A HiJack this SpywareDoc talked me into...H E L P!
Here is the HiJackThis that SpywareDr recommended that I post based on this discussion:
http://discussions.virtualdr.com/sho...44#post1307744
I hope I did this correctly and apologize if I did not, or in a reverse order......whatever.
My best guess is: The problem is in the Malwarebytes logfile.
Also: I was completely unable to get a logfile from gmer.
Would it be good enough to just say that a rootkit/malware scan found nothing with gmer's tool?
Problem summary:
Windows Explorer stops working (*many* instances)
-- Kaspersky Internet Security 2010 stops working
-- Games (not online) stop working
-- Cleaners....will not, or extremely slow
-- Full scans with deep rootkit scans are taking 4-5 hours on the Vista side (300GB WD Raptor HD), and 1/4 that amount on the XP side (150GB WD Raptor HD) of my RAID array.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Preliminany scan results from Bit Defender and Panda per P3-450's instructions:
http://discussions.virtualdr.com/sho...d.php?t=167915
On a 20 mbps connection (if relevant) the Panda scan took 3 hours, there was no option at that URL that said:
Disinfect automatically.
All the results said were:
Quote:
Congratulations!
Today you are not infected
We have detected that the Kaspersky Internet Security protection on your PC is enabled and up-to-date.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On to Bit Defender online scan:
Bit Defender Logfile:
BitDefender QuickScan Beta 32-bit v0.9.8.2
------------------------------------------
Scan date: Thu Dec 03 10:09:48 2009
Machine ID: 745F1D5F
Warning: Only 32-bit processes scanned.
No infection found.
---------------------
Processes
---------
<unsigned> VolPanlu.exe 2380 C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
<unsigned> Creative Audio Service 1244 C:\Program Files (x86)\Creative\Shared Files\CTAudSvc.exe
<unsigned> TWeakIt.exe 2416 C:\Program Files\ASUS\TweakIt\TWeakIt.exe
<verified> SMax4PNP 2548 C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
<verified> Kaspersky Anti-Virus 2528 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Kaspersky Anti-Virus 2720 C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Microsoft Office Word 4160 C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
<verified> Firefox 4372 C:\Program Files (x86)\Mozilla Firefox\firefox.exe
<verified> Stereo Vision Control Panel API Server 3676 C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
<verified> CPMonitor Application 2480 C:\Program Files (x86)\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
<verified> SaibSVC Application 2616 C:\Program Files (x86)\Roxio\BackOnTrack\Disaster Recovery\SaibSVC.exe
<verified> RoboForm TaskBar Icon 2328 C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
<verified> SUPERAntiSpyware Application 2312 C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
Network activity
----------------
Process avp.exe (2720) connected on port 80 (HTTP) - 65.55.17.39
Process avp.exe (2720) connected on port 80 (HTTP) - 65.55.17.34
Process avp.exe (2720) connected on port 80 (HTTP) - 209.85.225.138
Process avp.exe (2720) connected on port 80 (HTTP) - iy-in-f138.1e100.net
Process avp.exe (2720) connected on port 80 (HTTP) - a96-17-252-20.deploy.akamaitechnologies.com
Process avp.exe (2720) listens on ports: 1110, 19780
Autoruns and critical files
---------------------------
<unsigned> VolPanlu.exe C:\Program Files (x86)\Creative\SB X-Fi MB\Volume Panel\VolPanlu.exe
<unsigned> ShellExecuteHook c:\program files (x86)\superantispyware\sasseh.dll
<unsigned> SUPERAntiSpyware WinLogon Processor C:\Program Files (x86)\SUPERAntiSpyware\SASWINLO.dll
<unsigned> TWeakIt.exe C:\Program Files\ASUS\TweakIt\TWeakIt.exe
<unsigned> xInsIDE.exe C:\Windows\RaidTool\xInsIDE.exe
<verified> SMax4PNP C:\Program Files (x86)\Analog Devices\Core\smax4pnp.exe
<verified> RoxMMTrayApp Module C:\Program Files (x86)\Common Files\Roxio Shared\11.0\SharedCOM\RoxWatchTray11.exe
<verified> Kaspersky Anti-Virus C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
<verified> Mozilla 3 Virtual Keyboard c:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\mzvkbd3.dll
<verified> Sandbox r3 hooks for virtual processes c:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2010\sbhook.dll
<verified> CPMonitor Application C:\Program Files (x86)\Roxio Creator 2009 Ultimate\5.0\CPMonitor.exe
<verified> RoboForm TaskBar Icon C:\Program Files (x86)\Siber Systems\AI RoboForm\robotaskbaricon.exe
<verified> SUPERAntiSpyware Application C:\Program Files (x86)\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
<verified> Windows Sidebar C:\Program Files\Windows Sidebar\sidebar.exe
<verified> Shell Browser UI Library c:\windows\system32\browseui.dll
<verified> Microsoft Feeds Synchronization C:\Windows\system32\msfeedssync.exe
<verified> Web Site Monitor c:\windows\syswow64\webcheck.dll
<verified> Welcome Center oobefldr.dll
<verified> Userinit Logon Application userinit.exe
Browser plugins
---------------
<verified> IE Virtual Keyboard c:\program files (x86)\kaspersky lab\kaspersky internet security 2010\ievkbd.dll
<verified> WebToolBar component c:\program files (x86)\kaspersky lab\kaspersky internet security 2010\klwtbbho.dll
<verified> Default Plug-in C:\Program Files (x86)\Mozilla Firefox\plugins\npnul32.dll
<verified> Office Plugin for Netscape Navigator C:\Program Files (x86)\Mozilla Firefox\plugins\NPOFF12.DLL
<verified> RoboForm Main Module C:\Program Files (x86)\Siber Systems\AI RoboForm\roboform.dll
<verified> InstallShield Update Service Setup Player Module C:\Windows\Downloaded Program Files\dwusplay.dll
<verified> InstallShield Update Service Setup Player C:\Windows\Downloaded Program Files\dwusplay.exe
<verified> Macrovision Software Manager Web Agent C:\Windows\Downloaded Program Files\isusweb.dll
<verified> Windows Presentation Foundation (WPF) plug-in for c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
<verified> NPSWF32.dll C:\Windows\system32\Macromed\Flash\NPSWF32.dll
<verified> Microsoft Windows Sockets 2.0 Service Provider C:\Windows\System32\mswsock.dll
<verified> E-mail Naming Shim Provider C:\Windows\system32\napinsp.dll
<verified> Network Location Awareness 2 C:\Windows\system32\NLAapi.dll
<verified> PNRP Name Space Provider C:\Windows\system32\pnrpnsp.dll
<verified> LDAP RnR Provider DLL C:\Windows\System32\winrnr.dll
<verified> Internet Explorer C:\Windows\SysWOW64\ieframe.dll
Scan
----
No file uploaded.
Scan finished - communication took 4 sec
Total traffic - 0.04 MB sent, 1.16 KB recvd
Scanned 716 files and modules - 32 seconds
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Proceeding to Malwarebytes and SUPERantispyware logs -->
SAS in safe mode and Malwarebytes in normal mode files:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/03/2009 at 01:35 PM
Application Version : 4.31.1000
Core Rules Database Version : 4331
Trace Rules Database Version: 2185
Scan type : Complete Scan.....Ran In Safe Mode
Total Scan Time : 00:24:56
Memory items scanned : 134
Memory threats detected : 0
Registry items scanned : 6617
Registry threats detected : 0
File items scanned : 102147
File threats detected : 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Malwarebytes logfile in normal mode:
Malwarebytes' Anti-Malware 1.41
Database version: 3288
Windows 6.0.6002 Service Pack 2
12/3/2009 2:51:31 PM
mbam-log-2009-12-03 (14-51-02).txt
Scan type: Full Scan (C:\|)
Objects scanned: 206661
Time elapsed: 46 minute(s), 19 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
And finally:
On to the real deal.
My HijackThis logfile -->
Malwarebytes fixed something along the way
Hooray!
I guess. :confused:
The malwarebytes log for today (12/4/09 where I am) claims that nothing is infected.
Can't remember requesting a fix, but that may be in the logfiles somewhere.
I do know that the Vista side on newest i7 desktop is running a LOT better.
Why ..... in the world ..... Kaspersky hates this program is way beyond my comprehension.
Jealousy perhaps?
-- a Bit envy? :D
The log from today says:
Malwarebytes' Anti-Malware 1.42
Database version: 3291
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18828
12/4/2009 8:23:52 AM
mbam-log-2009-12-04 (08-23-52).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 236168
Time elapsed: 2 hour(s), 14 minute(s), 28 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you HiJackThis experts can find anything else....kindly post a reply.
I'm at a standstill until we get as much corrected as possible.
In case I haven't said this enough: Thank You moderators, et all to smithereens!
:p
Steve_83
10-4 crunchie & Broni.....Thank you fellows!
This is just a bump that I received this and will do that asap.
I'm running routine maintainence on the XP Pro side of this RAID array.
Once I finish the usual scans there & get into the fubared Vista Drive...I'll post back.
Good to hear from you crunchie ! ;)
It's been awhile since I have needed this type of help.
Bless you too Broni and SpywareDr ! I am --> Indebted.
Thanks gentlemen !
We are definitely making progress.
I want to install 7, but don't think it's a good plan to install a new OS over a sick one.
:rolleyes:
Steve_83
PLEASE LEND ME A HAND ON THE LOGFILE ????
Dr Web seems to be a nice tool to add to anyone's arsenal.
However....Saving a logfile (I am getting to detest Vista, seriously) :mad:...does not hi-lite and it was saved as:
%USERPROFILE%\DoctorWeb\CureIt.log
I've searched all over for that thing.
Frustrating. :(
It can't be found, or maybe (since I'm new at this program) I didn't tick the correct boxes, etc.
Would it suffice to say that it found nothing after taking 1 hour 50 minutes, ?
I'll await a reply and just leave the thing running so I don't lose it and have to spend another 2 hours to find nothing again.
I've got a busy day today with 3 hours of rack time.
Oh Well ? If life was fair....I'd get what I deserve and be in more trouble.
Re-posting another hijackthis is not any problem.
Steve_83
These look like there is a compatibilty issue.
Downloaded from bleepingcomputer:
Quote:
Error - Win 32 only
Incompatible OS. ComboFix only works for workstations with Windows 2000 and XP.
Then from subsgeekstogo:
Quote:
Win32. Not a valid combination.
I'm running Vista Ultimate x64 Broni.
Is there a compatible version, please?
I'm trying guy.....please be patient, ok?
Steve_83 :o
OTL scan results Broni, et all
As usual, you are correct Broni :) ......these are semi-large text files that there's no way jose' that I can interpret.
:confused:
So they are at the links below that I hope you can open with notepad.
I'm having one helluva time mangling attachments today.
Someone might be doing maintenance this early in the am ??
OTL Standard scan results are here.
OTL extras are here.
The latest Microsoft Malicious software removal tool for December is available today, and I came up.....clean !
:p
What next guys?
I'm running significantly better on my Vista side, and the case may be:
All my fubared files emanated from Microsoft updates, and Malwarebytes scans seem to have corrected that.
If I can improve: fine.
Should I post back another hijack logfile, and clean this drive up Please?
Bless you fellows, seriously.
Steve_83 :D
Been getting some scans run @ the hospital
ok....just a sec.
Can we pivot that thumb, 90 degrees clockwise, and colo-rrr it?
:o
steve_83 ;)
