1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Crazy Malware

Discussion in 'Malware and Virus Removal Archive' started by raniosman, 2008/08/08.

  1. 2008/08/08
    raniosman

    raniosman Inactive Thread Starter

    Joined:
    2008/08/08
    Messages:
    3
    Likes Received:
    0
    Hey everyone,
    I seem to be having a whole BUNCH crazy problems that are totally ruining my computer.
    1) Firefox doesn't start up
    2) Adware, SUPERantispyware, and Spybot can't update or search
    3) Google on IE redirects results that were presented, to some random sites like findthis.com
    4) I can't load or download any page that has to do with malware/virus removal, it just says: "Cannot Find Server "

    So pretty much, I've deduced that its some idiot's invention... *sighs*

    Here's my HiJackthis log (btw, I renamed this program 'appitite' because it wouldn't load at all with the default name)

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:45:44 PM, on 8/8/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\NMSSvc.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\lawin.exe
    C:\Program Files\MSN Messenger\MsnMsgr.Exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\MSN Messenger\usnsvc.exe
    C:\Hi\HijackThis.exe
    C:\Hi\Appetite.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    O2 - BHO: (no name) - {39D1DA17-F3EC-49F9-A2DA-7DEAE50C5111} - (no file)
    O2 - BHO: (no name) - {487C9905-26A8-42C8-8033-C58AD3D2AEC3} - (no file)
    O2 - BHO: (no name) - {843DAEB1-A153-4F65-8475-0B53A505931C} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe "
    O4 - HKLM\..\Run: [BM0fdb550b] Rundll32.exe "C:\WINDOWS\system32\fkswcqxr.dll ",s
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [0ce86697] rundll32.exe "C:\WINDOWS\system32\rsixwnyx.dll ",b
    O4 - HKLM\..\Run: [roocouvok] C:\WINDOWS\system32\lawin.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [UnHackMe Monitor] C:\PROGRA~1\UnHackMe\hackmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?be1181bcb4694f4282e3bee6f806a59c
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?be1181bcb4694f4282e3bee6f806a59c
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: cbXonnOF - cbXonnOF.dll (file missing)
    O20 - Winlogon Notify: nnnklLDT - nnnklLDT.dll (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: bcveServ (tiana3sfyyehy3j) - Unknown owner - C:\WINDOWS\system32\cysume.exe
    O24 - Desktop Component 0: (no name) - http://www.shopmotorola.ca/red/images/red.jpg

    --
    End of file - 7826 bytes
     
    raniosman,
    #1
  2. 2008/08/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS raniosman :)

    Download ComboFix by sUBs from here, saving the file to your desktop. If you cannot save it or run it, try renaming it to something else prior to saving (or attempting to save).


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/08/08
    raniosman

    raniosman Inactive Thread Starter

    Joined:
    2008/08/08
    Messages:
    3
    Likes Received:
    0
    Sorry about the delay, the website you gave me to download combofix was on the malwar's "thou shall not visit" list hehe, had to use my laptop to download it, move it here via usb drive, and rename it BKcombo.exe ;)

    Here is combofix's log (next post will be hijackthis's log):

    ComboFix 08-08-08.07 - Administrator 2008-08-09 0:09:59.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.245 [GMT -4:00]
    Running from: C:\Documents and Settings\Administrator\Desktop\BJCombo.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\D4RN9TJZ\interclick.com
    C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\D4RN9TJZ\interclick.com\ud.sol
    C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
    C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
    C:\Program Files\Common Files\ystem~1
    C:\Program Files\Common Files\ystem~1\?ystem\
    C:\Program Files\Insider
    C:\Program Files\Insider\UnInstall.exe
    C:\Program Files\WinAble
    C:\WINDOWS\BM0fdb550b.txt
    C:\WINDOWS\BM0fdb550b.xml
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\mbols~1
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\clbdll.dll
    C:\WINDOWS\system32\clbdll.old
    C:\WINDOWS\system32\clbinit.dll
    C:\WINDOWS\system32\drivers\beep.sys
    C:\WINDOWS\system32\drivers\clbdriver.sys
    C:\WINDOWS\system32\ehQtDJlm.ini
    C:\WINDOWS\system32\ehQtDJlm.ini2
    C:\WINDOWS\system32\FPWxIRqr.ini
    C:\WINDOWS\system32\FPWxIRqr.ini2
    C:\WINDOWS\system32\hesbrihh.ini
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\pforavlr.dll
    C:\WINDOWS\system32\pjkbfasm.ini
    C:\WINDOWS\system32\rlvarofp.ini
    C:\WINDOWS\system32\rsixwnyx.dll
    C:\WINDOWS\system32\xynwxisr.ini
    G:\recycler\s-1-5-21-1078073611-1993962763-839522115-1003\mmc32.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CLBDRIVER


    ((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
    .

    2008-08-09 00:16 . 2008-08-09 00:16 <DIR> d-------- C:\WINDOWS\system32\xircom
    2008-08-09 00:16 . 2008-08-09 00:16 <DIR> d-------- C:\Program Files\microsoft frontpage
    2008-08-08 23:45 . 2008-08-08 23:57 <DIR> d-------- C:\Hi
    2008-08-08 23:19 . 2008-08-08 23:19 <DIR> d-------- C:\!KillBox
    2008-08-08 22:15 . 2008-08-08 22:37 <DIR> d-------- C:\Program Files\UnHackMe
    2008-08-08 22:15 . 2008-08-08 22:15 30,946 --a------ C:\WINDOWS\system32\drivers\Partizan.sys
    2008-08-08 22:15 . 2008-08-08 22:15 28,672 --a------ C:\WINDOWS\system32\Partizan.exe
    2008-08-08 22:15 . 2005-04-03 15:02 8,944 --a------ C:\WINDOWS\system32\drivers\UnHackMeDrv.sys
    2008-08-08 22:15 . 2008-08-08 22:15 (2) -rahs-ot- C:\WINDOWS\winstart.bat
    2008-08-08 22:12 . 2008-08-08 22:13 <DIR> d-------- C:\Program Files\Norton Security Scan
    2008-08-08 22:11 . 2008-08-08 23:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
    2008-07-21 23:06 . 2008-07-21 23:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-07-21 23:06 . 2008-07-21 23:06 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\CyberLink
    2008-07-11 10:08 . 2008-08-09 00:16 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-07-11 10:08 . 2008-07-11 10:08 1,409 --a------ C:\WINDOWS\QTFont.for

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-09 03:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\uTorrent
    2008-08-09 02:11 --------- d-----w C:\Program Files\Google
    2008-07-17 02:22 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-07-17 02:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-07-15 04:44 135,680 ----a-w C:\WINDOWS\system32\lawin.exe
    2008-07-15 04:44 135,680 ----a-w C:\WINDOWS\system32\cysume.exe
    2008-07-15 04:36 --------- d-----w C:\Program Files\Apple Software Update
    2008-06-29 23:49 10,240 ----a-w C:\WINDOWS\system32\drivers\CLBDRIVER.SYS.del
    2008-06-29 23:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\ADSL Software Ltd
    2008-06-29 23:46 --------- d-----w C:\Program Files\Common Files\Nero
    2008-06-29 23:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
    2008-06-22 17:15 --------- d-----w C:\Program Files\SUPERAntiSpyware
    2008-06-22 02:21 238,080 ----a-w C:\WINDOWS\system32\rywvvhoy.exe
    2008-06-22 02:18 236,544 ----a-w C:\WINDOWS\system32\izcalm.exe
    2008-06-22 02:10 235,520 ----a-w C:\WINDOWS\system32\pkjcbdkplduw.exe
    2008-06-22 02:08 235,008 ----a-w C:\WINDOWS\system32\eyyzrqpuuayky.exe
    2008-06-01 18:42 691,545 ----a-w C:\WINDOWS\unins000.exe
    2008-04-12 04:10 92,064 ----a-w C:\Documents and Settings\Administrator\mqdmmdm.sys
    2008-04-12 04:10 9,232 ----a-w C:\Documents and Settings\Administrator\mqdmmdfl.sys
    2008-04-12 04:10 79,328 ----a-w C:\Documents and Settings\Administrator\mqdmserd.sys
    2008-04-12 04:10 66,656 ----a-w C:\Documents and Settings\Administrator\mqdmbus.sys
    2008-04-12 04:10 6,208 ----a-w C:\Documents and Settings\Administrator\mqdmcmnt.sys
    2008-04-12 04:10 5,936 ----a-w C:\Documents and Settings\Administrator\mqdmwhnt.sys
    2008-04-12 04:10 4,048 ----a-w C:\Documents and Settings\Administrator\mqdmcr.sys
    2008-04-12 04:10 25,600 ----a-w C:\Documents and Settings\Administrator\usbsermptxp.sys
    2008-04-12 04:10 22,768 ----a-w C:\Documents and Settings\Administrator\usbsermpt.sys
    .

    ------- Sigcheck -------

    2002-12-31 08:00 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\system32\svchost.exe

    2002-12-31 08:00 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINDOWS\$NtUninstallKB925902$\user32.dll
    2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b C:\WINDOWS\system32\user32.dll
    2007-03-08 11:48 578048 7aa4f6c00405dfc4b70ed4214e7d687b C:\WINDOWS\system32\dllcache\user32.dll

    2002-12-31 08:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 C:\WINDOWS\system32\ws2_32.dll

    2002-12-31 08:00 658944 e1e18136f9dd3df1ad9c82193a5898a6 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
    2007-08-22 08:55 665600 a1bc17eb3758d73c3938b2318820f5b4 C:\WINDOWS\system32\wininet.dll
    2007-08-22 08:55 665600 a1bc17eb3758d73c3938b2318820f5b4 C:\WINDOWS\system32\dllcache\wininet.dll

    2002-12-31 08:00 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
    2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\system32\dllcache\tcpip.sys
    2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\system32\drivers\tcpip.sys

    2002-12-31 08:00 502784 b66dbc40d428fe1293041d621d836ac8 C:\WINDOWS\system32\winlogon.exe

    2002-12-31 08:00 182912 558635d3af1c7546d26067d5d9b6959e C:\WINDOWS\system32\drivers\ndis.sys

    2002-12-31 08:00 29056 4448006b6bc60e6c027932cfc38d6855 C:\WINDOWS\system32\drivers\ip6fw.sys

    2002-12-31 08:00 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$NtUninstallKB931784$\ntkrnlpa.exe
    2007-02-28 05:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
    2007-02-28 05:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\system32\ntkrnlpa.exe
    2007-02-28 05:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba C:\WINDOWS\system32\dllcache\ntkrnlpa.exe

    2002-12-31 08:00 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$NtUninstallKB931784$\ntoskrnl.exe
    2007-02-28 05:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
    2007-02-28 05:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\system32\ntoskrnl.exe
    2007-02-28 05:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 C:\WINDOWS\system32\dllcache\ntoskrnl.exe

    2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\explorer.exe
    2002-12-31 08:00 1032192 98d45efddd1a67f90353be8d28ed72db C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
    2007-06-13 07:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\system32\dllcache\explorer.exe

    2002-12-31 08:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\system32\services.exe

    2002-12-31 08:00 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\system32\lsass.exe

    2002-12-31 08:00 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\ctfmon.exe

    2005-06-10 20:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
    2002-12-31 08:00 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
    2005-06-10 19:53 57856 da81ec57acd4cdc3d4c51cf3d409af9f C:\WINDOWS\system32\spoolsv.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MsnMsgr "= "C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 13:54 5674352]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2002-12-31 08:00 1694208]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-06-22 13:15 1506544]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2002-12-31 08:00 15360]
    "ares "= "C:\Program Files\Ares\Ares.exe" [2007-11-23 12:18 962560]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-08 22:11 39408]
    "UnHackMe Monitor "= "C:\PROGRA~1\UnHackMe\hackmon.exe" [2007-09-17 16:37 228352]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "DrvLsnr "= "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" [2003-05-08 13:34 69632]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
    "NBKeyScan "= "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 16:29 2221352]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 09:59 570664]
    "roocouvok "= "C:\WINDOWS\system32\lawin.exe" [2008-07-15 00:44 135680]
    "QuickTime Task "= "C:\Program Files\QuickTime Alternative\qttask.exe" [2008-02-01 00:13 385024]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
    "roocouvok "= "C:\WINDOWS\system32\lawin.exe" [2008-07-15 00:44 135680]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-06-02 00:23 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
    path=C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
    backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Miiy]
    C:\WINDOWS\??mbols\n?tdde.exe [?]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
    --a------ 2008-02-28 17:07 132392 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
    --a------ 2006-10-27 01:47 31016 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
    --a------ 2008-02-18 16:29 2221352 C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
    --a------ 2007-08-06 20:05 200704 C:\Program Files\PowerISO\PWRISOVM.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime Alternative\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PROMon.exe]
    --a------ 2002-10-30 18:09 73728 C:\WINDOWS\system32\PROMon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify "=dword:00000001
    "UpdatesDisableNotify "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\MSN Messenger\\livecall.exe "=
    "C:\\Program Files\\uTorrent\\uTorrent.exe "=
    "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE "=
    "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE "=
    "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
    "C:\\Program Files\\Ares\\Ares.exe "=
    "C:\\Program Files\\Messenger\\msmsgs.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=
    "C:\\Program Files\\MPlay\\Crazy Arcade\\NewPatcher.exe "=
    "C:\\Program Files\\Lavasoft\\Ad-Aware SE Professional\\Ad-Aware.exe "=
    "C:\\Program Files\\SUPERAntiSpyware\\SUPERANTISPYWARE.EXE "=

    S0 Partizan;Partizan;C:\WINDOWS\system32\drivers\Partizan.sys [2008-08-08 22:15]
    S2 tiana3sfyyehy3j;bcveServ;C:\WINDOWS\system32\cysume.exe [2008-07-15 00:44]
    S3 UnlockerDriver4;UnlockerDriver4 Driver;C:\WINDOWS\system32\UnlockerDriver4.sys [2005-04-24 06:08]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b882a5a-0847-11dd-9b4b-0040f45e1048}]
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL koukyquouzy.exe
    \Shell\explore\command - G:\koukyquouzy.exe
    \Shell\find\command - G:\koukyquouzy.exe
    \Shell\open\command - G:\koukyquouzy.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e147771e-2551-11dd-9b62-0040f45e1048}]
    \Shell\Auto\command - G:\boot.exe
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL boot.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2008-08-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

    2008-08-09 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2006-09-27 18:39]

    2008-08-09 C:\WINDOWS\Tasks\Norton Security Scan.job
    - C:\Program Files\Norton Security Scan\Nss.exe [2007-09-18 23:42]
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-BM0fdb550b - C:\WINDOWS\system32\fkswcqxr.dll
    HKLM-Run-0ce86697 - C:\WINDOWS\system32\rsixwnyx.dll
    Notify-cbXonnOF - cbXonnOF.dll
    Notify-NavLogon - (no file)
    Notify-nnnklLDT - nnnklLDT.dll
    MSConfigStartUp-Advanced Tools Check - C:\PROGRA~1\NORTON~1\AdvTools\ADVCHK.EXE
    MSConfigStartUp-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    MSConfigStartUp-ccRegVfy - C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
    MSConfigStartUp-vptray - C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\xu8mnzh6.default\


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-09 00:16:19
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\Program Files\UnHackMe\hackmon.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\PROGRA~1\UnHackMe\Unhackme.exe
    .
    **************************************************************************
    .
    Completion time: 2008-08-09 0:24:07 - machine was rebooted [Administrator]
    ComboFix-quarantined-files.txt 2008-08-09 04:23:42

    Pre-Run: 1,322,455,040 bytes free
    Post-Run: 4,920,135,680 bytes free

    249 --- E O F --- 2007-11-15 08:52:50
     
    raniosman,
    #3
  5. 2008/08/08
    raniosman

    raniosman Inactive Thread Starter

    Joined:
    2008/08/08
    Messages:
    3
    Likes Received:
    0
    Here is hijackthis's log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:30:18 AM, on 8/9/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    C:\WINDOWS\system32\lawin.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\IoctlSvc.exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Hi\Appetite.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.509.6972\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [roocouvok] C:\WINDOWS\system32\lawin.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime Alternative\qttask.exe" -atboottime
    O4 - HKLM\..\RunServices: [roocouvok] C:\WINDOWS\system32\lawin.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [UnHackMe Monitor] C:\PROGRA~1\UnHackMe\hackmon.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?be1181bcb4694f4282e3bee6f806a59c
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?be1181bcb4694f4282e3bee6f806a59c
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
    O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
    O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
    O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\system32\NMSSvc.exe
    O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
    O23 - Service: bcveServ (tiana3sfyyehy3j) - Unknown owner - C:\WINDOWS\system32\cysume.exe
    O24 - Desktop Component 0: (no name) - http://www.shopmotorola.ca/red/images/red.jpg

    --
    End of file - 7525 bytes
     
    raniosman,
    #4
  6. 2008/08/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please download Flash_Disinfector by sUBs and save it to your desktop:

    NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

    • Plug in your USB flash drive.
    • Double-click Flash_Disinfector.exe to run it.
    • Follow any prompts that may appear.
    • Your desktop will vanish for a while, and then reappear. This is normal.
    • Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.


    Now, once again, please disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    
http://www.windowsbbs.com/malware-virus-removal/75843-crazy-malware.html#post410339

Suspect::[22]
C:\WINDOWS\winstart.bat
Collect::[22]
C:\WINDOWS\system32\lawin.exe
C:\WINDOWS\system32\cysume.exe
C:\WINDOWS\system32\rywvvhoy.exe
C:\WINDOWS\system32\izcalm.exe
C:\WINDOWS\system32\pkjcbdkplduw.exe
C:\WINDOWS\system32\eyyzrqpuuayky.exe
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "roocouvok "=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
 "roocouvok "=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Miiy]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0b882a5a-0847-11dd-9b4b-0040f45e1048}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e147771e-2551-11dd-9b62-0040f45e1048}]
Driver::
tiana3sfyyehy3j
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


    Please note that I have instructed CFScript to collect some files. This means that when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created on your desktop. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. This will assist the author in adding the files for removal in future updates. Thanks!
     
    noahdfear,
    #5

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...