[gestahl]

This virus seems to be new today and hitting a lot of people. When I click any search result it redirects me to "http://vacmoresherry.com/?q=<the search term>". Manually pasting urls works fine.

Backgorund: Some kind of video started to run (don't know if it was shockwave or what I only heard it never got a chance to scroll up to see). Maybe 1 second in to the audio firefox seized up and simply closed itself. I opened taskmgr and there was a process that started with "sod" followed by lots of numbers. I closed that as it was using cpu and clearly doing stuff, pulled the ethernet and ran my virus scanner of choice. These were found/removed(?):

Trojan.Agent/Gen-FraudDrop
Trojan.Dropper/SVCHost-Fake
Trojan.Dropper/Win-NV (found this one 2 days ago also so it may be unrelated)
Trojan.SVCHost/Fake

Anyway after that I have this browser redirect issue that seems to have surfaced just today (all posts related to it are <10 hours old). It seemed to come in through firefox but it effects IE also.

These batch files were found in my root C:\, let me know if you want to see the text of these .bats

d45.bat
nm8912.bat

The text of the .bat files has something to do with a suspicious .exe and .tmp in my /local setting/temp directory. Also SOUNDMAN.EXE was running when I rebooted, which has never been running from the get-go before. (I disabled soundman in msconfig to try and keep this from getting worse on bootup)

Here's my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:15 PM, on 6/18/2009
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O17 - HKLM\System\CCS\Services\Tcpip\..\{69BAA651-21A2-4E0F-9D4C-5697C3C307CA}: NameServer = 68.94.156.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{E1DB35F4-CE6A-477C-9F27-A517E6000946}: NameServer = 68.94.156.1
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

--
End of file - 2381 bytes

Any helps is appreciated!

[Advertisements]

And yes I see now that I should have turned off my spyware scanner and yahoo messenger first sorry

[gestahl]

And yes I see now that I should have turned off my spyware scanner and yahoo messenger first sorry

[Rorschach112]

hi

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop**

• If you are using Firefox, make sure that your download settings are as follows:
  
  • Tools->Options->Main tab
  • Set to "Always ask me where to Save the files".
• During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  
• It is important you rename Combofix during the download, but not after.
• Please do not rename Combofix to other names, but only to the one indicated.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  

  -----------------------------------------------------------

  • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    

    -----------------------------------------------------------

  • Close any open browsers.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
  • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

  -----------------------------------------------------------

• Double click on combo-Fix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\Combo-Fix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combo-fix's window while it's running. That may cause it to stall**

[gestahl]

Wow ComboFix is an ominous app. What's with the rename? Anyway ran it just as instructed, when it rebooted my machine though my spyware program did automatically come on in the tray while it was preparing the log. I can confirm that real-time protection was off though.

PS: The symptoms are now gone


Here's my combo-fix log:

ComboFix 09-06-18.02 - Administrator 06/19/2009 12:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.510.373 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\driver
c:\program files\Microsoft Common
c:\program files\driver\driver.dll
c:\program files\driver\driver.sys
c:\windows\system32\drivers\str.sys
c:\windows\system32\wbem\proquota.exe

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DRIVER
-------\Legacy_DRIVERDRV
-------\Service_driver
-------\Service_driverdrv


((((((((((((((((((((((((( Files Created from 2009-05-19 to 2009-06-19 )))))))))))))))))))))))))))))))
.

2009-06-18 21:20 . 2009-06-18 21:20 2 ----a-w- c:\windows\010112010146118114.dat
2009-06-18 21:20 . 2009-06-18 21:20 180 ----a-w- C:\nm8912.bat
2009-06-15 13:45 . 2009-06-15 13:45 -------- d-----w- c:\program files\Sony
2009-06-14 20:28 . 2009-06-14 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\ImgBurn
2009-06-14 20:14 . 2009-06-14 20:14 -------- d-----w- c:\program files\ImgBurn
2009-06-10 15:31 . 2009-06-10 15:32 177 ----a-w- C:\d45.bat
2009-06-04 21:40 . 2009-06-04 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2009-05-27 19:44 . 2009-05-27 19:44 -------- d-----w- c:\documents and settings\Administrator\WINDOWS
2009-05-27 19:43 . 2009-05-27 19:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2009-05-25 20:40 . 2001-10-01 14:47 4990 ----a-r- c:\windows\system32\drivers\pcx500mp.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 -c--a-w- c:\windows\system32\dllcache\pcx500.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 ----a-r- c:\windows\system32\drivers\pcx500.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-17 19:05 . 2008-02-27 18:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-06-15 13:45 . 2008-02-24 06:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 22:11 . 2008-02-24 02:10 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-06-04 22:11 . 2008-02-24 02:10 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-06-04 22:11 . 2008-02-24 02:10 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-06-04 22:11 . 2008-02-24 02:10 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-06-04 22:11 . 2008-02-24 02:10 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StarWindServiceAE"=2 (0x2)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/29/2008 4:03 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 4:03 PM 51440]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [5/25/2009 3:40 PM 82501]
S3 PCX500MP;Cisco 350 Series Lower Device Filter;c:\windows\system32\drivers\pcx500mp.sys [5/25/2009 3:40 PM 4990]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ALG
*NewlyCreated* - IPNAT
.
.
------- Supplementary Scan -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {69BAA651-21A2-4E0F-9D4C-5697C3C307CA} = 68.94.156.1
TCP: {E1DB35F4-CE6A-477C-9F27-A517E6000946} = 68.94.156.1
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 12:06
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\drivers\qopplvrs.sys 80128 bytes executable
c:\windows\system32\drivers\str.sys 0 bytes

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\qphddxhqnc]
"ImagePath"="\??\c:\windows\System32\drivers\qopplvrs.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\ODBC32.dll
c:\windows\system32\cswGina.dll
c:\windows\system32\ACrd10SM.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(756)
c:\windows\System32\dssenh.dll

- - - - - - - > 'explorer.exe'(5016)
c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
c:\windows\System32\ODBC32.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-06-19 12:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-19 17:09

Pre-Run: 6,037,901,312 bytes free
Post-Run: 6,497,931,264 bytes free

WinXP_EN_PRO_BF.EXE
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect

127

[Rorschach112]

hi

Open notepad and copy/paste the text in the quotebox below into it:

http://www.geekstogo...nd-t242925.html

Collect::
c:\windows\010112010146118114.dat
C:\nm8912.bat
C:\d45.bat
Rootkit::
c:\windows\system32\drivers\qopplvrs.sys
c:\windows\system32\drivers\str.sys
Driver::
qphddxhqnc
KillAll::
Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\qphddxhqnc]

Suspect::

Save this as CFScript.txt




Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  proquota

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[gestahl]

Prouota being missing isn't anything that worries me terribly, it's for functionality that I don't actually use..

Anyhow here's the systemlook log:

SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 16:12 on 19/06/2009 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "proquota"
No files found.

-=End Of File=-

And the ComboFix log:

ComboFix 09-06-18.02 - Administrator 06/19/2009 14:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.510.355 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

file zipped: C:\d45.bat
file zipped: C:\nm8912.bat
file zipped: c:\windows\010112010146118114.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\d45.bat
C:\nm8912.bat
c:\windows\010112010146118114.dat
c:\windows\system32\drivers\str.sys

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_QPHDDXHQNC


((((((((((((((((((((((((( Files Created from 2009-05-19 to 2009-06-19 )))))))))))))))))))))))))))))))
.

2009-06-15 13:45 . 2009-06-15 13:45 -------- d-----w- c:\program files\Sony
2009-06-14 20:28 . 2009-06-14 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\ImgBurn
2009-06-14 20:14 . 2009-06-14 20:14 -------- d-----w- c:\program files\ImgBurn
2009-06-04 21:40 . 2009-06-04 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2009-05-27 19:44 . 2009-05-27 19:44 -------- d-----w- c:\documents and settings\Administrator\WINDOWS
2009-05-27 19:43 . 2009-05-27 19:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2009-05-25 20:40 . 2001-10-01 14:47 4990 ----a-r- c:\windows\system32\drivers\pcx500mp.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 -c--a-w- c:\windows\system32\dllcache\pcx500.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 ----a-r- c:\windows\system32\drivers\pcx500.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 19:05 . 2008-02-27 18:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-06-15 13:45 . 2008-02-24 06:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 22:11 . 2008-02-24 02:10 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-06-04 22:11 . 2008-02-24 02:10 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-06-04 22:11 . 2008-02-24 02:10 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-06-04 22:11 . 2008-02-24 02:10 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-06-04 22:11 . 2008-02-24 02:10 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-19_17.06.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-08-23 12:00 . 2009-06-19 17:15 40688 c:\windows\system32\perfc009.dat
+ 2008-02-24 04:15 . 2009-06-19 18:40 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-19 18:40 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-19 18:40 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2001-08-23 12:00 . 2009-06-19 17:15 313452 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StarWindServiceAE"=2 (0x2)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/29/2008 4:03 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 4:03 PM 51440]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [5/25/2009 3:40 PM 82501]
S3 PCX500MP;Cisco 350 Series Lower Device Filter;c:\windows\system32\drivers\pcx500mp.sys [5/25/2009 3:40 PM 4990]
.
.
------- Supplementary Scan -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {69BAA651-21A2-4E0F-9D4C-5697C3C307CA} = 68.94.156.1
TCP: {E1DB35F4-CE6A-477C-9F27-A517E6000946} = 68.94.156.1
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-19 16:06
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(708)
c:\windows\system32\ODBC32.dll
c:\windows\system32\cswGina.dll
c:\windows\system32\ACrd10SM.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(768)
c:\windows\System32\dssenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2009-06-19 16:08 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-19 21:08
ComboFix2.txt 2009-06-19 17:09

Pre-Run: 6,251,622,400 bytes free
Post-Run: 6,242,680,832 bytes free

118

[Rorschach112]

hi

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::

Folder::

Registry::
SRPeek::
c:\windows\system32\proquota.exe
Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[gestahl]

Ok sorry had a busy weekend. Am I reading correctly that combofix is freeing up HDD space? Here's the next combofix log:

ComboFix 09-06-18.02 - Administrator 06/21/2009 15:35.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.510.373 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2009-05-21 to 2009-06-21 )))))))))))))))))))))))))))))))
.

2009-06-15 13:45 . 2009-06-15 13:45 -------- d-----w- c:\program files\Sony
2009-06-14 20:28 . 2009-06-14 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\ImgBurn
2009-06-14 20:14 . 2009-06-14 20:14 -------- d-----w- c:\program files\ImgBurn
2009-06-04 21:40 . 2009-06-04 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2009-05-27 19:44 . 2009-05-27 19:44 -------- d-----w- c:\documents and settings\Administrator\WINDOWS
2009-05-27 19:43 . 2009-05-27 19:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2009-05-25 20:40 . 2001-10-01 14:47 4990 ----a-r- c:\windows\system32\drivers\pcx500mp.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 -c--a-w- c:\windows\system32\dllcache\pcx500.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 ----a-r- c:\windows\system32\drivers\pcx500.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-19 19:05 . 2008-02-27 18:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-06-15 13:45 . 2008-02-24 06:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 22:11 . 2008-02-24 02:10 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-06-04 22:11 . 2008-02-24 02:10 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-06-04 22:11 . 2008-02-24 02:10 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-06-04 22:11 . 2008-02-24 02:10 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-06-04 22:11 . 2008-02-24 02:10 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
((((((((((((((((((((((((((((( SnapShot@2009-06-19_17.06.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-08-23 12:00 . 2009-06-19 17:15 40688 c:\windows\system32\perfc009.dat
+ 2008-02-24 04:15 . 2009-06-21 16:57 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-21 16:57 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-21 16:57 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2001-08-23 12:00 . 2009-06-19 17:15 313452 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StarWindServiceAE"=2 (0x2)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/29/2008 4:03 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 4:03 PM 51440]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [5/25/2009 3:40 PM 82501]
S3 PCX500MP;Cisco 350 Series Lower Device Filter;c:\windows\system32\drivers\pcx500mp.sys [5/25/2009 3:40 PM 4990]
.
.
------- Supplementary Scan -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {69BAA651-21A2-4E0F-9D4C-5697C3C307CA} = 68.94.156.1
TCP: {E1DB35F4-CE6A-477C-9F27-A517E6000946} = 68.94.156.1
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-21 15:38
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\ODBC32.dll
c:\windows\system32\cswGina.dll
c:\windows\system32\ACrd10SM.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(756)
c:\windows\System32\dssenh.dll
.
Completion time: 2009-06-21 15:38
ComboFix-quarantined-files.txt 2009-06-21 20:38
ComboFix2.txt 2009-06-19 21:08
ComboFix3.txt 2009-06-19 17:09

Pre-Run: 6,229,233,664 bytes free
Post-Run: 6,256,091,136 bytes free

103

[Rorschach112]

hi

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
• Copy the content of the following codebox into the main textfield:
  

  :filefind
  proquota

• Click the Look button to start the scan.
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

[gestahl]

**UPDATE: I contracted seemingly the same virus again, same delivery method again (firefox suddenly seized loading a page then a zillion .tmp files were running in Taskmgr). I ran Combofix again and it fixed the problem again. Still no sign of proquota.exe;


SystemLook v1.0 by jpshortstuff (22.05.09)
Log created at 17:07 on 23/06/2009 by Administrator (Administrator - Elevation successful)

========== filefind ==========

Searching for "proquota"
No files found.

-=End Of File=-

Edited by gestahl, 23 June 2009 - 04:16 PM.

[gestahl]

Though you didn't ask for it, here's the combofix log for last night when I got virused all over again. Do you reccomend I update firefox? Maybe they're aware of this problem?


ComboFix 09-06-18.02 - Administrator 06/23/2009 3:24.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.510.377 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\wbem\proquota.exe

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2009-05-23 to 2009-06-23 )))))))))))))))))))))))))))))))
.

2009-06-23 08:22 . 2009-06-23 08:22 2 ----a-w- c:\windows\010112010146118114.dat
2009-06-23 08:21 . 2009-06-23 08:22 193 ----a-w- c:\windows\2232132.bat
2009-06-15 13:45 . 2009-06-15 13:45 -------- d-----w- c:\program files\Sony
2009-06-14 20:28 . 2009-06-14 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\ImgBurn
2009-06-14 20:14 . 2009-06-14 20:14 -------- d-----w- c:\program files\ImgBurn
2009-06-04 21:40 . 2009-06-04 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2009-05-27 19:44 . 2009-05-27 19:44 -------- d-----w- c:\documents and settings\Administrator\WINDOWS
2009-05-27 19:43 . 2009-05-27 19:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2009-05-25 20:40 . 2001-10-01 14:47 4990 ----a-r- c:\windows\system32\drivers\pcx500mp.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 -c--a-w- c:\windows\system32\dllcache\pcx500.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 ----a-r- c:\windows\system32\drivers\pcx500.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-23 08:20 . 2008-02-27 18:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-06-15 13:45 . 2008-02-24 06:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 22:11 . 2008-02-24 02:10 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-06-04 22:11 . 2008-02-24 02:10 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-06-04 22:11 . 2008-02-24 02:10 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-06-04 22:11 . 2008-02-24 02:10 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-06-04 22:11 . 2008-02-24 02:10 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-19_17.06.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-23 08:27 . 2009-06-23 08:27 16384 c:\windows\temp\Perflib_Perfdata_240.dat
+ 2001-08-23 12:00 . 2009-06-19 17:15 40688 c:\windows\system32\perfc009.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-22 18:57 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-22 18:57 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-22 18:57 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2001-08-23 12:00 . 2009-06-19 17:15 313452 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StarWindServiceAE"=2 (0x2)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/29/2008 4:03 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 4:03 PM 51440]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [5/25/2009 3:40 PM 82501]
S3 PCX500MP;Cisco 350 Series Lower Device Filter;c:\windows\system32\drivers\pcx500mp.sys [5/25/2009 3:40 PM 4990]
.
.
------- Supplementary Scan -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {69BAA651-21A2-4E0F-9D4C-5697C3C307CA} = 68.94.156.1
TCP: {E1DB35F4-CE6A-477C-9F27-A517E6000946} = 68.94.156.1
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-23 03:27
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\ODBC32.dll
c:\windows\system32\cswGina.dll
c:\windows\system32\ACrd10SM.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(784)
c:\windows\System32\dssenh.dll
.
Completion time: 2009-06-23 3:28
ComboFix-quarantined-files.txt 2009-06-23 08:28
ComboFix2.txt 2009-06-21 20:38
ComboFix3.txt 2009-06-19 21:08
ComboFix4.txt 2009-06-19 17:09

Pre-Run: 3,091,091,456 bytes free
Post-Run: 3,153,154,048 bytes free

105

[Rorschach112]

that wouldn't help

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\010112010146118114.dat
c:\windows\2232132.bat

SRPeek::
c:\windows\system32\proquota.exe
Folder::

Registry::

Driver::

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

[gestahl]

K, here's that.


ComboFix 09-06-18.02 - Administrator 06/23/2009 23:00.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.510.359 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::
"c:\windows\010112010146118114.dat"
"c:\windows\2232132.bat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\010112010146118114.dat
c:\windows\2232132.bat

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2009-05-24 to 2009-06-24 )))))))))))))))))))))))))))))))
.

2009-06-15 13:45 . 2009-06-15 13:45 -------- d-----w- c:\program files\Sony
2009-06-14 20:28 . 2009-06-14 21:44 -------- d-----w- c:\documents and settings\Administrator\Application Data\ImgBurn
2009-06-14 20:14 . 2009-06-14 20:14 -------- d-----w- c:\program files\ImgBurn
2009-06-04 21:40 . 2009-06-04 21:40 -------- d-----w- c:\documents and settings\Administrator\Application Data\vlc
2009-05-27 19:44 . 2009-05-27 19:44 -------- d-----w- c:\documents and settings\Administrator\WINDOWS
2009-05-27 19:43 . 2009-05-27 19:43 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Help
2009-05-25 20:40 . 2001-10-01 14:47 4990 ----a-r- c:\windows\system32\drivers\pcx500mp.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 -c--a-w- c:\windows\system32\dllcache\pcx500.sys
2009-05-25 20:40 . 2001-11-28 15:39 82501 ----a-r- c:\windows\system32\drivers\pcx500.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-24 03:58 . 2008-02-27 18:50 -------- d-----w- c:\documents and settings\Administrator\Application Data\uTorrent
2009-06-15 13:45 . 2008-02-24 06:14 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-04 22:11 . 2008-02-24 02:10 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2009-06-04 22:11 . 2008-02-24 02:10 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2009-06-04 22:11 . 2008-02-24 02:10 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2009-06-04 22:11 . 2008-02-24 02:10 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2009-06-04 22:11 . 2008-02-24 02:10 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))

c:\windows\system32\wbem\proquota.exe [x]
[-] 02B0FB5E328D311A2C47B3DFB586749E 38400 \RP2\A0001099.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-06-19_17.06.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2001-08-23 12:00 . 2009-06-19 17:15 40688 c:\windows\system32\perfc009.dat
+ 2008-02-24 04:15 . 2009-06-23 21:50 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-23 21:50 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-02-24 04:15 . 2009-06-23 21:50 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2008-02-24 04:15 . 2009-06-19 17:06 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2001-08-23 12:00 . 2009-06-19 17:15 313452 c:\windows\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 1481968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AtiPTA"="atiptaxx.exe" - c:\windows\system32\atiptaxx.exe [2006-02-22 344064]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 17:41 294912 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"StarWindServiceAE"=2 (0x2)

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2/29/2008 4:03 PM 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2/29/2008 4:03 PM 51440]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2/16/2006 4:51 PM 4096]
S3 PCX500;Cisco Wireless LAN Adapters Driver;c:\windows\system32\drivers\pcx500.sys [5/25/2009 3:40 PM 82501]
S3 PCX500MP;Cisco 350 Series Lower Device Filter;c:\windows\system32\drivers\pcx500mp.sys [5/25/2009 3:40 PM 4990]
.
.
------- Supplementary Scan -------
.
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
TCP: {69BAA651-21A2-4E0F-9D4C-5697C3C307CA} = 68.94.156.1
TCP: {E1DB35F4-CE6A-477C-9F27-A517E6000946} = 68.94.156.1
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-23 23:03
Windows 5.1.2600 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\windows\system32\ODBC32.dll
c:\windows\system32\cswGina.dll
c:\windows\system32\ACrd10SM.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(752)
c:\windows\System32\dssenh.dll
.
Completion time: 2009-06-24 23:04
ComboFix-quarantined-files.txt 2009-06-24 04:04
ComboFix2.txt 2009-06-23 22:17
ComboFix3.txt 2009-06-21 20:38
ComboFix4.txt 2009-06-19 21:08
ComboFix5.txt 2009-06-24 03:59

Pre-Run: 11,241,164,800 bytes free
Post-Run: 11,231,379,456 bytes free

112

[Rorschach112]

hi

Download TFC to your desktop

• Open the file and close any other windows.
• It will close all programs itself when run, make sure to let it run uninterrupted.
• Click the Start button to begin the process. The program should not take long to finish its job
• Once its finished it should reboot your machine, if not, do this yourself to ensure a complete clean

Please download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

• Read through the requirements and privacy statement and click on Accept button.
• It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
• When the downloads have finished, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, Adware, Dialers, and other potentially dangerous programs
    Archives
    Mail databases
• Click on My Computer under Scan.
• Once the scan is complete, it will display the results. Click on View Scan Report.
• You will see a list of infected items there. Click on Save Report As....
• Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

[gestahl]

Ack! I ran the Malwarebtes program, and now I can only boot into safe mode! When I start windows normally the splash screen looks normal for a few seconds then the progress bar slows to a crawl and it never (at least not within 10mins) loads windows. I'll post this log here before I move on to the Kaspersky thing:

*** Though it says "no action taken" this log is from before I hit "fix checked", after this it said it fixed them and initiated the first failed reboot ***


Malwarebytes' Anti-Malware 1.38
Database version: 2343
Windows 5.1.2600

6/27/2009 5:20:47 PM
mbam-log-2009-06-27 (17-20-42).txt

Scan type: Full Scan (C:\|)
Objects scanned: 99201
Time elapsed: 10 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Qoobox\quarantine\C\program files\driver\driver.dll.vir (Trojan.Agent) -> No action taken.
c:\Qoobox\quarantine\C\program files\driver\driver.sys.vir (Trojan.Agent) -> No action taken.
C:\WINDOWS\010112010146118114.lso (Worm.KoobFace) -> No action taken.