JABUCK please help!

April 7, 2009 at 22:01:53
Specs: Windows XP
Jabuck,

I read some other threads pertaining to the google redirect virus, thankfully combofix did the trick. However, I have continued to read on the matter and have found instances where the problem goes away for a day and then comes back. I would just like you to take a look at the logs and make sure everything looks good. I have logs from Hijack This and Malwarebytes' Anti-Malware. Please help!

Thank you,
Megan


See More: JABUCK please help!

Report •


#1
April 8, 2009 at 14:06:55
Megan, please post your Hijack This log and if you ran combofix post the copy of its text file located at C:\combofix.txt.

Report •

#2
April 9, 2009 at 05:32:31
hi jabuck sorry for the hijacking of the thread but if you have the time and if its not too much to ask would you mind taking a look at http://www.computing.net/answers/se... as well please?

Report •

#3
April 9, 2009 at 07:41:48
Thank you for the reply, jabuck.

Here is my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:31:34 AM, on 4/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe
C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Yahoo!\Companion\Installs\cpn\ytbb.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.mail.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Share-to-Web Namespace Daemon] "C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [UfSeAgnt.exe] "C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe
O4 - HKUS\S-1-5-18\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OE] C:\Program Files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe (User 'Default user')
O4 - Startup: MRI_DISABLED
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MRI_DISABLED
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O9 - Extra 'Tools' menuitem: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} - http://www.symantec.com/techsupp/as...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online...
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySp...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso...
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://megzie101.spaces.live.com/Ph...
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yah...
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpc...
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - http://www.symantec.com/techsupp/as...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)
O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmPfw.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 9389 bytes


and here is my ComboFix log:

ComboFix 09-04-04.01 - megan 2009-04-07 14:32:21.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.64 [GMT -5:00]
Running from: c:\documents and settings\megan\My Documents\My Pictures\ComboFix.exe
AV: Norton AntiVirus 2005 *On-access scanning disabled* (Outdated)
AV: Trend Micro AntiVirus *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\TDSSmact.sys
c:\windows\system32\Nail.exe
c:\windows\system32\TDSScfum.dll
c:\windows\system32\TDSSfxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSnrsr.dll
c:\windows\system32\TDSSofxh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsbhc.dll
c:\windows\system32\TDSStkdv.log

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSserv.sys
-------\Legacy_TDSSserv.sys
-------\Legacy_SVCPROC


((((((((((((((((((((((((( Files Created from 2009-03-07 to 2009-04-07 )))))))))))))))))))))))))))))))
.

