Please Help Me With Nt_kernel Error 1256, Storageprotector.com

jmcook
jmcook
in Malware talk

This is driving me insane! Please help if you can


HijackThis:


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 8:58:16 PM, on 2/7/2008


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\Ati2evxx.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\spoolsv.exe


C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


C:\Program Files\Common Files\LightScribe\LSSrvc.exe


C:\WINDOWS\system32\HPZipm12.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\Ati2evxx.exe


C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


C:\Program Files\Viewpoint\Common\ViewpointService.exe


C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe


C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe


C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe


C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe


C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant .exe


C:\Program Files\Common Files\Symantec Shared\ccApp.exe


C:\Program Files\Synaptics\SynTP\SynTPEnh .exe


C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe


C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe


C:\Program Files\Common Files\Symantec Shared\ccApp .exe


C:\Program Files\iTunes\iTunesHelper.exe


C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe


C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe


C:\WINDOWS\system32\rundll32.exe


C:\Program Files\iTunes\iTunesHelper .exe


C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


C:\Program Files\Last.fm\LastFMHelper.exe


C:\WINDOWS\system32\wuauclt.exe


C:\Program Files\iPod\bin\iPodService.exe


C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe


C:\Program Files\Mozilla Firefox\firefox.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\explorer.exe


C:\Program Files\Trend Micro\HijackThis\Crusty.exe.exe


C:\WINDOWS\system32\windows


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html


R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com


R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://register.hp.com/servlet/WebReg.serv...&prodOS=011


F3 - REG:win.ini: load=C:\WINDOWS\system32\geeby.exe


O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll


O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\bdzcydph.dll


O2 - BHO: (no name) - {C24D45A3-3D3F-4EDF-A85F-9AE27C25D0D6} - C:\WINDOWS\system32\geeby.dll


O2 - BHO: {a58fbb5f-85fb-c91a-cf44-8022a1c4a40e} - {e04a4c1a-2208-44fc-a19c-bf58f5bbf85a} - C:\WINDOWS\system32\buhomunr.dll


O2 - BHO: (no name) - {FC1B64D9-3499-4791-82D5-AABAC3FAEA45} - C:\WINDOWS\system32\qomliii.dll


O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll


O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll


O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe


O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe


O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe


O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start


O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe


O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe


O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"


O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"


O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe


O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup


O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime


O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"


O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe


O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


O4 - HKLM\..\Run: [09ed7103] rundll32.exe "C:\WINDOWS\system32\aqlxxiai.dll",b


O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe


O4 - Startup: SCRABBLE Complete Registration.lnk = C:\Documents and Settings\Valerie Cook\Local Settings\Temp\{8D32465D-38FF-46C6-959D-85B77638F01D}\{B36649A3-D0DD-4706-B042-F5B384529C7A}\ATR1.exe


O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL


O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll


O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155979773375


O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab


O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab


O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


O20 - Winlogon Notify: bdzcydph - C:\WINDOWS\SYSTEM32\bdzcydph.dll


O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe


O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\ecglltue.exe (file missing)


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe


O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


--


End of file - 11628 bytes


thank you so much in advance

Comments

  • farbar
    farbar ✭
    edited February 2008

    Hi,


    Step 1.


    Please run Notepad and copy the following text into a new file:



    @ECHO OFF


    sc config DomainService start= disabled


    sc stop DomainService


    sc delete DomainService


    del crusty.bat



    Save the file to the desktop as crusty.bat and make sure the "Save as type" field says "All files". Locate crusty.bat on the Desktop and double-click on it to run it. Please note any errors encountered.


    Step 2.


    • Download ComboFix.exe to your desktop using this link:


      bleepingcomputer

    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.
    • Double click on combofix.exe to run the programme & then follow the prompts.


      When finished, it will produce a report for you. Please post the content of this log ("C:\ComboFix.txt") into your next post. If combofix.txt contains a long list of deleted pos*.tmp files remove all but a few pos.tmp from the log (leave a few from each directory so that I kan see where they were created) and then copy and paste the log.

    • ComboFix may need to reboot to finish its work. Let it.
    • Note:Do not mouseclick combofix's window while it's running. That may cause it to stall
    Step 3.


    Reboot, make a fresh HJT log and post it along with the combofix log.

  • jmcook
    jmcook

    Thanks farbar,


    I ran ComboFix and it worked for about fifteen minutes and then had to reboot. Upon rebooting, there was an error (saying the combofix file was not found) so I ran it again. The same thing happened again upon rebooting. All of the .tmp files are now gone and "kernel error 1256" did not come up last time I rebooted. However, I am still having the problem with my C:\ having a big red X as the icon.


    Because Combofix did not run all the way through, I have no log of it. Here is my hijack this log:


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 00:50, on 2008-02-10


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Viewpoint\Common\ViewpointService.exe


    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\wscntfy.exe


    C:\WINDOWS\Explorer.EXE


    C:\WINDOWS\system32\wuauclt.exe


    C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


    C:\Program Files\Last.fm\LastFMHelper.exe


    C:\Program Files\Mozilla Firefox\firefox.exe


    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe


    C:\WINDOWS\system32\wuauclt.exe


    C:\Program Files\Trend Micro\HijackThis\Crusty.exe.exe


    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank


    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html


    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ycomp/def...//www.yahoo.com


    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://register.hp.com/servlet/WebReg.serv...&prodOS=011


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll


    O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll


    O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start


    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe


    O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime


    O4 - HKLM\..\Run: [Winupdate Engine] C:\WINDOWS\system32\wupeng.exe


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\kmd.exe /c C:\ComboFix(2)\Combobatch.bat


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe


    O4 - Startup: SCRABBLE Complete Registration.lnk = C:\Documents and Settings\Valerie Cook\Local Settings\Temp\{8D32465D-38FF-46C6-959D-85B77638F01D}\{B36649A3-D0DD-4706-B042-F5B384529C7A}\ATR1.exe


    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL


    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155979773375


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows (file missing)


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


    --


    End of file - 8917 bytes

  • farbar
    farbar ✭
    edited February 2008

    Please give me step by step feedback.


    Step 1.


    Viewpoint is not spyware or adware but is installed without the knowledge of the user. If you don't specifically need or use it you may uninstall it from add/remove programs.


    Step 2.


    Uninstall combofix to do that go to: Start >> Run... Type: Combofix /u and click OK.


    If you face any problem with uninstalling manually remove combofix and C:\Qoobox


    step 3.


    Use this URL to download the latest version (the file contains both English and French versions):


    http://siri.urz.free.fr/Fix/SmitfraudFix.exe

    Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually) Double-click SmitfraudFix.exe Select 2 and hit Enter to delete infect files.You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection. The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt Step 4.


    Download a fresh combofix from the link given earlier and run it. Terminate all realtime protections before running it.


    Step 5.


    Make a fresh HJT log and post it along with combofix log and smitfraud log.


  • farbar
    farbar ✭
    edited February 2008

    If you have not done the steps yet please do the following first. otherwise do it anyway in any stage:


    @ECHO OFF


    sc config MSControlService start= disabled


    sc stop MSControlService


    sc delete MSControlService


    del remove.bat


    Save the file to the desktop as remove.bat and make sure the "Save as type" field says "All files". Locate remove.bat on the Desktop and double-click on it to run it. Please note any errors encountered.

  • jmcook
    jmcook

    1. I saved remove.bat to the desktop. When I opened it, it quickly opened to a black window with text that closed immediately on its own and disappeared from the desktop.


    2. I successfully uninstalled combofix.


    3. then ran Smitfraud successfully. It did not require a reboot


    SmitFraudFix v2.286


    Scan done at 12:13:01.90, 2008-02-10


    Run from C:\Documents and Settings\Valerie Cook\Desktop\SmitfraudFix


    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT


    The filesystem type is NTFS


    Fix run in safe mode


    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix


    !!!Attention, following keys are not inevitably infected!!!


    SrchSTS.exe by S!Ri


    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost


    »»»»»»»»»»»»»»»»»»»»»»»» VACFix


    VACFix


    Credits: Malware Analysis & Diagnostic


    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix


    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix


    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix


    IEDFix


    Credits: Malware Analysis & Diagnostic


    Code: S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» DNS


    HKLM\SYSTEM\CCS\Services\Tcpip\..\{00B6F670-97E6-4DFE-A443-30B3C4B27395}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CCS\Services\Tcpip\..\{3A383463-01B5-449B-8329-770EF9515904}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CCS\Services\Tcpip\..\{6E24C2DF-7F99-4E8B-BF34-C8E9A8E95D38}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS1\Services\Tcpip\..\{00B6F670-97E6-4DFE-A443-30B3C4B27395}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS1\Services\Tcpip\..\{3A383463-01B5-449B-8329-770EF9515904}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS1\Services\Tcpip\..\{6E24C2DF-7F99-4E8B-BF34-C8E9A8E95D38}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS2\Services\Tcpip\..\{00B6F670-97E6-4DFE-A443-30B3C4B27395}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS2\Services\Tcpip\..\{3A383463-01B5-449B-8329-770EF9515904}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS2\Services\Tcpip\..\{6E24C2DF-7F99-4E8B-BF34-C8E9A8E95D38}: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.87.71.226 68.87.73.242


    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=68.87.71.226 68.87.73.242


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System


    !!!Attention, following keys are not inevitably infected!!!


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]


    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning


    Registry Cleaning done.


    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix


    !!!Attention, following keys are not inevitably infected!!!


    SrchSTS.exe by S!Ri


    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End


    4. Combofix ran successfully and quickly, did not require a reboot.


    ComboFix 08-02.05.3 - Valerie Cook 2008-02-10 12:34:57.5 - NTFSx86


    Running from: C:\Documents and Settings\Valerie Cook\Desktop\ComboFix.exe


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


    .


    ((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))


    .


    2008-02-10 12:30 . 2008-02-10 12:30 <DIR> d-------- C:\WINDOWS\LastGood


    2008-02-10 12:13 . 2008-02-10 12:13 2,858 --a------ C:\WINDOWS\system32\tmp.reg


    2008-02-09 18:15 . 2008-02-09 18:44 60,416 --a------ C:\WINDOWS\system32\drivers\ComboFix.sys


    2008-02-09 15:30 . 2008-02-09 15:30 338,432 --a------ C:\WINDOWS\system32\RCX944.tmp


    2008-02-07 20:35 . 2008-02-07 20:35 <DIR> d-------- C:\Program Files\Trend Micro


    2008-02-07 18:57 . 2004-08-04 07:00 388,608 --a------ C:\kmd.exe


    2008-02-07 13:14 . 2008-02-07 13:14 338,432 --a------ C:\WINDOWS\system32\RCXDC8.tmp


    2008-02-07 11:45 . 2008-02-07 12:18 <DIR> d-------- C:\Program Files\CleanUp!


    2008-01-29 14:43 . 2004-08-04 07:00 455,168 --a--c--- C:\WINDOWS\system32\dllcache\tintsetp.exe


    2008-01-24 10:45 . 2008-01-24 10:45 <DIR> d-------- C:\Documents and Settings\Valerie Cook\Citrix


    2008-01-17 21:22 . 2008-01-17 21:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems


    2008-01-16 17:45 . 2008-02-09 23:32 54,156 --ah----- C:\WINDOWS\QTFont.qfn


    2008-01-16 17:45 . 2008-01-16 17:45 1,409 --a------ C:\WINDOWS\QTFont.for


    2008-01-16 15:50 . 2004-08-04 07:00 131,584 --a--c--- C:\WINDOWS\system32\dllcache\pmxviceo.dll


    2008-01-16 15:49 . 2004-08-04 07:00 92,416 --a--c--- C:\WINDOWS\system32\dllcache\mga.sys


    2008-01-16 15:49 . 2004-08-04 07:00 92,032 --a--c--- C:\WINDOWS\system32\dllcache\mga.dll


    2008-01-16 15:49 . 2001-08-17 22:36 65,536 --a--c--- C:\WINDOWS\system32\dllcache\EXCH_mailmsg.dll


    2008-01-16 15:49 . 2004-08-04 07:00 35,328 --a--c--- C:\WINDOWS\system32\dllcache\iprip.dll


    2008-01-16 15:49 . 2004-08-04 07:00 33,792 --a--c--- C:\WINDOWS\system32\dllcache\lmmib2.dll


    2008-01-16 15:49 . 2004-08-04 07:00 22,528 --a--c--- C:\WINDOWS\system32\dllcache\lpdsvc.dll


    2008-01-16 15:49 . 2004-08-04 07:00 18,944 --a--c--- C:\WINDOWS\system32\dllcache\lprmon.dll


    2008-01-16 15:49 . 2004-08-04 07:00 18,432 --a--c--- C:\WINDOWS\system32\dllcache\jupiw.dll


    2008-01-16 15:49 . 2004-08-04 07:00 7,680 --a--c--- C:\WINDOWS\system32\dllcache\migregdb.exe


    2008-01-16 15:47 . 2004-08-04 07:00 331,264 --a--c--- C:\WINDOWS\system32\dllcache\aqueue.dll


    2008-01-16 15:46 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll


    2008-01-16 15:38 . 2008-01-16 15:38 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest


    2008-01-16 15:37 . 2008-01-16 15:37 749 -rah----- C:\WINDOWS\WindowsShell.Manifest


    2008-01-16 15:37 . 2008-01-16 15:37 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest


    2008-01-16 15:37 . 2008-01-16 15:37 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest


    2008-01-16 15:37 . 2008-01-16 15:37 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest


    2008-01-16 15:36 . 2004-08-04 07:00 16,384 --a--c--- C:\WINDOWS\system32\dllcache\isignup.exe


    2008-01-16 14:45 . 2004-08-04 07:00 10,129,408 --a--c--- C:\WINDOWS\system32\dllcache\hwxkor.dll


    2008-01-16 14:44 . 2004-08-04 07:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll


    2008-01-16 14:43 . 2004-08-04 07:00 2,012,670 --a--c--- C:\WINDOWS\system32\dllcache\NT5.CAT


    2008-01-16 14:08 . 2008-01-29 01:05 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe


    2008-01-16 14:04 . 2008-01-16 14:04 338,432 --a------ C:\WINDOWS\system32\RCX788.tmp


    2008-01-14 17:01 . 2008-01-14 17:01 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared


    2008-01-14 16:24 . 2008-01-14 16:23 103,424 --a------ C:\WINDOWS\system32\drvnud.dll


    2008-01-12 20:34 . 2008-01-12 20:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Last.fm


    2008-01-12 20:31 . 2008-01-12 20:31 <DIR> d-------- C:\Program Files\Last.fm


    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    2008-02-10 17:03 --------- d-----w C:\Program Files\Common Files\Symantec Shared


    2008-02-10 17:02 --------- d-----w C:\Program Files\Viewpoint


    2008-02-10 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint


    2008-02-09 22:57 --------- d-----w C:\Program Files\QuickTime


    2008-02-09 22:57 --------- d-----w C:\Program Files\iTunes


    2008-02-09 20:50 --------- d-----w C:\Program Files\Norton Internet Security


    2008-02-07 18:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec


    2008-02-06 17:10 2,382 ----a-w C:\Documents and Settings\Valerie Cook\Application Data\wklnhst.dat


    2008-01-30 22:39 --------- d-----w C:\Program Files\Common Files\Adobe


    2008-01-30 22:15 --------- d-----w C:\Documents and Settings\Valerie Cook\Application Data\AdobeUM


    2008-01-26 02:10 --------- d-----w C:\Documents and Settings\Valerie Cook\Application Data\Move Networks


    2008-01-18 20:00 --------- d-----w C:\Program Files\Norton Security Scan


    2008-01-18 17:56 --------- d-----w C:\Program Files\Soulseek


    2008-01-01 16:11 --------- d-----w C:\Program Files\Common Files\AOL


    2008-01-01 16:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL


    2007-12-12 22:03 --------- d-----w C:\Program Files\Audacity


    2007-12-10 19:23 --------- d-----w C:\Program Files\Microsoft ActiveSync


    2007-12-10 19:19 --------- d-----w C:\Program Files\Microsoft.NET


    2007-12-10 19:16 --------- d-----w C:\Program Files\TDC


    2006-08-30 00:05 56 --sha-r C:\WINDOWS\system32\4E046D745F.sys


    2007-10-21 20:04 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys


    .


    <pre>
    ----a-w           253,952 2008-02-09 22:24:32  C:\hp\drivers\hplsbwatcher\lsburnwatcher .exe
    ----a-w            39,792 2008-02-09 20:32:08  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
    ----a-w           339,968 2008-02-09 22:23:57  C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
    ----a-w            81,920 2008-02-09 20:32:05  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
    ----a-w           115,816 2008-02-09 22:24:34  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
    ----a-w            49,152 2008-02-09 22:24:22  C:\Program Files\Hp\HP Software Update\HPWuSchd2 .exe
    ----a-w           233,534 2008-02-09 22:24:23  C:\Program Files\HPQ\Default Settings\cpqset .exe
    ----a-w           794,624 2008-02-09 22:24:04  C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
    ----a-w           290,816 2008-01-30 17:32:19  C:\Program Files\HPQ\Quick Launch Buttons\EabServr .exe
    ----a-w           267,048 2008-02-09 22:25:02  C:\Program Files\iTunes\iTunesHelper .exe
    ----a-w           132,496 2008-02-09 20:31:59  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
    ----a-w         1,694,208 2008-02-09 22:25:48  C:\Program Files\Messenger\msmsgs .exe
    ----a-w            26,248 2008-02-07 18:50:45  C:\Program Files\Norton Internet Security\osCheck .exe
    ----a-w           692,316 2008-02-09 22:24:11  C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
    ----a-w           102,492 2008-02-04 18:53:00  C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
    ----a-w           208,952 2008-02-09 22:25:19  C:\WINDOWS\ime\imjp8_1\IMJPMIG .EXE
    ----a-w            15,360 2008-01-29 06:05:17  C:\WINDOWS\system32\ctfmon .exe
    ----a-w            59,392 2008-01-29 06:03:13  C:\WINDOWS\system32\IME\PINTLGNT\ImScInst .exe
    ----a-w           795,648 2008-01-31 16:20:01  C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP .EXE
    </pre>


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    .


    *Note* empty entries & legit default entries are not shown


    REGEDIT4


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]


    "eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [ ]


    "Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [ ]


    "NetscapeClient"="" []


    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [ ]


    "QuickTime Task"="C:\Program Files\QuickTime\QTTask .exe" [ ]


    "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 07:00 208952]


    "MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [ ]


    "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [ ]


    "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [ ]


    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]


    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2003-07-14 22:53 34880]


    C:\Documents and Settings\Valerie Cook\Start Menu\Programs\Startup\


    Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-01-12 20:31:17 106496]


    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\


    HP Digital Imaging Monitor.lnk - C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]


    R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 10:18]


    .


    Contents of the 'Scheduled Tasks' folder


    "2008-01-28 18:36:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"


    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe


    "2008-01-27 07:38:02 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Valerie Cook.job"


    - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exeh/TASK:


    "2008-02-08 20:00:00 C:\WINDOWS\Tasks\Norton Security Scan.job"


    - C:\Program Files\Norton Security Scan\Nss.exe


    .


    **************************************************************************


    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net


    Rootkit scan 2008-02-10 12:40:58


    Windows 5.1.2600 Service Pack 2 NTFS


    scanning hidden processes ...


    scanning hidden autostart entries ...


    scanning hidden files ...


    scan completed successfully


    hidden files: 0


    **************************************************************************


    .


    Completion time: 2008-02-10 12:45:38


    .


    2008-02-10 16:37:41 --- E O F ---


    5. I then ran hijackthis:


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 12:57, on 2008-02-10


    Platform: Windows XP SP2 (WinNT 5.01.2600)


    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


    Boot mode: Normal


    Running processes:


    C:\WINDOWS\System32\smss.exe


    C:\WINDOWS\system32\winlogon.exe


    C:\WINDOWS\system32\services.exe


    C:\WINDOWS\system32\lsass.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\WINDOWS\system32\svchost.exe


    C:\WINDOWS\System32\svchost.exe


    C:\WINDOWS\system32\spoolsv.exe


    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    C:\WINDOWS\system32\Ati2evxx.exe


    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    C:\WINDOWS\system32\HPZipm12.exe


    C:\WINDOWS\system32\svchost.exe


    C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


    C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


    C:\WINDOWS\system32\wscntfy.exe


    C:\Program Files\Last.fm\LastFMHelper.exe


    C:\WINDOWS\system32\wuauclt.exe


    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe


    C:\Program Files\Mozilla Firefox\firefox.exe


    C:\WINDOWS\SYSTEM32\NOTEPAD.EXE


    C:\WINDOWS\explorer.exe


    C:\Program Files\Trend Micro\HijackThis\Crusty.exe.exe


    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://register.hp.com/servlet/WebReg.serv...&prodOS=011


    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll


    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


    O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start


    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe


    O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup


    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask .exe" -atboottime


    O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32


    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC


    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


    O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')


    O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')


    O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe


    O4 - Startup: SCRABBLE Complete Registration.lnk = C:\Documents and Settings\Valerie Cook\Local Settings\Temp\{8D32465D-38FF-46C6-959D-85B77638F01D}\{B36649A3-D0DD-4706-B042-F5B384529C7A}\ATR1.exe


    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hp\Digital Imaging\bin\hpqtra08.exe


    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000


    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll


    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL


    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)


    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)


    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll


    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155979773375


    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/default/mjolauncher.cab


    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab


    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab


    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab


    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe


    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe


    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe


    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe


    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


    O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe


    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE


    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe


    --


    End of file - 7710 bytes


    thank you so much for all of this help.

  • farbar
    farbar ✭

    Step 1.


    Do you have a firewall? If yes Go to your firewall Internet traffic and check, note, report and remove all suspicious allowed applications.


    If not please start thinking of installing at least a free firewall with Internet traffic control as the infection may come back again.


    Step 2.


    Open a notepad (start menu-all programs-accessories-notepad)


    Copy and paste the text in the code box below into it.


    File::

    C:\WINDOWS\system32\drvnud.dll



    * Select save in:desktop


    * Fill in File name: CFScript.txt


    * save as type: All file types (*.*)


    * click save Open notepad and copy/paste into it:



    Drag CFScript.txt into ComboFix.exe. You can see the image showing this here: http://www.fromsej.saknet.dk/billeder/cfscript.gif.


    ComboFix will now run a scan on your system.


    It may reboot your system when it finishes. This is normal.



    Step 3


    Please download RenV.exe to desktop from:


    http://download.bleepingcomputer.com/sUBs/Beta/RenV.exe


    Run it, it produces a log - (log.txt) Please save a copy of this log and post it into your reply.


    Drag Log.txt into renv.exe-file. You can see the image showing this here: http://www.ctrlaltdel.dk/forum/uploads/FBJ...095939_RenV.gif


    ComboFix will (probably) now run a scan on your system.


    Post the log it finally producers into your next reply.


    Step 4


    Please download ATF Cleaner by Atribune.


    Double-click ATF-Cleaner.exe to run the program.


    Under Main choose: Select All


    Click the Empty Selected button.


    Step 5.


    Go to start-search-click all files and folders - click more advanced options and check: search system folders, search hidden files and folders and search subfolders- type the P*.tmp in the upper box click on search. If you find any of those files remove them manually.To do that highlight them all (select the first .tmp file- hold down Shift and scroll down to the last .tmp and highlight/select the last .tmp) and delete them using Shift+Del to bypass the Recycle bin.


    Reboot and see how your computer is running.


  • farbar
    farbar ✭
    edited February 2008

    1.Since your log is clean now you may any moment go to Internet Options (under tool in Internet Explorer) and set the privacy setting (which is lowered by Vundo malware) to default (Medium).


    2. Check also with the search box if this file still exist on your system (I could not see the first combofix log to confirm that), if yes remove it manually: C:\WINDOWS\system32\geeby.exe

All Time Leaders

Categories

Defenders of the month