definitately a virus, need help!!!
Results 1 to 10 of 10

Thread: definitately a virus, need help!!!

  1. October 15th, 2009, 12:53 PM #1
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245

    Red face definitately a virus, need help!!!

    hi, ok coworker got a virus on her pc. I tried downloading malwarebytes and HJT, but whatever this is its hip to it and quick. The HJT I had the option to open and run a scan and save log, it starts the scan, and then closes off immediately. there is no finished scan, no file log saved to post. So first question....how do I get this running so that I can get a file log posted on here?? thanks!!!:
    Reply With Quote Reply With Quote
  2. October 15th, 2009, 02:59 PM #2
    fink's Avatar
    fink
    fink is offline Site Moderator
    Join Date
    Jul 1998
    Location
    Toronto
    Posts
    26,543
    Have you tried safe mode (with networking) to download the files (tap F8 while booting to get to safe mode)? how about downloading them on another pc and transfering via cd or usb drive? How about renaming the file name(s) before running (eg- hijackthis.exe to scanner4.exe)?

    If none of this helps then..

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

    Above combofix instructions courtesy of Broni
    _____________________
    cat lovers click here
    Reply With Quote Reply With Quote
  3. October 19th, 2009, 11:16 AM #3
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245
    hi, thank you for the reply, i will paste the combofix log below and then send a hijackthis report next.

    combofix:
    ComboFix 09-10-18.06 - administrator 10/19/2009 10:53.1.2 - NTFSx86
    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\launcher.exe
    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\setuplng.dll
    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\unregwtr.exe
    c:\documents and settings\Administrator\Application Data\iniasd.txt
    c:\documents and settings\Administrator\Application Data\jahinewiwi._sy
    c:\documents and settings\Administrator\Application Data\lizkavd.exe
    c:\documents and settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Application Data\mumi.scr
    c:\documents and settings\Administrator\Application Data\seres.exe
    c:\documents and settings\Administrator\Application Data\svcst.exe
    c:\documents and settings\Administrator\Cookies\luhilido.scr
    c:\documents and settings\Administrator\Cookies\ycefati.dll
    c:\documents and settings\Administrator\Desktop\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Local Settings\Application Data\gyqicolale.dl
    c:\documents and settings\Administrator\Local Settings\Application Data\kogal.bin
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\launcher.exe
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\setuplng.dll
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\unregwtr.exe
    c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\vijehysymu.ban
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk
    c:\documents and settings\All Users\Application Data\jehuko.com
    c:\documents and settings\All Users\Application Data\yseqoxetys.reg
    C:\p2hhr.bat
    c:\program files\AntivirusPro_2010
    c:\program files\AntivirusPro_2010\AntivirusPro_2010.cfg
    c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe
    c:\program files\Common Files\erog.bin
    c:\program files\Common Files\isewidahe.reg
    c:\program files\Common Files\wyjixi.ban
    c:\recycler\NPROTECT
    c:\recycler\S-1-5-21-3839024881-3593992594-23071211-500
    c:\windows\dojox.dl
    c:\windows\jypuwusu.sys
    c:\windows\kugejewyko._sy
    c:\windows\onoq.bat
    c:\windows\pohexyl._sy
    c:\windows\system32\_scui.cpl
    c:\windows\system32\~.exe
    c:\windows\system32\axaltocm.dll
    c:\windows\system32\s6b8bxe74.dll
    c:\windows\ubufif.exe
    c:\windows\xedy.ban
    c:\windows\zyqebige._dl

    Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
    Restored copy from - c:\windows\system32\logevent.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NWCWORKSTATION
    -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
    -------\Service_NWCWorkstation
    Reply With Quote Reply With Quote
  4. October 19th, 2009, 11:17 AM #4
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245
    hijackthis log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:17:05 AM, on 10/19/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\brsvc01a.exe
    C:\WINDOWS\system32\brss01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\WINDOWS\SYSTEM32\DWRCS.EXE
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\SYSTEM32\DWRCST.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKUS\S-1-5-21-2773856361-2553065814-565847294-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - HKUS\S-1-5-21-2773856361-2553065814-565847294-500\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196176763328
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BFF4B330-9936-48BA-8096-E219EBEC1C94}: NameServer = 167.206.112.138,167.206.7.4
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
    O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
    O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
    O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
    O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 5917 bytes
    Reply With Quote Reply With Quote
  6. October 19th, 2009, 09:59 PM #5
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Combofix log is incomplete. Please, post C:\ComboFix.txt again.
    My Home Page
    Reply With Quote Reply With Quote
  7. October 20th, 2009, 02:06 PM #6
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245
    combofix log repost:


    ComboFix 09-10-18.06 - administrator 10/19/2009 10:53.1.2 - NTFSx86
    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\launcher.exe
    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\setuplng.dll
    c:\docume~1\ADMINI~1\LOCALS~1\Temp\~WKS99TEMP\unregwtr.exe
    c:\documents and settings\Administrator\Application Data\iniasd.txt
    c:\documents and settings\Administrator\Application Data\jahinewiwi._sy
    c:\documents and settings\Administrator\Application Data\lizkavd.exe
    c:\documents and settings\Administrator\Application Data\Microsoft\Internet Explorer\Quick Launch\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Application Data\mumi.scr
    c:\documents and settings\Administrator\Application Data\seres.exe
    c:\documents and settings\Administrator\Application Data\svcst.exe
    c:\documents and settings\Administrator\Cookies\luhilido.scr
    c:\documents and settings\Administrator\Cookies\ycefati.dll
    c:\documents and settings\Administrator\Desktop\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Local Settings\Application Data\gyqicolale.dl
    c:\documents and settings\Administrator\Local Settings\Application Data\kogal.bin
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\launcher.exe
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\setuplng.dll
    c:\documents and settings\Administrator\Local Settings\Temp\~WKS99TEMP\unregwtr.exe
    c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\vijehysymu.ban
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010\AntivirusPro_2010.lnk
    c:\documents and settings\Administrator\Start Menu\Programs\AntivirusPro_2010\Uninstall.lnk
    c:\documents and settings\All Users\Application Data\jehuko.com
    c:\documents and settings\All Users\Application Data\yseqoxetys.reg
    C:\p2hhr.bat
    c:\program files\AntivirusPro_2010
    c:\program files\AntivirusPro_2010\AntivirusPro_2010.cfg
    c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe
    c:\program files\Common Files\erog.bin
    c:\program files\Common Files\isewidahe.reg
    c:\program files\Common Files\wyjixi.ban
    c:\recycler\NPROTECT
    c:\recycler\S-1-5-21-3839024881-3593992594-23071211-500
    c:\windows\dojox.dl
    c:\windows\jypuwusu.sys
    c:\windows\kugejewyko._sy
    c:\windows\onoq.bat
    c:\windows\pohexyl._sy
    c:\windows\system32\_scui.cpl
    c:\windows\system32\~.exe
    c:\windows\system32\axaltocm.dll
    c:\windows\system32\s6b8bxe74.dll
    c:\windows\ubufif.exe
    c:\windows\xedy.ban
    c:\windows\zyqebige._dl

    Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
    Restored copy from - c:\windows\system32\logevent.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_NWCWORKSTATION
    -------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
    -------\Service_NWCWorkstation


    ((((((((((((((((((((((((( Files Created from 2009-09-19 to 2009-10-19 )))))))))))))))))))))))))))))))
    .

    2009-10-15 16:31 . 2009-10-15 16:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-10-15 16:31 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-10-15 16:31 . 2009-10-15 16:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-15 16:31 . 2009-10-15 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-10-15 16:31 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-10-14 18:18 . 2009-10-14 18:18 16862 ----a-w- c:\windows\system32\nixuqasa.com
    2009-10-14 18:18 . 2009-10-14 18:18 15545 ----a-w- c:\windows\wiximi.dat
    2009-10-14 18:14 . 2009-10-19 14:26 0 ----a-r- c:\windows\win32k.sys
    2009-10-14 18:11 . 2009-10-14 18:11 136 ----a-w- C:\nmihj.dat
    2009-10-14 18:10 . 2009-10-14 18:10 53248 ----a-w- C:\riyxlqe.exe
    2009-10-14 18:10 . 2009-10-14 18:10 31232 ----a-w- C:\iytcqy.exe
    2009-10-14 18:10 . 2009-10-14 18:10 243200 ----a-w- C:\tfdp.exe
    2009-10-14 18:10 . 2009-10-14 18:10 42114 ----a-w- C:\nmihj.exe
    2009-10-14 18:10 . 2009-10-14 18:10 9216 ----a-w- C:\svhkapw.exe
    2009-10-14 18:10 . 2009-10-14 18:10 19456 ----a-w- C:\cwxa.exe
    2009-09-29 18:01 . 2009-09-29 18:06 -------- d-----w- c:\documents and settings\Administrator\Application Data\webex
    2009-09-29 18:01 . 2009-09-29 19:05 -------- d-----w- c:\program files\WebEx

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-08-06 23:24 . 2004-08-04 08:00 327896 ----a-w- c:\windows\system32\wucltui.dll
    2009-08-06 23:24 . 2004-08-04 08:00 209632 ----a-w- c:\windows\system32\wuweb.dll
    2009-08-06 23:24 . 2005-05-26 09:16 44768 ----a-w- c:\windows\system32\wups2.dll
    2009-08-06 23:24 . 2004-08-04 08:00 35552 ----a-w- c:\windows\system32\wups.dll
    2009-08-06 23:24 . 2004-08-04 08:00 53472 ----a-w- c:\windows\system32\wuauclt.exe
    2009-08-06 23:24 . 2004-08-04 08:00 96480 ----a-w- c:\windows\system32\cdm.dll
    2009-08-06 23:23 . 2004-08-04 08:00 575704 ----a-w- c:\windows\system32\wuapi.dll
    2009-08-06 23:23 . 2007-11-28 03:21 274288 ----a-w- c:\windows\system32\mucltui.dll
    2009-08-06 23:23 . 2007-07-31 00:18 215920 ----a-w- c:\windows\system32\muweb.dll
    2009-08-06 23:23 . 2004-08-04 08:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
    2009-08-05 09:11 . 2004-08-04 08:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    1998-12-09 07:53 . 1998-12-09 07:53 99840 -c--a-w- c:\program files\Common Files\IRAABOUT.DLL
    1998-12-09 07:53 . 1998-12-09 07:53 70144 -c--a-w- c:\program files\Common Files\IRAMDMTR.DLL
    1998-12-09 07:53 . 1998-12-09 07:53 48640 -c--a-w- c:\program files\Common Files\IRALPTTR.DLL
    1998-12-09 07:53 . 1998-12-09 07:53 31744 -c--a-w- c:\program files\Common Files\IRAWEBTR.DLL
    1998-12-09 07:53 . 1998-12-09 07:53 186368 -c--a-w- c:\program files\Common Files\IRAREG.DLL
    1998-12-09 07:53 . 1998-12-09 07:53 17920 -c--a-w- c:\program files\Common Files\IRASRIAL.DLL
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
    2002-02-15 15:51 24638 ----a-w- c:\windows\system32\PCANotify.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PrintNow.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PrintNow.lnk
    backup=c:\windows\pss\PrintNow.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Symantec Fax Starter Edition Port.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Symantec Fax Starter Edition Port.lnk
    backup=c:\windows\pss\Symantec Fax Starter Edition Port.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Symantec\\pcAnywhere\\winaw32.exe"=
    "c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Microsoft Office\\ART\\Office\\MSACCESS.EXE"=
    "c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=
    "c:\\Program Files\\Microsoft Office\\Office\\1033\\WFXMSRVR.EXE"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8100:TCP"= 8100:TCP:bensonhurst01.ahr.com
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    S2 vnccom;vnccom;c:\windows\system32\Drivers\vnccom.SYS [2004-06-26 6016]

    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-19 c:\windows\Tasks\Acrobat Update.job
    - c:\nmihj.exe [2009-10-14 18:10]

    2009-10-19 c:\windows\Tasks\Symantec NetDetect.job
    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-02-02 14:04]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = www.yahoo.com/
    TCP: {BFF4B330-9936-48BA-8096-E219EBEC1C94} = 167.206.112.138,167.206.7.4
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-19 11:07
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3228)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\program files\Roxio\Easy Media Creator 8\Drag to Disc\Shellex.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
    c:\windows\system32\BRSVC01A.EXE
    c:\windows\system32\BRSS01A.EXE
    c:\program files\Symantec\pcAnywhere\awhost32.exe
    c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    c:\windows\system32\DWRCS.EXE
    c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    c:\windows\system32\snmp.exe
    c:\program files\Analog Devices\SoundMAX\SMAgent.exe
    c:\combofix\CF31893.exe
    c:\windows\system32\DWRCST.EXE
    .
    **************************************************************************
    .
    Completion time: 2009-10-19 11:10 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-10-19 15:10

    Pre-Run: 25,323,687,936 bytes free
    Post-Run: 26,304,970,752 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - FAF96B758E47B2AA41371347CC22CC65
    Reply With Quote Reply With Quote
  8. October 20th, 2009, 07:04 PM #7
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    1. Please open Notepad
    • Click Start , then Run
    • Type notepad.exe in the Run Box.


    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\system32\nixuqasa.com
c:\windows\wiximi.dat
c:\windows\win32k.sys
C:\nmihj.dat
C:\riyxlqe.exe
C:\iytcqy.exe
C:\tfdp.exe
C:\nmihj.exe
C:\svhkapw.exe
C:\cwxa.exe
c:\program files\Common Files\IRAABOUT.DLL
c:\program files\Common Files\IRAMDMTR.DLL
c:\program files\Common Files\IRALPTTR.DLL
c:\program files\Common Files\IRAWEBTR.DLL
c:\program files\Common Files\IRAREG.DLL
c:\program files\Common Files\IRASRIAL.DLL


Folder::

Driver::

Registry::

RegLockDel::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
    My Home Page
    Reply With Quote Reply With Quote
  9. November 2nd, 2009, 08:44 PM #8
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245

    Talking sorry for the delay

    ok, sorry it took so long, swamped with work. I did what you said to do, here is the new combofix report:

    ComboFix 09-11-01.04 - administrator 11/02/2009 19:30.2.2 - NTFSx86
    Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
    * Created a new restore point

    FILE ::
    "C:\cwxa.exe"
    "C:\iytcqy.exe"
    "C:\nmihj.dat"
    "C:\nmihj.exe"
    "c:\program files\Common Files\IRAABOUT.DLL"
    "c:\program files\Common Files\IRALPTTR.DLL"
    "c:\program files\Common Files\IRAMDMTR.DLL"
    "c:\program files\Common Files\IRAREG.DLL"
    "c:\program files\Common Files\IRASRIAL.DLL"
    "c:\program files\Common Files\IRAWEBTR.DLL"
    "C:\riyxlqe.exe"
    "C:\svhkapw.exe"
    "C:\tfdp.exe"
    "c:\windows\system32\nixuqasa.com"
    "c:\windows\win32k.sys"
    "c:\windows\wiximi.dat"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\cwxa.exe
    C:\iytcqy.exe
    C:\nmihj.dat
    C:\nmihj.exe
    c:\program files\Common Files\IRAABOUT.DLL
    c:\program files\Common Files\IRALPTTR.DLL
    c:\program files\Common Files\IRAMDMTR.DLL
    c:\program files\Common Files\IRAREG.DLL
    c:\program files\Common Files\IRASRIAL.DLL
    c:\program files\Common Files\IRAWEBTR.DLL
    C:\riyxlqe.exe
    C:\svhkapw.exe
    C:\tfdp.exe
    c:\windows\system32\nixuqasa.com
    c:\windows\win32k.sys
    c:\windows\wiximi.dat

    .
    ((((((((((((((((((((((((( Files Created from 2009-10-03 to 2009-11-03 )))))))))))))))))))))))))))))))
    .

    2009-11-01 15:00 . 2009-11-01 15:00 -------- d-----w- c:\windows\LastGood
    2009-10-19 15:17 . 2009-10-19 15:17 -------- d-----w- c:\program files\Trend Micro
    2009-10-15 16:31 . 2009-10-15 16:31 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
    2009-10-15 16:31 . 2009-09-10 18:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-10-15 16:31 . 2009-10-15 16:49 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2009-10-15 16:31 . 2009-10-15 16:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-10-15 16:31 . 2009-09-10 18:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-27 19:34 . 2008-01-21 17:16 -------- d-----w- c:\program files\ICAEL Application
    2009-09-29 19:05 . 2009-09-29 18:01 -------- d-----w- c:\program files\WebEx
    2009-09-29 18:06 . 2009-09-29 18:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\webex
    2009-08-06 23:24 . 2004-08-04 08:00 327896 ----a-w- c:\windows\system32\wucltui.dll
    2009-08-06 23:24 . 2004-08-04 08:00 209632 ----a-w- c:\windows\system32\wuweb.dll
    2009-08-06 23:24 . 2005-05-26 09:16 44768 ----a-w- c:\windows\system32\wups2.dll
    2009-08-06 23:24 . 2004-08-04 08:00 35552 ----a-w- c:\windows\system32\wups.dll
    2009-08-06 23:24 . 2004-08-04 08:00 53472 ------w- c:\windows\system32\wuauclt.exe
    2009-08-06 23:24 . 2004-08-04 08:00 96480 ----a-w- c:\windows\system32\cdm.dll
    2009-08-06 23:23 . 2004-08-04 08:00 575704 ----a-w- c:\windows\system32\wuapi.dll
    2009-08-06 23:23 . 2007-11-28 03:21 274288 ----a-w- c:\windows\system32\mucltui.dll
    2009-08-06 23:23 . 2007-07-31 00:18 215920 ----a-w- c:\windows\system32\muweb.dll
    2009-08-06 23:23 . 2004-08-04 08:00 1929952 ----a-w- c:\windows\system32\wuaueng.dll
    2009-08-05 09:11 . 2004-08-04 08:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-10-19_15.07.45 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-11-01 15:04 . 2009-11-01 15:04 16384 c:\windows\Temp\Perflib_Perfdata_29c.dat
    - 2006-02-18 09:09 . 2007-07-27 14:41 26488 c:\windows\system32\spupdsvc.exe
    + 2006-02-18 09:09 . 2008-07-09 07:38 26488 c:\windows\system32\spupdsvc.exe
    + 2007-11-27 15:47 . 2008-07-09 07:38 17272 c:\windows\system32\spmsg.dll
    + 2004-08-09 13:44 . 2009-11-02 15:10 71060 c:\windows\system32\perfc009.dat
    - 2004-08-09 13:44 . 2009-10-19 15:08 71060 c:\windows\system32\perfc009.dat
    + 2004-08-09 13:44 . 2009-11-02 15:10 441124 c:\windows\system32\perfh009.dat
    - 2004-08-09 13:44 . 2009-10-19 15:08 441124 c:\windows\system32\perfh009.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-19 68856]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PCANotify]
    2002-02-15 15:51 24638 ----a-w- c:\windows\system32\PCANotify.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
    @="Service"

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^PrintNow.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\PrintNow.lnk
    backup=c:\windows\pss\PrintNow.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Symantec Fax Starter Edition Port.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Symantec Fax Starter Edition Port.lnk
    backup=c:\windows\pss\Symantec Fax Starter Edition Port.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Symantec\\pcAnywhere\\winaw32.exe"=
    "c:\\Program Files\\Symantec\\pcAnywhere\\awhost32.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Microsoft Office\\ART\\Office\\MSACCESS.EXE"=
    "c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=
    "c:\\Program Files\\Microsoft Office\\Office\\1033\\WFXMSRVR.EXE"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "8100:TCP"= 8100:TCP:bensonhurst01.ahr.com
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    S2 vnccom;vnccom;c:\windows\system32\Drivers\vnccom.SYS [2004-06-26 6016]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - MBR
    *NewlyCreated* - PROCEXP113
    *Deregistered* - mbr
    *Deregistered* - PROCEXP113
    .
    Contents of the 'Scheduled Tasks' folder

    2009-11-02 c:\windows\Tasks\Symantec NetDetect.job
    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2006-02-02 14:04]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = www.yahoo.com/
    TCP: {BFF4B330-9936-48BA-8096-E219EBEC1C94} = 167.206.112.138,167.206.7.4
    .

    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************
    .
    Completion time: 2009-11-03 19:39
    ComboFix-quarantined-files.txt 2009-11-03 00:38
    ComboFix2.txt 2009-10-19 15:10

    Pre-Run: 26,067,447,808 bytes free
    Post-Run: 26,315,153,408 bytes free

    - - End Of File - - 4FAF8C4460DFFD3E753F8E840D6A71A2
    Reply With Quote Reply With Quote
  11. November 2nd, 2009, 08:46 PM #9
    ladytinkerbell
    ladytinkerbell is offline Virtual Intern
    Join Date
    Apr 2009
    Posts
    245
    and here is the hijack this report:


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:44:52 PM, on 11/2/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16876)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\brsvc01a.exe
    C:\WINDOWS\system32\brss01a.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    C:\WINDOWS\SYSTEM32\DWRCS.EXE
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    C:\WINDOWS\System32\snmp.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\SYSTEM32\DWRCST.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
    O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKUS\S-1-5-21-2773856361-2553065814-565847294-500\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" (User '?')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1196176763328
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BFF4B330-9936-48BA-8096-E219EBEC1C94}: NameServer = 167.206.112.138,167.206.7.4
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
    O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
    O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
    O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
    O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
    O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
    O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 5673 bytes
    Reply With Quote Reply With Quote
  12. November 2nd, 2009, 11:27 PM #10
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    Very well...

    Uninstall Combofix:
    Go Start > Run
    Type in:
    combofix /u
    Note the space between the "combofix" and the "/u"
    Restart computer.

    Now, the computer doesn't have any antivirus running, so, please, download and install one of these:

    - Avira free antivirus: http://www.free-av.com/en/download/1...antivirus.html
    - Avast! free antivirus: http://www.avast.com/eng/download-avast-home.html

    - free Comodo Internet Security (firewall + AV): http://www.personalfirewall.comodo.com/
    NOTE. During installation, Comodo will also allow you to install AV only, or firewall only, if you prefer to combine one Comodo product with some other product.

    If you decide to install Avast, or Avira, make sure, Windows firewall is turned on, or use Comodo firewall..
    If you decide to install Comodo Internet Security, or just Comodo firewall, make sure, Windows firewall is turned off.

    IMPORTANT! Make sure, you use only ONE antivirus, and ONE firewall.

    After installation, update the program and run full scan.

    Post fresh HJT log.
    My Home Page
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules