Infected with maleware

Compaq / SR2170NX
January 8, 2009 at 12:21:47
Specs: Windows XP, 3.0 Ghz 2 GB Ram
You can see my orignal post here. I have not been able to return until now. Sorry to not keep you updated. I have been very busy. I have ran the scan lastnight and it seems I was infected again. I tried to install AVG Antimaleware and it will not even come up. Also if I try to download an AV program the browser will close. I had to reinstall Antimaleware Bytes in safemode the only way I was able to do that was to run cCleaner in safemode and run the registery cleaner. The maleware program found over 30 things after i reinstalled it and I tried to run it in normal mode and it will not run or come up. Another thing I could not log in to this site on the infected PC.

Here is my post from 12-30-07. Again I am sorry I have not been to update until now.

http://www.computing.net/answers/se...

Here is the antimaleware log.

Malwarebytes' Anti-Malware 1.32
Database version: 1631
Windows 5.1.2600 Service Pack 2

1/8/2009 11:37:12 AM
mbam-log-2009-01-08 (11-37-12).txt

Scan type: Full Scan (C:\|)
Objects scanned: 91708
Time elapsed: 9 minute(s), 46 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 12
Registry Values Infected: 3
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 19

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\orb.ta (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{1b7f9329-aaf9-4e34-8ecf-c363fd3c60cf} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{21eeb010-57f3-11dd-b116-dad055d89593} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ada8c222-95d2-47b5-950b-aebc0a508839} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{ada8c222-95d2-47b5-950b-aebc0a508839} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ada8c222-95d2-47b5-950b-aebc0a508839} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\orb.ta.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\spyware guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{2d677765-3995-409a-b759-5c603d390c4d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5aa036dd-0358-4931-8132-745f9a32464b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\spywareguard (Rogue.Spyguard) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\InternetConnection (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ieModule (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Spyware Guard 2008 (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\quarantine (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Start Menu\Programs\System Security (Rogue.SystemSecurity) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Spyware Guard 2008\spywareguard.exe (Rogue.Spyguard) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\spria.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winscenter.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\conf.cfg (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\mbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\quarantine.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\queue.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\uninstall.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Program Files\Spyware Guard 2008\vbase.vdb (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Documents and Settings\User\Start Menu\Programs\System Security\System Security.lnk (Rogue.SystemSecurity) -> Quarantined and deleted successfully.
C:\WINDOWS\sysexplorer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\reged.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\spoolsystem.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\sys.com (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\syscert.exe (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\WINDOWS\vmreg.dll (Rogue.SpywareGuard) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\kutrpktpbo.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\ieModule.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\moduleie.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


See More: Infected with maleware

Report •


#1
January 8, 2009 at 12:45:17
BTW I was asked to post the log. And if needed I can run and post a jijack this l;og.

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#2
January 8, 2009 at 15:12:34
You must disable any antivirus or antispyware prorams that you have before running Combofix.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your antivirus, and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#3
January 8, 2009 at 16:26:22
I cannot even open Antimaleware Bytes. Here is the combo log.

