Boards.ie uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Click here to find out more x
Post Reply  
 
Thread Tools Search this Thread
23-02-2010, 16:19   #1
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
Rootkit.Agent removal

I got no response on my last thread about this so without the full scans here is the brunt of my problem - Rootkit.Agent atvtq.sys.

I can't delete it, keeps showing up on Malware Bytes, I've tried kill box, tried deleting/scanning and removal in safe mode and it's still there. Not sure how much of a problem this is but since it is a threat I'd like any help getting rid.

Files Infected:
C:\WINDOWS\system32\drivers\atvtq.sys (Rootkit.Agent) -> Delete on reboot.
homerun_homer is offline  
Advertisement
23-02-2010, 18:08   #2
kierank01
Registered User
 
Join Date: Jun 2008
Location: Cork
Posts: 556
There are commercial tools that run from a CD, and can remove rootkits, because they never attempt to start windows. I had a version of symantic that did this about 3 or 4 years ago.

If I were you I would copy any user data do an external drive, and run a virus check, from another pc, and then reinstall windows on the infected machine

Last edited by kierank01; 23-02-2010 at 19:41.
kierank01 is offline  
23-02-2010, 22:40   #3
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
hi

Download ComboFix here :

Link 1
Link 2


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you don't know how to disable them then just continue on.

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.




Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix\ComboFix.txt log in your next reply.
ASJ112 is offline  
25-02-2010, 22:25   #4
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
Combo Fix Log

ComboFix 10-02-25.02 - Aaron 25/02/2010 22:02:32.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1319 [GMT 0:00]
Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Aaron\LOCALS~1\Temp\clclean.0001.dir.0001\~df394b.tmp
c:\documents and settings\Aaron\Local Settings\temp\clclean.0001.dir.0001\~df394b.tmp
c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
c:\program files\WinPCap
c:\program files\WinPCap\rpcapd.exe
c:\windows\EventSystem.log
c:\windows\srchasst\nls302en.lex
c:\windows\system32\Data
c:\windows\system32\drivers\atvtq.sys
c:\windows\system32\drivers\npf.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\twain_32.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll

c:\windows\system32\powrprof.dll . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_npf
-------\Legacy_atvtq
-------\Service_atvtq


((((((((((((((((((((((((( Files Created from 2010-01-25 to 2010-02-25 )))))))))))))))))))))))))))))))
.

2010-02-25 21:56 . 2010-02-25 21:56 389120 ----a-w- c:\windows\system32\CF19463.exe
2010-02-25 20:39 . 2010-02-25 20:39 389120 ----a-w- c:\windows\system32\CF4304.exe
2010-02-25 19:16 . 2010-02-25 19:16 -------- d-----w- c:\program files\LightroomPortable
2010-02-25 17:54 . 2010-02-25 17:54 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\Temp
2010-02-23 21:13 . 2010-02-23 21:13 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\CANON_INC
2010-02-22 22:30 . 2010-02-22 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\PhotoStitch
2010-02-14 11:45 . 2010-02-14 11:45 -------- d-----w- c:\program files\iPod
2010-02-14 11:45 . 2010-02-14 11:46 -------- d-----w- c:\program files\iTunes
2010-02-12 00:05 . 2010-02-12 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2010-02-10 20:10 . 2010-02-10 20:10 -------- d-----w- C:\!KillBox
2010-02-09 20:56 . 2010-02-09 21:25 116 ----a-w- c:\windows\system32\fjhdyfhsn.bat
2010-01-30 20:54 . 2010-01-30 20:54 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-01-30 20:49 . 2010-01-30 20:49 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-25 22:17 . 2009-09-13 20:33 -------- d-----w- c:\documents and settings\All Users\Application Data\RetroExp
2010-02-25 22:16 . 2008-06-14 13:07 -------- d-----w- c:\program files\DNA
2010-02-25 22:16 . 2008-06-14 13:07 -------- d-----w- c:\documents and settings\Aaron\Application Data\DNA
2010-02-25 22:01 . 2009-11-11 14:51 79488 ----a-w- c:\documents and settings\Aaron\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-25 21:52 . 2009-12-03 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-23 22:52 . 2007-11-13 20:51 -------- d-----w- c:\documents and settings\Aaron\Application Data\ZoomBrowser EX
2010-02-23 22:10 . 2007-10-15 21:36 -------- d-----w- c:\program files\Canon
2010-02-23 21:44 . 2007-10-15 21:36 -------- d-----w- c:\program files\Common Files\Canon
2010-02-22 21:20 . 2007-09-15 12:51 -------- d-----w- c:\program files\Flickr Uploadr
2010-02-14 11:45 . 2007-09-13 16:41 -------- d-----w- c:\program files\Common Files\Apple
2010-02-14 11:33 . 2010-02-14 11:33 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-10 21:49 . 2009-12-26 04:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-09 20:55 . 2010-02-09 20:55 16 ----a-w- c:\documents and settings\LocalService\Application Data\sgcpom.dat
2010-01-30 20:49 . 2007-09-11 15:35 -------- d-----w- c:\program files\Google
2010-01-23 12:20 . 2010-01-23 12:20 152576 ----a-w- c:\documents and settings\Aaron\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-20 18:54 . 2009-06-15 22:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 18:52 . 2008-06-14 13:07 -------- d-----w- c:\documents and settings\Aaron\Application Data\BitTorrent
2010-01-19 23:44 . 2009-06-15 22:40 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-18 00:16 . 2010-01-18 00:16 -------- d-----w- c:\program files\AnvSoft
2010-01-12 21:24 . 2010-01-12 21:23 -------- d-----w- c:\program files\QuickTime
2010-01-07 16:07 . 2009-06-15 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2009-06-15 22:39 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2005-08-16 03:18 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2005-08-16 03:18 916480 ----a-w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2005-08-16 03:37 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2005-08-16 03:18 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2005-08-16 03:18 2145280 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2004-08-03 21:59 2023936 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2005-08-16 03:18 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-03 23:38 . 2009-07-14 22:32 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-03 23:38 . 2009-07-14 22:32 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-03 23:38 . 2009-07-14 22:32 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-03 23:38 . 2009-07-14 22:32 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
.

------- Sigcheck -------

[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4A9D-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4A9D-BDFE-192AAD5099B1}]
2008-06-25 21:38 2401584 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}]
2008-06-25 21:38 2401584 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-27 68856]
"BitTorrent DNA"="c:\program files\dna\btdna.exe" [2009-11-11 323392]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2006-02-10 2048000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-10-31 1392640]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-06-28 1355042]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-05-02 184320]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"RetroExpress"="c:\progra~1\RETROS~1\RETROS~1.5\RetroExpress.exe" [2008-07-16 9499928]
"TRUUpdater"="c:\program files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe" [2009-01-05 558360]
"WatcherHelper"="c:\program files\Sierra Wireless Inc\3G Watcher\WaHelper.exe" [2009-01-15 58648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-11 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2009-9-13 2311472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-03 23:38 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-06-19 16:21 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2007-02-20 11:29 1191936 ----a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-08-13 17:32 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-09-11 15:35 1862144 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 19:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 08:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 10:22 221184 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
2006-02-16 08:20 1118208 ------w- c:\program files\Creative\VoiceCenter\AndreaVC.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Flickr Uploadr\\Flickr Uploadr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Sierra Wireless Inc\\3G Watcher\\SwiApiMux.exe"=
"c:\\Program Files\\Sierra Wireless Inc\\WebUpdater\\SwiApiMux.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/07/2009 22:32 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/07/2009 22:32 360584]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30/01/2010 20:49 135664]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\aspi32.sys [20/09/2007 22:21 16512]
S3 L6UX2;Service - Line 6 UX2;c:\windows\system32\Drivers\L6UX2.sys --> c:\windows\system32\Drivers\L6UX2.sys [?]
S3 SWNC8U90;Sierra Wireless MUX NDIS Driver (UMTS90);c:\windows\system32\drivers\swnc8u90.sys [02/12/2008 09:10 173312]
S3 SWUMX90;Sierra Wireless USB MUX Driver (UMTS90);c:\windows\system32\drivers\swumx90.sys [17/11/2008 13:33 145280]
S3 zlportio;zlportio;\??\c:\documents and settings\Aaron\Desktop\Aaron\Ultrastar\zlportio.sys --> c:\documents and settings\Aaron\Desktop\Aaron\Ultrastar\zlportio.sys [?]
S4 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [03/12/2009 23:37 285392]
.
Contents of the 'Scheduled Tasks' folder

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:34]

2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 20:49]

2010-02-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 20:49]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.boards.ie/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/&s=8pPZOBNAeZLayr8Ub4zj4ZmanqU
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: line6.net
FF - ProfilePath - c:\documents and settings\Aaron\Application Data\Mozilla\Firefox\Profiles\ul636oyx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.boards.ie/
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-FreeVPN - c:\program files\FreeVPN\FreeVPN.exe
HKLM-Run-AirCardEnabler - (no file)
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
AddRemove-Security Task Manager - c:\program files\Security Task Manager\Uninstal.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-25 22:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(960)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\windows\System32\BCMLogon.dll

- - - - - - - > 'explorer.exe'(2072)
c:\windows\system32\WININET.dll
c:\program files\MozyHome\mozyshell.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\btncopy.dll
c:\program files\Roxio\Drag-to-Disc\Shellex.dll
c:\windows\system32\DLAAPI_W.DLL
c:\windows\system32\CDRTC.DLL
c:\program files\Roxio\Drag-to-Disc\ShellRes.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\WLTRYSVC.EXE
c:\windows\System32\bcmwltry.exe
c:\program files\AVG\AVG9\avgchsvx.exe
c:\program files\AVG\AVG9\avgrsx.exe
c:\program files\AVG\AVG9\avgcsrvx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
c:\windows\system32\CTsvcCDA.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\MozyHome\mozybackup.exe
c:\program files\Retrospect\Retrospect Express HD 2.5\retrorun.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\UAService7.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\dllhost.exe
c:\windows\System32\vssvc.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\Rundll32.exe
c:\docume~1\Aaron\LOCALS~1\Temp\clclean.0001
c:\program files\iPod\bin\iPodService.exe
c:\program files\Retrospect\Retrospect Express HD 2.5\retrospect.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2010-02-25 22:22:50 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-25 22:22

Pre-Run: 5,734,912,000 bytes free
Post-Run: 5,899,988,992 bytes free

- - End Of File - - A3FF30EFA0F079DAE9DF59E75DEEE388
homerun_homer is offline  
26-02-2010, 00:41   #5
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
hi

Please download OTM
  • Save it to your desktop.
  • Please double-click OTM to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
  • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

    Code:
    :Processes
    
    :Services
    zlportio
    
    :Reg
    
    :Files
    c:\windows\system32\fjhdyfhsn.bat
    c:\documents and settings\Aaron\Desktop\Aaron\Ultrastar\zlportio.sys 
    
    :Commands
    [purity]
    [resethosts]
    [emptytemp]
    [Reboot]
  • Return to OTM, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTM and reboot your PC.

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.



  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

    • c:\windows\system32\powrprof.dll

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.
ASJ112 is offline  
Advertisement
26-02-2010, 18:26   #6
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
OTM Log

OTM Log

Quote:
All processes killed
========== PROCESSES ==========
========== SERVICES/DRIVERS ==========
Service zlportio stopped successfully!
Service zlportio deleted successfully!
========== REGISTRY ==========
========== FILES ==========
c:\windows\system32\fjhdyfhsn.bat moved successfully.
File/Folder c:\documents and settings\Aaron\Desktop\Aaron\Ultrastar\zlportio.sys not found.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Aaron
->Temp folder emptied: 758597 bytes
->Temporary Internet Files folder emptied: 9147803 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 36677106 bytes
->Apple Safari cache emptied: 0 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32835 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 192 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 44.00 mb


OTM by OldTimer - Version 3.1.6.0 log created on 02262010_181619
All processes killed

OTM by OldTimer - Version 3.1.6.0 log created on 02262010_181614

Files moved on Reboot...
C:\Documents and Settings\Aaron\Local Settings\Temp\clclean.0001.dir.0000\~df394b.tmp moved successfully.
C:\Documents and Settings\Aaron\Local Settings\Temp\clclean.0001.dir.0000\~efe2.tmp moved successfully.

Registry entries deleted on Reboot...
homerun_homer is offline  
26-02-2010, 19:21   #7
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
VirScan.org log

Quote:
VirSCAN.org Scanned Report :
Scanned time : 2010/02/26 18:39:53 (GMT)
Scanner results: 14% Scanner(s) (5/36) found malware!
File Name : powrprof.dll
File Size : 21504 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 70299b463f8c940cba318171148005f6
SHA1 : 004d67f594697d9a141e3159e4defcb5cf32e3fe
Online report : http://virscan.org/report/085e894ce2...277df3f45.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100227023444 2010-02-27 5.43 -
AhnLab V3 2010.02.27.00 2010.02.27 2010-02-27 2.89 -
AntiVir 8.2.1.176 7.10.4.158 2010-02-26 0.08 -
Antiy 2.0.18 20100226.3925867 2010-02-26 0.12 -
Arcavir 2009 201002261429 2010-02-26 0.03 -
Authentium 5.1.1 201002261355 2010-02-26 1.37 -
AVAST! 4.7.4 100226-0 2010-02-26 0.00 Win32:Patched-KS [Trj]
AVG 8.5.720 271.1.1/2711 2010-02-26 0.25 -
BitDefender 7.81008.5324048 7.30553 2010-02-27 5.34 Trojan.Patched.EL
ClamAV 0.95.3 10461 2010-02-26 0.02 -
Comodo 3.13.579 4073 2010-02-26 1.49 -
CP Secure 1.3.0.5 2010.02.27 2010-02-27 1.23 -
Dr.Web 5.0.1.12222 2010.02.27 2010-02-27 5.66 -
F-Prot 4.4.4.56 20100226 2010-02-26 1.41 -
F-Secure 7.02.73807 2010.02.26.06 2010-02-26 0.12 -
Fortinet 11.529- 11.529 2010-02-25 0.21 -
GData 19.10697/19.782 20100226 2010-02-26 7.15 Win32:Patched-KS [Trj] [Engine:B]
ViRobot 20100226 2010.02.26 2010-02-26 0.53 -
Ikarus T3.1.01.80 2010.02.26.75290 2010-02-26 4.64 -
JiangMin 13.0.900 2010.02.25 2010-02-25 13.62 -
Kaspersky 5.5.10 2010.02.26 2010-02-26 0.08 -
KingSoft 2009.2.5.15 2010.2.26.17 2010-02-26 1.10 -
McAfee 5.3.00 5903 2010-02-25 3.77 -
Microsoft 1.5502 2010.02.26 2010-02-26 7.16 -
Norman 6.01.09 6.01.00 2010-02-10 4.00 -
Panda 9.05.01 2010.02.26 2010-02-26 2.57 -
Trend Micro 9.120-1004 6.878.02 2010-02-26 0.04 -
Quick Heal 10.00 2010.02.26 2010-02-26 1.38 -
Rising 20.0 22.36.04.04 2010-02-26 1.05 -
Sophos 3.04.1 4.50 2010-02-27 3.55 -
Sunbelt 3.9.2406.2 5700 2010-02-25 3.95 Trojan.Win32.Patched.el (v)
Symantec 1.3.0.24 20100226.006 2010-02-26 0.15 -
nProtect 20100226.01 7564961 2010-02-26 5.08 Trojan.Patched.EL
The Hacker 6.5.1.6 v00212 2010-02-26 0.37 -
VBA32 3.12.12.2 20100225.2226 2010-02-25 2.64 -
VirusBuster 4.5.11.10 10.120.9/2019141 2010-02-26 2.38 -
homerun_homer is offline  
26-02-2010, 19:52   #8
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
hi

  • Make sure to use Internet Explorer for this
  • Please go to VirSCAN.org FREE on-line scan service
  • Copy and paste the following file path into the "Suspicious files to scan" box on the top of the page:

    • c:\windows\$NtServicePackUninstall$\powrprof.dll

  • Click on the Upload button
  • If a pop-up appears saying the file has been scanned already, please select the ReScan button.
  • Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
  • Paste the contents of the Clipboard in your next reply.



repeat it for this file

c:\windows\ServicePackFiles\i386\powrprof.dll
ASJ112 is offline  
27-02-2010, 13:07   #9
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
First scan

Quote:
VirSCAN.org Scanned Report :
Scanned time : 2010/02/27 12:57:47 (GMT)
Scanner results: 14% Scanner(s) (5/36) found malware!
File Name : powrprof.dll
File Size : 21504 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 70299b463f8c940cba318171148005f6
SHA1 : 004d67f594697d9a141e3159e4defcb5cf32e3fe
Online report : http://virscan.org/report/82a34f7c09...d6be82f57.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100227202227 2010-02-27 6.49 -
AhnLab V3 2010.02.28.00 2010.02.28 2010-02-28 3.82 -
AntiVir 8.2.1.176 7.10.4.158 2010-02-26 0.05 -
Antiy 2.0.18 20100226.3925867 2010-02-26 0.12 -
Arcavir 2009 201002261910 2010-02-26 0.03 -
Authentium 5.1.1 201002262354 2010-02-26 1.29 -
AVAST! 4.7.4 100227-0 2010-02-27 0.00 Win32:Patched-KS [Trj]
AVG 8.5.720 271.1.1/2712 2010-02-27 0.23 -
BitDefender 7.81008.5334765 7.30561 2010-02-27 5.34 Trojan.Patched.EL
ClamAV 0.95.3 10462 2010-02-27 0.01 -
Comodo 3.13.579 4083 2010-02-27 0.94 -
CP Secure 1.3.0.5 2010.02.27 2010-02-27 0.04 -
Dr.Web 5.0.1.12222 2010.02.27 2010-02-27 5.57 -
F-Prot 4.4.4.56 20100226 2010-02-26 1.27 -
F-Secure 7.02.73807 2010.02.27.02 2010-02-27 0.16 -
Fortinet 11.531- 11.531 2010-02-27 0.43 -
GData 19.10701/19.784 20100227 2010-02-27 7.47 Win32:Patched-KS [Trj] [Engine:B]
ViRobot 20100227 2010.02.27 2010-02-27 0.47 -
Ikarus T3.1.01.80 2010.02.27.75293 2010-02-27 5.95 -
JiangMin 13.0.900 2010.02.27 2010-02-27 5.59 -
Kaspersky 5.5.10 2010.02.27 2010-02-27 0.09 -
KingSoft 2009.2.5.15 2010.2.27.7 2010-02-27 0.88 -
McAfee 5.3.00 5904 2010-02-26 3.76 -
Microsoft 1.5502 2010.02.27 2010-02-27 6.92 -
Norman 6.01.09 6.01.00 2010-02-10 6.01 -
Panda 9.05.01 2010.02.26 2010-02-26 2.24 -
Trend Micro 9.120-1004 6.880.03 2010-02-27 0.10 -
Quick Heal 10.00 2010.02.27 2010-02-27 1.56 -
Rising 20.0 22.36.05.04 2010-02-27 1.07 -
Sophos 3.04.1 4.50 2010-02-27 3.54 -
Sunbelt 3.9.2406.2 5702 2010-02-26 3.08 Trojan.Win32.Patched.el (v)
Symantec 1.3.0.24 20100226.006 2010-02-26 0.08 -
nProtect 20100227.01 7579365 2010-02-27 4.61 Trojan.Patched.EL
The Hacker 6.5.1.6 v00213 2010-02-26 0.40 -
VBA32 3.12.12.2 20100225.2226 2010-02-25 2.70 -
VirusBuster 4.5.11.10 10.120.9/2019141 2010-02-26 2.42 -
homerun_homer is offline  
Advertisement
27-02-2010, 13:16   #10
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
2nd scan
Quote:
VirSCAN.org Scanned Report :
Scanned time : 2010/02/27 13:10:43 (GMT)
Scanner results: 14% Scanner(s) (5/36) found malware!
File Name : powrprof.dll
File Size : 21504 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : 70299b463f8c940cba318171148005f6
SHA1 : 004d67f594697d9a141e3159e4defcb5cf32e3fe
Online report : http://virscan.org/report/2a837ff264...56799389d.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 4.5.0.8 20100227202227 2010-02-27 4.38 -
AhnLab V3 2010.02.28.00 2010.02.28 2010-02-28 1.11 -
AntiVir 8.2.1.176 7.10.4.158 2010-02-26 1.40 -
Antiy 2.0.18 20100226.3925867 2010-02-26 0.12 -
Arcavir 2009 201002261910 2010-02-26 0.03 -
Authentium 5.1.1 201002262354 2010-02-26 1.30 -
AVAST! 4.7.4 100227-0 2010-02-27 0.00 Win32:Patched-KS [Trj]
AVG 8.5.720 271.1.1/2712 2010-02-27 0.26 -
BitDefender 7.81008.5334765 7.30561 2010-02-27 5.37 Trojan.Patched.EL
ClamAV 0.95.3 10462 2010-02-27 0.01 -
Comodo 3.13.579 4083 2010-02-27 1.11 -
CP Secure 1.3.0.5 2010.02.27 2010-02-27 0.04 -
Dr.Web 5.0.1.12222 2010.02.27 2010-02-27 5.77 -
F-Prot 4.4.4.56 20100226 2010-02-26 1.38 -
F-Secure 7.02.73807 2010.02.27.02 2010-02-27 0.14 -
Fortinet 11.531- 11.531 2010-02-27 0.20 -
GData 19.10701/19.784 20100227 2010-02-27 6.75 Win32:Patched-KS [Trj] [Engine:B]
ViRobot 20100227 2010.02.27 2010-02-27 0.46 -
Ikarus T3.1.01.80 2010.02.27.75293 2010-02-27 4.69 -
JiangMin 13.0.900 2010.02.27 2010-02-27 21.07 -
Kaspersky 5.5.10 2010.02.27 2010-02-27 0.09 -
KingSoft 2009.2.5.15 2010.2.27.7 2010-02-27 2.14 -
McAfee 5.3.00 5904 2010-02-26 3.69 -
Microsoft 1.5502 2010.02.27 2010-02-27 6.53 -
Norman 6.01.09 6.01.00 2010-02-10 4.01 -
Panda 9.05.01 2010.02.26 2010-02-26 1.81 -
Trend Micro 9.120-1004 6.880.04 2010-02-27 0.03 -
Quick Heal 10.00 2010.02.27 2010-02-27 1.41 -
Rising 20.0 22.36.05.04 2010-02-27 1.25 -
Sophos 3.04.1 4.50 2010-02-27 3.51 -
Sunbelt 3.9.2406.2 5702 2010-02-26 5.23 Trojan.Win32.Patched.el (v)
Symantec 1.3.0.24 20100226.006 2010-02-26 0.06 -
nProtect 20100227.01 7579365 2010-02-27 4.95 Trojan.Patched.EL
The Hacker 6.5.1.6 v00213 2010-02-26 0.46 -
VBA32 3.12.12.2 20100225.2226 2010-02-25 3.34 -
VirusBuster 4.5.11.10 10.120.9/2019141 2010-02-26 2.53 -
homerun_homer is offline  
27-02-2010, 20:03   #11
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
hi

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:
File::

SRPeek::
c:\windows\system32\powrprof.dll
c:\windows\$NtServicePackUninstall$\powrprof.dll
c:\windows\ServicePackFiles\i386\powrprof.dll
Folder::

Registry::

Driver::
Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.
ASJ112 is offline  
28-02-2010, 14:43   #12
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
combofix scan log
Quote:
ComboFix 10-02-27.04 - Aaron 28/02/2010 2:11.3.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2038.1232 [GMT 0:00]
Running from: c:\documents and settings\Aaron\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Aaron\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Aaron\LOCALS~1\Temp\clclean.0001.dir.0001\~df394b.tmp
c:\documents and settings\Aaron\Local Settings\temp\clclean.0001.dir.0001\~df394b.tmp

c:\windows\system32\powrprof.dll . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2010-01-28 to 2010-02-28 )))))))))))))))))))))))))))))))
.

2010-02-27 16:23 . 2010-02-27 17:09 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\Adobe
2010-02-26 18:16 . 2010-02-26 18:16 -------- d-----w- C:\_OTM
2010-02-25 21:56 . 2010-02-25 21:56 389120 ----a-w- c:\windows\system32\CF19463.exe
2010-02-25 20:39 . 2010-02-25 20:39 389120 ----a-w- c:\windows\system32\CF4304.exe
2010-02-25 19:16 . 2010-02-25 19:16 -------- d-----w- c:\program files\LightroomPortable
2010-02-25 17:54 . 2010-02-25 17:54 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\Temp
2010-02-23 21:13 . 2010-02-23 21:13 -------- d-----w- c:\documents and settings\Aaron\Local Settings\Application Data\CANON_INC
2010-02-22 22:30 . 2010-02-22 22:41 -------- d-----w- c:\documents and settings\All Users\Application Data\PhotoStitch
2010-02-14 11:45 . 2010-02-14 11:45 -------- d-----w- c:\program files\iPod
2010-02-14 11:45 . 2010-02-14 11:46 -------- d-----w- c:\program files\iTunes
2010-02-14 11:33 . 2010-02-14 11:33 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
2010-02-12 00:05 . 2010-02-12 00:05 -------- d-----w- c:\documents and settings\All Users\Application Data\ZoomBrowser
2010-02-10 20:10 . 2010-02-10 20:10 -------- d-----w- C:\!KillBox
2010-01-30 20:54 . 2010-01-30 20:54 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2010-01-30 20:49 . 2010-01-30 20:49 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-28 14:16 . 2008-06-14 13:07 -------- d-----w- c:\documents and settings\Aaron\Application Data\DNA
2010-02-27 02:17 . 2009-11-11 14:51 79488 ----a-w- c:\documents and settings\Aaron\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-27 02:13 . 2009-09-13 20:33 -------- d-----w- c:\documents and settings\All Users\Application Data\RetroExp
2010-02-27 02:11 . 2008-06-14 13:07 -------- d-----w- c:\program files\DNA
2010-02-25 21:52 . 2009-12-03 23:37 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-02-23 22:52 . 2007-11-13 20:51 -------- d-----w- c:\documents and settings\Aaron\Application Data\ZoomBrowser EX
2010-02-23 22:10 . 2007-10-15 21:36 -------- d-----w- c:\program files\Canon
2010-02-23 21:44 . 2007-10-15 21:36 -------- d-----w- c:\program files\Common Files\Canon
2010-02-22 21:20 . 2007-09-15 12:51 -------- d-----w- c:\program files\Flickr Uploadr
2010-02-14 11:45 . 2007-09-13 16:41 -------- d-----w- c:\program files\Common Files\Apple
2010-02-10 21:49 . 2009-12-26 04:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-09 20:55 . 2010-02-09 20:55 16 ----a-w- c:\documents and settings\LocalService\Application Data\sgcpom.dat
2010-01-30 20:49 . 2007-09-11 15:35 -------- d-----w- c:\program files\Google
2010-01-23 12:20 . 2010-01-23 12:20 152576 ----a-w- c:\documents and settings\Aaron\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-01-20 18:54 . 2009-06-15 22:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-01-20 18:52 . 2008-06-14 13:07 -------- d-----w- c:\documents and settings\Aaron\Application Data\BitTorrent
2010-01-19 23:44 . 2009-06-15 22:40 5115823 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-01-18 00:16 . 2010-01-18 00:16 -------- d-----w- c:\program files\AnvSoft
2010-01-12 21:24 . 2010-01-12 21:23 -------- d-----w- c:\program files\QuickTime
2010-01-07 16:07 . 2009-06-15 22:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 16:07 . 2009-06-15 22:39 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-31 16:50 . 2005-08-16 03:18 353792 ----a-w- c:\windows\system32\drivers\srv.sys
2009-12-21 19:14 . 2005-08-16 03:18 916480 ------w- c:\windows\system32\wininet.dll
2009-12-16 18:43 . 2005-08-16 03:37 343040 ----a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2005-08-16 03:18 33280 ----a-w- c:\windows\system32\csrsrv.dll
2009-12-08 19:26 . 2005-08-16 03:18 2145280 ------w- c:\windows\system32\ntoskrnl.exe
2009-12-08 18:43 . 2004-08-03 21:59 2023936 ------w- c:\windows\system32\ntkrnlpa.exe
2009-12-04 18:22 . 2005-08-16 03:18 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2009-12-03 23:38 . 2009-07-14 22:32 12464 ----a-w- c:\windows\system32\avgrsstx.dll
2009-12-03 23:38 . 2009-07-14 22:32 360584 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-12-03 23:38 . 2009-07-14 22:32 333192 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-12-03 23:38 . 2009-07-14 22:32 28424 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
.

(((((((((((((((((((((((((((((((((((((((((( SR_Search ))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
------- Sigcheck -------

[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB917422\SP2QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB935839\SP2QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$hf_mig$\KB959426\SP3QFE\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtServicePackUninstall$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB935839$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\$NtUninstallKB959426$\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\ServicePackFiles\i386\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\system32\kernel32.dll
[-] 2009-06-08 . C1FC04A603EE3F80AA51A090C42E5E2C . 993792 . . [5.1.2600.5781] . . c:\windows\system32\dllcache\kernel32.dll

[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\$NtServicePackUninstall$\powrprof.dll
[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\ServicePackFiles\i386\powrprof.dll
[-] 2009-06-08 . 70299B463F8C940CBA318171148005F6 . 21504 . . [6.00.2900.5512] . . c:\windows\system32\powrprof.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4A9D-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4A9D-BDFE-192AAD5099B1}]
2008-06-25 21:38 2401584 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}]
2008-06-25 21:38 2401584 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 24576]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-01-27 68856]
"BitTorrent DNA"="c:\program files\dna\btdna.exe" [2009-11-11 323392]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2006-02-10 2048000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-12-13 98304]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-12-13 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-12-13 118784]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 761947]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2006-10-31 1392640]
"CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 57344]
"MBMon"="CTMBHA.DLL" [2006-06-28 1355042]
"UpdReg"="c:\windows\UpdReg.EXE" [2000-05-11 90112]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-05-02 184320]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe" [2007-05-10 405504]
"RetroExpress"="c:\progra~1\RETROS~1\RETROS~1.5\RetroExpress.exe" [2008-07-16 9499928]
"TRUUpdater"="c:\program files\Sierra Wireless Inc\WebUpdater\TRUUpdater.exe" [2009-01-05 558360]
"WatcherHelper"="c:\program files\Sierra Wireless Inc\3G Watcher\WaHelper.exe" [2009-01-15 58648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-22 141608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-9-11 24576]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2009-9-13 2311472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-12-03 23:38 12464 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2009-06-19 16:21 10536 ----a-w- c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell QuickSet]
2007-02-20 11:29 1191936 ----a-w- c:\program files\Dell\QuickSet\quickset.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupportCenter]
2008-08-13 17:32 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
2007-09-11 15:35 1862144 ----a-w- c:\program files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-01-22 19:16 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
2006-08-17 08:00 1116920 ----a-w- c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2006-11-05 10:22 221184 ----a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
2006-02-16 08:20 1118208 ------w- c:\program files\Creative\VoiceCenter\AndreaVC.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Flickr Uploadr\\Flickr Uploadr.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Sierra Wireless Inc\\3G Watcher\\SwiApiMux.exe"=
"c:\\Program Files\\Sierra Wireless Inc\\WebUpdater\\SwiApiMux.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [14/07/2009 22:32 333192]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [14/07/2009 22:32 360584]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [30/01/2010 20:49 135664]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [03/11/2006 18:19 13592]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\aspi32.sys [20/09/2007 22:21 16512]
S3 L6UX2;Service - Line 6 UX2;c:\windows\system32\Drivers\L6UX2.sys --> c:\windows\system32\Drivers\L6UX2.sys [?]
S3 SWNC8U90;Sierra Wireless MUX NDIS Driver (UMTS90);c:\windows\system32\drivers\swnc8u90.sys [02/12/2008 09:10 173312]
S3 SWUMX90;Sierra Wireless USB MUX Driver (UMTS90);c:\windows\system32\drivers\swumx90.sys [17/11/2008 13:33 145280]
S4 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [03/12/2009 23:37 285392]
.
Contents of the 'Scheduled Tasks' folder

2010-02-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 11:34]

2010-02-27 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 20:49]

2010-02-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-30 20:49]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.boards.ie/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://127.0.0.1:4664/&s=8pPZOBNAeZLayr8Ub4zj4ZmanqU
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: line6.net
FF - ProfilePath - c:\documents and settings\Aaron\Application Data\Mozilla\Firefox\Profiles\ul636oyx.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.boards.ie/
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Canon\ZoomBrowser EX\Program\NPCIG.dll
FF - plugin: c:\program files\Google\Update\1.2.183.17\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-28 14:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(956)
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
c:\windows\System32\BCMLogon.dll
.
Completion time: 2010-02-28 14:28:26
ComboFix-quarantined-files.txt 2010-02-28 14:28
ComboFix2.txt 2010-02-25 22:22

Pre-Run: 4,468,875,264 bytes free
Post-Run: 4,683,694,080 bytes free

- - End Of File - - 45182B0DAD66248ACE4334CD7A5C09F0
homerun_homer is offline  
01-03-2010, 16:10   #13
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
got your windows cd ?

* Go here to run an online scannner from ESET.
  • Note: You will need to use Internet explorer for this scan
  • Tick the box next to YES, I accept the Terms of Use.
  • Click Start
  • When asked, allow the activex control to install
  • Click Start
  • Check next options: Remove found threats and Scan unwanted applications.
  • Click Scan
  • Wait for the scan to finish
  • Use notepad to open the logfile located at C:\Program Files\ESET\ESET Online Scanner\log.txt
  • Copy and paste that log as a reply to this topic




Please download Dr.Web CureIt . Save it to your desktop:
  • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in the pop-up window to allow the scan.
  • This will scan the files currently running in memory and if something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, select Complete scan.
  • Click the green arrow at the right, and the scan will start.
  • Click Yes to all if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click File and choose Save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Note:this report may need to be renamed to Dr.Web.txt in order to post it on the forum.
  • Please post the Dr.Web.txt report in your next reply
  • Close Dr.Web Cureit.
  • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.

NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on the X in the upper right corner.
ASJ112 is offline  
03-03-2010, 00:09   #14
homerun_homer
Registered User
 
homerun_homer's Avatar
 
Join Date: Jan 2007
Location: Chi Town
Posts: 5,024
Send a message via MSN to homerun_homer
Online scanner - I should still have the windows cd

ESETSmartInstaller@High as CAB hook log:
OnlineScanner.ocx - registred OK
# version=7
# IEXPLORE.EXE=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6211
# api_version=3.0.2
# EOSSerial=f93c244677ce9d4a8d39fffd124949b7
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=false
# utc_time=2010-03-02 08:14:26
# local_time=2010-03-02 08:14:26 (+0000, GMT Standard Time)
# country="Ireland"
# lang=9
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 23052063 23052063 0 0
# compatibility_mode=768 16777215 100 0 22461004 22461004 0 0
# compatibility_mode=1024 16777175 100 0 7675765 7675765 0 0
# compatibility_mode=4352 16777215 100 0 0 0 0 0
# compatibility_mode=6143 16777215 0 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 3992 3992 0 0
# scanned=142674
# found=2
# cleaned=2
# scan_time=5273
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atvtq.sys.vir a variant of Win32/Rootkit.Kryptik.AF trojan (cleaned by deleting - quarantined) E153DCEA8CA499CFC45F5E485A7F6577 C
C:\_OTM\MovedFiles\02262010_181619\c_windows\system32\fjhdyfhsn.bat BAT/Agent.NFC trojan (cleaned by deleting - quarantined) 0C98D0683F0C086A288C093C2C985121 C
homerun_homer is offline  
03-03-2010, 12:22   #15
ASJ112
Banned
 
Join Date: Jan 2010
Posts: 1,155
if you do, do the following


place it in your CD ROM drive and follow the instructions below:
  • Click on Start and select Run... type sfc /scannow (note the space) (Let this run undisturbed until the window with the blue progress bar goes away)

SFC
- Which stands for System File Checker, retrieves the correct version of the file from %Systemroot%\System32\Dllcache or the Windows installation source files, and then replaces the incorrect file.
If you want to see what was replaced, right-click My Computer and click on Manage. In the new window that appears, expand the Event Viewer (by clicking on the + symbol next to it) and then click on System.



Boot from the Windows XP installation CD.

At the "Welcome to Setup" screen, press R to start Recovery Console. Choose the installation to be repaired by number (usually 1) and press "Enter".

When you are asked for the Administrator password, leave it blank and press "Enter".

At the command prompt, type chkdsk /r and press "Enter". (Note the space before /r) The disk check operation will start.

This will be a very thorough check of the hard drive and the file system...be patient and let it complete. It may appear to hang or even back up a few times...this is normal. 60 to 90 minutes is not unusual for this check...it may take longer in some cases.

Once the check completes and you are back at the command prompt, type exit and press "Enter". Let your computer boot normally to Windows.
ASJ112 is offline  
Post Reply

Quick Reply
Message:
Remove Text Formatting
Bold
Italic
Underline

Insert Image
Wrap [QUOTE] tags around selected text
 
Decrease Size
Increase Size
Please sign up or log in to join the discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search



Share Tweet