Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Google Redirect


  • Please log in to reply

#1
icaro1

icaro1

    New Member

  • Member
  • Pip
  • 1 posts
Well I've tried ComboFix and Malwarebytes, but no luck. I appear to need some hand holding. Please help me remove this nasty virus.

This is what ComboFix said:


ComboFix 09-09-28.01 - User 09/28/2009 21:12.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.52.1033.18.503.132 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\fu456.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\documents and settings\User\Application Data\Malwarebytes
2009-09-27 20:31 . 2009-09-10 21:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-27 20:31 . 2009-09-10 21:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-27 20:31 . 2009-09-27 20:31 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-27 19:58 . 2009-09-27 21:29 -------- d-sh--w- c:\documents and settings\All Users\Application Data\93a8c3e
2009-09-17 02:40 . 2008-10-16 21:06 268648 ----a-w- c:\windows\system32\mucltui.dll
2009-09-17 02:40 . 2008-10-16 21:06 208744 ----a-w- c:\windows\system32\muweb.dll
2009-09-16 04:01 . 2009-09-29 03:58 -------- d-----w- c:\documents and settings\User\Tracing
2009-09-16 03:45 . 2009-09-16 03:45 -------- d-----w- c:\program files\Microsoft Sync Framework
2009-09-16 03:44 . 2006-11-29 20:06 3426072 ----a-w- c:\windows\system32\d3dx9_32.dll
2009-09-16 03:44 . 2009-09-16 03:44 -------- d-----w- c:\program files\Microsoft SQL Server Compact Edition
2009-09-16 03:42 . 2009-09-16 03:42 -------- d-----w- c:\program files\Microsoft
2009-09-16 03:42 . 2009-09-16 03:42 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-16 03:41 . 2009-09-16 03:46 -------- d-----w- c:\program files\Windows Live
2009-09-16 03:37 . 2009-09-16 03:37 -------- d-----w- c:\program files\Common Files\Windows Live
2009-09-10 04:57 . 2009-06-21 22:04 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-09-10 01:42 . 2009-09-10 01:42 -------- d-----w- c:\program files\iPod
2009-09-10 01:42 . 2009-09-10 01:43 -------- d-----w- c:\program files\iTunes
2009-09-10 01:42 . 2009-09-10 01:43 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-10 01:32 . 2009-09-10 01:33 -------- d-----w- c:\program files\QuickTime

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-29 03:44 . 2006-04-20 01:44 -------- d-----w- c:\program files\CCleaner
2009-09-29 02:57 . 2006-04-20 01:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-29 02:33 . 2008-12-27 18:27 -------- d-----w- c:\documents and settings\User\Application Data\skypePM
2009-09-19 08:17 . 2008-12-27 18:22 -------- d-----w- c:\documents and settings\User\Application Data\Skype
2009-09-16 04:01 . 2006-04-20 01:57 23192 ----a-w- c:\documents and settings\User\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-10 03:56 . 2007-08-10 05:13 -------- d-----w- c:\documents and settings\User\Application Data\Apple Computer
2009-09-10 01:42 . 2007-08-10 05:10 -------- d-----w- c:\program files\Common Files\Apple
2009-09-09 03:19 . 2006-04-12 14:42 -------- d-----w- c:\program files\Common Files\Real
2009-08-29 02:42 . 2009-07-10 00:44 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-29 02:42 . 2008-12-26 15:31 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-05 09:11 . 2004-08-10 17:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-02 08:37 . 2006-04-12 14:34 -------- d-----w- c:\program files\Dell
2009-07-26 23:44 . 2009-07-26 23:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-17 18:55 . 2004-08-10 17:50 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 06:43 . 2004-08-10 17:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-10 19:15 . 2009-07-10 19:15 306544 ----a-w- c:\windows\WLXPGSS.SCR
2008-12-24 20:02 . 2006-04-20 23:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll
2008-12-24 20:02 . 2006-04-20 23:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-24 20:02 . 2008-06-11 15:48 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll
2008-12-24 20:02 . 2008-06-11 15:48 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll
2008-12-24 20:02 . 2006-04-20 23:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll
2006-04-20 01:58 . 2006-04-20 01:57 56 --sh--r- c:\windows\system32\B97063234C.sys
2006-04-20 01:58 . 2006-04-20 01:56 4704 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2008-11-07 21633320]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-10-15 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-15 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-10-15 114688]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-09-10 393216]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-21 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Sync\\WindowsLiveSync.exe"=

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 10:51 AM 14336]
.
Contents of the 'Scheduled Tasks' folder

2009-04-14 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]

2008-07-01 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
- c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2006-04-20 08:04]
.
.
------- Supplementary Scan -------
.
mStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\3cfxor3h.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - mail.yahoo.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\[email protected]\components\qfaservices.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 21:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(1476)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-29 21:19
ComboFix-quarantined-files.txt 2009-09-29 04:19
ComboFix2.txt 2009-09-29 03:56
ComboFix3.txt 2009-09-29 02:46

Pre-Run: 17,548,480,512 bytes free
Post-Run: 17,517,588,480 bytes free

128 --- E O F --- 2009-09-18 19:30

Edited by icaro1, 29 September 2009 - 02:49 PM.

  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP