[Metallica]

Please download and run RootkitRevealer from:
http://www.sysintern...itrevealer.html

Post the log it makes.
Please do not undertake any action based on those results alone. Some important files have a very good reason to be hidden.

Regards,

[Advertisements]

Hi Pieter,

I downloaded rootkit revealer and ran it. As I was running it a virus was detected by AVG but i wasn't able to make any actions before it went out of the screen. Anyway, the rootkitrevealer scan did not find any discrepancies so no log was generated.

The strange thing is if I ran panda active scan, it's finding at least 10 spywares on folders I can't access or see. it's pointing to location c:\document settings\ogie\local settings\temporary internet files\content IE5\xxxxxx...So I can't delete it or do any actions.

Hope to hear from you.


thanks,

olace88

[olace88]

Hi Pieter,

I downloaded rootkit revealer and ran it. As I was running it a virus was detected by AVG but i wasn't able to make any actions before it went out of the screen. Anyway, the rootkitrevealer scan did not find any discrepancies so no log was generated.

The strange thing is if I ran panda active scan, it's finding at least 10 spywares on folders I can't access or see. it's pointing to location c:\document settings\ogie\local settings\temporary internet files\content IE5\xxxxxx...So I can't delete it or do any actions.

Hope to hear from you.


thanks,

olace88

[Metallica]

To empty this folder:
c:\document settings\ogie\local settings\temporary internet files\content IE5\
open IE and click Tools > Internet Options
On the General tab click Delete Files and put a checkmark in the include offline content box.

Can you see and let me know what it was that AVG found.

Regards,

[olace88]

Hi Pieter,

I followed your instructions. I deleted the files on the internet properties toinclude offline content box. After this I ran panda active scan and those infected files were gone and it only found 1 malicious file located in the "windows registry". No specified location was shown. Just plain "windows registry".

Anyway, after this I ran rootkit revelear again and see it it'll make the trojan come again. And yes it did. AVG caught it and it's a trojan horse dropper.small.24.L. Infected file is C:\System Volume Information|_restore\xxxxx\A0011376.exe. While rootkit revealer is still scanning this trojan appeared and I immediately moved it into the virus vault. The rootkit revealer finishes and found 3 discrepancies this time. Below is the log file.

C:\$VAULT$.AVG\03358718.FIL 8/29/2005 8:57 AM 10.94 KB Hidden from Windows API.
C:\System Volume Information\_restore{41747CAB-4C60-44A6-ADCF-288F72509D1E}\RP5\A0011376.exe 8/25/2005 2:22 PM 10.48 KB Visible in Windows API, but not in MFT or directory index.
C:\WINDOWS\Prefetch\RUNDLL32.EXE-3A26AEFB.pf 8/29/2005 8:57 AM 25.81 KB Hidden from Windows API.


Hope to hear from you soon.

thanks and regards,

Olace88(ogie)

[Metallica]

Good. That means we will have to "flush" your Restore Points.

To do so:

- Disable System restore
- Reboot
- Re-enable System Restore

More information: http://service1.syma...src=sec_doc_nam

Let me know,

[olace88]

Hi Pieter,

After following your instructions, I ran the rootkit revealer and here's the log.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesProcessed 8/30/2005 11:05 AM 4 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher\TracesSuccessful 8/30/2005 11:05 AM 4 bytes Data mismatch between Windows API and raw hive data.
C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb 8/30/2005 11:04 AM 64.00 KB Visible in Windows API, but not in MFT or directory index.

Hope to hear from you.

Regards,

Olace88(ogie)

[Metallica]

Nothing wrong with that.

Did a full system scan with AVG turn up any new items?

And can you post a new HijackThis log?

Regards,

[olace88]

Hi Pieter,

AVG turned out clean. No new items found. But Panda Active scan always find 1 malware on the windows registry which is not specified where in the windows registry. Other than this, I ocassionally ran Ad-aware SE free edition and it'll find some critical objects and i just removed it. My system looks clean but I'll wait for your judgment. Here's my latest Hijackthis Log.

Logfile of HijackThis v1.99.1
Scan saved at 7:19:27 AM, on 8/31/2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\ScsiAccess.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\LVComS.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Microsoft Office\Office10\msoffice.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\ogie\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=msgr
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.c...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.c...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.c...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=msgr
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn0\ycomp5_6_2_0.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn0\ycomp5_6_2_0.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [Telechips,Mass] C:\Windows\System\patch.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\RunServices: [steam] steam.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: VIA RAID TOOL.lnk = C:\Program Files\VIA\RAID\raid_tool.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg...t/c381/chat.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1096789983978
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125040610828
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {D6FCA8ED-4715-43DE-9BD2-2789778A5B09} (NPKCX Control) - http://gameguard1.le...Crypt/npkcx.cab
O16 - DPF: {D719897A-B07A-4C0C-AEA9-9B663A28DFCB} (iTunesDetector Class) - http://ax.phobos.app.../ITDetector.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{997E32F4-4143-4E15-BD09-D6E0DDF885AE}: NameServer = 202.124.128.2,202.124.138.3
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\System32\npkcsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: ScsiAccess - Unknown owner - C:\WINDOWS\System32\ScsiAccess.EXE

Keeping my fingers cross...


thanks and regards,

olace88(ogie)

[Metallica]

Looks clean to me as well.

Can you install SP2 for XP and IE?

Regards,

[olace88]

Hi Pieter,

Thanks for all your help. I appreciate very much all the effort you put into this and what's more interesting is that you don't charge any labor or service fee. More power to you and your forum.

I hope our threads have helped other people in some ways who have the same problem.

I believe it's an everyday battle against trojans and viruses. It's always a good habbit to scan once or twice a week and keep away from unpopular sites.

Take care my friend and hope this won't be our last chat. And I hope you won't tire helping people like me.

Thanks , again.


Olace88(ogie)

[Metallica]

Glad I could hlep.

Please do have a look at my site about removing and preventing spyware.

Regards,

[olace88]

I will.


thanks again.

regards,

Olace88

[Metallica]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.