ComboFix 09-01-08.01 - User 2009-01-08 18:28:39.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1791.1496 [GMT -5:00]
Running from: g:\combo fix\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\oeminfo.ini
G:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2009-01-08 11:23 . 2009-01-08 11:23 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-08 11:23 . 2009-01-08 11:23 <DIR> d-------- c:\documents and settings\User\Application Data\Malwarebytes
2009-01-08 11:23 . 2009-01-08 11:23 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-08 11:23 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-08 11:23 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-07 21:22 . 2009-01-07 21:22 <DIR> d-------- c:\documents and settings\Administrator
2009-01-07 21:09 . 2009-01-07 21:09 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
2009-01-07 19:54 . 2009-01-07 21:13 <DIR> d-------- c:\program files\Norton Internet Security
2009-01-05 21:30 . 2009-01-05 21:30 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8
2009-01-03 08:48 . 2009-01-03 08:48 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-02 21:43 . 2009-01-02 21:43 <DIR> d-------- c:\program files\Avanquest
2009-01-02 21:43 . 2009-01-02 21:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\BVRP Software
2009-01-02 21:43 . 2007-04-27 16:15 4,244,992 --a------ c:\windows\system32\qtp-mt334.dll
2009-01-02 21:43 . 2007-04-27 16:14 247,808 --a------ c:\windows\system32\prgiso.dll
2009-01-02 21:43 . 2007-04-27 16:25 38,432 --a------ c:\windows\system32\drivers\hotcore3.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-08 22:33 278,033 ----a-w c:\windows\system32\efecbd.dll
2009-01-08 22:25 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-08 22:24 --------- d-----w c:\documents and settings\User\Application Data\DNA
2009-01-08 20:24 --------- d-----w c:\program files\DNA
2009-01-08 14:19 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-08 02:18 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-08 02:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-01-08 02:14 --------- d-----w c:\program files\Symantec
2009-01-08 02:07 --------- d-----w c:\documents and settings\User\Application Data\Symantec
2009-01-03 02:43 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-06 20:50 27,262,976 ----a-w C:\VIRTPART.DAT
2008-12-06 18:30 --------- d-----w c:\program files\Norton SystemWorks
2008-12-05 23:49 --------- d-----w c:\program files\Common Files\Adobe
2008-12-05 00:00 --------- d-----w c:\program files\HP
2008-12-05 00:00 --------- d-----w c:\program files\Hewlett-Packard
2008-12-05 00:00 --------- d-----w c:\program files\Common Files\HP
2008-12-04 23:59 --------- d-----w c:\documents and settings\All Users\Application Data\HP
2008-12-04 23:56 --------- d-----w c:\documents and settings\User\Application Data\HP
2008-12-03 16:01 --------- d-----w c:\documents and settings\User\Application Data\BitTorrent
2008-12-01 17:05 --------- d-----w c:\program files\Common Files\Acronis
2008-11-30 18:18 2,069,272 ----a-w c:\windows\system32\AutoPartNt.exe
2008-11-30 18:14 --------- d-----w c:\documents and settings\User\Application Data\Acronis
2008-11-30 00:35 --------- d-----w c:\documents and settings\All Users\Application Data\ESET
2008-11-29 23:04 --------- d-----w c:\program files\Runtime Software
2008-11-29 02:46 --------- d-----w c:\program files\Recuva
2008-11-28 16:59 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-27 18:46 971,552 ----a-w c:\windows\system32\drivers\tdrpm174.sys
2008-11-27 18:46 540,000 ----a-w c:\windows\system32\drivers\timntr.sys
2008-11-27 18:46 44,704 ----a-w c:\windows\system32\drivers\tifsfilt.sys
2008-11-22 02:10 --------- d-----w c:\program files\Google
2008-11-19 16:44 --------- d-----w c:\documents and settings\User\Application Data\Ahead
2008-11-19 15:26 --------- d-----w c:\program files\EASEUS
2008-11-19 15:11 --------- d-----w c:\documents and settings\User\Application Data\uTorrent
2008-11-19 14:42 --------- d-----w c:\program files\MSXML 6.0
2008-11-18 04:05 --------- d-----w c:\program files\uTorrent
2008-11-18 03:52 --------- d-----w c:\program files\BitTorrent
2008-11-18 03:52 --------- d-----w c:\program files\AskSearch
2008-11-13 14:10 --------- d-----w c:\program files\MSBuild
2008-11-13 14:08 --------- d-----w c:\program files\Reference Assemblies
2008-11-12 17:15 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-12 02:33 --------- d-----w c:\program files\CCleaner
2008-11-12 02:15 --------- d-----w c:\program files\Microsoft Works
2008-11-11 16:05 --------- d-----w c:\program files\ValuSoft
2008-11-11 16:03 --------- d-----w c:\program files\trailer park tycoon
2008-11-11 16:00 --------- d-----w c:\program files\Hasbro Interactive
2008-11-11 15:56 --------- d-----w c:\program files\Hard Truck 18 Wheels
2008-11-11 15:54 --------- d-----w c:\program files\Common Files\InstallShield
2008-11-11 15:42 --------- d-----w c:\program files\Microsoft Games
2008-11-11 15:40 --------- d-----w c:\program files\Oquirrh
2008-11-11 15:40 --------- d-----w c:\program files\directx
2008-11-11 15:38 --------- d-----w c:\program files\Headgames
2008-11-11 15:19 --------- d-----w c:\program files\EA SPORTS
2008-11-11 15:12 756,736 ------w c:\windows\system32\ir41_32.dll
2008-11-11 15:12 56,832 ------w c:\windows\system32\iyvu9_32.dll
2008-11-11 15:12 143,872 ------w c:\windows\system32\iacenc.dll
2008-11-11 00:20 805 ----a-w c:\windows\system32\drivers\SYMEVENT.INF
2008-11-11 00:20 10,671 ----a-w c:\windows\system32\drivers\SYMEVENT.CAT
2008-11-10 10:38 642,912 ------w c:\windows\system32\drivers\SNAPRSTR.SYS
2008-11-10 10:38 1,154,752 ------w c:\windows\system32\srnotifier.exe
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-10-18 02:29 127,034 ------r c:\windows\bwUnin-8.1.1.50-8876480SL.exe
2008-10-17 23:35 86,408 ----a-w c:\windows\system32\setupempdrv03.exe
2008-10-17 21:59 8,704 ----a-w c:\windows\system32\epmntdrv.sys
2008-10-17 21:59 3,072 ----a-w c:\windows\system32\EuGdiDrv.sys
2008-10-17 21:58 14,848 ----a-w c:\windows\system32\EuEpmGdi.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:07 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-16 10:37 659,456 ----a-w c:\windows\system32\wininet.dll
2008-10-16 01:43 319,488 ----a-w c:\windows\HideWin.exe
2008-10-15 19:06 171,008 ----a-w c:\windows\system32\BootMan.exe
2008-10-15 02:30 558,142 ----a-w c:\windows\java\Packages\93RVTVL3.ZIP
2008-10-15 02:30 155,995 ----a-w c:\windows\java\Packages\RVVDBNJ7.ZIP
2009-01-07 23:52 66,578 ----a-w c:\program files\mozilla firefox\components\daafeefbdbddacdbd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-11-21 39408]
"Messenger (Yahoo!)"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2008-09-19 4347120]
"AIM"="c:\program files\AIM\aim.exe" [2006-08-01 67112]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-09-07 1871872]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Google Update"="c:\documents and settings\User\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-27 133104]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-02 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LogitechQuickCamRibbon"="c:\program files\Logitech\QuickCam\Quickcam.exe" [2007-07-25 2027792]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-08-01 61440]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-07-25 563984]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 49152]
"GhostStartTrayApp"="c:\program files\Symantec\Norton Ghost 2003\GhostStartTrayApp.exe" [2002-08-14 94208]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"RTHDCPL"="RTHDCPL.EXE" [2008-09-30 c:\windows\RTHDCPL.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-11 282624]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2008-10-17 67128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efecbd]
2009-01-08 17:33 278033 c:\windows\system32\efecbd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.IV41"= IR41_32.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"c:\\Documents and Settings\\User\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [2009-01-02 38432]
R1 GhPciScan;GhostPciScanner;c:\program files\Symantec\Norton Ghost 2003\GhPciScan.sys [2002-08-14 5632]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2008-11-19 8704]
S3 EraserUtilDrvI7;EraserUtilDrvI7;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI7.sys [?]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2008-11-19 3072]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fbe70a8-9b1a-11dd-9f41-001921b84f39}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL D:\m.exe /s
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-spywareguard - c:\program files\Spyware Guard 2008\spywareguard.exe
HKLM-Run-529942322 - c:\documents and settings\All Users\Application Data\299219841\529942322.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\fxbvsziy.default\
FF - plugin: c:\documents and settings\User\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\User\Local Settings\Application Data\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 18:29:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\986d3e3e77474c9f26d4366573799cb3.sys 39936 bytes executable
c:\windows\system32\_986d3e3e77474c9f26d4366573799cb3.sys_.vir 39936 bytes executable

scan completed successfully
hidden files: 2

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\986d3e3e77474c9f26d4366573799cb3]
"ImagePath"="system32\986d3e3e77474c9f26d4366573799cb3.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(448)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\efecbd.dll
.
Completion time: 2009-01-08 18:30:47
ComboFix-quarantined-files.txt 2009-01-08 23:30:45

Pre-Run: 68,735,332,352 bytes free
Post-Run: 68,836,331,520 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
[acronis snap restore]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

218 --- E O F --- 2008-11-12 02:17:50

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

Related Solutions

#4
January 8, 2009 at 16:28:45
GGGGGRRRRRRRRRRRRRRRRRRRRRRRR Combofix removed the OEM Info from system Properties. Also removed the autorun.ini from my jump drive.
Also when I try to download HiJack this the prowser and the download closes. I may try in firefox. Also if I try to install Hijack I downloaded from another computer it will not install it just closes.
<edit>
Firefox doese the same.
Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#5
January 8, 2009 at 16:44:08
It was supposed to, they are baddies.

Report •

#6
January 8, 2009 at 17:03:31
OEM Info is put in system properties by the OEM'S. Each OEM has there own logo. Why is it bad? Am I still infected? What else do I need to do?

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#7
January 8, 2009 at 17:08:11
Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, File, Folder, Registry etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP
c:\windows\system32\efecbd.dll

Folder::
c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7fbe70a8-9b1a-11dd-9f41-001921b84f39}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efecbd]
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\986d3e3e77474c9f26d4366573799cb3]
"ImagePath"=-

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
6. Click View scan report at the bottom.
7. Click the Save Report As... button.
8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Report •

#8
January 8, 2009 at 18:34:33
I figured you did not know what else to do so I went ahead and restored a ghost backup. One funny thing is my main computer I use for a server got the same virus. Not the AV 2009 but I tried to download hijack this from my main computer and the browser closed on it also. I figured it was virus related. I did have the jump drive in the infected computer and then in the main computer. Could the main computer have gotten infected like that? Sounds funny to me. Maybe it just jumped thru my network. All computers are connected thry a wireless router WRT54G and 1 laptop that was not or has not been infected yet. Maybe I should have waited about the ghost restore but atleast its restored now. Thanks for your help. If I have any more trouble I will reply back.

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#9
January 8, 2009 at 19:15:17
Did you not read response #7?

Most people run into problems when they don't follow the directions. Once you finish the procedure in response # 7 and a second opinion (online scan) is finished you would get the following info.

Your router is probably infected and a simple reset destroyes the infection, and yes the pin drive was infected....m.exe.


Report •

#10
January 8, 2009 at 19:34:17
Yes I read # 7 after I restored. And I read # 5 and all you said is "It was supposed to, they are baddies." Why didn't you post what you did in # 7 in # 5? No big deal I will reset the router I guess. I don't see how it can be infected because its linux based.

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#11
January 9, 2009 at 20:46:04
Jabuck thanks for the help. Again how could my router be infected? I have not reset it yet. It causes alot of problems I have to reconfigure the IP address because its the same as my modem. Also I have it set up and configured like I want it. Is there any way to tell if its infected? Will someone please let Jbuck know I am still asking questions?

Jesus Loves You!

Keyboard not detected. Hit F1 to Continue. BREAKFAST.SYS HALTED Cerial port not Responding!!


Report •

#12
January 9, 2009 at 20:59:12
Several folks have asked why they have to RESET the router. And how on earth could malware effect the router in the first place? There are, that I have seen in the last few weeks, in wide distribution, at least four malware infections, one rootkit-based, that at present do exactly this; and have since the last week in October. As to how this can be done, please read this short Article: geekstogo tutorial on router infections

Report •


Ask Question