2009-04-07 12:32 . 2009-04-07 12:32 <DIR> d-------- c:\documents and settings\megan\Application Data\Malwarebytes
2009-04-07 11:21 . 2009-04-07 11:21 687,104 --a------ c:\windows\isRS-000.tmp
2009-04-07 10:34 . 2009-04-07 12:31 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-04-07 10:34 . 2009-04-07 10:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-07 10:34 . 2009-04-06 15:32 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-04-07 10:34 . 2009-04-06 15:32 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-03-15 21:40 . 2008-02-16 00:07 138,384 --a------ c:\windows\SYSTEM32\DRIVERS\tmcomm.sys
2009-03-15 21:40 . 2008-02-16 00:07 52,496 --a------ c:\windows\SYSTEM32\DRIVERS\tmactmon.sys
2009-03-15 21:40 . 2008-02-16 00:07 52,240 --a------ c:\windows\SYSTEM32\DRIVERS\tmevtmgr.sys
2009-03-15 20:49 . 2009-03-15 20:49 <DIR> d-------- c:\program files\IObit
2009-03-15 20:49 . 2009-03-15 20:49 <DIR> d-------- c:\documents and settings\megan\Application Data\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-07 17:17 --------- d-----w c:\program files\Trend Micro
2009-03-09 06:10 --------- d-----w c:\program files\Ares
2007-03-26 22:51 74,208 -c--a-w c:\documents and settings\susan\Application Data\GDIPFONTCACHEV1.DAT
2006-08-06 20:02 0 -c-ha-w c:\documents and settings\NetworkService\hpothb07.dat
2004-08-15 01:51 0 -c--a-w c:\documents and settings\Guest\ad.dat
2008-09-25 02:07 32,768 -csha-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\MSHist012008092420080925\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2006-05-01 190024]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"ares"="c:\program files\Ares\Ares.exe" [2008-08-21 888832]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-02-22 2272592]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"MessengerPlus3"="c:\program files\MessengerPlus! 3\MsgPlus.exe" [2006-05-01 190024]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-02-16 1398024]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= c:\windows\System32\ctmp3.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=3 (0x3)
"SBService"=2 (0x2)
"NPFMntor"=2 (0x2)
"NISUM"=2 (0x2)
"LiveUpdate"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"tmproxy"=2 (0x2)
"Tmntsrv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:@xpsp2res.dll,-22010
"3540:UDP"= 3540:UDP:@xpsp2res.dll,-22011
"1900:UDP"= 1900:UDP:@xpsp2res.dll,-22007
"443:TCP"= 443:TCP:HTTPS
"21:TCP"= 21:TCP:FTP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R2 Devx;Devx;c:\windows\SYSTEM32\DRIVERS\Devx.sys [2003-05-05 4448]
R2 tmevtmgr;tmevtmgr;c:\windows\SYSTEM32\DRIVERS\tmevtmgr.sys [2009-03-15 52240]
R2 tmpreflt;tmpreflt;c:\windows\SYSTEM32\DRIVERS\tmpreflt.sys [2008-02-16 35856]
R2 VtPr;VtPr;c:\windows\SYSTEM32\DRIVERS\VtPr.sys [2003-05-05 3328]
S3 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-03-15 648456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c45e8a19-f5ab-11da-8390-00038a000015}]
\Shell\AutoRun\command - E:\iPodSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca7690ff-7940-11dd-846d-0007e9bc811c}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)
HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe
HKU-Default-Run-msnmsgr - c:\program files\MSN Messenger\msnmsgr.exe
MSConfigStartUp-SSRunScript - c:\program files\Support.com\Charter\bin\SSRunScript.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.myspace.com/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
IE: &Search
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-07 14:43:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\program files\Trend Micro\BM\TMBMSRV.exe
c:\windows\SYSTEM32\wscntfy.exe
c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-07 14:55:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-07 19:54:17

Pre-Run: 52,092,669,952 bytes free
Post-Run: 52,461,170,688 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

188 --- E O F --- 2009-03-11 06:12:19


Report •

Related Solutions

#4
April 9, 2009 at 07:43:55
Also, I have been able to change some things on my computer since I got rid of the virus. I now have my Trend Micro Internet Security back and running/updating fine and the google redirect isn't a problem anymore. I just want to make sure everything looks fine. Should I jun ComboFix again?

Report •

#5
April 9, 2009 at 08:21:02
Sorry jabuck, I just read the other message from you. I ran Malwarebytes' Anti-Malware multiple times and it did not take car of the problem so I decided to try ComboFix, which did work. I probably should have waited for a response from you first. I will post the Malwarebyte's Anti-Malware log below:

Thank you in advance! :)

Malwarebytes' Anti-Malware 1.36
Database version: 1949
Windows 5.1.2600 Service Pack 3

4/9/2009 10:19:33 AM
mbam-log-2009-04-09 (10-19-33).txt

Scan type: Quick Scan
Objects scanned: 79227
Time elapsed: 24 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


Report •

#6
April 9, 2009 at 15:19:00
Looks better now, some clean-up to do.

Run Hijack This again, close all windows and browsers except Hijack This, place a check to the left of these items and press "fix checked":

R3 - URLSearchHook: (no name) - - (no file)

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe (file missing)

Exit Hijack This.

Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, File, Folder, Registry etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\isRS-000.tmp

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Please post the log that is produced.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Please go to Virus Total and upload the following file for analysis:

c:\documents and settings\Guest\ad.dat

Use the browse button at the site to find the file, once you find the file double click it and it should appear in the empty space to the left of the browse button> click "send file".

Post the results in your reply.


Report •

#7
April 12, 2009 at 11:14:40
Hi jabuck, here is my combofix log:

ComboFix 09-04-12.03 - megan 2009-04-12 12:23.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.48 [GMT -5:00]
Running from: c:\documents and settings\megan\My Documents\My Pictures\ComboFix.exe
Command switches used :: c:\documents and settings\megan\Desktop\CFScript.txt
AV: Norton AntiVirus 2005 *On-access scanning disabled* (Outdated)
AV: Trend Micro Internet Security *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *disabled*
FW: Trend Micro Personal Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-03-12 to 2009-04-12 )))))))))))))))))))))))))))))))
.

2009-04-12 17:20 . 2006-03-03 05:42 73728 ----a-w C:\pv.exe
2009-04-09 21:27 . 2009-04-09 21:27 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-04-09 14:26 . 2009-04-09 14:26 -------- d-sh--w c:\documents and settings\megan\IECompatCache
2009-04-09 14:24 . 2009-04-09 14:24 -------- d-sh--w c:\documents and settings\megan\PrivacIE
2009-04-09 14:08 . 2009-04-09 14:08 -------- d-----w c:\windows\system32\Service
2009-04-09 14:07 . 2009-04-09 14:07 -------- d-sh--w c:\documents and settings\megan\IETldCache
2009-04-09 14:02 . 2009-04-09 14:02 -------- d-----w c:\windows\ie8updates
2009-04-09 13:58 . 2009-04-09 14:28 -------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-04-09 13:53 . 2009-04-09 13:57 -------- dc-h--w c:\windows\ie8
2009-04-09 13:52 . 2009-04-09 14:02 -------- d--h--w c:\windows\msdownld.tmp
2009-04-09 13:48 . 2009-02-28 04:55 105984 ------w c:\windows\system32\dllcache\iecompat.dll
2009-04-09 08:44 . 2009-01-09 19:19 1089593 ------w c:\windows\system32\dllcache\ntprint.cat
2009-04-08 15:23 . 2009-04-08 15:23 -------- d-----w c:\windows\system32\XPSViewer
2009-04-08 15:21 . 2008-07-06 12:06 89088 ------w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-04-08 15:21 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-04-08 15:21 . 2008-07-06 12:06 575488 ------w c:\windows\system32\dllcache\xpsshhdr.dll
2009-04-08 15:21 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-04-08 15:21 . 2008-07-06 10:50 597504 ------w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-04-08 15:21 . 2009-04-08 15:22 -------- d-----w C:\fe8e1b5e2277e1bb76f34ca04f8b99
2009-04-08 15:21 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-04-08 15:21 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\dllcache\xpssvcs.dll
2009-04-08 12:22 . 2008-10-16 19:06 27496 ----a-w c:\windows\system32\mucltui.dll.mui
2009-04-08 12:22 . 2008-10-16 19:06 268648 ----a-w c:\windows\system32\mucltui.dll
2009-04-07 19:19 . 2000-08-31 13:00 89504 ----a-w c:\windows\fdsv.exe
2009-04-07 17:32 . 2009-04-07 17:32 -------- d-----w c:\documents and settings\megan\Application Data\Malwarebytes
2009-04-07 16:21 . 2009-04-07 16:21 687104 ----a-w c:\windows\isRS-000.tmp
2009-04-07 15:34 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-07 15:34 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-07 15:34 . 2009-04-07 15:34 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-04-07 10:22 . 2009-04-07 10:09 50192 ----a-w c:\windows\system32\drivers\tmevtmgr.sys
2009-04-07 10:22 . 2009-04-07 10:09 150032 ----a-w c:\windows\system32\drivers\tmcomm.sys
2009-04-07 10:22 . 2009-04-07 10:09 50192 ----a-w c:\windows\system32\drivers\tmactmon.sys
2009-04-07 10:13 . 2008-10-21 18:59 46456 ----a-r c:\windows\system32\exitwx.exe
2009-04-07 10:09 . 2009-04-07 10:09 661808 ----a-w c:\windows\system32\UfWSC.cpl
2009-04-07 10:09 . 2009-04-07 10:09 1195512 ----a-w c:\windows\system32\drivers\vsapint.sys
2009-04-07 10:09 . 2009-04-07 10:09 80400 ----a-w c:\windows\system32\drivers\tmtdi.sys
2009-04-07 10:09 . 2009-04-07 10:09 36368 ----a-w c:\windows\system32\drivers\tmpreflt.sys
2009-04-07 10:09 . 2009-04-07 10:09 335376 ----a-w c:\windows\system32\drivers\TM_CFW.sys
2009-04-07 10:09 . 2009-04-07 10:09 205328 ----a-w c:\windows\system32\drivers\tmxpflt.sys
2009-03-16 01:49 . 2009-03-16 01:49 -------- d-----w c:\documents and settings\megan\Application Data\IObit

