RUNMGR.EXE and other friends

Unknown
edited July 2008 in Spyware & Virus Removal
I apparently have some type virus or viruses on my computer. A pop-up box said something about "c:\runmgr.exe" and then disappeared. I checked c:\ and found the file runmgr.exe. I deleted this file and emptied the recycle bin. After rebooting the file was back along with; "gold.exe", "win32.exe", and "sys.exe". When I tried to delete any of them I am told "access is denied".

I have Panda Internet Security 2008 running a currently up to date. several scans in normal and safe modes report nothing.

I can no longer navigate to any web sites that are associated with any virus detection software.

Help!!

Comments

  • KatanaKatana
    edited July 2008
    Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.
    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. If you don't know, stop and ask! Don't keep going on.
    2. Please reply to this thread. Do not start a new topic.
    3. Please continue to respond until I give you the "All Clear"
    (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those three things, everything should go smoothly :D

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe


    Click here to download HJTinstall.exe
    • Save HJTinstall.exe to your desktop.
    • Double click on the HJTinstall.exe icon on your desktop.
    • By default it will install to C:\Program Files\Trend Micro\Hijack This.
    • Click I accept
    • Click on the Do a system scan and save a log file button. It will scan and then ask you to save the log.
    • Click Save to save the log file and then the log will open in notepad.
    • Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
    • Come back here to this thread and Paste the log in your next reply.
    • DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.



    Installed Programs

    Please could you give me a list of the programs that are installed.
    • Start HijackThis
    • Click on the Misc Tools button
    • Click on the Open Uninstall Manager button.

    You will see a list with the programs installed in your computer.
    Click on save list button and specify where you would like to save this file.
    When you press Save button a notepad will open with the contents of that file.
    Simply copy and paste the contents of that notepad into your next post.
  • scott11
    edited July 2008
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 7:37:44 PM, on 7/11/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\Citrix\GoToMyPC\g2svc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    C:\Program Files\Citrix\GoToMyPC\g2comm.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE
    c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Citrix\GoToMyPC\g2pre.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    C:\Program Files\Citrix\GoToMyPC\g2tray.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe
    C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
    C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    C:\Program Files\WinZip\WZQKPICK.EXE
    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE
    C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe
    C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
    C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe
    C:\WINDOWS\SYSTEM32\cidaemon.exe
    c:\win32.exe
    c:\win32.exe
    c:\win32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\system32\HPZipm12.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.att.net/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe"
    O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
    O4 - HKLM\..\Run: [MediaFace Integration] C:\Program Files\Fellowes\MediaFACE 5.0\SetHook.exe
    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s
    O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [GoToMyPC] "C:\Program Files\Citrix\GoToMyPC\g2svc.exe" -logon
    O4 - HKLM\..\Run: [NvGraphicsInterface] c:\win32.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\scott.SCOTT2\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
    O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
    O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
    O4 - Global Startup: hpoddt01.exe.lnk = ?
    O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
    O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.3.5.cab
    O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) - http://www.nanoscan.com/as/v1/cabs/ascstubie.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1203206074796
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1203206026484
    O16 - DPF: {8436FE12-31DB-48BF-83BF-FE682F9160B4} (NanoInstaller Class) - http://www.nanoscan.com/cabs/nanoinst.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab?AuthParam=1209250827_54591f2bee114b6411a02d209fc5f20a&GroupName=JSC&BHost=javadl.sun.com&FilePath=/ESD40/JSCDL/jre/6u5-b19/jinstall-6u5-windows-i586-jc.cab&File=jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: C-DillaCdaC11BA - C-Dilla Ltd - C:\WINDOWS\system32\drivers\CDAC11BA.EXE
    O23 - Service: GoToMyPC - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToMyPC\g2svc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe
    O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe
    O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
    O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe
    O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE
    O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe
    O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUPnPRenderer9.exe
    O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Common Files\Sonic Shared\RoxioUpnpService9.exe
    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe
    --
    End of file - 11799 bytes
  • KatanaKatana
    edited July 2008
    I'm afraid I have unpleasant news for you. You have a Very Dangerous infection on this machine.
    The infection is delivered by C:\win32.exe == Troj/Bckdr-QKI


    It allows outsiders COMPLETE access to every keystroke, account, and password you use while on this machine, and complete access to any other data present...
    IF this computer has been used for any kind of important data, my best recommendation is to Disconnect from Internet, Re-Format the entire drive and re-install your Operating system and Applications.

    We can likely clean the infected files off the computer, and if you wish we will attempt to do so, but we cannot be sure that the infection didn't do something to your system to reduce the system security. In that instance, even after removal of the infection, you could be subject to another attack or takeover as soon as you re-connect to the Internet.

    The Decision Whether to ReFormat or Not should be based on:
    • The use of the computer - this is the primary factor in the decision whether to re-format and re-install, or just disinfect.
    • The variety of malware - this influences the decision on whether to re-format and re-install, or just disinfect. IN THIS CASE we have a Backdoor Trojan, the worst kind.

    If the Computer has been used for any important data, you are strongly advised to do the following, immediately:
    • Disconnect the infected computer from the internet and from any networked computers until the computer can be cleaned.
    • Back up all important data on the machine. Do not back up any Applications (programs). Those should be re-installed from the original source CDs or websites.
    • If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
      Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
    • From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
    • DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
    • Take any other steps you think appropriate for an attempted identity theft.

    While you are deciding whether to ReFormat and Re-Install, a useful link is here: http://www.dslreports.com/faq/10063
    Please let me know what you decide.
  • scott11
    edited July 2008
    Adobe Acrobat 6.0 Professional
    Adobe Flash Player ActiveX
    Adobe Photoshop 7.0
    Adobe SVG Viewer 3.0
    AirSnare
    ATI - Software Uninstall Utility
    ATI Control Panel
    ATI Display Driver
    Avery Wizard 3.1
    Cda Product Service - shared component
    Compatibility Pack for the 2007 Office system
    CutStudio
    DivX
    DVD Decrypter (Remove Only)
    DVD Shrink 3.1.4
    dvdSanta 4.00
    dvdSanta 4.50
    Ethereal 0.99.0
    exPressit S.E. 2.2
    GoToMyPC
    HijackThis 2.0.2
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows XP (KB915865)
    HP Photo and Imaging 2.0 - All-in-One
    HP Photo and Imaging 2.0 - All-in-One Drivers
    HP Photo and Imaging 2.0 - hp psc 2170 series
    hp psc 2170 series
    hp psc 2170 series
    InterVideo XPack (Combo)
    Java(TM) 6 Update 5
    LimeWire PRO 4.12.11
    Marvell Miniport Driver
    MediaFACE 5.0
    Microsoft .NET Framework (English)
    Microsoft .NET Framework (English) v1.0.3705
    Microsoft .NET Framework 1.0 Hotfix (KB928367)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft .NET Framework 3.0
    Microsoft .NET Framework 3.0
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Professional Edition 2003
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Picture It! Photo Premium 7.0
    MicroWizard Fast Track Utility
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 6.0 Parser (KB933579)
    Network Stumbler 0.4.0 (remove only)
    Panda Internet Security 2008
    Panda NanoScan
    Panda TotalScan
    PC Attorney
    PC Wizard 2006.1.71.3
    Power BibleCD 5.5
    Quicken 2007
    Realtek AC'97 Audio
    RegCure 1.5.0.1
    Registry Mechanic 6.0
    Roxio Drag-to-Disc
    Roxio Easy Media Creator 9 Suite
    Samsung CamCorder Driver
    Samsung Video Codec 1.1 Uninstall
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows XP (KB914388)
    Security Update for Windows XP (KB914389)
    Security Update for Windows XP (KB918118)
    Security Update for Windows XP (KB918439)
    Security Update for Windows XP (KB919007)
    Security Update for Windows XP (KB920213)
    Security Update for Windows XP (KB920670)
    Security Update for Windows XP (KB920683)
    Security Update for Windows XP (KB920685)
    Security Update for Windows XP (KB922819)
    Security Update for Windows XP (KB923191)
    Security Update for Windows XP (KB923414)
    Security Update for Windows XP (KB923689)
    Security Update for Windows XP (KB923980)
    Security Update for Windows XP (KB924270)
    Security Update for Windows XP (KB924667)
    Security Update for Windows XP (KB925902)
    Security Update for Windows XP (KB926255)
    Security Update for Windows XP (KB926436)
    Security Update for Windows XP (KB927779)
    Security Update for Windows XP (KB927802)
    Security Update for Windows XP (KB928255)
    Security Update for Windows XP (KB928843)
    Security Update for Windows XP (KB929123)
    Security Update for Windows XP (KB930178)
    Security Update for Windows XP (KB931261)
    Security Update for Windows XP (KB931784)
    Security Update for Windows XP (KB932168)
    Security Update for Windows XP (KB933729)
    Security Update for Windows XP (KB935839)
    Security Update for Windows XP (KB935840)
    Security Update for Windows XP (KB936021)
    Security Update for Windows XP (KB937894)
    Security Update for Windows XP (KB938829)
    Security Update for Windows XP (KB941202)
    Security Update for Windows XP (KB941568)
    Security Update for Windows XP (KB941569)
    Security Update for Windows XP (KB941644)
    Security Update for Windows XP (KB941693)
    Security Update for Windows XP (KB943055)
    Security Update for Windows XP (KB943460)
    Security Update for Windows XP (KB943485)
    Security Update for Windows XP (KB944653)
    Security Update for Windows XP (KB945553)
    Security Update for Windows XP (KB946026)
    Security Update for Windows XP (KB948590)
    Security Update for Windows XP (KB948881)
    Security Update for Windows XP (KB950749)
    Security Update for Windows XP (KB950760)
    Security Update for Windows XP (KB950762)
    Security Update for Windows XP (KB951376-v2)
    Security Update for Windows XP (KB951698)
    SightSpeed (remove only)
    Spybot - Search & Destroy
    TaxACT 2006
    TaxACT 2007
    Total Recorder 6.0
    Tournament Bracket Builder 1.2
    Update for Windows XP (KB911280)
    Update for Windows XP (KB916595)
    Update for Windows XP (KB920872)
    Update for Windows XP (KB922582)
    Update for Windows XP (KB925720)
    Update for Windows XP (KB927891)
    Update for Windows XP (KB930916)
    Update for Windows XP (KB932823-v3)
    Update for Windows XP (KB936357)
    Update for Windows XP (KB938828)
    Update for Windows XP (KB942763)
    Update Rollup 1 for Windows XP Media Center Edition 2005 with HDTV Support (KB873369)
    VSO CopyToDVD 3
    Winamp
    Windows Communication Foundation
    Windows Installer Clean Up
    Windows Internet Explorer 7
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player 11
    Windows Presentation Foundation
    Windows Workflow Foundation
    Windows XP Hotfix - KB885836
    Windows XP Media Center Edition 2005 KB888316
    Windows XP Service Pack 3
    WinPcap 3.1
    WinRAR archiver
    WinZip
    Yahoo! Messenger
  • scott11
    edited July 2008
    Katana,

    Thanks for the quick response.

    1. This is my home computer, I have no info or anything that I feel would be dangerous on it. I would like to attempt to clean it. It has been constantly behind Pandas' firewall.

    2. I have another computer that I use for e-bay sales and have occasionally checked my bank account. I would like to send the HJT files from that machine to you as well. I have alerted my bank that I need to freeze activity on that account and that I will change passwords and access codes later. That machine also has an up to date version of Panda and has been behind its' firewall. I can't start on that machine until Monday.


    Please let me know what you want to do to start cleaning this machine.
  • KatanaKatana
    edited July 2008
    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper



    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

    Read the Requirements and limitations before you click Accept.
    Allow the ActiveX download if necessary and let the database download.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
  • scott11
    edited July 2008
    ComboFix 08-07-11.1 - scott 2008-07-12 11:33:13.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1026 [GMT -4:00]
    Running from: C:\Documents and Settings\scott.SCOTT2\Desktop\ComboFix.exe
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run
    .
    C:\WINDOWS\hosts
    C:\WINDOWS\system32\drivers\npf.sys
    C:\WINDOWS\system32\packet.dll
    C:\WINDOWS\system32\pthreadVC.dll
    C:\WINDOWS\system32\wanpacket.dll
    C:\WINDOWS\system32\wpcap.dll
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_NPF
    \Service_NPF

