Network Problems And Extra Volume

jfs_1950

Hello,

I've come down with a nasty piece of malware. Running WinXP Home, SP2 on a greybox, legal version of the OS.

A couple of days ago BD found and quarantined a virus. I sent it & deleted, and don't remember what it was. But next time I booted, the machine began steady low level network traffic, up and down. I blocked the network, unplugged the ethernet cable, and started looking around:

Task manager was showing several instances of svchost.exe, also alg.exe which was not visible before.

Task manager was showing instances of local service and network service along with system and my login.

Network settings control panel was showing a new network connection, named application layer gateway. I could disable this, which killed my network connection, but could not delete it. Prior network connection was still visible and when I disabled it, that also killed the network connection.

Unable to create a new network connection.

Also, on my old boot drive (with a damaged version of WinXP home) I found a 16GB volume that I certainly didn't put there. Running apps of Ultimate Boot Disk showed "unknown" for disk type (rest of the drive, like the others, is NTFS).

Ran a complete system scan with BD and it quarantined trojan.generic-165605. Also ran full scans with Windows Defender, Ad-aware, and Spybot, and they showed nothing unusual.

But since then, the new network connection is no longer visible. And in normal windows mode, the original network icon shows that it is enabled and connected. However the network is not functioning and I cannot send a ping.

If I reboot into safe mode with networking, the network is operational and seems to behave itself; at least, I'm not seeing any excessive activity on the switch my machine is connected to.

I haven't tried anything irreversible (e.g., wipe that drive with the weird volume) or windows repair. But here is my HiJack This file (windows normal mode):

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:23:50 PM, on 5/31/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

E:\WINDOWS\System32\smss.exe

E:\WINDOWS\system32\winlogon.exe

E:\WINDOWS\system32\services.exe

E:\WINDOWS\system32\lsass.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\Windows Defender\MsMpEng.exe

E:\WINDOWS\System32\svchost.exe

E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

E:\WINDOWS\system32\spoolsv.exe

E:\WINDOWS\Explorer.EXE

E:\Program Files\FarStone\RestoreIT\RestoreIT_XP\VBPTASK.EXE

E:\WINDOWS\system32\RUNDLL32.EXE

E:\Program Files\Intel\IDU\iptray.exe

E:\Program Files\SiteAdvisor\6261\SiteAdv.exe

E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

E:\Program Files\BitDefender\BitDefender 2008\bdagent.exe

E:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe

E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

E:\Program Files\Microsoft IntelliPoint\ipoint.exe

E:\Program Files\iTunes\iTunesHelper.exe

E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe

E:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe

E:\Program Files\Windows Defender\MSASCui.exe

E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

E:\Program Files\SEC\Natural Color\NaturalColorLoad.exe

E:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

E:\Program Files\Intel\IDU\awServ.exe

E:\Program Files\Bonjour\mDNSResponder.exe

E:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

E:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe

E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe

E:\WINDOWS\system32\nvsvc32.exe

E:\Program Files\SiteAdvisor\6261\SAService.exe

E:\WINDOWS\system32\svchost.exe

E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

E:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

E:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

E:\Program Files\BitDefender\BitDefender 2008\vsserv.exe

E:\Program Files\iPod\bin\iPodService.exe

E:\WINDOWS\System32\svchost.exe

E:\WINDOWS\system32\wuauclt.exe

\Upgrades\highjackthis\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - E:\Program Files\SiteAdvisor\6261\SiteAdv.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - E:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll

O4 - HKLM\..\Run: [sigmatelSysTrayApp] sttray.exe

O4 - HKLM\..\Run: [intelAudioStudio] "E:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" BOOT

O4 - HKLM\..\Run: [DiskeeperSystray] "E:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [RestoreIT!] "E:\Program Files\FarStone\RestoreIT\RestoreIT_XP\VBPTASK.EXE" VBStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ipTray.exe] "E:\Program Files\Intel\IDU\iptray.exe"

O4 - HKLM\..\Run: [siteAdvisor] "E:\Program Files\SiteAdvisor\6261\SiteAdv.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "E:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"

O4 - HKLM\..\Run: [bDAgent] "E:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"

O4 - HKLM\..\Run: [XboxStat] "e:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun

O4 - HKLM\..\Run: [sunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [intelliPoint] "E:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKLM\..\Run: [QuickTime Task] "E:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [MaxtorOneTouch] E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe

O4 - HKLM\..\Run: [mxomssmenu] "E:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"

O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [spybotSD TeaTimer] E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: NaturalColorLoad.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1203385224984

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1203385217703

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe Active File Monitor V5 (AdobeActiveFileMonitor5.0) - Unknown owner - E:\Program Files\Adobe\Photoshop Elements 5.0\PhotoshopElementsFileAgent.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - E:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Admin Works Agent X8 (AWService) - OSA Technologies Inc., An Avocent Company - E:\Program Files\Intel\IDU\awServ.exe

O23 - Service: Bonjour Service - Apple Inc. - E:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Diskeeper - Diskeeper® Corporation - E:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: iPod Service - Apple Inc. - E:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - E:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: MaxBackServiceInt - Unknown owner - E:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe

O23 - Service: MaxSyncService (NTService1) - - E:\Program Files\Maxtor\OneTouch\Utils\SyncServices.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PinnacleUpdate Service (PinnacleUpdateSvc) - KALiNKOsoft - E:\Program Files\KALiNKOsoft\Pinnacle Game Profiler\pinnacle_updater.exe

O23 - Service: SiteAdvisor Service - Unknown owner - E:\Program Files\SiteAdvisor\6261\SAService.exe

O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - E:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - E:\Program Files\BitDefender\BitDefender 2008\vsserv.exe

O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - E:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

End of file - 8539 bytes

Thanks in advance for any help you can give me on this one!

jfs

Find more posts tagged with

Comments

rootkit

The log is clean !

jfs_1950

The log is clean !

Hmm, thanks! Guess I will work to fix the windows network problem...and the weird disk volume. Appreciate your looking at my data!

jfs

rootkit

What version of BD do you have ?! (9/10/11 ?!)

Antivirus or Internet Security ?!

Please try to run a complete scan with SUPERAntiSpyware (ad-aware && Windows Defender don't do the job)

Niels

Hello jfs_1950,

If you are using BitDefender Total Security 2008 (this is version 11) or BitDefender Internet Security 2008 navigate to the firewall section and more specificly to the zones section. Do you see any untrusted network? If so double click on it and change it to trusted. After that go to the traffic tab and press on reset profile. Reboot your pc.

If that fails try this first right click on your network connection and click on repair. Reboot your pc afterwards see if you still have the problem in normal mode. If that is the case please download winsockfix from here. Download it and press on fix and reboot your pc afterwards. Try also this unplug the main powercable of your router for 30 seconds and plug it back in.

Best regards

Niels

jfs_1950

What version of BD do you have ?! (9/10/11 ?!)

Antivirus or Internet Security ?!

Please try to run a complete scan with SUPERAntiSpyware (ad-aware && Windows Defender don't do the job)

Well, the malware won't let me install SUPERAntiSpyware. If I try it says the administrator has set policies to prevent it. And when I go into properties and try to reset the security settings, it will not let me. The "OK" button is greyed out. Attempting to do it in safe mode. Logging in as administrator or myself makes no difference. I guess it's afraid of this app so once I get this under control I guess I'll buy the full version! I never heard of this tool before, thanks for pointing me to it!

Regarding BitDefender I am running Internet Security 2008.

rootkit

http://www.softpedia.com/get/Antivirus/Mal...i-Malware.shtml

Try with this

jfs_1950

Okay, I tried Malwarebytes' Anti-Malware. Installed properly over the internet. Deep scan came up clean.

I still cannot install Superantispyware. I have tried the registry fixes I found on the web that supposedly address the "The system administrator has set policies to prevent this installation" error. Regedit showed normal indication for HKLM\software\policies\microsoft\windows\installer. And there is no visible registry entry for superantispyware at HKEY_CLASSES_ROOT\installer\products, so there's nothing to delete.

Tried to re-register the windows installer, no effect. Haven't tried reinstalling it yet. Hoping you can give me some advice on how to get my installer back so I can run superantispyware.

Network remains down in normal mode, but works in safe mode with networking, and with no abnormal indications on the external switch. I have not tried to fix it as you all advised, still hoping to verify whether or not the malware is dead.

And thanks for the help.

Niels

Hello jfs_1950,

Can you please download combofix you will find it here. Print the following instructions and read them carefully. Please post the output of the scan into your next post. So I or someone else can see if there is still some infections.

To change your rights please open the registry editor by pressing the windows button together with r now typ regedit press enter. Now right click on HKEY_LOCAL_MACHINE choose premissions see if your user account is allowed to have full access and has read access. If not check the boxes and press on apply and ok. You have to do this also for the 4 remaining folders. Reboot your pc and see if superantispyware can install now.

Best regards

Niels

jfs_1950

I can't tell you how much I appreciate your help.

Okay, the easy part first. I looked at my permissions in the registry and indeed, in one case (HKLM) I had limited rights. I fixed that and also found an "unknown user" and I deleted its rights.

Ran combofix in safe mode. Maybe that was a mistake and I should have done it in normal mode. If so sorry, the instructions didn't say which mode to run. But after that when I booted into normal mode I found two problems: (1) desktop now shows only wallpaper, no icons or taskbar. (2) Was seeing a lot of network traffic again. This could have been BitDefender doing an upgrade, because it has been disconnected for nearly a week, but I had no way of knowing so I yanked the cable and restarted into safe mode with networking.

Machine now takes quite a bit longer to load into normal mode than before.

Safe mode with networking seems to work ok. I still cannot install superantispyware, the same error (system administrator has set policies to prevent this installation) still comes up. The malware must really hate that program.

Here is the combofix log:

ComboFix 08-06-04.1 - Julius 2008-06-04 18:20:43.1 - NTFSx86 NETWORK

Running from: E:\Documents and Settings\Julius\Desktop\ComboFix.exe

((((((((((((((((((((((((( Files Created from 2008-05-04 to 2008-06-04 )))))))))))))))))))))))))))))))

2008-06-03 17:30 . 2008-06-03 17:30 <DIR> d-------- E:\Program Files\Malwarebytes' Anti-Malware

2008-06-03 17:30 . 2008-06-03 17:30 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Malwarebytes

2008-06-03 17:30 . 2008-06-03 17:30 <DIR> d-------- E:\Documents and Settings\Administrator\Application Data\Malwarebytes

2008-06-03 17:30 . 2008-05-30 01:06 34,296 --a------ E:\WINDOWS\system32\drivers\mbamcatchme.sys

2008-06-03 17:30 . 2008-05-30 01:06 15,864 --a------ E:\WINDOWS\system32\drivers\mbam.sys

2008-06-03 06:27 . 2008-06-03 06:27 <DIR> d---s---- E:\Documents and Settings\Administrator\UserData

2008-05-30 20:49 . 2008-05-30 20:49 <DIR> d-------- E:\Program Files\Spybot - Search & Destroy

2008-05-30 20:49 . 2008-05-30 21:11 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2008-05-30 20:26 . 2008-05-30 20:26 <DIR> d-------- E:\Program Files\Windows Defender

2008-05-29 20:16 . 2008-05-29 20:16 <DIR> d-------- E:\Program Files\Lavasoft

2008-05-29 20:16 . 2008-05-29 20:17 <DIR> d-------- E:\Documents and Settings\All Users\Application Data\Lavasoft

2008-05-29 20:10 . 2008-06-02 19:20 <DIR> d-------- E:\Program Files\Common Files\Wise Installation Wizard

2008-05-26 12:42 . 2008-05-26 12:42 <DIR> d--hs---- E:\WINDOWS\ftpcache

2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ E:\WINDOWS\system32\lsdelete.exe

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-05-28 23:57 --------- d-----w E:\Program Files\Mozilla Thunderbird

2008-05-28 00:00 --------- d-----w E:\Documents and Settings\All Users\Application Data\SiteAdvisor

2008-05-25 13:03 --------- d-----w E:\Program Files\Java

2008-05-24 18:51 --------- d-----w E:\Program Files\SiteAdvisor

2008-05-10 16:38 --------- d-----w E:\Documents and Settings\Julius\Application Data\SiteAdvisor

2008-05-03 19:28 --------- d-----w E:\Documents and Settings\All Users\Application Data\Maxtor

2008-05-03 19:26 --------- d-----w E:\Program Files\Maxtor

2008-05-03 19:25 --------- d--h--w E:\Program Files\InstallShield Installation Information

2008-04-29 15:20 15,648 ----a-w E:\WINDOWS\system32\drivers\NSDriver.sys

2008-04-29 15:19 15,648 ----a-w E:\WINDOWS\system32\drivers\Awrtrd.sys

2008-04-29 15:19 12,960 ----a-w E:\WINDOWS\system32\drivers\Awrtpd.sys

2008-04-12 19:55 --------- d-----w E:\Documents and Settings\All Users\Application Data\Apple Computer

2008-04-11 00:02 --------- d-----w E:\Program Files\NetWaiting

2008-04-10 23:47 --------- d-----w E:\Program Files\Hayes

2008-04-05 21:03 --------- d-----w E:\Program Files\QuickTime

2008-04-05 21:01 --------- d-----w E:\Program Files\iTunes

2008-04-05 21:01 --------- d-----w E:\Program Files\iPod

2008-04-05 20:56 --------- d-----w E:\Documents and Settings\Julius\Application Data\Apple Computer

2008-03-27 08:12 151,583 ----a-w E:\WINDOWS\system32\msjint40.dll

2008-03-19 09:47 1,845,248 ----a-w E:\WINDOWS\system32\win32k.sys

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="E:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SigmatelSysTrayApp"="sttray.exe" []

"IntelAudioStudio"="E:\Program Files\Intel Audio Studio\IntelAudioStudio.exe" [2006-08-02 18:17 9134080]

"DiskeeperSystray"="E:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [2006-02-24 20:29 196709]

"farstone"="" []

"RestoreIT!"="E:\Program Files\FarStone\RestoreIT\RestoreIT_XP\VBPTASK.exe" [2005-04-30 01:09 122880]

"NvCplDaemon"="E:\WINDOWS\system32\NvCpl.dll" [2007-05-11 07:03 8429568]

"nwiz"="nwiz.exe" [2007-05-11 07:03 1626112 E:\WINDOWS\system32\nwiz.exe]

"NvMediaCenter"="E:\WINDOWS\system32\NvMcTray.dll" [2007-05-11 07:03 81920]

"ipTray.exe"="E:\Program Files\Intel\IDU\iptray.exe" [2006-11-24 13:26 2209792]

"SiteAdvisor"="E:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-12-04 17:03 36640]

"Adobe Reader Speed Launcher"="E:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

"BitDefender Antiphishing Helper"="E:\Program Files\BitDefender\BitDefender 2008\IEShow.exe" [2007-10-09 16:46 61440]

"BDAgent"="E:\Program Files\BitDefender\BitDefender 2008\bdagent.exe" [2008-02-22 19:33 360448]

"XboxStat"="e:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" [2007-09-26 19:05 734264]

"SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]

"IntelliPoint"="E:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2006-11-21 21:09 842584]

"QuickTime Task"="E:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]

"iTunesHelper"="E:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]

"MaxtorOneTouch"="E:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-27 15:04 712704]

"mxomssmenu"="E:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2005-10-17 16:24 81920]

E:\Documents and Settings\All Users\Start Menu\Programs\Startup\

NaturalColorLoad.lnk - E:\Program Files\SEC\Natural Color\NaturalColorLoad.exe [2008-02-23 15:20:53 155715]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.dvacm"= E:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm

"msacm.mpegacm"= mpegacm.acm

"msacm.ulmp3acm"= ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"E:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"E:\\Program Files\\iTunes\\iTunes.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

bdx REG_MULTI_SZ scan

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]

\Shell\AutoRun\command - G:\setup.exe /autorun

\Shell\directx\command - G:\DirectX\dxsetup.exe

\Shell\setup\command - G:\setup.exe

*Newly Created Service* - CATCHME

Contents of the 'Scheduled Tasks' folder

"2008-06-04 22:11:56 E:\WINDOWS\Tasks\MP Scheduled Scan.job"

- E:\Program Files\Windows Defender\MpCmdRun.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-06-04 18:21:58

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: E:\WINDOWS\system32\winlogon.exe

-> E:\WINDOWS\system32\tsd32.dll

Completion time: 2008-06-04 18:22:32

ComboFix-quarantined-files.txt 2008-06-04 22:22:26

Pre-Run: 238,846,861,312 bytes free

Post-Run: 239,082,455,040 bytes free

114 --- E O F --- 2008-05-15 18:51:11

jfs_1950

Addendum after I thought about this. It is possible that my desktop problem came from running combofix in safe mode. Because when it cleared the desktop, the safe mode alert about running in safe mode came up. Usually you have to hit okay at that point and then windows loads the desktop. But the combofix instructions state you shouldn't do anything while combofix is doing its thing, so I didn't hit okay. And the desktop was black at the end, no icons, until I restarted.

Seems to me there might be an ambiguity in the combofix instructions. Not your fault, obviously.

So now, I have desktop icons or taskbar when in safe mode, but no icons or taskbar in normal mode. And I am not sure if this is due to the malware or due to combofix behavior when run in safe mode.

If you can help me get the icons and taskbar back in normal mode, I can run combofix again in normal mode and we can see if there are differences.

Thanks for the help!

Niels

Hello jfs_1950,

Please try this press the following keys together: ctrl+alt+del (control,alt and delete button) Go to the file menu and choose new task and type explorer.exe and press enter. If that fails reboot your pc into safe mode but select load lastworking configuration. So far I can't find any suspecious entries in your combofix log.Comboxfix should automatically reboot your pc.

Best regards

Niels

jfs_1950

Thank you Niels and Crysty2k5!

I will try that tonight. I do have control of the task mgr window.

I'm slowly chipping away at the malware's defenses that keep me from installing superantispyware. After I found the extra user in the registry (named S-1-5-21- with a long string of numbers following), I deleted that in the registry and restored my own rights I had lost. But from my quick look this morning I will have to drill down thru the disk volumes and folders to restore rights along the way. That's a project for tonight, as well as re-establishing the desktop and running combofix. BTW combofix did not restart my machine when I ran it in safe mode. Will run it in normal mode when I get the desktop back.

And with any luck I'll get superantispyware on the machine as well.

jfs_1950

I have deleted a malware user from the registry and from the folders where superantispyware installer is loaded, but still cannot get it to let me install. The app itself still is denying me security rights. The check boxes are disabled and I can't figure out how to enable them. While I was deleting the malware user from security it replicated itself in the security window but eventually I got rid of both.

Also, I'm finding that the unknown user S-1-5-21-plus many digits has propagated itself throughout my security tabs. To delete it I must open the tab, clear the inheritance, and then delete it from each and every folder and file. Do I need to do this? And if so, is there a quick way to do it? I was not surprised to find that this user does not appear in the user accounts control panel.

And still cannot run Superantispyware installer.

Got a desktop with "last known good configuration" but it took an incredibly long time and appears to hang at the point where BitDefender complains that it is shut off, and sets the balloon "click here to resolve the problem." Running explorer.exe in the task manager run menu doesn't seem to do anything, or maybe it just takes a really long time. When I try to shut down, explorer.exe hangs and I have to kill the process. And if I try to click anything in the desktop I get a permanent hourglass.

So still not there. Sheesh.

But really appreciate your help!

jfs_1950

Here is combofix log from running it with windows in normal mode. The recovery console somehow got uninstalled, and so I had to run it again after reinstalling.

Combofix seems to run normally but hangs after it opens the log. To get the computer back, I have to open the task manager and do a restart off the menu, and it takes several minutes to get a desktop in normal mode...it used to take only a few seconds.

And thanks for the help!

ComboFix 08-06-04.1 - Julius 2008-06-06 6:20:55.3 - NTFSx86

Running from: E:\Documents and Settings\Julius\Desktop\ComboFix.exe

((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))