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-12 16:37 . 2006-02-16 13:51 -------- d-----w c:\program files\Ares
2009-04-09 13:58 . 2005-09-16 01:36 -------- d-----w c:\documents and settings\All Users\Application Data\yahoo!
2009-04-09 13:58 . 2003-02-17 00:04 -------- d-----w c:\program files\Yahoo!
2009-04-08 15:23 . 2009-04-08 15:23 -------- d-----w c:\program files\MSBuild
2009-04-08 15:23 . 2009-04-08 15:23 -------- d-----w c:\program files\Reference Assemblies
2009-04-08 15:11 . 2009-04-08 15:11 -------- d-----w c:\program files\Microsoft CAPICOM 2.1.0.2
2009-04-07 17:31 . 2009-04-07 15:34 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-07 11:22 . 2002-12-16 04:07 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-07 11:05 . 2007-10-10 15:45 -------- d-----w c:\documents and settings\megan\Application Data\Move Networks
2009-04-07 11:05 . 2005-11-22 03:33 -------- d-----w c:\documents and settings\megan\Application Data\Yahoo!
2009-04-07 11:04 . 2007-05-01 20:49 150 ----a-w C:\YServer.txt
2009-04-07 10:29 . 2008-03-25 22:45 -------- d-----w c:\documents and settings\All Users\Application Data\Trend Micro
2009-04-07 10:22 . 2007-03-20 22:28 -------- d-----w c:\program files\Trend Micro
2009-03-16 01:49 . 2009-03-16 01:49 -------- d-----w c:\program files\IObit
2009-03-08 19:09 . 2006-11-07 08:27 391536 ----a-w c:\windows\SYSTEM32\DLLCACHE\iedkcs32.dll
2009-03-08 19:09 . 2006-10-17 17:04 638816 ----a-w c:\windows\SYSTEM32\DLLCACHE\iexplore.exe
2009-03-08 09:41 . 2007-03-20 22:47 5937152 ----a-w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2009-03-08 09:39 . 2007-06-27 14:34 11063808 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieframe.dll
2009-03-08 09:34 . 2007-03-20 22:47 914944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wininet.dll
2009-03-08 09:34 . 2005-06-18 04:49 914944 ----a-w c:\windows\SYSTEM32\wininet.dll
2009-03-08 09:34 . 2007-03-20 22:47 1206784 ----a-w c:\windows\SYSTEM32\DLLCACHE\urlmon.dll
2009-03-08 09:34 . 2006-11-08 02:03 236544 ----a-w c:\windows\SYSTEM32\DLLCACHE\webcheck.dll
2009-03-08 09:34 . 2005-06-27 16:17 43008 ----a-w c:\windows\SYSTEM32\licmgr10.dll
2009-03-08 09:34 . 2005-06-27 16:17 43008 ----a-w c:\windows\SYSTEM32\DLLCACHE\licmgr10.dll
2009-03-08 09:34 . 2006-10-17 17:05 105984 ----a-w c:\windows\SYSTEM32\DLLCACHE\url.dll
2009-03-08 09:34 . 2007-03-20 22:47 193536 ----a-w c:\windows\SYSTEM32\DLLCACHE\msrating.dll
2009-03-08 09:34 . 2006-10-17 17:04 109568 ----a-w c:\windows\SYSTEM32\DLLCACHE\occache.dll
2009-03-08 09:33 . 2006-09-18 14:15 759296 ----a-w c:\windows\SYSTEM32\DLLCACHE\VGX.dll
2009-03-08 09:33 . 2009-03-08 09:33 18944 ------w c:\windows\SYSTEM32\DLLCACHE\corpol.dll
2009-03-08 09:33 . 2005-06-27 16:18 18944 ----a-w c:\windows\SYSTEM32\corpol.dll
2009-03-08 09:33 . 2007-03-20 22:47 25600 ----a-w c:\windows\SYSTEM32\DLLCACHE\jsproxy.dll
2009-03-08 09:33 . 2008-05-09 10:53 726528 ----a-w c:\windows\SYSTEM32\DLLCACHE\jscript.dll
2009-03-08 09:33 . 2006-11-07 08:27 229376 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieaksie.dll
2009-03-08 09:33 . 2008-05-09 10:53 420352 ----a-w c:\windows\SYSTEM32\DLLCACHE\vbscript.dll
2009-03-08 09:33 . 2005-06-27 16:17 420352 ----a-w c:\windows\SYSTEM32\vbscript.dll
2009-03-08 09:33 . 2006-11-07 08:26 125952 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieakeng.dll
2009-03-08 09:32 . 2005-06-27 16:18 72704 ----a-w c:\windows\SYSTEM32\DLLCACHE\admparse.dll
2009-03-08 09:32 . 2005-06-27 16:18 72704 ----a-w c:\windows\SYSTEM32\admparse.dll
2009-03-08 09:32 . 2006-11-07 08:26 173056 ----a-w c:\windows\SYSTEM32\DLLCACHE\ie4uinit.exe
2009-03-08 09:32 . 2002-08-29 11:00 163840 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieakui.dll
2009-03-08 09:32 . 2006-11-07 08:26 71680 ----a-w c:\windows\SYSTEM32\DLLCACHE\iesetup.dll
2009-03-08 09:32 . 2006-11-07 08:26 55808 ----a-w c:\windows\SYSTEM32\DLLCACHE\iernonce.dll
2009-03-08 09:32 . 2005-06-27 16:17 71680 ----a-w c:\windows\SYSTEM32\iesetup.dll
2009-03-08 09:32 . 2006-11-07 08:26 128512 ----a-w c:\windows\SYSTEM32\DLLCACHE\advpack.dll
2009-03-08 09:32 . 2005-06-27 16:17 94720 ----a-w c:\windows\SYSTEM32\DLLCACHE\inseng.dll
2009-03-08 09:32 . 2007-06-27 14:34 594432 ----a-w c:\windows\SYSTEM32\DLLCACHE\msfeeds.dll
2009-03-08 09:32 . 2007-06-27 14:34 1985024 ----a-w c:\windows\SYSTEM32\DLLCACHE\iertutil.dll
2009-03-08 09:32 . 2007-03-20 22:47 611840 ----a-w c:\windows\SYSTEM32\DLLCACHE\mstime.dll
2009-03-08 09:24 . 2006-10-17 16:44 68608 ----a-w c:\windows\SYSTEM32\DLLCACHE\hmmapi.dll
2009-03-08 09:22 . 2002-08-29 11:00 156160 ----a-w c:\windows\SYSTEM32\msls31.dll
2009-03-08 09:22 . 2002-08-29 11:00 156160 ----a-w c:\windows\SYSTEM32\DLLCACHE\msls31.dll
2009-03-08 09:11 . 2007-06-27 14:34 445952 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieapfltr.dll
2009-02-09 11:13 . 2008-10-16 01:02 1846784 ------w c:\windows\SYSTEM32\DLLCACHE\win32k.sys
2009-02-09 11:13 . 2005-06-27 16:17 1846784 ----a-w c:\windows\SYSTEM32\win32k.sys
2009-02-07 02:07 . 2007-04-17 09:32 3698584 ----a-w c:\windows\SYSTEM32\DLLCACHE\ieapfltr.dat
2009-02-05 03:50 . 2009-02-05 03:51 410984 ----a-w c:\windows\SYSTEM32\deploytk.dll
2006-08-06 20:02 . 2006-08-06 20:02 0 -c-ha-w c:\documents and settings\NetworkService\hpothb07.dat
2004-08-15 01:51 . 2004-08-15 01:51 0 -c--a-w c:\documents and settings\Guest\ad.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"Advanced SystemCare 3"="c:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-02-22 2272592]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-04-07 492808]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600]
"Share-to-Web Namespace Daemon"="c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe" [2002-04-11 69632]
"DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672]
"diagent"="c:\program files\Creative\SBLive\Diagnostics\diagent.exe" [2002-04-03 135264]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-10-06 5058560]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]
"UfSeAgnt.exe"="c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe" [2009-04-07 995528]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"OE"="c:\program files\Trend Micro\Internet Security\TMAS_OE\TMAS_OEMon.exe" [2009-04-07 492808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= c:\windows\System32\ctmp3.acm

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
--a------ 2002-04-10 17:44 679936 c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-10-01 19:57 289576 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-09-06 16:09 413696 c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=3 (0x3)
"SBService"=2 (0x2)
"NPFMntor"=2 (0x2)
"NISUM"=2 (0x2)
"LiveUpdate"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccEvtMgr"=2 (0x2)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"tmproxy"=2 (0x2)
"Tmntsrv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=
"c:\\WINDOWS\\SYSTEM32\\LEXPPS.EXE"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:@xpsp2res.dll,-22010
"3540:UDP"= 3540:UDP:@xpsp2res.dll,-22011
"1900:UDP"= 1900:UDP:@xpsp2res.dll,-22007
"443:TCP"= 443:TCP:HTTPS
"21:TCP"= 21:TCP:FTP

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R4 TmProxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-04-07 677128]
S2 Devx;Devx;c:\windows\system32\drivers\Devx.sys [2001-09-06 4448]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-04-07 50192]
S2 TmPfw;Trend Micro Personal Firewall;c:\program files\Trend Micro\Internet Security\TmPfw.exe [2009-04-07 497008]
S2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2009-04-07 36368]
S2 VtPr;VtPr;c:\windows\system32\drivers\VtPr.sys [2001-10-10 3328]
S2 YahooAUService;Yahoo! Updater;c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe [2008-11-09 602392]
S3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\DRIVERS\TM_CFW.sys [2009-04-07 335376]


--- Other Services/Drivers In Memory ---

*Deregistered* - ALG
*Deregistered* - Apple Mobile Device
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - Beep
*Deregistered* - BITS
*Deregistered* - Bonjour Service
*Deregistered* - Browser
*Deregistered* - Cdfs
*Deregistered* - Creative Service for CDROM Access
*Deregistered* - CryptSvc
*Deregistered* - DcomLaunch
*Deregistered* - Devx
*Deregistered* - Dhcp
*Deregistered* - Dnscache
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fallback
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Fsks
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - HTTP
*Deregistered* - i2omgmt
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - K56
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LexBceS
*Deregistered* - LmHosts
*Deregistered* - MCSTRM
*Deregistered* - mdmxsdk
*Deregistered* - mmc_2K
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxDAV
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - NVSvc
*Deregistered* - omci
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - PfModNT
*Deregistered* - PolicyAgent
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - PSched
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - Secdrv
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SfCtlCom
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - SoftFax
*Deregistered* - SpeakerPhone
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - symlcbrd
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - tmactmon
*Deregistered* - TMBMServer
*Deregistered* - tmcfw
*Deregistered* - tmcomm
*Deregistered* - tmevtmgr
*Deregistered* - TmPfw
*Deregistered* - tmpreflt
*Deregistered* - tmtdi
*Deregistered* - tmxpflt
*Deregistered* - Tones
*Deregistered* - TrkWks
*Deregistered* - tunmp
*Deregistered* - UdfReadr_xp
*Deregistered* - Update
*Deregistered* - V124
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - vsapint
*Deregistered* - VtPr
*Deregistered* - w32time
*Deregistered* - Wanarp
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
*Deregistered* - YahooAUService

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c45e8a19-f5ab-11da-8390-00038a000015}]
\Shell\AutoRun\command - E:\iPodSetup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ca7690ff-7940-11dd-846d-0007e9bc811c}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
c:\windows\system32\rundll32.exe c:\windows\system32\advpack.dll,LaunchINFSectionEx c:\program files\Internet Explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
Contents of the 'Scheduled Tasks' folder

2009-04-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{00A6FAF6-072E-44cf-8957-5838F569A31D} - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.mail.yahoo.com/
mSearch Bar =
uInternet Settings,ProxyOverride = *.local
IE: &Search
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-12 12:33
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(744)
c:\windows\system32\ieframe.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\LEXBCES.EXE
c:\windows\SYSTEM32\LEXPPS.EXE
c:\program files\Trend Micro\BM\TMBMSRV.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\SYSTEM32\nvsvc32.exe
c:\program files\Trend Micro\Internet Security\SfCtlCom.exe
c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
.
**************************************************************************
.
Completion time: 2009-04-12 12:47 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-12 17:46
ComboFix2.txt 2009-04-07 19:55

Pre-Run: 53,970,436,096 bytes free
Post-Run: 53,959,618,560 bytes free

386 --- E O F --- 2009-04-09 13:22


the virus total results are as follows:

0 bytes size received / Se ha recibido un archivo vacio


I am not sure if this worked correctly or not.


Report •

#8
April 12, 2009 at 16:32:47
It worked good enough. Do the following clean-up then run the online scan. The online scan is long so be patient while it runs.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
6. Click View scan report at the bottom.
7. Click the Save Report As... button.
8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Report •


Ask Question