    ((((((((((((((((((((((((( Files Created from 2008-06-12 to 2008-07-12 )))))))))))))))))))))))))))))))
    .
    2008-07-12 10:13 . 2008-07-12 10:15 82,944 --a
    C:\WINDOWS\system32\ras32.exe
    2008-07-12 10:13 . 2008-07-12 10:19 30,798 --a
    C:\ras32.exe
    2008-07-12 10:13 . 2008-07-12 10:15 17,055 --a
    C:\runmgr.exe
    2008-07-12 10:13 . 2008-07-12 10:13 2,368 --a
    C:\WINDOWS\system32\SVKP.sys
    2008-07-12 10:13 . 2008-07-12 10:15 133 --a
    C:\ras32.bat
    2008-07-11 19:37 . 2008-07-11 19:37 <DIR> d
    C:\Program Files\Trend Micro
    2008-07-09 21:35 . 2008-07-09 23:06 30,798 --a
    C:\win32.exe
    2008-07-03 21:39 . 2008-07-03 21:39 <DIR> d
    C:\tracks
    2008-07-03 21:39 . 2008-07-03 21:46 <DIR> d
    C:\encoretrax
    2008-07-02 22:13 . 2008-07-12 10:15 16,751 --a
    C:\WINDOWS\system32\drivers\hosts
    2008-06-29 21:08 . 2008-06-29 21:08 <DIR> d
    C:\Program Files\johnqtv1
    2008-06-25 21:27 . 2008-06-25 21:27 <DIR> d
    C:\R72793
    2008-06-24 16:44 . 2008-06-24 16:51 <DIR> d
    C:\Documents and Settings\scott.SCOTT2\Application Data\mjusbsp
    2008-06-20 06:43 . 2008-06-13 09:10 272,128
    C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-20 06:43 . 2008-06-13 09:10 272,128
    c--- C:\WINDOWS\system32\dllcache\bthport.sys
    2008-06-17 23:13 . 2008-06-17 23:13 <DIR> d
    C:\Program Files\Common Files\Avery
    2008-06-17 23:13 . 2008-06-17 23:55 <DIR> d
    C:\Program Files\Avery Wizard 3.1
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-07-12 15:32 314,916 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
    2008-07-12 15:32 314,916 ----a-w C:\WINDOWS\system32\drivers\APPFCONT.DAT
    2008-07-12 15:32 1,264 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
    2008-07-12 15:32 1,264 ----a-w C:\WINDOWS\system32\drivers\APPFLTR.CFG
    2008-07-06 11:22
    d
    w C:\Program Files\dvdSanta
    2008-07-06 05:47
    d
    w C:\Documents and Settings\scott.SCOTT2\Application Data\Roxio
    2008-06-18 03:15
    d--h--w C:\Program Files\InstallShield Installation Information
    2008-06-07 17:00
    d
    w C:\Program Files\Citrix
    2008-06-07 16:59 3,902,784 ----a-w C:\Documents and Settings\scott.SCOTT2\gosetup.exe
    2008-06-03 18:31
    d
    w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
    2008-06-03 18:29
    d
    w C:\Program Files\Yahoo!
    2008-05-23 02:01
    d
    w C:\Program Files\DvdSanta2
    2008-05-19 02:06
    d
    w C:\Program Files\Swift Elite 4
    2008-05-19 01:54
    d
    w C:\Program Files\Common Files\Adobe
    2008-05-17 23:32
    d
    w C:\Program Files\Tournament Bracket Builder
    2008-05-17 17:51
    d
    w C:\Documents and Settings\All Users.WINDOWS\Application Data\DVD Shrink
    2008-05-17 17:39
    d
    w C:\Program Files\exPressit S.E. 2.2
    2008-05-15 21:28
    d
    w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
    2008-05-15 02:38
    d
    w C:\Program Files\Spybot - Search & Destroy
    2008-05-14 03:22
    d
    w C:\Program Files\MicroWizard Fast Track Utility
    2008-05-14 03:21 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
    2008-05-14 03:21 249,856
    w C:\WINDOWS\Setup1.exe
    2008-05-07 04:55 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
    2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-04-03 20:46 251 ---ha-w C:\Program Files\hpothb07.tif
    2008-04-03 20:46 143 ---ha-w C:\Program Files\hpothb07.dat
    2008-04-03 20:32 366 ---ha-w C:\Documents and Settings\NetworkService.NT AUTHORITY\hpothb07.dat
    2008-04-03 20:32 362 ---ha-w C:\Documents and Settings\LocalService.NT AUTHORITY\hpothb07.dat
    2008-04-03 20:32 344 ---ha-w C:\Documents and Settings\scott\hpothb07.dat
    2008-04-03 20:32 172 ---ha-w C:\Documents and Settings\All Users.WINDOWS\hpothb07.dat
    2008-04-03 20:32 164 ---ha-w C:\Documents and Settings\All Users\hpothb07.dat
    2008-04-03 20:32 1,204 ---ha-w C:\Documents and Settings\scott.SCOTT2\hpothb07.dat
    2008-04-03 20:32 0 ---ha-w C:\Documents and Settings\scott.SCOTT2\Application Data\hpothb07.dat
    2008-04-03 20:32 0 ---ha-w C:\Documents and Settings\NetworkService\hpothb07.dat
    2008-04-03 20:32 0 ---ha-w C:\Documents and Settings\LocalService\hpothb07.dat
    2008-04-03 20:32 0 ---ha-w C:\Documents and Settings\Default User\hpothb07.dat
    2008-04-03 20:32 0 ---ha-w C:\Documents and Settings\Default User.WINDOWS\hpothb07.dat
    2007-01-27 02:57 563,712
    w C:\Documents and Settings\scott\gotomypc_370.exe
    2006-12-31 01:46 0 ----a-w C:\Program Files\MICROS~3
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 13:21 1694208]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
    "cdloader"="C:\Documents and Settings\scott.SCOTT2\Application Data\mjusbsp\cdloader2.exe" [2008-06-12 15:37 50520]
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TotalRecorderScheduler"="C:\Program Files\HighCriteria\TotalRecorder\TotRecSched.exe" [2006-05-12 02:32 86016]
    "RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-07-31 09:00 1116920]
    "MediaFace Integration"="C:\Program Files\Fellowes\MediaFACE 5.0\SetHook.exe" [2005-10-27 05:43 53248]
    "RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-08-10 13:10 221184]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-03-27 02:35 36352]
    "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184]
    "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
    "GoToMyPC"="C:\Program Files\Citrix\GoToMyPC\g2svc.exe" [2007-06-20 11:09 258856]
    "NvGraphicsInterface"="C:\win32.exe" [2008-07-09 23:06 30798]
    "SoundMan"="SOUNDMAN.EXE" [2004-11-15 06:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
    C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
    Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-04-07 02:42:52 217190]
    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-01 23:46:01 113664]
    hp psc 2000 Series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-04-09 17:41:38 323646]
    hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12 28672]
    InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-12-30 00:02:27 114688]
    WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2007-01-01 17:28:39 118784]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToMyPC]
    2007-06-20 11:09 10536 C:\Program Files\Citrix\GoToMyPC\G2WinLogon.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
    2007-02-15 19:02 50736 C:\WINDOWS\system32\avldr.dll
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.NTN1"= NUVision.ax
    "vidc.SEDG"= mcs_vfw.dll
    "msacm.ivimp3en"= ivimp3en.acm
    "wave"= DrvTrNTm.dll
    "mixer"= DrvTrNTm.dll
    HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
    --a
    2004-08-12 22:10 339968 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
    --a
    2006-08-14 02:07 102400 C:\Program Files\Roxio\Media Experience\DMXLauncher.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
    --a
    2004-08-10 05:04 59392 C:\WINDOWS\ehome\ehtray.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
    --a
    2002-07-10 03:45 28672 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a
    2004-10-13 13:21 1694208 C:\Program Files\Messenger\msmsgs.exe
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\SightSpeed\\SightSpeed.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-09-28 13:05]
    R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-01 20:06]
    R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 08:33]
    R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-11-14 17:48]
    R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 10:39]
    R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-10-25 08:50]
    R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 15:40]
    R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 08:33]
    R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 08:33]
    R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 07:44]
    R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 13:49]
    R2 SVKP;SVKP;C:\WINDOWS\system32\SVKP.sys [2008-07-12 10:13]
    R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
    R3 NETIMFLT01050097;PANDA NDIS IM Filter Miniport v1.5.0.97;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-11-19 13:01]
    R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
    R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
    S3 AVC3310F;AVC-3310/AVC-3610 USB Loader;C:\WINDOWS\system32\Drivers\avcuwfl2.sys []
    S3 AvcUWil2;Adaptec AVC-3210/3310/3610 USB Device;C:\WINDOWS\system32\DRIVERS\avcuwil2.sys []
    S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\NSNDIS5.SYS [2004-03-23 22:12]
    S3 NUVision;NUVision II Video Service;C:\WINDOWS\system32\DRIVERS\nuvvid2.sys [2004-02-16 20:18]
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-07-10 00:00:01 C:\WINDOWS\Tasks\At1.job"
    - C:\Program Files\Panda Security\Panda Internet Security 2008\PAVJOBS.EXEn/PROGRAMADA PAV5.tsk PAV_FOG.OPC
    "2007-12-29 19:03:13 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1191080420.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
    "2008-07-12 15:29:18 C:\WINDOWS\Tasks\RegCure Program Check.job"
    - C:\Program Files\RegCure\RegCure.exe
    "2008-07-10 13:08:32 C:\WINDOWS\Tasks\RegCure.job"
    - C:\Program Files\RegCure\RegCure.exe
    .
    **************************************************************************
    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-07-12 11:37:53
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...

    **************************************************************************
    .
    Completion time: 2008-07-12 11:41:54
    ComboFix-quarantined-files.txt 2008-07-12 15:40:49
    Pre-Run: 20,373,860,352 bytes free
    Post-Run: 20,358,615,040 bytes free
    189 --- E O F --- 2008-07-08 19:06:46
  • KatanaKatana
    edited July 2008
    Do you have the Kaspersky log ?
  • scott11
    edited July 2008
    I have the kasperky log now, it is included in this post.

    A question--the kaspersky scan took over 20 hours--I was instructed to disable all other virus programs while the scan ran--what is the possibility for other infections while on line that long without some protection??
    KASPERSKY ONLINE SCANNER 7 REPORT
    Sunday, July 13, 2008
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Saturday, July 12, 2008 22:06:49
    Records in database: 946264
    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes
    Scan area - My Computer:
    A:\
    C:\
    D:\
    E:\
    F:\
    G:\
    Scan statistics:
    Files scanned: 187667
    Threat name: 6
    Infected objects: 11
    Suspicious objects: 0
    Duration of the scan: 20:49:14

    File name / Threat name / Threats count
    C:\win32.exe/C:\win32.exe Infected: Trojan.Win32.Agent.tpj 1
    C:\Documents and Settings\scott.SCOTT2\Desktop\spywaredetectorb.exe Infected: not-a-virus:FraudTool.Win32.SpywareDetector.b 1
    C:\Documents and Settings\scott.SCOTT2\Desktop\spywaredetectorm.exe Infected: not-a-virus:FraudTool.Win32.SpywareDetector.b 1
    C:\Documents and Settings\scott.SCOTT2\Shared\(iNCiTE) mtu hoster [New Version] Video.zip Infected: Trojan-Dropper.Win32.Agent.dkn 1
    C:\Program Files\SpywareDetector\SDLiveupdate\SDProduct.exe Infected: not-a-virus:FraudTool.Win32.SpywareDetector.b 1
    C:\ras32.exe Infected: Trojan.Win32.Agent.tpj 1
    C:\runmgr.exe Infected: Trojan.Win32.Qhost.kfr 1
    C:\win32.exe Infected: Trojan.Win32.Agent.tpj 1
    D:\OLD DRIVE\Downloads\bpftpserver_install.exe Infected: not-a-virus:Server-FTP.Win32.BulletProof.231 1
    D:\OLD DRIVE\downloads1\kf141.zip Infected: not-a-virus:PSWTool.Win32.RAS.a 2
    The selected area was scanned.
  • KatanaKatana
    edited July 2008
    Disable Teatimer
    First step:
    • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
    • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
    • If you have Version 1.4, Click on Exit Spybot S&D Resident
    Second step, For Either Version :
    • Open Spybot S&D
    • Click Mode, choose Advanced Mode
    • Go To the bottom of the Vertical Panel on the Left, Click Tools
    • then, also in left panel, click Resident shows a red/white shield.
    • If your firewall raises a question, say OK
    • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
    • OK any prompts.
    • Use File, Exit to terminate Spybot
    • Reboot your machine for the changes to take effect.



    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
      http://icrontic.com/forum/showthread.php?p=629545#post629545

Comment:: Katana ... runmgr.exe and friends

Collect::[4]
C:\WINDOWS\system32\ras32.exe
C:\ras32.exe
C:\runmgr.exe
C:\WINDOWS\system32\SVKP.sys
C:\ras32.bat
C:\win32.exe

DirLook::
C:\WINDOWS\system32\drivers\hosts
C:\R72793
C:\Documents and Settings\scott.SCOTT2\Application Data\mjusbsp
C:\Program Files\MICROS~3


File::
C:\Documents and Settings\scott.SCOTT2\Desktop\spywaredetectorb.exe
C:\Documents and Settings\scott.SCOTT2\Desktop\spywaredetectorm.exe
C:\Documents and Settings\scott.SCOTT2\Shared\(iNCiTE) mtu hoster [New Version] Video.zip
D:\OLD DRIVE\Downloads\bpftpserver_install.exe
D:\OLD DRIVE\downloads1\kf141.zip
Folder::
C:\Program Files\SpywareDetector
    • Save this as CFScript.txt and place it on your desktop.


      CFScript.gif
    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
    • A window will open asking you to ensure you are connected to the internet, this is so a file can be submitted for analysis.
    • Click OK and follow the instructions to submit the file.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.



    Eset NOD32 Online AntiVirus

    Run Eset NOD32 Online AntiVirus
    http://www.eset.eu/online-scanner
    Note: You will need to use Internet Explorer for this scan.
    • Tick the box next to YES, I accept the Terms of Use.
    • Click Start
    • When asked, allow the activex control to install
    • Disable your current Antivirus software. You can usually do this with its Notfication Tray icon near the clock.
    • Click Start
    • Make sure that the option "Remove found threats" is Un-checked, and the option "Scan unwanted applications" is checked
    • Click Scan
    • Wait for the scan to finish
    • Re-enable your Anvirisus software.
    • A logfile is created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please include this on your post.



    Please Download GMER to your desktop

    Please create a folder in the Program Files folder called GMER.

    Download GMER and extract it to the C:\program files\GMER folder you have just made.


    Run the Gmer.exe program by double-clicking the executable file gmer.exe.
    You may be prompted to scan immediately if GMER detects rootkit activity.

    If you are prompted to scan your system click "yes" to begin the scan.
    If you are not prompted, Click the "Rootkit" tab, then click "Scan".


    DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc !

    At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply.

    Please post the results from the GMER scan in your reply.
  • scott11
    edited July 2008
    Katana,

    1. Eset scan log
    2. GMER scsn log

    Are we making progress in this endeavour?

    1.# version=4
    # OnlineScanner.ocx=1.0.0.56
    # OnlineScannerDLLA.dll=1, 0, 0, 51
    # OnlineScannerDLLW.dll=1, 0, 0, 51
    # OnlineScannerUninstaller.exe=1, 0, 0, 49
    # vers_standard_module=3267 (20080714)
    # vers_arch_module=1.064 (20080214)
    # vers_adv_heur_module=1.064 (20070717)
    # EOSSerial=777144db55aed844a1322f2701006d24
    # end=stopped
    # remove_checked=false
    # unwanted_checked=true
    # utc_time=2008-07-15 01:36:31
    # local_time=2008-07-14 09:36:31 (-0500, Eastern Daylight Time)
    # country="United States"
    # osver=5.1.2600 NT Service Pack 2
    # scanned=160051
    # found=0
    # scan_time=3092
  • KatanaKatana
    edited July 2008
    scott11 wrote:
    2. GMER scsn log

    Are we making progress in this endeavour?

    You tell me if we are making progress, how are things running now ?
    Do you have the Gmer log ?
  • scott11
    edited July 2008
    The Gmer log says it is too big--do i just copy portions of it and send?? I am only using this computer to communicate with you and try to do what you say, but yes it seems to be better.
  • KatanaKatana
    edited July 2008
    Can you attach the log ?

    See "Manage attachments" below the Submit reply button
  • scott11
    edited July 2008
    I fouled up and failed to save the Gmer log after pasting to notepad--I will run again and post.
  • scott11
    edited July 2008
    Gmer log uploaded using manage attachments.
  • KatanaKatana
    edited July 2008
    Congratulations your logs look clean :D

    Let's see if I can help you keep it that way

    First lets tidy up :D


    • Click START then RUN
    • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
      • CF_Cleanup.png

    You can also delete any logs we have produced, and empty your Recycle bin.


    Enable Teatimer

    • RIGHT click Link >>> HERE <<< Link and select "save as" and save it to your desktop
    • Double click ResetTeaTimer.bat
    • Open Spybot S&D
    • Click Mode, check Advanced Mode
    • Go To Left Panel, Click Tools, then also in left panel, click Resident
    • If your firewall raises a question, say OK
    • check the box labeled Resident Tea-Timer and OK any prompts.
    • Use File, Exit to terminate Spybot
    • Reboot your machine for the changes to take effect.
    • You can now delete ResetTeaTimer.bat





    The following is some info to help you stay safe and clean.
    ( Vista users must ensure that any programs are Vista compatible BEFORE installing )

    You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.

    Online Scanners
    I would recommend a scan at one or more of the following sites at least once a month.

    http://www.pandasecurity.com/activescan
    http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

    !!! Make sure that all your programs are updated !!!
    Secunia Software Inspector does all the work for you, .... see HERE for details

    AntiSpyware
      AntiSpyware is
    not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
    [*]Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites

    [*] MalwareBytes Anti-malware <<< A New and effective program
    [*]a-squared Free <<< A good "realtime" or "on demand" scanner
    [*]superantispyware <<< A good "realtime" or "on demand" scanner



    Prevention
      These programs don't detect malware, they help stop it getting on your machine in the first place. Each does a different job, so you can have more than one
    • Winpatrol
      • An excellent startup manager and then some !!
      • Notifies you if programs are added to startup
      • Allows delayed startup
      • A must have addition
    • SpywareBlaster 4.0
      • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
    • SpywareGuard 2.2
      • SpywareGuard provides real-time protection against spyware.
      • Not required if you have other "realtime" antispyware or Winpatrol
    • ZonedOut
      • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
    • MVPS HOSTS
      • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
      • For information on how to download and install, please read this tutorial by WinHelp2002.
      • Not required if you are using other host file protections


    Internet Browsers
      Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys. Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.

    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available



    Cleaning Temporary Internet Files and Tracking Cookies
      Temporary Internet Files are mainly the files that are downloaded when you open a web page. Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware. It is a good idea to empty the Temporary Internet Files folder on a regular basis. Tracking Cookies are files that websites use to monitor which sites you visit and how often. A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted. CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords Both of these can be cleaned manually, but a quicker option is to use a program
    • ATF Cleaner
      • Free and very simple to use
    • CCleaner
      • Free and very flexible, you can chose which cookies to keep


    Also PLEASE read this article.....So How Did I Get Infected In The First Place

    The last and most important thing I can tell you is UPDATE.
    If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
    Malware changes on a day to day basis. You should update every week at the very least.

    If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


    If you could post back one more time to let me know everything is OK, then I can have this thread archived.

    Happy surfing K'
  • scott11
    edited July 2008
    Katana,

    Thanks for your help and patience. I appreciate it more than words can express.

    Everything seems to be running fine and working correctly.

    As I said in one of the early posts, I have another computer that I am sure has the same problems, I would like to have you help on that one also if possible.

    Please let me know.

    Again, thanks and God Bless.

    Scott Gantt
  • KatanaKatana
    edited July 2008
    If you start a fresh topic, I will keep an eye open for it.
    But you will be in good hands whoever helps you.
  • KatanaKatana
    edited July 2008
    Glad we could be of assistance! This topic is now closed.

    If you wish to reopen your topic, please send a Private Message (PM) to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
This discussion has been closed.