1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Virus Problem (Black Internet rootkit)

Discussion in 'Malware and Virus Removal Archive' started by Pete, 2010/06/20.

Page 3 of 7
  1. 2010/06/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I sitll have usually 2 iexplore.exe processes running in task manager
    With IE 8, it's normal.

    If those files were bad, most likely, Kaspersky would flag them.
    In any case, you cam always upload them here: http://www.virustotal.com/ for security check.

    Let's run one more scan.

    Download Dr.Web CureIt to the desktop:
    ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
    Alternative download: http://majorgeeks.com/Dr.Web_CureIT_d4783.html

    • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
    • This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
    • Once the short scan has finished, select Complete scan.
    • Click the green arrow [​IMG] at the right, and the scan will start.
    • Click Yes to all if it asks if you want to cure/move the file.
    • When the scan has finished, in the menu, click File and choose Save report list
    • Save the report to your desktop. The report will be called DrWeb.csv
    • Close Dr.Web Cureit.
    • [color=5]Important![/color] Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
    • Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

    NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.
     
    broni,
    #41
  2. 2010/06/24
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    I never use IE.

    usually 2, but sometimes its 3-5.

    Running scan. will post with updates.
     
    Last edited: 2010/06/24
    Pete,
    #42


  3. to hide this advert.

  4. 2010/06/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download Process Explorer: http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx
    Unzip ProcessExplorer.zip, and double click on procexp.exe to run the program.
    Click on View > Select Colunms.
    In addition to already pre-selected options, make sure, the Command Line is selected, and press OK.
    Go File>Save As, and save the report as Procexp.txt.
    Post the content in your next reply.
     
    broni,
    #43
  5. 2010/06/24
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Procexp.txt :


    Process PID CPU Private Bytes Working Set Description Company Name Command Line
    System Idle Process 0 98.46 0 K 16 K
    Interrupts n/a 0 K 0 K Hardware Interrupts
    DPCs n/a 0 K 0 K Deferred Procedure Calls
    System 4 0 K 944 K
    smss.exe 756 168 K 1,064 K Windows NT Session Manager Microsoft Corporation \SystemRoot\System32\smss.exe
    csrss.exe 936 1,732 K 11,080 K Client Server Runtime Process Microsoft Corporation C:\WINDOWS\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16
    winlogon.exe 1124 6,776 K 1,896 K Windows NT Logon Application Microsoft Corporation winlogon.exe
    services.exe 1172 1,644 K 36,992 K Executable.exe 4
    smss.exe 1224 11,896 K 53,252 K Executable.exe 4
    services.exe 1288 0.77 1,956 K 12,740 K Services and Controller app Microsoft Corporation C:\WINDOWS\system32\services.exe
    nvsvc32.exe 1520 3,228 K 26,972 K NVIDIA Driver Helper Service, Version 185.85 NVIDIA Corporation C:\WINDOWS\system32\nvsvc32.exe
    svchost.exe 1696 3,232 K 33,680 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k DcomLaunch
    iexplore.exe 596 14,020 K 81,452 K Internet Explorer Microsoft Corporation "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -Embedding
    iexplore.exe 2572 29,608 K 41,312 K Internet Explorer Microsoft Corporation "C:\Program Files\Internet Explorer\IEXPLORE.EXE" SCODEF:596 CREDAT:145434
    svchost.exe 1780 1,992 K 29,484 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost -k rpcss
    svchost.exe 1836 18,232 K 82,128 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k netsvcs
    btwdins.exe 1896 2,248 K 26,556 K Bluetooth Support Server Broadcom Corporation. "C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe "
    svchost.exe 2028 5,224 K 32,592 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k LocalService
    AvastSvc.exe 504 4,416 K 80,872 K avast! Service ALWIL Software "C:\Program Files\Alwil Software\Avast5\AvastSvc.exe "
    spoolsv.exe 1304 5,288 K 41,656 K Spooler SubSystem App Microsoft Corporation C:\WINDOWS\system32\spoolsv.exe
    AppleMobileDeviceService.exe 1408 1,920 K 14,092 K Apple Mobile Device Service Apple Inc. "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe "
    jqs.exe 1676 2,276 K 1,448 K Java(TM) Quick Starter Service Sun Microsystems, Inc. "C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf "
    mdm.exe 1820 1,036 K 16,616 K Machine Debug Manager Microsoft Corporation "C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe "
    svchost.exe 1980 2,760 K 33,520 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\system32\svchost.exe -k imgsvc
    TuneUpUtilitiesService32.exe 1996 4,552 K 35,552 K TuneUp Utilities Service TuneUp Software "C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe "
    WDBtnMgrSvc.exe 308 4,068 K 26,668 K WD Drive Manager Service WDC "C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe "
    IAANTmon.exe 2388 2,412 K 28,832 K RAID Monitor Intel Corporation "C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe "
    alg.exe 3100 1,268 K 27,876 K Application Layer Gateway Service Microsoft Corporation C:\WINDOWS\System32\alg.exe
    svchost.exe 3284 1,692 K 27,588 K Generic Host Process for Win32 Services Microsoft Corporation C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    lsass.exe 1300 2,452 K 1,912 K LSA Shell (Export Version) Microsoft Corporation C:\WINDOWS\system32\lsass.exe
    explorer.exe 1636 45,932 K 128,684 K Windows Explorer Microsoft Corporation C:\WINDOWS\Explorer.EXE
    WDBtnMgrUI.exe 1148 2,164 K 24,068 K WD Drive Manager WDC "C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe"
    IAAnotif.exe 1716 2,348 K 28,568 K Event Monitor User Notification Tool Intel Corporation "C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe"
    stsystra.exe 2004 4,748 K 34,088 K Sigmatel Audio system tray application SigmaTel, Inc. "C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe"
    AvastUI.exe 2148 4,148 K 41,612 K avast! Antivirus ALWIL Software "C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe" /nogui
    jusched.exe 2204 904 K 24,684 K Java(TM) Update Scheduler Sun Microsystems, Inc. "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    pg2.exe 436 15,488 K 37,964 K PeerGuardian 2 Methlabs "C:\Program Files\PeerGuardian2\pg2.exe"
    CursorFx.exe 164 7,856 K 27,320 K CursorFX Stardock Corporation "C:\Program Files\Stardock\CursorFX\CursorFX.exe"
    firefox.exe 1652 107,476 K 124,072 K Firefox Mozilla Corporation "C:\Program Files\Mozilla Firefox\firefox.exe"
    procexp.exe 4056 0.77 18,024 K 23,796 K Sysinternals Process Explorer Sysinternals - www.sysinternals.com "C:\Documents and Settings\Pete\Desktop\procexp.exe "
     
    Pete,
    #44
  6. 2010/06/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Did you have IE open while running Process Explorer?
     
    broni,
    #45
  7. 2010/06/24
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    No


    Still running complete scan. Halfway done and still nothing found
    will post with results
     
    Pete,
    #46
  8. 2010/06/24
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Ok....
     
    broni,
    #47
  9. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    DrWeb.csv :

    uninstall.exe;C:\Documents and Settings\Pete\Desktop\Downloads;Trojan.Swizzor.based;Deleted.;
    ipscan.exe;C:\_OTL\MovedFiles\06242010_193710\C_Program Files\Bluetack\Blocklist Manager\Tools;Tool.AngryIpscan;Incurable.Deleted.;
    Blocklist_Manager_Install_2.7.7.exe;C:\_OTL\MovedFiles\06242010_193710\D_Setup Files\Internet\Safe Peer\Blocklist Manager;Tool.AngryIpscan.7;Incurable.Deleted.;
    Keygen.exe;C:\_OTL\MovedFiles\06242010_193710\D_Setup Files\Utilities\Active WebCam 9.9\Active WebCam v9.9 Patch;Trojan.PWS.Wsgame.13249;Incurable.Moved.;
    RemoveWGA.exe;D:\Setup Files\Utilities\WGA Remover 1.2;Tool.RemoveWGA;Incurable.Deleted.;



    Notes :

    the uninstaller.exe in the downloads folder was something i experimented. Its was a generic LOP virus remover. After using it, the problem seemed to go away for a min or so but then I saw 2-5 iexplore.exe shoot up in process manager again. Usually they start right back up after terminating them.

    And from more research, it seems my "wave volume" slider problem (native audio mixer settings) i mentioned before is connected to this whole mess and it has nothing to do with drivers/hardware. Others also have the same symptoms.
     
    Pete,
    #48
  10. 2010/06/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #49
  11. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Combofix Log :


    ComboFix 10-06-24.03 - Pete 06/25/2010 13:01:50.6.2 - x86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1576 [GMT -4:00]
    Running from: c:\documents and settings\Pete\Desktop\ComboFix.exe
    AV: avast! Antivirus *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2010-05-25 to 2010-06-25 )))))))))))))))))))))))))))))))
    .

    2010-06-25 01:02 . 2010-06-25 01:02 -------- d-sh--w- c:\documents and settings\Pete\PrivacIE
    2010-06-25 00:30 . 2010-06-25 00:54 -------- d-----w- c:\documents and settings\Pete\DoctorWeb
    2010-06-24 01:23 . 2010-06-24 01:23 -------- d-----w- C:\_OTL
    2010-06-24 01:13 . 2010-06-24 01:13 503808 ----a-w- c:\documents and settings\Pete\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-63956ed9-n\msvcp71.dll
    2010-06-24 01:13 . 2010-06-24 01:13 499712 ----a-w- c:\documents and settings\Pete\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-63956ed9-n\jmc.dll
    2010-06-24 01:13 . 2010-06-24 01:13 348160 ----a-w- c:\documents and settings\Pete\Application Data\Sun\Java\Deployment\SystemCache\6.0\46\f84c6ae-63956ed9-n\msvcr71.dll
    2010-06-24 01:13 . 2010-06-24 01:13 61440 ----a-w- c:\documents and settings\Pete\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27a6e5be-n\decora-sse.dll
    2010-06-24 01:13 . 2010-06-24 01:13 12800 ----a-w- c:\documents and settings\Pete\Application Data\Sun\Java\Deployment\SystemCache\6.0\50\5535ab32-27a6e5be-n\decora-d3d.dll
    2010-06-24 01:13 . 2010-06-24 01:13 -------- d-----w- c:\program files\Common Files\Java
    2010-06-24 01:12 . 2010-06-24 01:09 411368 ----a-w- c:\windows\system32\deployJava1.dll
    2010-06-21 01:34 . 2010-05-06 20:39 46672 ----a-w- c:\windows\system32\drivers\aswTdi.sys
    2010-06-21 01:34 . 2010-05-06 20:39 164048 ----a-w- c:\windows\system32\drivers\aswSP.sys
    2010-06-21 01:34 . 2010-05-06 20:34 23376 ----a-w- c:\windows\system32\drivers\aswRdr.sys
    2010-06-21 01:34 . 2010-05-06 20:33 100432 ----a-w- c:\windows\system32\drivers\aswmon2.sys
    2010-06-21 01:34 . 2010-05-06 20:33 94800 ----a-w- c:\windows\system32\drivers\aswmon.sys
    2010-06-21 01:34 . 2010-05-06 20:33 19024 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
    2010-06-21 01:34 . 2010-05-06 20:33 28880 ----a-w- c:\windows\system32\drivers\aavmker4.sys
    2010-06-21 01:34 . 2010-05-06 20:59 38848 ----a-w- c:\windows\system32\avastSS.scr
    2010-06-21 01:34 . 2010-05-06 20:59 165032 ----a-w- c:\windows\system32\aswBoot.exe
    2010-06-21 01:34 . 2010-06-21 01:34 -------- d-----w- c:\program files\Alwil Software
    2010-06-21 01:34 . 2010-06-21 01:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Alwil Software
    2010-06-20 16:02 . 2010-06-20 16:02 -------- d-----w- c:\program files\Trend Micro
    2010-06-20 07:18 . 2010-06-20 07:18 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe
    2010-06-20 01:36 . 2010-06-20 01:36 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\Deployment
    2010-06-18 21:25 . 2010-06-18 21:25 -------- d-sh--w- c:\documents and settings\Default User\IETldCache
    2010-06-18 19:37 . 2010-06-18 19:37 -------- d-----w- c:\documents and settings\Pete\Application Data\Malwarebytes
    2010-06-18 19:37 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-06-18 19:37 . 2010-06-18 19:37 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-06-18 19:37 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-06-18 19:33 . 2010-06-18 19:33 63488 ----a-w- c:\documents and settings\Pete\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
    2010-06-18 16:43 . 2010-06-18 16:43 -------- d-sh--w- c:\windows\system32\config\systemprofile\PrivacIE
    2010-06-18 08:40 . 2010-06-18 08:40 198056 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
    2010-06-17 21:55 . 2010-06-17 22:16 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\Painkiller Resurrection
    2010-05-31 23:49 . 2010-05-31 23:49 -------- d-----w- c:\program files\StreamTorrent 1.0
    2010-05-31 23:49 . 2010-05-31 23:49 -------- d-----w- c:\documents and settings\Pete\Application Data\StreamTorrent
    2010-05-28 04:50 . 2010-06-25 09:15 -------- d-----w- c:\documents and settings\Pete\Application Data\vlc
    2010-05-28 01:22 . 2010-05-28 01:22 -------- d-----w- c:\documents and settings\All Users\Application Data\RosettaStoneLtdBackup
    2010-05-26 23:16 . 2010-05-26 23:16 -------- d-----w- c:\documents and settings\Pete\Application Data\Canneverbe Limited

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-06-25 16:53 . 2009-05-23 01:49 -------- d-----w- c:\program files\PeerGuardian2
    2010-06-25 09:01 . 2009-05-23 01:48 -------- d-----w- c:\documents and settings\Pete\Application Data\uTorrent
    2010-06-24 23:37 . 2010-03-13 18:24 -------- d-----w- c:\program files\FlashMute
    2010-06-24 01:17 . 2009-05-25 01:05 188152 ----a-w- c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\FlashGot.exe
    2010-06-20 16:08 . 2009-12-07 12:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2010-06-20 02:59 . 2009-05-23 01:49 -------- d-----w- c:\program files\uTorrent
    2010-06-20 02:22 . 2009-07-12 08:50 -------- d-----w- c:\documents and settings\Pete\Application Data\Media Player Classic
    2010-06-20 02:22 . 2010-04-18 17:56 -------- d-----w- c:\program files\CCleaner
    2010-06-18 21:33 . 2009-08-24 05:09 -------- d-----w- c:\program files\Microsoft Silverlight
    2010-06-18 19:33 . 2010-01-20 04:13 117760 ----a-w- c:\documents and settings\Pete\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
    2010-06-18 19:32 . 2009-12-07 12:34 -------- d-----w- c:\program files\SUPERAntiSpyware
    2010-06-17 22:29 . 2009-06-25 22:29 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
    2010-06-17 22:29 . 2009-05-22 22:12 134696 ----a-w- c:\windows\system32\nvModes.dat
    2010-06-16 19:10 . 2009-05-23 00:17 -------- d--h--w- c:\program files\InstallShield Installation Information
    2010-06-15 02:13 . 2009-07-07 06:39 5580288 ----a-w- c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe
    2010-06-15 02:09 . 2009-07-07 05:55 2286080 ----a-w- c:\windows\system32\TUKernel.exe
    2010-06-02 19:21 . 2009-05-22 22:27 -------- d-----w- c:\program files\FlashGet
    2010-05-28 16:35 . 2009-10-29 20:58 -------- d-----w- c:\program files\CDBurnerXP
    2010-05-28 01:47 . 2009-09-25 15:15 -------- d-----w- c:\documents and settings\All Users\Application Data\Rosetta Stone
    2010-05-13 05:10 . 2010-05-13 05:10 -------- d-----w- c:\program files\Ubisoft
    2010-04-30 00:50 . 2009-05-30 22:56 -------- d-----w- c:\documents and settings\Pete\Application Data\TeamViewer
    2010-04-29 03:34 . 2010-04-29 03:34 -------- d-----w- c:\program files\Tunatic
    2010-04-08 23:24 . 2009-05-22 23:06 95800 ----a-w- c:\documents and settings\Pete\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2006-06-16 03:33 . 2009-05-23 00:21 233472 ----a-w- c:\program files\mozilla firefox\plugins\CrazyTalk4Native.dll
    2006-05-26 01:43 . 2009-05-23 00:20 204895 ----a-w- c:\program files\mozilla firefox\plugins\ctdomemhelper.dll
    2005-09-29 21:41 . 2009-05-23 00:21 77824 ----a-w- c:\program files\mozilla firefox\plugins\ctframeplayerobject.dll
    2006-06-19 20:10 . 2009-05-23 00:20 426081 ----a-w- c:\program files\mozilla firefox\plugins\ctplayerobject.dll
    2005-02-02 19:19 . 2009-05-23 00:20 458752 ----a-w- c:\program files\mozilla firefox\plugins\imagickrt.dll
    2006-04-11 01:35 . 2009-05-23 00:21 139264 ----a-w- c:\program files\mozilla firefox\plugins\rlcontentclass.dll
    2005-11-09 18:10 . 2009-05-23 00:20 204800 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicPacker.dll
    2005-11-09 18:42 . 2009-05-23 00:20 106496 ----a-w- c:\program files\mozilla firefox\plugins\RLMusicUnpacker.dll
    2006-01-04 18:22 . 2009-05-23 00:20 212992 ----a-w- c:\program files\mozilla firefox\plugins\RLVoicePacker.dll
    2006-01-04 18:21 . 2009-05-23 00:20 167936 ----a-w- c:\program files\mozilla firefox\plugins\RLVoiceUnpacker.dll
    .

    ------- Sigcheck -------

    [-] 2009-05-22 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}]
    2009-11-04 02:12 556432 ----a-w- c:\progra~1\MI1933~1\Office14\URLREDIR.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PeerGuardian "= "c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824]
    "DAEMON Tools Lite "= "c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
    "CursorFX "= "c:\program files\Stardock\CursorFX\CursorFX.exe" [2008-02-19 653128]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
    "WD Drive Manager "= "c:\program files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe" [2009-06-26 450560]
    "IAAnotif "= "c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2009-06-05 186904]
    "SigmatelSysTrayApp "= "c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
    "avast5 "= "c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-05-06 2815192]
    "SunJavaUpdateSched "= "c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-02-18 248040]

    c:\documents and settings\Pete\Start Menu\Programs\Startup\
    Mozilla Firefox.lnk - c:\program files\Mozilla Firefox\firefox.exe [2009-5-22 910296]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "NoWinKeys "= 1 (0x1)

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost "= "c:\documents and settings\All Users\Application Data\TuneUp Software\TuneUp Utilities\WinStyler\tu_logonui.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2009-09-03 19:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OfficeSAS.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OfficeSAS.lnk
    backup=c:\windows\pss\OfficeSAS.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
    2010-03-24 18:17 952768 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    2010-04-04 05:42 36272 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FlashMute]
    2006-03-11 19:49 221184 ----a-w- c:\program files\FlashMute\flashmute.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    2009-10-29 00:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    2010-02-18 15:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "wuauserv "=2 (0x2)
    "wscsvc "=2 (0x2)
    "Schedule "=2 (0x2)
    "NMSAccessU "=2 (0x2)
    "JavaQuickStarterService "=2 (0x2)
    "idsvc "=3 (0x3)
    "ERSvc "=2 (0x2)
    "Bonjour Service "=2 (0x2)
    "wlidsvc "=2 (0x2)
    "PnkBstrB "=2 (0x2)
    "PnkBstrA "=2 (0x2)
    "npggsvc "=3 (0x3)
    "ACTIVEWEBCAMWATCHDOG "=3 (0x3)
    "FLEXnet Licensing Service "=3 (0x3)
    "WMPNetworkSvc "=3 (0x3)
    "Microsoft SharePoint Workspace Audit Service "=3 (0x3)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "CursorFX "= "c:\program files\Stardock\CursorFX\CursorFX.exe "

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" -atboottime
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe "
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe "
    "nwiz "=nwiz.exe /install
    "MSConfig "=c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
    "WinampAgent "= "c:\program files\Winamp\winampa.exe "
    "BCSSync "= "c:\program files\Microsoft Office\Office14\BCSSync.exe" /DelayServices

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\FlashGet\\flashget.exe "=
    "c:\\Program Files\\uTorrent\\uTorrent.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "d:\\Games\\FEAR\\FEAR.exe "=
    "d:\\Games\\FEAR\\FEARMP.exe "=
    "d:\\Games\\FEAR\\FEARXP\\FEARXP.exe "=
    "d:\\Games\\FEAR Perseus Mandate\\FEARXP2.exe "=
    "c:\\WINDOWS\\system32\\PnkBstrA.exe "=
    "c:\\WINDOWS\\system32\\PnkBstrB.exe "=
    "c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
    "c:\\Program Files\\AIM\\aim.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\TeamViewer\\Version5\\TeamViewer.exe "=
    "c:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE "=
    "c:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\Ubisoft\\Ubisoft Game Launcher\\UbisoftGameLauncher.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\support\\bin\\win\\RosettaStoneLtdServices.exe "=
    "c:\\Program Files\\Rosetta Stone\\Rosetta Stone Version 3\\RosettaStoneVersion3.exe "=

    R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [6/20/2010 9:34 PM 164048]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [1/5/2010 8:56 AM 12872]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [1/5/2010 8:56 AM 67656]
    R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/20/2010 9:34 PM 19024]
    R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2/25/2010 5:59 AM 1047880]
    R2 WDBtnMgrSvc.exe;WD Drive Manager Service;c:\program files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe [6/26/2009 3:56 PM 102400]
    R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv;c:\program files\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys [10/14/2009 7:24 AM 10064]
    S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [6/30/2009 8:38 AM 17408]
    S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [9/26/2009 5:28 AM 4639136]
    S3 ProtoWall;ProtoWall Network Service;c:\windows\system32\DRIVERS\ProtoWall.sys --> c:\windows\system32\DRIVERS\ProtoWall.sys [?]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [1/5/2010 8:56 AM 12872]
    S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [10/23/2009 5:11 PM 11520]
    S4 ACTIVEWEBCAMWATCHDOG;Active WebCam Watchdog;c:\program files\Active WebCam\Watchdog.exe [11/30/2009 11:15 PM 580608]
    S4 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;c:\program files\Microsoft Office\Office14\GROOVE.EXE [10/29/2009 11:22 AM 30603640]
    S4 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
    S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/16/2009 11:01 PM 691696]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - PGFILTER

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    UxTuneUp
    .
    Contents of the 'Scheduled Tasks' folder

    2009-12-03 c:\windows\Tasks\OGALogon.job
    - c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    IE: &Download All with FlashGet - c:\program files\FlashGet\jc_all.htm
    IE: &Download with FlashGet - c:\program files\FlashGet\jc_link.htm
    IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office14\EXCEL.EXE/3000
    IE: Se&nd to OneNote - c:\progra~1\MI1933~1\Office14\ONBttnIE.dll/105
    IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    Trusted Zone: microsoft.com
    Trusted Zone: microsoft.com\*.windowsupdate
    Trusted Zone: windowsupdate.com\download
    Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - c:\program files\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL
    FF - ProfilePath - c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\
    FF - prefs.js: browser.startup.homepage - www.google.com/ncr
    FF - component: c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\vyo3zjh0.default\extensions\cfxHelper@Triton\components\dwmxpcom.dll
    FF - plugin: c:\progra~1\MI1933~1\Office14\NPAUTHZ.DLL
    FF - plugin: c:\progra~1\MI1933~1\Office14\NPSPWRAP.DLL
    FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npijjiFFPlugin1.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npRLCT4Player.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: nglayout.initialpaint.delay - 600
    FF - user.js: content.notify.interval - 600000
    FF - user.js: content.max.tokenizing.time - 1800000
    FF - user.js: content.switch.threshold - 600000
    FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\Mozilla Firefox\greprefs\all.js - pref( "ui.use_native_colors ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.lu ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nu ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.nz ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgberp4a5d4ar ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--p1ai ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.xn--mgbayh7gpa ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.IDN.whitelist.tel ", true);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.auth.force-generic-ntlm ", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "network.proxy.type ", 5);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "dom.ipc.plugins.timeoutSecs ", 10);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "svg.smil.enabled ", false);
    c:\program files\Mozilla Firefox\greprefs\all.js - pref( "accelerometer.enabled ", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref ", true);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.renego_unrestricted_hosts ", " ");
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.treat_unsafe_negotiation_as_broken ", false);
    c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref( "security.ssl.require_safe_negotiation ", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description ", "chrome://browser/locale/browser.properties ");
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "plugins.update.notifyUser ", false);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.nptest.dll ", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npswf32.dll ", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npctrl.dll ", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled.npqtplugin.dll ", true);
    c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref( "dom.ipc.plugins.enabled ", false);
    .
    - - - - ORPHANS REMOVED - - - -

    AddRemove-FlashMute - c:\program files\FlashMute\uninstall.exe



    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
    "ImagePath "= "c:\windows\system32\GameMon.des -service "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,84,d1,a6,42,76,58,40,b8,14,4f,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,76,84,d1,a6,42,76,58,40,b8,14,4f,\
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(1128)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\WININET.dll

    - - - - - - - > 'explorer.exe'(3584)
    c:\windows\system32\WININET.dll
    c:\progra~1\MI1933~1\Office14\1033\GrooveIntlResource.dll
    c:\program files\Stardock\CursorFX\CurXP0.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\wpdshserviceobj.dll
    c:\windows\system32\portabledevicetypes.dll
    c:\windows\system32\portabledeviceapi.dll
    .
    Completion time: 2010-06-25 13:08:19
    ComboFix-quarantined-files.txt 2010-06-25 17:08
    ComboFix2.txt 2010-06-22 05:20

    Pre-Run: 9,912,479,744 bytes free
    Post-Run: 9,938,726,912 bytes free

    - - End Of File - - B81DB4EB0D16DB7FD1E7089DE6DD1835
     
    Pete,
    #50
  12. 2010/06/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download SystemLook from one of the links below and save it to your Desktop.
    Download Mirror #1
    Download Mirror #2
    • Double-click SystemLook.exe to run it.
    • Vista users:: Right click on SystemLook.exe, click Run As Administrator
    • Copy the content of the following box into the main textfield:
      Code:
      :filefind
sfcfiles.dll
    • Click the Look button to start the scan.
    • When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
    Note: The log can also be found on your Desktop entitled SystemLook.txt

    ================================================================

    Download Rooter.exe to your desktop.

    1. Double click it to start the tool.
    2. A Notepad file containing the report will open, also found at C:\Rooter.txt.
    3. Copy all text, and paste it into your next reply.
     
    broni,
    #51
  13. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Systemlook log :

    SystemLook v1.0 by jpshortstuff (11.01.10)
    Log created at 14:36 on 25/06/2010 by Pete (Administrator - Elevation successful)

    ========== filefind ==========

    Searching for "sfcfiles.dll "
    C:\WINDOWS\system32\sfcfiles.dll --a--- 1614848 bytes [05:23 22/05/2009] [05:23 22/05/2009] 362BC5AF8EAF712832C58CC13AE05750

    -=End Of File=-
     
    Pete,
    #52
  14. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Rooter Log :

    Rooter.exe (v1.0.2) by Eric_71
    .
    SeDebugPrivilege granted successfully ...
    .
    Windows XP . (5.1.2600) Service Pack 3
    [32_bits] - x86 Family 6 Model 15 Stepping 13, GenuineIntel
    .
    [wscsvc] (Security Center) RUNNING (state:4)
    [SharedAccess] RUNNING (state:4)
    Windows Firewall -> Disabled !
    .
    Internet Explorer 8.0.6001.18702
    Mozilla Firefox 3.6.4 (en-US)
    .
    C:\ [Fixed-NTFS] .. ( Total:49 Go - Free:9 Go )
    D:\ [Fixed-NTFS] .. ( Total:61 Go - Free:35 Go )
    E:\ [CD_Rom]
    .
    Scan : 14:38.28
    Path : C:\Documents and Settings\Pete\Desktop\Downloads\Rooter.exe
    User : Pete ( Administrator -> YES )
    .
    ----------------------\\ Processes
    .
    Locked [System Process] (0)
    ______ System (4)
    ______ \SystemRoot\System32\smss.exe (756)
    ______ \??\C:\WINDOWS\system32\csrss.exe (940)
    ______ \??\C:\WINDOWS\system32\winlogon.exe (1128)
    ______ C:\System Volume Information\Microsoft\services.exe (1160)
    ______ C:\System Volume Information\Microsoft\smss.exe (1228)
    ______ C:\WINDOWS\system32\services.exe (1292)
    ______ C:\WINDOWS\system32\lsass.exe (1304)
    ______ C:\WINDOWS\system32\nvsvc32.exe (1528)
    ______ C:\WINDOWS\system32\svchost.exe (1656)
    ______ C:\WINDOWS\system32\svchost.exe (1768)
    ______ C:\WINDOWS\System32\svchost.exe (1824)
    ______ C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (1868)
    ______ C:\WINDOWS\system32\svchost.exe (1992)
    ______ C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (492)
    ______ C:\WINDOWS\system32\spoolsv.exe (1664)
    ______ C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (984)
    ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1368)
    ______ C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (1244)
    ______ C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (840)
    ______ C:\Program Files\Java\jre6\bin\jqs.exe (880)
    ______ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (948)
    ______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (1248)
    ______ C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (1948)
    ______ C:\Program Files\Stardock\CursorFX\CursorFX.exe (1628)
    ______ C:\WINDOWS\system32\svchost.exe (232)
    ______ C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (384)
    ______ C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (720)
    ______ C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (2652)
    ______ C:\WINDOWS\System32\alg.exe (3864)
    ______ C:\WINDOWS\System32\svchost.exe (2168)
    ______ C:\Program Files\PeerGuardian2\pg2.exe (3684)
    ______ C:\Program Files\Internet Explorer\IEXPLORE.EXE (3484)
    ______ C:\WINDOWS\explorer.exe (3584)
    ______ C:\Program Files\Mozilla Firefox\firefox.exe (1696)
    ______ C:\Program Files\Internet Explorer\IEXPLORE.EXE (3060)
    ______ C:\Documents and Settings\Pete\Desktop\Downloads\Rooter.exe (2536)
    .
    ----------------------\\ Device\Harddisk0\
    .
    \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
    .
    \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:32256 | Length:53686370304)
    \Device\Harddisk0\Partition0 (Start_Offset:53686402560 | Length:66336883200)
    \Device\Harddisk0\Partition2 (Start_Offset:53686434816 | Length:66336850944)
    .
    ----------------------\\ Scheduled Tasks
    .
    C:\WINDOWS\Tasks\desktop.ini
    C:\WINDOWS\Tasks\OGALogon.job
    C:\WINDOWS\Tasks\SA.DAT
    .
    ----------------------\\ Registry
    .
    .
    ----------------------\\ Files & Folders
    .
    ----------------------\\ Scan completed at 14:38.32
    .
    C:\Rooter$\Rooter_1.txt - (25/06/2010 | 14:38.32)
     
    Pete,
    #53
  15. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Notes :

    It seems that this is a more recent virus infecting a lot of people. Most scans detect just cookies from harmless sites etc.

    This is what I've dug up from more research. I seem to have the exact problem as the one posted in these threads.

    and my services.exe seems like its injected with certain .dlls or .exes from Windows/system32

    http://forums.avg.com/us-en/avg-free-forum?sec=thread&act=show&id=94519&type=0

    http://thespykiller.co.uk/index.php...db722b8373bf0a636f038&topic=9310.msg37374#new
     
    Pete,
    #54
  16. 2010/06/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, reset system restore and post fresh Rooter log.

    1. Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    2. Restart computer.

    3. Turn System Restore on.
     
    broni,
    #55
  17. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Which step exactly is the rooter scan ?

    After restart and before system restore on i presume ?
     
    Last edited: 2010/06/25
    Pete,
    #56
  18. 2010/06/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Rooter from my reply #51.

    Turn system restore off.
    Restart computer.
    Turn system restore on.
    Run Rooter.
     
    broni,
    #57
  19. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    Fresh Rooter Log :



    Rooter.exe (v1.0.2) by Eric_71
    .
    SeDebugPrivilege granted successfully ...
    .
    Windows XP . (5.1.2600) Service Pack 3
    [32_bits] - x86 Family 6 Model 15 Stepping 13, GenuineIntel
    .
    [wscsvc] (Security Center) RUNNING (state:4)
    [SharedAccess] RUNNING (state:4)
    Windows Firewall -> Disabled !
    .
    Internet Explorer 8.0.6001.18702
    Mozilla Firefox 3.6.4 (en-US)
    .
    C:\ [Fixed-NTFS] .. ( Total:49 Go - Free:9 Go )
    D:\ [Fixed-NTFS] .. ( Total:61 Go - Free:35 Go )
    E:\ [CD_Rom]
    .
    Scan : 19:16.11
    Path : C:\Documents and Settings\Pete\Desktop\Downloads\Rooter.exe
    User : Pete ( Administrator -> YES )
    .
    ----------------------\\ Processes
    .
    Locked [System Process] (0)
    ______ System (4)
    ______ \SystemRoot\System32\smss.exe (756)
    ______ \??\C:\WINDOWS\system32\csrss.exe (940)
    ______ \??\C:\WINDOWS\system32\winlogon.exe (1128)
    ______ C:\System Volume Information\Microsoft\services.exe (1160)
    ______ C:\System Volume Information\Microsoft\smss.exe (1216)
    ______ C:\WINDOWS\system32\services.exe (1280)
    ______ C:\WINDOWS\system32\lsass.exe (1292)
    ______ C:\WINDOWS\system32\nvsvc32.exe (1504)
    ______ C:\WINDOWS\system32\svchost.exe (1688)
    ______ C:\WINDOWS\system32\svchost.exe (1768)
    ______ C:\WINDOWS\System32\svchost.exe (1824)
    ______ C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe (1884)
    ______ C:\WINDOWS\system32\svchost.exe (2016)
    ______ C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (492)
    ______ C:\WINDOWS\Explorer.EXE (1344)
    ______ C:\WINDOWS\system32\spoolsv.exe (1652)
    ______ C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrUI.exe (828)
    ______ C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe (412)
    ______ C:\Program Files\SigmaTel\C-Major Audio\WDM\stsystra.exe (512)
    ______ C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe (560)
    ______ C:\Program Files\Common Files\Java\Java Update\jusched.exe (1000)
    ______ C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (1008)
    ______ C:\Program Files\PeerGuardian2\pg2.exe (1044)
    ______ C:\Program Files\Java\jre6\bin\jqs.exe (1568)
    ______ C:\Program Files\Stardock\CursorFX\CursorFX.exe (1868)
    ______ C:\Program Files\Mozilla Firefox\firefox.exe (936)
    ______ C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe (1612)
    ______ C:\WINDOWS\system32\svchost.exe (2196)
    ______ C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe (2236)
    ______ C:\Program Files\Western Digital\WD Drive Manager\WDBtnMgrSvc.exe (2400)
    ______ C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe (2556)
    ______ C:\Program Files\Internet Explorer\IEXPLORE.EXE (2800)
    ______ C:\WINDOWS\system32\wuauclt.exe (3016)
    ______ C:\Program Files\Internet Explorer\IEXPLORE.EXE (2180)
    ______ C:\WINDOWS\System32\alg.exe (2256)
    ______ C:\WINDOWS\System32\svchost.exe (3936)
    ______ C:\WINDOWS\system32\wbem\wmiprvse.exe (3704)
    ______ C:\Documents and Settings\Pete\Desktop\Downloads\Rooter.exe (2536)
    .
    ----------------------\\ Device\Harddisk0\
    .
    \Device\Harddisk0 [Sectors : 63 x 512 Bytes]
    .
    \Device\Harddisk0\Partition1 --[ MBR ]-- (Start_Offset:32256 | Length:53686370304)
    \Device\Harddisk0\Partition0 (Start_Offset:53686402560 | Length:66336883200)
    \Device\Harddisk0\Partition2 (Start_Offset:53686434816 | Length:66336850944)
    .
    ----------------------\\ Scheduled Tasks
    .
    C:\WINDOWS\Tasks\desktop.ini
    C:\WINDOWS\Tasks\OGALogon.job
    C:\WINDOWS\Tasks\SA.DAT
    .
    ----------------------\\ Registry
    .
    .
    ----------------------\\ Files & Folders
    .
    ----------------------\\ Scan completed at 19:16.32
    .
    C:\Rooter$\Rooter_2.txt - (25/06/2010 | 19:16.32)
     
    Pete,
    #58
  20. 2010/06/25
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Download the MBR Rootkit Detector: http://www2.gmer.net/mbr/mbr.exe to your desktop.

    * Doubleclick mbr.exe and follow prompts (Vista users: right click on mbr.exe and click "Run As Administrator ").
    * A black DOS window will quickly appear then disappear.
    * When mbr.exe is finished it will create a log on your desktop.
    * Copy and paste contents of that log (mbr.log) file to your next reply.
     
    broni,
    #59
  21. 2010/06/25
    Pete

    Pete Inactive Thread Starter

    Joined:
    2010/06/20
    Messages:
    73
    Likes Received:
    0
    mbr.log :


    Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

    device: opened successfully
    user: error reading MBR
    kernel: MBR read successfully
     
    Pete,
    #60
Page 3 of 7

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...