:58 . 2008-05-09 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Logitech
2008-05-09 15:58 . 2007-04-23 04:00 163,840 --a------ C:\WINDOWS\system32\kemutb.dll
2008-05-09 15:58 . 2007-04-23 04:00 135,168 --a------ C:\WINDOWS\system32\KemUtil.dll
2008-05-09 15:58 . 2007-04-23 04:00 110,592 --a------ C:\WINDOWS\system32\KemWnd.dll
2008-05-09 15:58 . 2007-04-23 04:00 69,632 --a------ C:\WINDOWS\system32\KemXML.dll
2008-05-09 15:57 . 2008-05-09 15:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-04-29 11:20 . 2008-04-29 11:20 15,648 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 11:19 . 2008-04-29 11:19 15,648 --a------ C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 11:19 . 2008-04-29 11:19 12,960 --a------ C:\WINDOWS\system32\drivers\Awrtpd.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-27 05:23 --------- d-----w C:\Program Files\Steam
2008-05-27 04:11 --------- d-----w C:\Program Files\Warcraft III
2008-05-26 06:18 --------- d-----w C:\Program Files\Java
2008-05-26 04:55 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-26 03:27 25,585 ----a-w C:\aem8.dat
2008-05-18 20:58 --------- d-----w C:\Documents and Settings\fou\Application Data\mIRC
2008-05-14 15:34 --------- d-----w C:\Documents and Settings\fou\Application Data\uTorrent
2008-05-09 23:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-09 23:01 --------- d-----w C:\Program Files\Logitech
2008-05-09 22:58 --------- d-----w C:\Program Files\Common Files\Logitech
2008-05-03 05:28 --------- d-----w C:\Documents and Settings\fou\Application Data\dvdcss
2008-04-27 01:06 --------- d-----w C:\Program Files\Google
2008-04-25 02:45 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-25 00:36 --------- d-----w C:\Documents and Settings\fou\Application Data\LimeWire
2008-04-03 04:14 --------- d-----w C:\Program Files\Image-Line
2008-04-03 04:08 --------- d-----w C:\Program Files\iPod
2008-04-03 04:06 102,664 ----a-w C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-28 02:20 --------- d-----w C:\Program Files\AltoMP3 Gold
2007-06-29 02:32 109,528 ----a-w C:\Documents and Settings\fou\Application Data\GDIPFONTCACHEV1.DAT
2003-04-17 08:16 447,616 ----a-w C:\WINDOWS\inf\EL2K_N64.sys
2003-04-17 08:15 147,328 ----a-w C:\WINDOWS\inf\EL2K_XP.sys
2003-04-17 08:15 147,200 ----a-w C:\WINDOWS\inf\EL2K_2K.sys
2006-05-06 16:42 7,260,160 ----a-w C:\Program Files\mozilla firefox\plugins\libvlc.dll
.

((((((((((((((((((((((((((((( snapshot@2008-05-26_22.13.03.79 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-05-27 05:23:09 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_630.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
2008-05-25 23:19 34816 --a------ C:\Program Files\Java\jre6\bin\jp2ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
2008-05-25 23:19 73728 --a------ C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54 5674352]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2003-04-04 13:38 774144]
"TCASUTIEXE"="TCAUDIAG.exe" [2003-02-12 02:55 1334784 C:\WINDOWS\system32\TCAUDIAG.EXE]
"zBrowser Launcher"="C:\Program Files\Logitech\iTouch\iTouch.exe" [2002-11-23 03:15 631362]
"Logitech Utility"="Logi_MwX.Exe" [2002-11-08 02:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"D-Link AirPremier AG Utility"="C:\Program Files\D-Link\AirPremier AG Utility\AirPMCFG.exe" [2005-11-04 10:46 1724416]
"ANIWZCS2Service"="C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2005-10-19 18:19 49152]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-06-26 18:50 212992]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 11:54 282624]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47 31016]
"NSLauncher"="C:\Program Files\Nokia\Nokia Software Launcher\NSLauncher.exe" [2006-11-28 01:12 2658304]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-04-11 15:32 56080 C:\WINDOWS\KHALMNPR.Exe]
"css"="C:\Program Files\Comodo\Css\cssurf.exe" [2008-05-22 16:16 188160]
"SunJavaUpdateSched"="C:\Program Files\Java\jre6\bin\jusched.exe" [2008-05-25 23:19 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 00:56 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\fou\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-05-09 16:01:54 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-05-09 15:58:43 692224]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\PROGRA~1\Comodo\Css\cssdll32.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\__STUFF__\\_DOWNLOADS\\utorrent.exe"=
"C:\\Program Files\\utorrent\\utorrent.exe"=
"C:\\WINDOWS\\system32\\mshta.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Warcraft III\\Frozen Throne.exe"=
"C:\\Program Files\\Warcraft III\\war3.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"C:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"C:\\Program Files\\Steam\\steamapps\\jason_so\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Steam\\steamapps\\ftx951\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:TCP"= 6112:TCP:warcraft
"6113:TCP"= 6113:TCP:warcraft
"6114:TCP"= 6114:TCP:warcraft
"6115:TCP"= 6115:TCP:warcraft
"6116:TCP"= 6116:TCP:warcraft
"6117:TCP"= 6117:TCP:warcraft
"6118:TCP"= 6118:TCP:warcraft
"6119:TCP"= 6119:TCP:warcraft

R2 JavaQuickStarterService;Java Quick Starter;"C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf" []
R2 tcaicchg;tcaicchg;C:\WINDOWS\System32\tcaicchg.sys [2000-06-06 11:08]
R2 TCAITDI;TCAITDI Protocol;C:\WINDOWS\system32\DRIVERS\TCAITDI.sys [2001-09-04 04:22]
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-08-25 15:00]
R3 LCcfltr;Logitech USB Filter Driver;C:\WINDOWS\system32\Drivers\LCcFltr.Sys [2002-11-08 02:50]
S2 nvTUNEP;nVidia WDM TVTuner;C:\WINDOWS\system32\DRIVERS\nvtunep.sys [2003-04-09 16:47]
S2 nvtvSND;nVidia WDM TVAudio Crossbar;C:\WINDOWS\system32\DRIVERS\nvtvsnd.sys [2003-04-09 16:47]
S3 WINFOXIO;WINFOXIO;C:\WINDOWS\system32\Drivers\WINFOXIO.SYS [2003-09-16 17:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0728601e-d157-11dc-babf-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3e790ff3-6710-11dc-b9d5-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8d37dde0-58e7-11db-b789-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{919bfd61-fc61-11dc-bb20-001346fed118}]
\Shell\AutoRun\command - G:\RavMon.exe
\Shell\explore\Command - G:\RavMon.exe -e
\Shell\open\Command - G:\RavMon.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-02-09 07:42:07 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 2300 series#1160375904.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 2300 series#1160375904
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-26 22:45:36
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-05-26 22:46:49
ComboFix-quarantined-files.txt 2008-05-27 05:46:22
ComboFix2.txt 2008-05-27 05:13:20

Pre-Run: 36,061,229,056 bytes free
Post-Run: 36,051,353,600 bytes free

227
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP