Jump to content

frustrateduser

Members
  • Posts

    15
  • Joined

  • Last visited

Reputation

0 Neutral
  1. yes, there was no error message when i logged back in after OTL rebooted the machine
  2. here's the log: All processes killed ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-3416897047-2638764587-1843569379-1005\Software\Microsoft\Windows\CurrentVersion\Run\\Gzumuyaxu deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 6723 bytes ->Temporary Internet Files folder emptied: 32969 bytes ->Java cache emptied: 7140 bytes ->FireFox cache emptied: 71942561 bytes ->Flash cache emptied: 1001 bytes User: All Users User: aricketson ->Temp folder emptied: 1143458286 bytes ->Temporary Internet Files folder emptied: 120369786 bytes ->Java cache emptied: 81726282 bytes ->FireFox cache emptied: 132233844 bytes ->Google Chrome cache emptied: 346599495 bytes ->Apple Safari cache emptied: 18058240 bytes ->Flash cache emptied: 2433879 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes User: LocalService ->Temp folder emptied: 65748 bytes ->Temporary Internet Files folder emptied: 16786 bytes User: MAGMA User: NetworkService ->Temp folder emptied: 7104 bytes ->Temporary Internet Files folder emptied: 32902 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 2577 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 11045 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 1,828.00 mb OTL by OldTimer - Version 3.2.10.0 log created on 08242010_143335 Files\Folders moved on Reboot... Registry entries deleted on Reboot...
  3. OTL.Txt: OTL logfile created on: 8/24/2010 13:03:49 - Run 1 OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\aricketson\Desktop Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy 3.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 39.00% Memory free 5.00 Gb Paging File | 3.00 Gb Available in Paging File | 62.00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 87.46 Gb Total Space | 27.72 Gb Free Space | 31.69% Space Free | Partition Type: NTFS D: Drive not present or media not loaded Drive E: | 5.68 Gb Total Space | 5.45 Gb Free Space | 95.91% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MAGMA Current User Name: aricketson Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2010/08/24 13:03:36 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\aricketson\Desktop\OTL.exe PRC - [2010/08/24 10:49:29 | 000,014,808 | ---- | M] (Mozilla Corporation) -- C:\Program Files\FireFox35\plugin-container.exe PRC - [2010/08/24 10:49:21 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\FireFox35\firefox.exe PRC - [2010/08/17 21:58:17 | 000,945,720 | ---- | M] (Google Inc.) -- C:\Documents and Settings\aricketson\Local Settings\Application Data\Google\Chrome\Application\chrome.exe PRC - [2010/06/01 14:53:46 | 001,093,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe PRC - [2010/05/20 23:44:02 | 012,978,544 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE PRC - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe PRC - [2009/11/13 14:09:34 | 000,046,824 | ---- | M] (Xobni Corporation) -- C:\Program Files\Xobni\XobniService.exe PRC - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe PRC - [2008/07/30 11:06:58 | 001,100,280 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\devenv.exe PRC - [2008/07/30 11:06:58 | 000,136,208 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\DevServer\9.0\WebDev.WebServer.EXE PRC - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\inetsrv\inetinfo.exe PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007/02/10 05:29:48 | 000,242,544 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe PRC - [2007/01/04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe PRC - [2006/07/07 19:14:38 | 000,576,320 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\itype.exe PRC - [2006/02/15 18:43:16 | 000,892,928 | ---- | M] () -- C:\WINDOWS\SMINST\Scheduler.exe PRC - [2005/10/14 03:53:42 | 000,819,928 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft SQL Server\90\Tools\Binn\VSShell\Common7\IDE\SqlWb.exe PRC - [2005/05/20 04:11:06 | 000,925,696 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe PRC - [2004/10/15 13:16:22 | 001,105,920 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL Global VPN Client\SWGVpnClient.exe PRC - [2004/10/15 13:12:38 | 000,131,072 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\SonicWALL Global VPN Client\RampartSvc.exe PRC - [2002/12/17 19:43:10 | 000,053,248 | ---- | M] (FedEx) -- C:\Program Files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe ========== Modules (SafeList) ========== MOD - [2010/08/24 13:03:36 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\aricketson\Desktop\OTL.exe MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx MOD - [2006/05/03 23:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll ========== Win32 Services (SafeList) ========== SRV - [2010/03/25 21:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc) SRV - [2009/11/13 14:09:34 | 000,046,824 | ---- | M] (Xobni Corporation) [Auto | Running] -- C:\Program Files\Xobni\XobniService.exe -- (XobniService) SRV - [2008/11/24 22:31:12 | 000,087,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2008/07/29 14:10:46 | 003,201,024 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon90) SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (W3SVC) SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (SMTPSVC) Simple Mail Transfer Protocol (SMTP) SRV - [2008/04/13 20:12:22 | 000,015,360 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\system32\inetsrv\inetinfo.exe -- (IISADMIN) SRV - [2007/09/17 10:58:06 | 000,219,136 | ---- | M] () [Auto | Stopped] -- C:\Program Files\GNU\GnuPG\dirmngr.exe -- (DirMngr) SRV - [2007/02/10 05:29:54 | 029,178,224 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS) SRV - [2007/02/10 05:29:48 | 000,242,544 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2007/01/04 20:48:52 | 000,112,152 | R--- | M] (InterVideo) [Auto | Running] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr) SRV - [2006/12/02 06:17:54 | 002,805,000 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80) SRV - [2005/10/14 06:50:19 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) SRV - [2004/10/15 13:12:38 | 000,131,072 | ---- | M] (SonicWALL, Inc.) [On_Demand | Running] -- C:\Program Files\SonicWALL Global VPN Client\RampartSvc.exe -- (RampartSvc) SRV - [2002/12/17 19:43:10 | 000,053,248 | ---- | M] (FedEx) [Auto | Running] -- C:\Program Files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe -- (FDXAPISVC) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\UltraMonMirror.sys -- (UltraMonMirror) DRV - File not found [Kernel | Disabled | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - File not found [Kernel | System | Stopped] -- C:\Program Files\McAfee\VirusScan Enterprise\mferkdk.sys -- (mferkdk) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme) DRV - [2010/03/25 21:30:22 | 000,151,216 | ---- | M] (Microsoft Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\MpFilter.sys -- (MpFilter) DRV - [2009/07/20 10:14:43 | 000,229,208 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VMM.sys -- (vmm) DRV - [2009/05/09 01:14:20 | 000,014,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nuidfltr.sys -- (NuidFltr) DRV - [2008/05/08 10:02:52 | 000,203,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\rmcast.sys -- (RMCAST) DRV - [2008/04/13 14:45:12 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbaudio.sys -- (usbaudio) USB Audio Driver (WDM) DRV - [2008/04/13 14:39:44 | 000,092,544 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mqac.sys -- (MQAC) DRV - [2008/04/13 12:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2007/06/26 21:58:18 | 002,303,488 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007/01/29 07:20:34 | 000,059,280 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VMNetSrv.sys -- (VPCNetS2) DRV - [2006/07/24 17:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2006/03/10 21:12:54 | 000,130,048 | ---- | M] (AuthenTec, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\atswpdrv.sys -- (ATSWPDRV) AuthenTec TruePrint USB Driver (AES2500) DRV - [2006/02/28 09:36:20 | 000,176,128 | ---- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService) DRV - [2006/02/15 18:56:58 | 001,342,570 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2006/02/15 18:54:46 | 000,030,363 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btport.sys -- (BTDriver) DRV - [2006/02/15 18:54:10 | 000,057,096 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2006/02/08 21:00:04 | 000,142,720 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2006/01/29 21:00:04 | 001,120,352 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2006/01/19 09:50:40 | 001,428,096 | ---- | M] (Intel
  4. one more thing: when i log into my user account (i was running scans from the Administrator account because it never demonstrated the same issues my user account did, so i thought it would be safer), i get a window that opens titled "RUNDLL" that says: Error loading c:\windows\kdbenpm.dll The specified module could not be found I tried googling kdbenpm.dll, but found nothing.
  5. I updated Java earlier. ESET Online Scanner didn't find anything. Looks like we were successful in removing the rootkit!
  6. MBAM found nothing this time, and is now running considerably faster than it has any time in the past. Log: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4466 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/23/2010 2:47:56 PM mbam-log-2010-08-23 (14-47-56).txt Scan type: Quick scan Objects scanned: 166805 Time elapsed: 10 minute(s), 24 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
  7. latest combo fix log: ComboFix 10-08-22.07 - Administrator 08/23/2010 12:39:40.7.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2731 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat c:\windows\Temp\tmp3.tmp ----- BITS: Possible infected sites ----- hxxp://updates.swarmcast.net . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_KOOSW -------\Service_koosw ((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 ))))))))))))))))))))))))))))))) . 2010-08-23 15:20 . 2010-08-23 15:20 -------- d-----w- c:\program files\Common Files\Java 2010-08-23 15:20 . 2010-08-23 15:20 423656 ----a-w- c:\windows\system32\deployJava1.dll 2010-08-22 17:19 . 2010-08-22 17:19 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2010-08-22 14:15 . 2010-08-22 14:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help 2010-08-20 17:39 . 2010-08-20 17:39 -------- d-----w- c:\program files\Trend Micro 2010-08-20 17:31 . 2010-08-20 17:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2010-08-19 21:11 . 2010-06-01 17:37 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-08-19 21:02 . 2010-08-19 21:03 -------- d-----w- c:\program files\Microsoft Security Essentials 2010-08-19 16:05 . 2010-08-19 16:05 60904 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-19 16:04 . 2010-08-19 16:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\SonicWALL 2010-08-19 16:04 . 2010-08-19 16:05 -------- d-----w- c:\documents and settings\Administrator\.autobahn 2010-08-19 16:03 . 2010-08-19 16:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-19 15:17 . 2010-08-19 15:17 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2010-08-19 14:21 . 2010-08-19 14:21 77824 ----a-w- c:\windows\system32\drvsign.exe 2010-08-19 14:21 . 2010-08-19 14:21 20480 ----a-w- c:\windows\system32\ndisrd.sys 2010-08-19 14:21 . 2010-08-19 14:21 13824 ----a-w- c:\windows\system32\snetcfg.exe 2010-08-16 18:45 . 2010-08-19 20:18 120 ----a-w- c:\windows\Brosuja.dat 2010-08-16 18:45 . 2010-08-19 14:17 0 ----a-w- c:\windows\Ezoxulaqocuba.bin . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-23 16:33 . 2009-08-19 15:07 -------- d-----w- c:\program files\FireFox35 2010-08-22 14:15 . 2007-08-04 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-08-20 15:04 . 2009-02-02 21:42 -------- d-----w- c:\program files\Firefox3 2010-08-20 13:09 . 2007-08-16 17:18 -------- d-----w- c:\program files\ViewSonic 2010-08-19 16:04 . 2006-04-14 09:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI 2010-08-19 14:21 . 2010-08-19 14:21 36 ----a-w- c:\documents and settings\LocalService\Application Data\cgvhed.dat 2010-08-19 14:13 . 2010-08-16 18:43 36 ----a-w- c:\documents and settings\NetworkService\Application Data\cgvhed.dat 2010-08-14 00:44 . 2007-08-04 15:18 -------- d-----w- c:\program files\Microsoft SQL Server 2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-24 12:22 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44 . 2004-08-04 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-21 15:27 . 2004-08-04 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-17 14:03 . 2004-08-04 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 07:41 . 2004-08-04 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2008-12-19 18:34 . 2007-08-04 16:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-12-19 18:34 . 2007-08-04 16:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-19 18:34 . 2007-08-04 16:08 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-12-19 18:34 . 2007-08-04 16:08 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-12-19 18:34 . 2007-08-04 16:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsmqIntCert"="mqrt.dll" [2008-04-14 177152] "AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 88203] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 761945] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960] "Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-01-23 802816] "Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-02-15 892928] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-06 184320] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208] "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096] c:\documents and settings\All Users\Start Menu\Programs\Startup\ MLB.TV NexDef Plug-in.lnk - c:\documents and settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2010-4-2 802056] SonicWALL Global VPN Client.lnk - c:\program files\SonicWALL Global VPN Client\SWGVpnClient.exe [2007-8-6 1105920] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\WINDOWS\\SMINST\\Scheduler.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "c:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\devenv.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\CoreFTP\\coreftp.exe"= "c:\\Documents and Settings\\aricketson\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= "c:\\Program Files\\Firefox3\\firefox.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FireFox35\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [8/6/2007 10:30 PM 91136] R2 FDXAPISVC;FedExAPI Service;c:\program files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe [11/29/2007 1:53 PM 53248] R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/2/2008 1:17 PM 46824] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [4/14/2006 5:23 AM 87936] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [6/10/2005 9:26 AM 35968] R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [8/6/2007 10:30 PM 23180] S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [9/17/2007 10:58 AM 219136] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys --> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?] S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [12/2/2006 6:17 AM 2805000] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder 2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005Core.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-23 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005UA.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-23 c:\windows\Tasks\MpIdleTask.job - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.hp.com IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8acjn281.default\ FF - plugin: c:\program files\FireFox35\plugins\npdeployJava1.dll FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-23 12:59 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????U??????(?@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3416897047-2638764587-1843569379-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,37,d7,b1,7f,04,d8,9c,4f,b4,e1,67,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,37,d7,b1,7f,04,d8,9c,4f,b4,e1,67,\ [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1280) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3768) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Microsoft Security Essentials\MsMpEng.exe c:\windows\system32\Ati2evxx.exe c:\windows\System32\SCardSvr.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\SearchIndexer.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\windows\system32\wscntfy.exe c:\windows\AGRSMMSG.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE c:\program files\SonicWALL Global VPN Client\RampartSvc.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe . ************************************************************************** . Completion time: 2010-08-23 13:14:17 - machine was rebooted ComboFix-quarantined-files.txt 2010-08-23 17:14 ComboFix2.txt 2010-08-23 14:47 ComboFix3.txt 2010-08-22 18:03 ComboFix4.txt 2010-08-22 15:23 Pre-Run: 29,250,011,136 bytes free Post-Run: 29,242,339,328 bytes free - - End Of File - - 7038CB2F50804FEADA764E81E08053C0
  8. i booted into the windows recovery console this time, and was able to successfully delete koosw.sys this is the resulting MBAM log after deleting the file via the recovery console: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4465 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/23/2010 12:22:05 PM mbam-log-2010-08-23 (12-22-05).txt Scan type: Quick scan Objects scanned: 166955 Time elapsed: 18 minute(s), 2 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)
  9. the latest run of MBAM found the same thing: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4465 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/23/2010 11:43:50 AM mbam-log-2010-08-23 (11-43-50).txt Scan type: Quick scan Objects scanned: 166923 Time elapsed: 20 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\drivers\koosw.sys (Rootkit.Bubnix) -> Delete on reboot. after rebooting, the file is still there.
  10. I had tried to just Repair the connection, but that was not working, so I had to manually disable that driver to be able to connect to the internet. Not sure if that's normally there or if it's part of this infection... Results of the latest ComboFix run: ComboFix 10-08-22.05 - Administrator 08/23/2010 10:31:02.6.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2677 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible infected sites ----- hxxp://updates.swarmcast.net . ((((((((((((((((((((((((( Files Created from 2010-07-23 to 2010-08-23 ))))))))))))))))))))))))))))))) . 2010-08-22 17:19 . 2010-08-22 17:19 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE 2010-08-22 14:15 . 2010-08-22 14:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help 2010-08-20 17:39 . 2010-08-20 17:39 -------- d-----w- c:\program files\Trend Micro 2010-08-20 17:31 . 2010-08-20 17:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2010-08-19 21:11 . 2010-06-01 17:37 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-08-19 21:02 . 2010-08-19 21:03 -------- d-----w- c:\program files\Microsoft Security Essentials 2010-08-19 16:05 . 2010-08-19 16:05 60904 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-19 16:04 . 2010-08-19 16:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\SonicWALL 2010-08-19 16:04 . 2010-08-19 16:05 -------- d-----w- c:\documents and settings\Administrator\.autobahn 2010-08-19 16:03 . 2010-08-19 16:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-19 15:17 . 2010-08-19 15:17 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2010-08-19 14:21 . 2010-08-19 14:21 77824 ----a-w- c:\windows\system32\drvsign.exe 2010-08-19 14:21 . 2010-08-19 14:21 20480 ----a-w- c:\windows\system32\ndisrd.sys 2010-08-19 14:21 . 2010-08-19 14:21 13824 ----a-w- c:\windows\system32\snetcfg.exe 2010-08-16 18:45 . 2010-08-19 20:18 120 ----a-w- c:\windows\Brosuja.dat 2010-08-16 18:45 . 2010-08-19 14:17 0 ----a-w- c:\windows\Ezoxulaqocuba.bin 2010-08-16 18:44 . 2010-08-23 14:44 585504 ----a-w- c:\windows\system32\drivers\koosw.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-23 13:46 . 2009-08-19 15:07 -------- d-----w- c:\program files\FireFox35 2010-08-22 14:15 . 2007-08-04 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-08-20 15:04 . 2009-02-02 21:42 -------- d-----w- c:\program files\Firefox3 2010-08-20 13:09 . 2007-08-16 17:18 -------- d-----w- c:\program files\ViewSonic 2010-08-19 16:04 . 2006-04-14 09:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI 2010-08-19 14:21 . 2010-08-19 14:21 36 ----a-w- c:\documents and settings\LocalService\Application Data\cgvhed.dat 2010-08-19 14:13 . 2010-08-16 18:43 36 ----a-w- c:\documents and settings\NetworkService\Application Data\cgvhed.dat 2010-08-14 00:44 . 2007-08-04 15:18 -------- d-----w- c:\program files\Microsoft SQL Server 2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-24 12:22 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44 . 2004-08-04 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-21 15:27 . 2004-08-04 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-17 14:03 . 2004-08-04 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31 . 2004-08-04 08:00 744448 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe 2010-06-14 07:41 . 2004-08-04 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2010-06-09 14:35 . 2009-01-13 15:33 1561536 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\VisualStudio\9.0\1033\ResourceCache.dll 2008-12-19 18:34 . 2007-08-04 16:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-12-19 18:34 . 2007-08-04 16:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-19 18:34 . 2007-08-04 16:08 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-12-19 18:34 . 2007-08-04 16:08 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-12-19 18:34 . 2007-08-04 16:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsmqIntCert"="mqrt.dll" [2008-04-14 177152] "AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 88203] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 761945] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960] "Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-01-23 802816] "Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-02-15 892928] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-06 184320] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096] c:\documents and settings\All Users\Start Menu\Programs\Startup\ MLB.TV NexDef Plug-in.lnk - c:\documents and settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2010-4-2 802056] SonicWALL Global VPN Client.lnk - c:\program files\SonicWALL Global VPN Client\SWGVpnClient.exe [2007-8-6 1105920] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\WINDOWS\\SMINST\\Scheduler.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "c:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\devenv.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\CoreFTP\\coreftp.exe"= "c:\\Documents and Settings\\aricketson\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= "c:\\Program Files\\Firefox3\\firefox.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FireFox35\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [8/6/2007 10:30 PM 91136] R2 FDXAPISVC;FedExAPI Service;c:\program files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe [11/29/2007 1:53 PM 53248] R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/2/2008 1:17 PM 46824] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [4/14/2006 5:23 AM 87936] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [6/10/2005 9:26 AM 35968] R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [8/6/2007 10:30 PM 23180] S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [9/17/2007 10:58 AM 219136] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys --> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?] S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [12/2/2006 6:17 AM 2805000] --- Other Services/Drivers In Memory --- *Deregistered* - koosw [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder 2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005Core.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005UA.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-23 c:\windows\Tasks\MpIdleTask.job - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.hp.com IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8acjn281.default\ FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-23 10:44 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????U??????(?@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\koosw] . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-3416897047-2638764587-1843569379-500\Software\Microsoft\Internet Explorer\User Preferences] @Denied: (2) (Administrator) "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,37,d7,b1,7f,04,d8,9c,4f,b4,e1,67,\ "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15, d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,37,d7,b1,7f,04,d8,9c,4f,b4,e1,67,\ [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1296) c:\windows\system32\Ati2evxx.dll . Completion time: 2010-08-23 10:47:39 ComboFix-quarantined-files.txt 2010-08-23 14:47 ComboFix2.txt 2010-08-22 18:03 ComboFix3.txt 2010-08-22 15:23 Pre-Run: 29,399,863,296 bytes free Post-Run: 29,386,625,024 bytes free - - End Of File - - F932F4DDA27D0FB08253F358009EE77D
  11. i was able to access the internet after disabling "WinpkFilter Driver" under Local Area Connection properties. This is the combofix log: ComboFix 10-08-21.06 - Administrator 08/22/2010 10:56:50.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2661 [GMT -4:00] Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA} c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome.manifest c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome\content\_cfg.js c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\chrome\content\overlay.xul c:\documents and settings\Administrator\Local Settings\Application Data\{B4A0AE1B-F237-4795-9931-E068D77841CA}\install.rdf c:\documents and settings\aricketson\g2ax_customer_downloadhelper_win32_x86.exe c:\documents and settings\aricketson\g2ax_expert_downloadhelper_win32_x86.exe c:\documents and settings\aricketson\g2mdlhlpx.exe C:\Thumbs.db c:\windows\system32\2347633182.dat c:\windows\system32\Cache c:\windows\system32\drivers\ndisrd.sys c:\windows\Temp\tmp3.tmp E:\Autorun.inf . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SMTPSVCJAVAQUICKSTARTERSERVICE -------\Legacy_TAPISRVODSERV -------\Legacy_XOBNISERVICELMHOSTS -------\Service_ndisrd -------\Service_SMTPSVCJavaQuickStarterService -------\Service_TapiSrvodserv -------\Service_XobniServiceLmHosts ((((((((((((((((((((((((( Files Created from 2010-07-22 to 2010-08-22 ))))))))))))))))))))))))))))))) . 2010-08-22 15:05 . 2010-08-22 15:05 114688 ----a-w- c:\windows\system32\chg.exe 2010-08-22 14:15 . 2010-08-22 14:15 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help 2010-08-20 17:39 . 2010-08-20 17:39 -------- d-----w- c:\program files\Trend Micro 2010-08-20 17:31 . 2010-08-20 17:31 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla 2010-08-19 21:11 . 2010-06-01 17:37 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-08-19 21:02 . 2010-08-19 21:03 -------- d-----w- c:\program files\Microsoft Security Essentials 2010-08-19 16:05 . 2010-08-19 16:05 60904 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2010-08-19 16:04 . 2010-08-19 16:04 -------- d-----w- c:\documents and settings\Administrator\Application Data\SonicWALL 2010-08-19 16:04 . 2010-08-19 16:05 -------- d-----w- c:\documents and settings\Administrator\.autobahn 2010-08-19 16:03 . 2010-08-19 16:03 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-19 15:32 . 2010-08-19 15:32 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2010-08-19 15:32 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-19 15:17 . 2010-08-19 15:17 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache 2010-08-19 14:21 . 2010-08-19 14:21 77824 ----a-w- c:\windows\system32\drvsign.exe 2010-08-19 14:21 . 2010-08-19 14:21 20480 ----a-w- c:\windows\system32\ndisrd.sys 2010-08-19 14:21 . 2010-08-19 14:21 13824 ----a-w- c:\windows\system32\snetcfg.exe 2010-08-16 18:45 . 2010-08-19 20:18 120 ----a-w- c:\windows\Brosuja.dat 2010-08-16 18:45 . 2010-08-19 14:17 0 ----a-w- c:\windows\Ezoxulaqocuba.bin 2010-08-16 18:44 . 2010-08-22 15:08 585504 ----a-w- c:\windows\system32\drivers\koosw.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-08-22 14:36 . 2009-08-19 15:07 -------- d-----w- c:\program files\FireFox35 2010-08-22 14:15 . 2007-08-04 23:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help 2010-08-20 15:04 . 2009-02-02 21:42 -------- d-----w- c:\program files\Firefox3 2010-08-20 13:09 . 2007-08-16 17:18 -------- d-----w- c:\program files\ViewSonic 2010-08-19 16:04 . 2006-04-14 09:43 -------- d-----w- c:\documents and settings\Administrator\Application Data\ATI 2010-08-19 14:21 . 2010-08-19 14:21 36 ----a-w- c:\documents and settings\LocalService\Application Data\cgvhed.dat 2010-08-19 14:13 . 2010-08-16 18:43 36 ----a-w- c:\documents and settings\NetworkService\Application Data\cgvhed.dat 2010-08-14 00:44 . 2007-08-04 15:18 -------- d-----w- c:\program files\Microsoft SQL Server 2010-06-30 12:31 . 2004-08-04 08:00 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-24 12:22 . 2004-08-04 08:00 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-23 13:44 . 2004-08-04 08:00 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-21 15:27 . 2004-08-04 08:00 354304 ----a-w- c:\windows\system32\drivers\srv.sys 2010-06-17 14:03 . 2004-08-04 08:00 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 07:41 . 2004-08-04 08:00 1172480 ----a-w- c:\windows\system32\msxml3.dll 2008-12-19 18:34 . 2007-08-04 16:08 67688 ----a-w- c:\program files\mozilla firefox\components\jar50.dll 2008-12-19 18:34 . 2007-08-04 16:08 54368 ----a-w- c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-19 18:34 . 2007-08-04 16:08 34944 ----a-w- c:\program files\mozilla firefox\components\myspell.dll 2008-12-19 18:34 . 2007-08-04 16:08 46712 ----a-w- c:\program files\mozilla firefox\components\spellchk.dll 2008-12-19 18:34 . 2007-08-04 16:08 172136 ----a-w- c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsmqIntCert"="mqrt.dll" [2008-04-14 177152] "AGRSMMSG"="AGRSMMSG.exe" [2006-01-30 88203] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-10 761945] "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-02 131072] "Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960] "Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840] "Reminder"="c:\windows\Creator\Remind_XP.exe" [2006-01-23 802816] "Scheduler"="c:\windows\SMINST\Scheduler.exe" [2006-02-15 892928] "itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2006-07-07 576320] "IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2006-07-07 600896] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "WatchDog"="c:\program files\InterVideo\DVD Check\DVDCheck.exe" [2006-09-06 184320] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280] "MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-06-01 1093208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2008-11-04 435096] c:\documents and settings\All Users\Start Menu\Programs\Startup\ MLB.TV NexDef Plug-in.lnk - c:\documents and settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe [2010-4-2 802056] SonicWALL Global VPN Client.lnk - c:\program files\SonicWALL Global VPN Client\SWGVpnClient.exe [2007-8-6 1105920] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc] @="Service" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\mqsvc.exe"= "c:\\WINDOWS\\SMINST\\Scheduler.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\SonicWALL Global VPN Client\\SWGVpnClient.exe"= "c:\\Program Files\\Microsoft Visual Studio 8\\Common7\\IDE\\devenv.exe"= "c:\\WINDOWS\\system32\\ftp.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Mozilla Firefox\\firefox.exe"= "c:\\Program Files\\CoreFTP\\coreftp.exe"= "c:\\Documents and Settings\\aricketson\\Application Data\\Macromedia\\Flash Player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= "c:\\Program Files\\Firefox3\\firefox.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\FireFox35\\firefox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [8/6/2007 10:30 PM 91136] R2 FDXAPISVC;FedExAPI Service;c:\program files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe [11/29/2007 1:53 PM 53248] R2 XobniService;XobniService;c:\program files\Xobni\XobniService.exe [5/2/2008 1:17 PM 46824] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [4/14/2006 5:23 AM 87936] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [6/10/2005 9:26 AM 35968] R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [8/6/2007 10:30 PM 23180] S2 DirMngr;DirMngr;c:\program files\GNU\GnuPG\dirmngr.exe [9/17/2007 10:58 AM 219136] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\DRIVERS\UltraMonMirror.sys --> c:\windows\system32\DRIVERS\UltraMonMirror.sys [?] S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [12/2/2006 6:17 AM 2805000] --- Other Services/Drivers In Memory --- *Deregistered* - koosw [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder 2009-10-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34] 2010-08-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005Core.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3416897047-2638764587-1843569379-1005UA.job - c:\documents and settings\aricketson\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-09 15:23] 2010-08-22 c:\windows\Tasks\MpIdleTask.job - c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2010-03-26 01:40] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.hp.com IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\CoreFTP\pftpns.dll DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\8acjn281.default\ FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ FF - HiddenExtension: XULRunner: {90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} - c:\documents and settings\aricketson\Local Settings\Application Data\{90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} ---- FIREFOX POLICIES ---- c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\FireFox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\FireFox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); . - - - - ORPHANS REMOVED - - - - Toolbar-Locked - (no file) HKLM-Run-AAWTray - c:\program files\Lavasoft\Ad-Aware 2007\AAWTray.exe AddRemove-ShockwaveFlash - c:\windows\system32\Macromed\Flash\FlashUtil9c.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-08-22 11:08 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????U??????(?@???????@ scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\koosw] . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\DeterministicNetworks\DNE\Parameters] "SymbolicLinkValue"=hex(6):5c,00,52,00,65,00,67,00,69,00,73,00,74,00,72,00,79, 00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,79,00,73,00,\ . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(756) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3480) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\Microsoft Security Essentials\MsMpEng.exe c:\windows\system32\Ati2evxx.exe c:\windows\System32\SCardSvr.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\program files\Java\jre1.6.0_02\bin\javaw.exe c:\windows\system32\inetsrv\inetinfo.exe c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe c:\windows\system32\wdfmgr.exe c:\windows\system32\SearchIndexer.exe c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe c:\windows\system32\wscntfy.exe c:\windows\AGRSMMSG.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE c:\program files\SonicWALL Global VPN Client\RampartSvc.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\windows\system32\SearchProtocolHost.exe c:\windows\system32\SearchFilterHost.exe c:\program files\FireFox35\firefox.exe . ************************************************************************** . Completion time: 2010-08-22 11:23:16 - machine was rebooted ComboFix-quarantined-files.txt 2010-08-22 15:23 Pre-Run: 29,340,127,232 bytes free Post-Run: 29,364,269,056 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect - - End Of File - - 9EC877DE78B8923948DBEA088D0F2759
  12. I have run combofix but now I am no longer able to connect to the Internet either wirelessly or wired. because of this I can't post the log. I have tried rebooting but that does not solve my connectivity problem. (I am posting this from my smartphone.) when I run ipconfig at the command prompt, it just shows "windows ip configuration" with no actual info about the connections themselves, even if I do ipconfig /all
  13. Followed the instructions here after having run the Anti-Malware program a few times and it still finding Rootkit.Bubnix. When running GMER, I got a blue screen, so that log file is not attached. DDS Log: DDS (Ver_10-03-17.01) - NTFSx86 Run by Administrator at 13:46:08.42 on Fri 08/20/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3455.2611 [GMT -4:00] AV: Microsoft Security Essentials *On-access scanning enabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF} ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe c:\Program Files\Microsoft Security Essentials\MsMpEng.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe C:\Program Files\FedEx\FedEx Ship Manager API\Atom\AtomSvc.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Java\jre1.6.0_02\bin\javaw.exe C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe C:\Program Files\Java\jre6\bin\jqs.exe c:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe -k HPZ12 C:\WINDOWS\System32\svchost.exe -k HPZ12 c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Xobni\XobniService.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe C:\WINDOWS\SMINST\Scheduler.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Microsoft Security Essentials\msseces.exe C:\Documents and Settings\aricketson\Local Settings\Application Data\Autobahn\mlb-nexdef-autobahn.exe C:\Program Files\SonicWALL Global VPN Client\SWGVpnClient.exe c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\SonicWALL Global VPN Client\RampartSvc.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\FireFox35\firefox.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\Documents and Settings\Administrator\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.hp.com mRun: [MsmqIntCert] regsvr32 /s mqrt.dll mRun: [AGRSMMSG] AGRSMMSG.exe mRun: [soundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe mRun: [soundMAX] c:\program files\analog devices\soundmax\Smax4.exe /tray mRun: [synTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start mRun: [Cpqset] c:\program files\hpq\default settings\cpqset.exe mRun: [Recguard] c:\windows\sminst\Recguard.exe mRun: [Reminder] c:\windows\creator\Remind_XP.exe mRun: [scheduler] c:\windows\sminst\Scheduler.exe mRun: [itype] "c:\program files\microsoft intellitype pro\itype.exe" mRun: [intelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [startCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe mRun: [AAWTray] c:\program files\lavasoft\ad-aware 2007\AAWTray.exe mRun: [WatchDog] c:\program files\intervideo\dvd check\DVDCheck.exe mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\mlbtvn~1.lnk - c:\documents and settings\aricketson\local settings\application data\autobahn\mlb-nexdef-autobahn.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sonicw~1.lnk - c:\program files\sonicwall global vpn client\SWGVpnClient.exe IE: Send To &Bluetooth - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} - hxxp://www.nintendo.com/consumer/systems/wii/en_na/usbaptest.cab DPF: {195B4BBF-E1E4-4020-9773-0A8C6F65EA35} - hxxp://p.playfirst.com/play/game/cookingdash/CookingDashWeb.1.0.0.9.cab DPF: {2108E348-A0C0-1563-D327-730450CF5E34} - hxxp://www.shockwave.com/content/dinerdash/sis/DDComcast.1.0.0.39.cab DPF: {639658F3-B141-4D6B-B936-226F75A5EAC3} - hxxp://www.shockwave.com/content/dinerdash2/sis/DinerDash2.1.0.0.67.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1186414487937 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll Notify: AtiExtEvent - Ati2evxx.dll SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\8acjn281.default\ FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: XULRunner: {90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} - c:\documents and settings\aricketson\local settings\application data\{90BD25AE-4FBC-48D5-8F25-38DC10EF35E1} FF - HiddenExtension: XULRunner: {B4A0AE1B-F237-4795-9931-E068D77841CA} - c:\documents and settings\administrator\local settings\application data\{b4a0ae1b-f237-4795-9931-e068d77841ca}\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox35\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\firefox35\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} ---- FIREFOX POLICIES ---- c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.lu", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.nu", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.nz", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true); c:\program files\firefox35\greprefs\all.js - pref("network.IDN.whitelist.tel", true); c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); c:\program files\firefox35\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); c:\program files\firefox35\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); ============= SERVICES / DRIVERS =============== R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2010-3-25 151216] R1 RCFOX;SonicWALL IPsec Driver;c:\windows\system32\drivers\RCFOX.SYS [2007-8-6 91136] R2 FDXAPISVC;FedExAPI Service;c:\program files\fedex\fedex ship manager api\atom\AtomSvc.exe [2007-11-29 53248] R2 XobniService;XobniService;c:\program files\xobni\XobniService.exe [2008-5-2 46824] R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2006-4-14 87936] R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-6-10 35968] R3 ndisrd;WinpkFilter Service;c:\windows\system32\drivers\ndisrd.sys [2010-8-19 20480] R3 rcvpn;SonicWALL VPN Adapter;c:\windows\system32\drivers\rcvpn.sys [2007-8-6 23180] S1 mferkdk;VSCore mferkdk;\??\c:\program files\mcafee\virusscan enterprise\mferkdk.sys --> c:\program files\mcafee\virusscan enterprise\mferkdk.sys [?] S2 DirMngr;DirMngr;c:\program files\gnu\gnupg\dirmngr.exe [2007-9-17 219136] S2 SMTPSVCJavaQuickStarterService;Simple Mail Transfer Protocol (SMTP) SMTPSVCJavaQuickStarterService;c:\windows\system32\6to4svcx.exe srv --> c:\windows\system32\6to4svcx.exe srv [?] S2 TapiSrvodserv;Telephony TapiSrvodserv;c:\windows\system32\3076n.exe srv --> c:\windows\system32\3076n.exe srv [?] S2 XobniServiceLmHosts;XobniService XobniServiceLmHosts;c:\windows\system32\1031n.exe srv --> c:\windows\system32\1031n.exe srv [?] S3 UltraMonMirror;UltraMonMirror;c:\windows\system32\drivers\ultramonmirror.sys --> c:\windows\system32\drivers\UltraMonMirror.sys [?] S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2006-12-2 2805000] =============== Created Last 30 ================ 2010-08-20 17:44:32 0 ----a-w- c:\documents and settings\administrator\defogger_reenable 2010-08-20 17:39:33 0 d-----w- c:\program files\Trend Micro 2010-08-20 17:21:45 54016 ----a-w- c:\windows\system32\drivers\rjrdh.sys 2010-08-20 16:52:33 114688 ----a-w- c:\windows\system32\chg.exe 2010-08-19 21:11:28 221568 ------w- c:\windows\system32\MpSigStub.exe 2010-08-19 21:02:46 0 d-----w- c:\program files\Microsoft Security Essentials 2010-08-19 16:04:41 0 d-----w- c:\docume~1\admini~1\applic~1\SonicWALL 2010-08-19 16:04:40 0 d-----w- c:\documents and settings\administrator\.autobahn 2010-08-19 15:32:15 0 d-----w- c:\docume~1\admini~1\applic~1\Malwarebytes 2010-08-19 15:32:07 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-08-19 15:32:06 20952 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-08-19 15:32:06 0 d-----w- c:\program files\Malwarebytes' Anti-Malware 2010-08-19 15:32:06 0 d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes 2010-08-19 15:17:23 0 d-sh--w- c:\documents and settings\administrator\IETldCache 2010-08-19 14:21:41 77824 ----a-w- c:\windows\system32\drvsign.exe 2010-08-19 14:21:41 3387 ----a-w- c:\windows\system32\ndisrd.inf 2010-08-19 14:21:41 20480 ----a-w- c:\windows\system32\ndisrd.sys 2010-08-19 14:21:41 1400 ----a-w- c:\windows\system32\ndisrd_m.inf 2010-08-19 14:21:41 13824 ----a-w- c:\windows\system32\snetcfg.exe 2010-08-19 14:15:41 32 --s-a-w- c:\windows\system32\2347633182.dat 2010-08-19 14:13:16 20480 ----a-w- c:\windows\system32\drivers\ndisrd.sys 2010-08-16 18:45:37 120 ----a-w- c:\windows\Brosuja.dat 2010-08-16 18:45:37 0 ----a-w- c:\windows\Ezoxulaqocuba.bin 2010-08-16 18:44:04 585504 ----a-w- c:\windows\system32\drivers\koosw.sys ==================== Find3M ==================== 2010-07-27 06:30:35 8462336 ------w- c:\windows\system32\dllcache\shell32.dll 2010-06-30 12:31:35 149504 ----a-w- c:\windows\system32\schannel.dll 2010-06-30 12:31:35 149504 ------w- c:\windows\system32\dllcache\schannel.dll 2010-06-24 21:51:58 11077120 ----a-w- c:\windows\system32\dllcache\ieframe.dll 2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\wininet.dll 2010-06-24 12:22:03 916480 ----a-w- c:\windows\system32\dllcache\wininet.dll 2010-06-24 12:22:03 12800 ------w- c:\windows\system32\dllcache\xpshims.dll 2010-06-24 12:22:02 1210368 ----a-w- c:\windows\system32\dllcache\urlmon.dll 2010-06-24 12:22:01 611840 ----a-w- c:\windows\system32\dllcache\mstime.dll 2010-06-24 12:22:01 5951488 ----a-w- c:\windows\system32\dllcache\mshtml.dll 2010-06-24 12:22:01 206848 ----a-w- c:\windows\system32\dllcache\occache.dll 2010-06-24 12:21:59 599040 ----a-w- c:\windows\system32\dllcache\msfeeds.dll 2010-06-24 12:21:59 55296 ----a-w- c:\windows\system32\dllcache\msfeedsbs.dll 2010-06-24 12:21:59 25600 ----a-w- c:\windows\system32\dllcache\jsproxy.dll 2010-06-24 12:21:58 247808 ------w- c:\windows\system32\dllcache\ieproxy.dll 2010-06-24 12:21:58 1986560 ----a-w- c:\windows\system32\dllcache\iertutil.dll 2010-06-24 12:21:58 184320 ----a-w- c:\windows\system32\dllcache\iepeers.dll 2010-06-24 12:21:56 743424 ------w- c:\windows\system32\dllcache\iedvtool.dll 2010-06-24 12:21:55 387584 ----a-w- c:\windows\system32\dllcache\iedkcs32.dll 2010-06-23 13:44:04 1851904 ----a-w- c:\windows\system32\win32k.sys 2010-06-23 13:44:04 1851904 ------w- c:\windows\system32\dllcache\win32k.sys 2010-06-23 12:08:09 173056 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe 2010-06-21 15:27:11 354304 ------w- c:\windows\system32\dllcache\srv.sys 2010-06-18 13:36:12 3558912 ------w- c:\windows\system32\dllcache\moviemk.exe 2010-06-17 14:03:00 80384 ----a-w- c:\windows\system32\iccvid.dll 2010-06-14 14:31:20 744448 ------w- c:\windows\system32\dllcache\helpsvc.exe 2010-06-14 07:41:45 1172480 ----a-w- c:\windows\system32\msxml3.dll 2010-06-14 07:41:45 1172480 ------w- c:\windows\system32\dllcache\msxml3.dll 2008-09-05 14:52:43 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008090520080906\index.dat ============= FINISH: 13:48:53.62 =============== MBAM Log: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Database version: 4450 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 8/20/2010 1:21:43 PM mbam-log-2010-08-20 (13-21-43).txt Scan type: Quick scan Objects scanned: 167159 Time elapsed: 22 minute(s), 22 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\drivers\koosw.sys (Rootkit.Bubnix) -> Delete on reboot. Attach.zip.zip
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.