A HiJack this SpywareDoc talked me into...H E L P!
Here is the HiJackThis that SpywareDr recommended that I post based on this discussion:
http://discussions.virtualdr.com/sho...44#post1307744
I hope I did this correctly and apologize if I did not, or in a reverse order......whatever.
My best guess is: The problem is in the Malwarebytes logfile.
Also: I was completely unable to get a logfile from gmer.
Would it be good enough to just say that a rootkit/malware scan found nothing with gmer's tool?
Problem summary:
Windows Explorer stops working (*many* instances)
-- Kaspersky Internet Security 2010 stops working
-- Games (not online) stop working
-- Cleaners....will not, or extremely slow
-- Full scans with deep rootkit scans are taking 4-5 hours on the Vista side (300GB WD Raptor HD), and 1/4 that amount on the XP side (150GB WD Raptor HD) of my RAID array.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Preliminany scan results from Bit Defender and Panda per P3-450's instructions:
http://discussions.virtualdr.com/sho...d.php?t=167915
On a 20 mbps connection (if relevant) the Panda scan took 3 hours, there was no option at that URL that said:
Disinfect automatically.
All the results said were:
Quote:
Congratulations!
Today you are not infected
We have detected that the Kaspersky Internet Security protection on your PC is enabled and up-to-date.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On to Bit Defender online scan:
Bit Defender Logfile:
BitDefender QuickScan Beta 32-bit v0.9.8.2
------------------------------------------
Scan date: Thu Dec 03 10:09:48 2009
Machine ID: 745F1D5F
Warning: Only 32-bit processes scanned.
No infection found.
---------------------
Processes
---------
<unsigned> VolPanlu.exe 2380 C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
<unsigned> Creative Audio Service 1244 C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
<unsigned> TWeakIt.exe 2416 C:\Program Files\ASUS\TweakIt\TWeakIt.exe
<verified> SMax4PNP 2548 C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
<verified> Kaspersky Anti-Virus 2528 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Kaspersky Anti-Virus 2720 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Microsoft Office Word 4160 C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
<verified> Firefox 4372 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
<verified> Stereo Vision Control Panel API Server 3676 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
<verified> CPMonitor Application 2480 C:\Program Files (x86)\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
<verified> SaibSVC Application 2616 C:\Program Files (x86)\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
<verified> RoboForm TaskBar Icon 2328 C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
<verified> SUPERAntiSpyware Application 2312 C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
Network activity
----------------
Process avp.exe (2720) connected on port 80 (HTTP) - 65.55.17.39
Process avp.exe (2720) connected on port 80 (HTTP) - 65.55.17.34
Process avp.exe (2720) connected on port 80 (HTTP) - 209.85.225.138
Process avp.exe (2720) connected on port 80 (HTTP) - iy-in-f138.1e100.net
Process avp.exe (2720) connected on port 80 (HTTP) - a96-17-252-20.deploy.akamaitechnologies.com
Process avp.exe (2720) listens on ports: 1110, 19780
Autoruns and critical files
---------------------------
<unsigned> VolPanlu.exe C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
<unsigned> ShellExecuteHook c:\program files (x86)\superantispyware\sasseh.dll
<unsigned> SUPERAntiSpyware WinLogon Processor C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
<unsigned> TWeakIt.exe C:\Program Files\ASUS\TweakIt\TWeakIt.exe
<unsigned> xInsIDE.exe C:\Windows\RaidTool\xInsIDE.exe
<verified> SMax4PNP C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
<verified> RoxMMTrayApp Module C:\Program Files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe
<verified> Kaspersky Anti-Virus C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Mozilla 3 Virtual Keyboard c:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll
<verified> Sandbox r3 hooks for virtual processes c:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\sbhook.dll
<verified> CPMonitor Application C:\Program Files (x86)\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
<verified> RoboForm TaskBar Icon C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
<verified> SUPERAntiSpyware Application C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
<verified> Windows Sidebar C:\Program Files\Windows Sidebar\sidebar.exe
<verified> Shell Browser UI Library c:\windows\system32\browseui.dll
<verified> Microsoft Feeds Synchronization C:\Windows\system32\msfeedssync.exe
<verified> Web Site Monitor c:\windows\syswow64\webcheck.dll
<verified> Welcome Center oobefldr.dll
<verified> Userinit Logon Application userinit.exe
Browser plugins
---------------
<verified> IE Virtual Keyboard c:\program files (x86)\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
<verified> WebToolBar component c:\program files (x86)\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
<verified> Default Plug-in C:\Program Files (x86)\Mozilla Firefox\plugins\npnul32.dll
<verified> Office Plugin for Netscape Navigator C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
<verified> RoboForm Main Module C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
<verified> InstallShield Update Service Setup Player Module C:\Windows\Downloaded Program Files\dwusplay.dll
<verified> InstallShield Update Service Setup Player C:\Windows\Downloaded Program Files\dwusplay.exe
<verified> Macrovision Software Manager Web Agent C:\Windows\Downloaded Program Files\isusweb.dll
<verified> Windows Presentation Foundation (WPF) plug-in for c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
<verified> NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll
<verified> Microsoft Windows Sockets 2.0 Service Provider C:\Windows\System32\mswsock.dll
<verified> E-mail Naming Shim Provider C:\Windows\system32\napinsp.dll
<verified> Network Location Awareness 2 C:\Windows\system32\NLAapi.dll
<verified> PNRP Name Space Provider C:\Windows\system32\pnrpnsp.dll
<verified> LDAP RnR Provider DLL C:\Windows\System32\winrnr.dll
<verified> Internet Explorer C:\Windows\SysWOW64\ieframe.dll
Scan
----
No file uploaded.
Scan finished - communication took 4 sec
Total traffic - 0.04 MB sent, 1.16 KB recvd
Scanned 716 files and modules - 32 seconds
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proceeding to Malwarebytes and SUPERantispyware logs -->
SAS in safe mode and Malwarebytes in normal mode files:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/03/2009 at 01:35 PM
Application Version : 4.31.1000
Core Rules Database Version : 4331
Trace Rules Database Version: 2185
Scan type : Complete Scan.....Ran In Safe Mode
Total Scan Time : 00:24:56
Memory items scanned : 134
Memory threats detected : 0
Registry items scanned : 6617
Registry threats detected : 0
File items scanned : 102147
File threats detected : 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Malwarebytes logfile in normal mode:
Malwarebytes' Anti-Malware 1.41
Database version: 3288
Windows 6.0.6002 Service Pack 2
12/3/2009 2:51:31 PM
mbam-log-2009-12-03 (14-51-02).txt
Scan type: Full Scan (C:\|)
Objects scanned: 206661
Time elapsed: 46 minute(s), 19 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
And finally:
On to the real deal.
My HijackThis logfile -->
Malwarebytes fixed something along the way
Hooray!
I guess. :confused:
The malwarebytes log for today (12/4/09 where I am) claims that nothing is infected.
Can't remember requesting a fix, but that may be in the logfiles somewhere.
I do know that the Vista side on newest i7 desktop is running a LOT better.
Why ..... in the world ..... Kaspersky hates this program is way beyond my comprehension.
Jealousy perhaps?
-- a Bit envy? :D
The log from today says:
Malwarebytes' Anti-Malware 1.42
Database version: 3291
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18828
12/4/2009 8:23:52 AM
mbam-log-2009-12-04 (08-23-52).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 236168
Time elapsed: 2 hour(s), 14 minute(s), 28 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you HiJackThis experts can find anything else....kindly post a reply.
I'm at a standstill until we get as much corrected as possible.
In case I haven't said this enough: Thank You moderators, et all to smithereens!
:p
Steve_83
10-4 crunchie & Broni.....Thank you fellows!
This is just a bump that I received this and will do that asap.
I'm running routine maintainence on the XP Pro side of this RAID array.
Once I finish the usual scans there & get into the fubared Vista Drive...I'll post back.
Good to hear from you crunchie ! ;)
It's been awhile since I have needed this type of help.
Bless you too Broni and SpywareDr ! I am --> Indebted.
Thanks gentlemen !
We are definitely making progress.
I want to install 7, but don't think it's a good plan to install a new OS over a sick one.
:rolleyes:
Steve_83
PLEASE LEND ME A HAND ON THE LOGFILE ????
Dr Web seems to be a nice tool to add to anyone's arsenal.
However....Saving a logfile (I am getting to detest Vista, seriously) :mad:...does not hi-lite and it was saved as:
%USERPROFILE%\DoctorWeb\CureIt.log
I've searched all over for that thing.
Frustrating. :(
It can't be found, or maybe (since I'm new at this program) I didn't tick the correct boxes, etc.
Would it suffice to say that it found nothing after taking 1 hour 50 minutes, ?
I'll await a reply and just leave the thing running so I don't lose it and have to spend another 2 hours to find nothing again.
I've got a busy day today with 3 hours of rack time.
Oh Well ? If life was fair....I'd get what I deserve and be in more trouble.
Re-posting another hijackthis is not any problem.
Steve_83
