Printable View
Despite having what I thought was a pretty secure machine, I find that Firefox has been hijacked by "Windows Secure Kit 2011". I get a popup (despite having popups blocked) which tells me -
"Windows Secure Kit 2011 has found critical process activity on your PC and will perform fast scan of system files".
How do I get rid of this?
You've been to this forum before.
Not once.
You should know how to proceed.
Please, complete all steps listed here: http://discussions.virtualdr.com/sho...d.php?t=167915
Please, observe following rules:
- Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
- If you're stuck, or you're not sure about certain step, always ask before doing anything else.
- Please refrain from running tools or applying updates other than those I suggest.
- Never run more than one scan at a time.
- Keep updating me regarding your computer behavior, good, or bad.
- The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
- If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
- I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.
Thanks Broni.
MalwareBytes scan is clean.
GMER.log is 200000 characters long :eek:- much longer than others usualy posted here. Do you want all of it?
aswMBR.log -
aswMBR version 0.9.9.1532 Copyright(c) 2011 AVAST Software
Run date: 2012-02-04 18:01:04
-----------------------------
18:01:04.500 OS Version: Windows 5.1.2600 Service Pack 3
18:01:04.500 Number of processors: 4 586 0xF0B
18:01:04.500 ComputerName: TESTBED UserName:
18:01:04.890 Initialize success
18:01:15.093 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
18:01:15.093 Disk 0 Vendor: Maxtor_6Y160M0 YAR51BW0 Size: 156333MB BusType: 3
18:01:15.109 Disk 0 MBR read successfully
18:01:15.109 Disk 0 MBR scan
18:01:15.109 Disk 0 Windows XP default MBR code
18:01:15.125 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 24677 MB offset 63
18:01:15.125 Disk 0 Partition - 00 0F Extended LBA 131649 MB offset 50540490
18:01:15.171 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 65789 MB offset 50540553
18:01:15.171 Disk 0 Partition - 00 05 Extended 65860 MB offset 185277645
18:01:15.171 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 65860 MB offset 185277708
18:01:15.171 Disk 0 scanning sectors +320159385
18:01:15.281 Disk 0 scanning C:\WINDOWS\system32\drivers
18:01:43.062 Service scanning
18:01:43.984 Modules scanning
18:02:19.500 Disk 0 trace - called modules:
18:02:19.546 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
18:02:19.546 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8a684ab8]
18:02:19.546 3 CLASSPNP.SYS[b80f8fd7] -> nt!IofCallDriver -> \Device\00000072[0x8a662f18]
18:02:19.546 5 ACPI.sys[b7f7f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8a692d98]
18:02:19.546 Scan finished successfully
18:06:26.234 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
18:06:26.234 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"
---
DDS.txt -
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_24
Run by Administrator at 18:10:23 on 2012-02-04
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.2046.1416 [GMT 0:00]
.
AV: ESET NOD32 Antivirus 5.0 *Enabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
E:\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
E:\Tablet\Pen\Pen_TouchService.exe
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
E:\Tablet\Pen\Pen_TouchUser.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
E:\SUPERAntiSpyware\SASCORE.EXE
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
D:\APC PowerChute\mainserv.exe
svchost.exe
E:\NOD32\ekrn.exe
E:\Java\jre6\bin\jqs.exe
E:\PerfectDisk\PDAgent.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
E:\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
D:\Acronis\TrueImageMonitor.exe
D:\Acronis\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Java\Java Update\jusched.exe
E:\Microsoft IntelliType Pro\itype.exe
E:\Microsoft IntelliPoint\ipoint.exe
E:\NOD32\egui.exe
E:\Shortcuts\kshortcuts.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
E:\Office 2000\Office\1033\msoffice.exe
D:\APC PowerChute\apcsystray.exe
E:\PerfectDisk\PDEngine.exe
svchost.exe
E:\Comodo\Dragon\dragon_updater.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.gcactuaries.org/
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - e:\acrobat 5.0\acrobat\activex\AcroIEHelper.ocx
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - e:\divx\divx plus web player\npdivx32.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - e:\divx\divx plus web player\npdivx32.dll
BHO: LastPass Browser Helper Object: {95d9ecf5-2a4d-4550-be49-70d42f71296e} - d:\lastpass\LPBar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - e:\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - e:\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: LastPass Toolbar: {9f6b5cc3-5c7b-4b5c-97af-19dec1e380e5} - d:\lastpass\LPBar.dll
uRun: [kshortcuts] e:\shortcuts\kshortcuts.exe /background
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [TrueImageMonitor.exe] d:\acronis\TrueImageMonitor.exe
mRun: [AcronisTimounterMonitor] d:\acronis\TimounterMonitor.exe
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [itype] "e:\microsoft intellitype pro\itype.exe"
mRun: [IntelliPoint] "e:\microsoft intellipoint\ipoint.exe"
mRun: [egui] "e:\nod32\egui.exe" /hide /waitservice
mRun: [COMODO Internet Security] "e:\comodo\comodo internet security\cfp.exe" -h
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\apcups~1.lnk - d:\apc powerchute\Display.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - e:\office 2000\office\OSA9.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nikonm~1.lnk - c:\program files\common files\nikon\monitor\NkMonitor.exe
IE: LastPass - file://d:\lastpass\context.html?cmd=lastpass
IE: LastPass Fill Forms - file://d:\lastpass\context.html?cmd=fillforms
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {95D9ECF5-2A4D-4550-BE49-70D42F71296E} - d:\lastpass\LPBar.dll
DPF: {0A43D7AC-D6C1-4622-B309-BF975F427C0E} - hxxps://internetbankingplus1.firstdirect.com/ibplus/frontdoorFD.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} - hxxp://catalog.update.microsoft.com/v7/site/ClientControl/en/x86/MuCatalogWebControl.cab?1303933542234
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1262100731234
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {B1D21FC5-A742-4261-86F2-C7B7F1A31C5D} - hxxps://services.dlink.eu/jde/axctls/jdewebctlsU.cab
DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab
TCP: Interfaces\{3E924A38-47D1-4391-B42B-E57BF37566EC} : NameServer = 8.26.56.26,156.154.70.22
AppInit_DLLs: c:\windows\system32\guard32.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Eudora's Shell Extension: {edb0e980-90bd-11d4-8599-0008c7d3b6f8} - Eudora's Shell Extension
SEH: {4F07DA45-8170-4859-9B5F-037EF2970034} - No File
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - e:\superantispyware\SASSEH.DLL
LSA: Authentication Packages = msv1_0 relog_ap
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\administrator\application data\mozilla\firefox\profiles\7blzqhig.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.gcactuaries.org
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\7blzqhig.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll
FF - component: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\7blzqhig.default\extensions\[email protected]\platform\winnt_x86-msvc\components\lpxpcom.dll
FF - plugin: c:\program files\windows media player\npdrmv2.dll
FF - plugin: c:\program files\windows media player\npdsplay.dll
FF - plugin: c:\program files\windows media player\npwmsdrm.dll
FF - plugin: d:\firefox\plugins\npdeployJava1.dll
FF - plugin: e:\acrobat 5.0\acrobat\browser\nppdf32.dll
FF - plugin: e:\canon\easy-photoprint ex\NPEZFFPI.DLL
FF - plugin: e:\divx\divx ovs helper\npovshelper.dll
FF - plugin: e:\divx\divx plus web player\npdivx32.dll
FF - plugin: e:\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: e:\microsoft silverlight\4.0.60831.0\npctrl.dll
FF - plugin: e:\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: e:\opera\program\plugins\np_gp.dll
FF - plugin: e:\opera\program\plugins\nppdf32.dll
FF - plugin: e:\opera\program\plugins\npupd62.dll
FF - plugin: e:\tabletplugins\npwacom.dll
.
============= SERVICES / DRIVERS ===============
.
R0 EUBAKUP;EUBAKUP;c:\windows\system32\drivers\eubakup.sys [2010-2-18 26248]
R0 EUFS;EUFS;c:\windows\system32\drivers\eufs.sys [2010-2-18 20616]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdGuard.sys [2012-1-17 494968]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2011-12-19 31704]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2011-8-4 118104]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2011-8-4 103112]
R1 SASDIFSV;SASDIFSV;e:\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;e:\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;e:\superantispyware\SASCORE.EXE [2011-7-19 116608]
R2 cmdAgent;COMODO Internet Security Helper Service;e:\comodo\comodo internet security\cmdagent.exe [2011-12-19 1960584]
R2 DragonUpdater;COMODO Dragon Update Service;e:\comodo\dragon\dragon_updater.exe [2012-1-24 404216]
R2 ekrn;ESET Service;e:\nod32\ekrn.exe [2011-9-22 974944]
R2 TabletServicePen;TabletServicePen;e:\tablet\pen\Pen_Tablet.exe [2011-6-22 4869488]
R2 TouchServicePen;Wacom Consumer Touch Service;e:\tablet\pen\Pen_TouchService.exe [2011-6-22 416112]
R3 EuDisk;EASEUS Disk Enumerator;c:\windows\system32\drivers\EuDisk.sys [2010-2-18 122504]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2010-1-29 13192]
S3 EUDSKACS;EUDSKACS;c:\windows\system32\drivers\eudskacs.sys [2010-2-18 14216]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2010-1-29 8456]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2011-3-16 13224]
S3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\drivers\wacmoumonitor.sys [2008-9-21 16240]
S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2007-7-27 14336]
S4 NasPmService;NAS PM Service;c:\program files\buffalo\nasnavi\nassvc.exe -service_execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 --> c:\program files\buffalo\nasnavi\nassvc.exe -Service_Execute -dcyc=60 -dto=3 -dluc=0 -dmin=1 -dmax=60 -dflc=0 -apc=0 -log=0 -pm=1 -pall=1 -phttp=0 -pbc=0 -ppro=0 -pcyc=0 -pmin=1 -pmax=60 -pflc=0 [?]
S4 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\drivers\vboxnetflt.sys --> c:\windows\system32\drivers\VBoxNetFlt.sys [?]
.
=============== Created Last 30 ================
.
2012-02-04 15:39:12 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Comodo
2012-02-04 15:31:40 -------- d-----w- c:\documents and settings\all users\application data\Comodo
2012-02-04 15:30:42 -------- d-----w- e:\\COMODO
2012-02-04 15:04:00 -------- d-----w- c:\documents and settings\administrator\local settings\application data\Privatefirewall
2012-02-04 15:01:46 -------- d-----w- c:\documents and settings\all users\application data\Privacyware
2012-01-17 21:00:50 494968 ----a-w- c:\windows\system32\drivers\cmdGuard.sys
.
==================== Find3M ====================
.
2011-12-19 18:59:22 31704 ----a-w- c:\windows\system32\drivers\cmdhlp.sys
2011-12-19 18:59:20 18056 ----a-w- c:\windows\system32\drivers\cmderd.sys
2011-12-19 18:58:58 33984 ----a-w- c:\windows\system32\cmdcsr.dll
2011-12-19 18:58:56 301224 ----a-w- c:\windows\system32\guard32.dll
2011-12-10 15:24:06 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-12-01 10:13:12 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2009-11-21 14:28:48 5262024 ----a-w- c:\program files\common files\lpuninstall.exe
.
============= FINISH: 18:10:41.34 ===============
attach.txt -
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 29/08/2008 22:35:21
System Uptime: 04/02/2012 15:33:44 (3 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | P35-DS3
Processor: Intel(R) Core(TM)2 Quad CPU Q6600 @ 2.40GHz | Socket 775 | 2400/266mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 24 GiB total, 7.781 GiB free.
D: is FIXED (NTFS) - 64 GiB total, 59.934 GiB free.
E: is FIXED (NTFS) - 64 GiB total, 60.949 GiB free.
F: is CDROM ()
G: is FIXED (NTFS) - 932 GiB total, 920.257 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97D-E325-11CE-BFC1-08002BE10318}
Description:
Device ID: ROOT\COMPOSITE_BATTERY\0000
Manufacturer: Microsoft
Name:
PNP Device ID: ROOT\COMPOSITE_BATTERY\0000
Service:
.
Class GUID: {EEC5AD98-8080-425F-922A-DABF3DE3F69A}
Description: Nokia E71
Device ID: ROOT\WPD\0000
Manufacturer: Nokia
Name: Nokia E71
PNP Device ID: ROOT\WPD\0000
Service: WUDFRd
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
Acoustica Effects Pack
Acronis*True*Image*Home
Adobe Acrobat 5.0
Adobe Download Manager
Adobe Flash Player 10 ActiveX
Adobe Flash Player 11 Plugin
Adobe Shockwave Player 11.5
APC PowerChute Personal Edition
Ashampoo Burning Studio 6 FREE v.6.80
Bamboo
BaseStation
BS Route
BUFFALO NAS Navigator
Canon IJ Network Tool
Canon MP640 series MP Drivers
Canon MP640 series User Registration
Canon Utilities Easy-PhotoPrint EX
Canon Utilities My Printer
Canon Utilities Solution Menu
Capture NX 2
CCleaner
CD-LabelPrint
Click to Call with Skype
Comodo Dragon
COMODO Internet Security
Compatibility Pack for the 2007 Office system
CSE HTML Validator Lite v10.02
DivX Setup
doPDF 7.1 printer
EASEUS Partition Master 4.1.1 Professional
EASEUS Todo Backup 1.1
ESET NOD32 Antivirus
FastStone Image Viewer 4.0
Foxit PDF Editor
Foxit PDF IFilter
FTDI USB Serial Converter Drivers
Gigabyte Raid Configurer
Google Update Helper
Iconoid Version 3.8.5
IZArc 4.1.2
Java Auto Updater
Java(TM) 6 Update 24
jv16 PowerTools 2011
Keyboard Shortcuts 1.2
Malwarebytes Anti-Malware version 1.60.1.1000
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft .NET Framework 3.0
Microsoft Application Error Reporting
Microsoft IntelliPoint 7.1
Microsoft IntelliType Pro 7.1
Microsoft Office 2000 Disc 2
Microsoft Office 2000 Premium
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
ML-1510_700 Series
Mozilla Firefox 10.0 (x86 en-GB)
Mozilla Thunderbird (8.0)
MSVC80_x86
MSVC80_x86_v2
MSVC90_x86
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
MyTomTom 3.1.0.432
NEF Codec
Nikon Message Center
Nikon Message Center 2
Nikon Transfer
NVIDIA Control Panel 260.99
NVIDIA Graphics Driver 260.99
NVIDIA Install Application
NVIDIA nView 135.36
NVIDIA nView Desktop Manager
OpenOffice.org 3.2
Opera 11.61
PC Connectivity Solution
Pegasus Mail
PerfectDisk 11 Professional
Picture Control Utility
PlanePlotter 5.4.3.9
PSPad editor
Radar Assistant
Real Alternative 2.0.2
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
RegVac Registry Cleaner 5.02 (Registered Version)
RJ TextEd
SBS-resources
Security Update for CAPICOM (KB931906)
Skype™ 5.5
Spin It Again
SpywareBlaster 4.5
SUPERAntiSpyware
System Requirements Lab
The Eye v1.0.6 (b345)
Turbo Lister 2
Tweak UI
UltraExplorer 2.0.3.1
Update Cleanup
VC80CRTRedist - 8.0.50727.4053
VideoReDo TVSuite Version 3.1.5.564
ViewNX 2
VinylStudio
Visual Studio C++ 10.0 Runtime
Visual Studio C++ 9.0 Runtime
VLC media player 1.1.11
WebEx
WebFldrs XP
WebTablet IE Plugin
WebTablet Netscape Plugin
Windows Communication Foundation
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Media Format 11 runtime
Windows Media Player Firefox Plugin
Windows Presentation Foundation
Windows Workflow Foundation
WinRAR archiver
XML Paper Specification Shared Components Pack 1.0
ZipGenius 6 (6.3.1.2617)
ZSoft Uninstaller 2.5
.
==== Event Viewer Messages From Past Week ========
.
04/02/2012 15:14:03, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library Easy Disk USB Device.
04/02/2012 15:04:39, error: RemoteAccess [20151] - The Control Protocol IPCP in the Point to Point Protocol module (unknown) returned an error while initializing. A device attached to the system is not functioning.
04/02/2012 15:03:51, error: PlugPlayManager [12] - The device 'WAN Miniport (IP) - Privacyware Filter Miniport' (Root\PWIPF6MP\0002) disappeared from the system without first being prepared for removal.
04/02/2012 15:03:51, error: PlugPlayManager [12] - The device 'TomTom - Privacyware Filter Miniport' (Root\PWIPF6MP\0000) disappeared from the system without first being prepared for removal.
04/02/2012 15:03:51, error: PlugPlayManager [12] - The device 'Realtek RTL8168/8111 PCI-E Gigabit Ethernet NIC - Privacyware Filter Miniport' (Root\PWIPF6MP\0001) disappeared from the system without first being prepared for removal.
03/02/2012 17:22:22, error: Removable Storage Service [111] - RSM could not load media in drive Drive 0 of library USB DISK 2.0 USB Device.
02/02/2012 08:47:13, error: Removable Storage Service [15] - RSM cannot manage library CdRom0. The database is corrupt.
.
==== End Of File ===========================
Upload GMER file here: http://uploadmb.com/
Copy the link inside the Direct Link box and post it in your next reply.
GMER.txt is at http://www.uploadmb.com/dw.php?id=1328385875
Please download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
- Please, never rename Combofix unless instructed.
- Close any open browsers.
- Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
- Double click on combofix.exe & follow the prompts.
- When finished, it will produce a report for you.
- Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.
Make sure, you re-enable your security programs, when you're done with Combofix.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
NOTE.
If, for some reason, Combofix refuses to run, try one of the following:
1. Run Combofix from Safe Mode (How to...)
2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.
Rkill.com
Rkill.scr
Rkill.exe
- Double-click on the Rkill desktop icon to run the tool.
- If using Vista or Windows 7 right-click on it and choose Run As Administrator.
- A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
- If not, delete the file, then download and use the one provided in Link 2.
- If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
- Do not reboot until instructed.
- If the tool does not run from any of the links provided, please let me know.
Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.
If normal mode still doesn't work, run BOTH tools from safe mode.
In case #2, please post BOTH logs, rKill and Combofix.
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
ComboFix warns me that NOD32's real-time scanner is still running - even though I have disabled NOD32 via the GUI. Task Manager shows that ekrn.exe is still running, and it's impossible to close it. Safe Mode makes no difference. So the only way I could run ComboFix will be to uninstall NOD32 ... ?
Disregard Combofix warning and run it.
One and a half hours on "Completed Stage 8" ... ?
Something wrong here.
Restart manually to safe mode and try again from there.
Exactly the same thing happens in Safe Mode - ComboFix just stops after "Completed Stage 8".
Download Bootkit Remover to your Desktop.
- Unzip downloaded file to your Desktop.
- Double-click on boot_cleaner.exe to run the program (Vista/7 users,right click on boot_cleaner.exe and click Run As Administrator).
- It will show a Black screen with some data on it.
- Right click on the screen and click Select All.
- Press CTRL+C
- Open a Notepad and press CTRL+V
- Post the output back here.
Bootkit log looks clear to me -
Bootkit Remover
<c> 2009 Esage Lab
www.esagelab.com
Program version: 1.2.0.1
OS Version: Microsoft Windows XP Professional Service Pack 3 <build 2600>
System volume is \\.\C:
\\.\C: -> \\.\PhysicalDrive0 at offset 0x00000000'00007e00
Boot sector MD5 is: 6def5ffcbcdbdb4082f1015625e597bd
Size Device Name MBR Status
--------------------------------------------
152 GB \\.\PhysicalDrive0 OK <DOS/Win32 Boot code found>
Done;
Press any key to quit...
Edit to my last post. I see that a log file (bootkit_remover_debug_log.txt) has been generated. This is 730 lines long, around 43000 characters. Do you want me to post this?
No.
Download TDSSKiller and save it to your desktop.
- Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
- If an infected file is detected, the default action will be Cure, click on Continue.
- If a suspicious file is detected, the default action will be Skip, click on Continue.
- It may ask you to reboot the computer to complete the process. Click on Reboot Now.
- If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
- If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.
TDSSKiller scan is 100% clean - nothing detected.
Download OTL to your Desktop.
- Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
- Click the Scan All Users checkbox.
- Under the Custom Scan box paste this in:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop
- Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
- When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
- Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
Still with me?
Yep - been away on business and just back. It's bedtime here now. Will post the logs from OTL tomorrow but - to my untutored eye - they look clean.
OK.....
Broni
Really appreciate your help and perseverance here. But these two logs look clean to me. Also - and forgive me if I'm being naive here - I have just tried uninstalling Firefox and deleting my profile and application data, then reinstalling (v10 - previously running v9 when the hijack occurred) and re-creating my profile ... and no more browser hijack :confused:. Everything seems clean as a whistle.
I'm inclined to leave things as they are for the time being but be extra vigilant for any further oddities. What do you think?
That will be up to you.