Eset giving me warning Win32/Spy.Ursnif.Avirus

jbake3jbake3 The Bayou
edited December 2009 in Spyware & Virus Removal
Hello all,
Eset is popping up whenever I open firefox or jsut about any other program with a warning:

Win32/Spy.Ursnif.Avirus
I have read up on your forum, didn't know it even existed until today but it looks great!!!! Hope that we can work together to get rid of this. I also hope I learn how to help myself along the way. Thanks in advance!!!

It can not remove the virus. Below is my hijack this log file:
Logfile of Trend Micro HijackThis v2.0.3 (BETA)
Scan saved at 7:56:09 AM, on 12/24/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cobian Backup 9\cbService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Handy Password\HandyPassword.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
O3 - Toolbar: Handy Password - {B2DE56E2-907A-4080-AE06-5C2A7BD4364E} - C:\Program Files\Handy Password\handypasswordtoolbar.dll
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [HandyPassword] C:\Program Files\Handy Password\HandyPassword.exe /Tray
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Handy Password: Autosubmit - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_autologin.html
O8 - Extra context menu item: Handy Password: Fill - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_fill.html
O8 - Extra context menu item: Handy Password: Fill with - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_fillwith.html
O8 - Extra context menu item: Handy Password: Lock/Unlock - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_lock.html
O8 - Extra context menu item: Handy Password: Save - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_save.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Cobian Backup 9 service (CobianBackupAmanita) - Luis Cobian - C:\Program Files\Cobian Backup 9\cbService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 8610 bytes

Comments

  • chiazchiaz
    edited December 2009
    Hey there, welcome. :)

    A few things before we start....
    1. Please Read All Instructions Carefully.
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you.
    4. If you have to go away for an extended period of time, let me know.
    5. Please continue to respond until I give you the "All Clear".
    (Just because you can't see a problem doesn't mean it isn't there)

    ===============

    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.



    Next let's have you download ComboFix.exe. Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use the download meant for SP2.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.


    Please include the MBAM log, C:\ComboFix.txt as well as a new HijackThis log for further review, so that we may continue cleansing the system.


    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • jbake3jbake3 The Bayou
    edited December 2009
    Thanks for replying. I did what was instructed. Combo Fix rebooted my pc and Eset popped up right away with this warning:

    Object:
    C:\windows\system32\termsrv.dll
    Threat:
    win32/spy.ursnif.avirus

    Here are the log files requested:

    ComboFix 09-12-28.06 - Owner 12/29/2009 9:04.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.621 [GMT -6:00]
    Running from: c:\documents and settings\Owner\My Documents\ESET\ComboFix.exe
    AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
    .
    ADS - WINDOWS: deleted 24 bytes in 1 streams.

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\Owner\Application Data\inst.exe
    c:\windows\ModemLog_PANTECH USB Modem .txt

    Infected copy of c:\windows\system32\winlogon.exe was found and disinfected
    Restored copy from - c:\windows\ServicePackFiles\i386\winlogon.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_TDSSSERV.SYS


    ((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-29 )))))))))))))))))))))))))))))))
    .

    2009-12-24 20:03 . 2009-12-24 20:03 4844296 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-12-24 13:55 . 2009-12-24 13:55 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2009-12-24 13:55 . 2009-12-24 13:55
    d
    w- c:\program files\TrendMicro
    2009-12-24 13:24 . 2009-12-24 13:24
    d
    w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
    2009-12-24 13:22 . 2009-12-24 13:22
    d
    w- c:\documents and settings\Owner\Local Settings\Application Data\ESET
    2009-12-24 13:21 . 2009-12-24 13:21
    d
    w- c:\documents and settings\Owner\Application Data\ESET
    2009-12-24 13:20 . 2009-12-24 13:20
    d
    w- c:\program files\ESET
    2009-12-24 13:20 . 2009-12-24 13:20
    d
    w- c:\documents and settings\All Users\Application Data\ESET
    2009-12-04 12:14 . 2009-12-04 12:14
    d
    w- c:\windows\system32\XPSViewer
    2009-12-04 12:14 . 2009-12-04 12:14
    d
    w- c:\program files\MSBuild
    2009-12-04 12:13 . 2009-12-04 12:13
    d
    w- c:\program files\Reference Assemblies
    2009-12-04 12:13 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
    2009-12-04 12:12 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-12-04 12:12 . 2008-07-06 12:06 117760
    w- c:\windows\system32\prntvpt.dll
    2009-12-04 12:12 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-12-04 12:12 . 2008-07-06 10:50 597504
    w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    2009-12-04 12:12 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-12-04 12:12 . 2008-07-06 12:06 575488
    w- c:\windows\system32\xpsshhdr.dll
    2009-12-04 12:12 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-12-04 12:12 . 2008-07-06 12:06 1676288
    w- c:\windows\system32\xpssvcs.dll
    2009-12-04 12:12 . 2009-12-04 12:13
    d
    w- C:\2ab32667ffec93eacf31a4
    2009-12-04 12:08 . 2009-12-04 12:08
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-12-03 04:02 . 2009-12-03 04:02
    d
    w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
    2009-12-03 03:53 . 2009-12-03 03:53
    d-sh--w- c:\documents and settings\Default User\IETldCache
    2009-12-02 23:33 . 2009-10-29 07:45 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
    2009-12-02 23:33 . 2009-10-29 07:45 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-12-02 23:25 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
    2009-12-02 23:20 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
    2009-12-02 23:12 . 2009-08-07 01:23 215920 ----a-w- c:\windows\system32\muweb.dll
    2009-12-02 23:12 . 2009-08-07 01:23 274288 ----a-w- c:\windows\system32\mucltui.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-29 14:57 . 2008-03-30 17:33
    d
    w- c:\documents and settings\Owner\Application Data\OpenOffice.org2
    2009-12-29 14:32 . 2008-03-05 03:45
    d
    w- c:\program files\Mozilla Thunderbird
    2009-12-29 14:28 . 2008-03-12 20:59
    d
    w- c:\documents and settings\Owner\Application Data\Canon
    2009-12-29 13:59 . 2008-03-30 17:34 1 ----a-w- c:\documents and settings\Owner\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-12-28 13:08 . 2008-11-30 00:17
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-12-24 20:05 . 2009-09-01 19:06
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-12-24 13:14 . 2008-12-23 14:34
    d
    w- c:\documents and settings\All Users\Application Data\Norton
    2009-12-24 13:14 . 2008-12-23 14:25
    d
    w- c:\documents and settings\All Users\Application Data\NortonInstaller
    2009-12-24 12:22 . 2009-02-07 13:58
    d
    w- c:\documents and settings\All Users\Application Data\Lue
    2009-12-16 22:56 . 2009-11-20 16:25
    d
    w- c:\program files\Google
    2009-12-15 01:08 . 2008-03-04 20:50 30632 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-12-10 02:37 . 2009-07-06 18:49
    d
    w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-12-04 13:57 . 2009-07-06 18:56
    d
    w- c:\program files\Microsoft Works
    2009-12-03 22:14 . 2009-09-01 19:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-12-03 22:13 . 2009-09-01 19:06 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-11-20 16:50 . 2009-11-20 16:50
    d
    w- c:\documents and settings\All Users\Application Data\TechSmith
    2009-11-20 16:50 . 2009-11-20 16:50
    d
    w- c:\program files\TechSmith
    2009-11-20 16:49 . 2009-11-20 16:49
    d
    w- c:\program files\Common Files\Wise Installation Wizard
    2009-11-16 15:06 . 2009-11-16 15:06 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
    2009-11-16 15:06 . 2009-11-16 15:06 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
    2009-11-16 15:03 . 2009-11-16 15:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
    2009-11-16 14:56 . 2009-11-16 14:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
    2009-11-14 16:03 . 2009-11-14 16:00
    d
    w- c:\program files\Garmin
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\documents and settings\Owner\Application Data\GARMIN
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\program files\Garmin GPS Plugin
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\program files\DIFX
    2009-11-12 19:59 . 2008-03-30 17:26
    d
    w- c:\program files\Java
    2009-11-12 19:58 . 2009-11-12 19:58 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-12 19:45 . 2009-11-12 19:45 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-10-29 07:45 . 2004-08-12 14:09 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-10-21 05:38 . 2004-08-12 14:06 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:38 . 2004-08-12 13:57 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 16:20 . 2004-08-12 13:57 265728 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:30 . 2004-08-12 14:02 270336 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:38 . 2004-08-12 14:04 149504 ----a-w- c:\windows\system32\rastls.dll
    2009-10-12 13:38 . 2004-08-12 14:04 79872 ----a-w- c:\windows\system32\raschap.dll
    2009-10-11 10:17 . 2008-12-22 23:04 411368 ----a-w- c:\windows\system32\deploytk.dll
    2008-03-06 05:03 . 2008-03-06 05:03 23 --sha-w- c:\windows\system32\dadbd_g.dll
    .
    Sigcheck

    [-] 2008-11-27 16:47 . !HASH: COULD NOT OPEN FILE !!!!! . 295424 . . . . c:\windows\system32\termsrv.dll
    [7] 2008-04-14 . FF3477C03BE7201C294C35F684B3479F . 295424 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\termsrv.dll
    [7] 2004-08-12 . B60C877D16D9C880B952FDA04ADF16E6 . 295424 . . [5.1.2600.2180] . . c:\windows\$NtServicePackUninstall$\termsrv.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HandyPassword"="c:\program files\Handy Password\HandyPassword.exe" [2008-04-29 3719768]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-22 1191936]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    2008-10-21 17:09 50472 ----a-w- c:\program files\AIM6\aim6.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
    2004-04-11 16:43 53248
    w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232
    w- c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    2008-04-17 23:27 9117696 ----a-w- c:\program files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792]
    R2 CobianBackupAmanita;Cobian Backup 9 service;c:\program files\Cobian Backup 9\cbService.exe [2/11/2009 4:26 PM 583168]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11/16/2009 9:04 AM 735960]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/20/2009 10:25 AM 133104]
    S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [3/4/2008 4:45 PM 29952]
    S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [3/4/2008 4:45 PM 41856]
    S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [3/4/2008 4:45 PM 39936]
    S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [3/4/2008 4:45 PM 59520]
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    IE: Handy Password: Autosubmit - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_autologin.html
    IE: Handy Password: Fill - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_fill.html
    IE: Handy Password: Fill with - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_fillwith.html
    IE: Handy Password: Lock/Unlock - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_lock.html
    IE: Handy Password: Save - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_save.html
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\yli3ak9y.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-HookURL - (no file)
    URLSearchHooks-Rank - (no file)
    WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)
    HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    HKLM-Run-QOELOADER - c:\program files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-6.0.1.33\QOELoader.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-29 09:09
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(1696)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    .
    Other Running Processes
    .
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Analog Devices\SoundMAX\spkrmon.exe
    c:\windows\system32\wdfmgr.exe
    c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    c:\program files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-12-29 09:14:43 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-12-29 15:14

    Pre-Run: 58,375,589,888 bytes free
    Post-Run: 58,370,912,256 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    - - End Of File - - D0D6DC672BE69420226B8EC16A06C4B7


    Logfile of Trend Micro HijackThis v2.0.3 (BETA)
    Scan saved at 9:19:54 AM, on 12/29/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Cobian Backup 9\cbService.exe
    C:\Program Files\ESET\ESET Smart Security\ekrn.exe
    C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\ESET\ESET Smart Security\egui.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Handy Password\HandyPassword.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
    O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\Snagit 9\SnagitBHO.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
    O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\Snagit 9\SnagitIEAddin.dll
    O3 - Toolbar: Handy Password - {B2DE56E2-907A-4080-AE06-5C2A7BD4364E} - C:\Program Files\Handy Password\handypasswordtoolbar.dll
    O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
    O4 - HKCU\..\Run: [HandyPassword] C:\Program Files\Handy Password\HandyPassword.exe /Tray
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    O8 - Extra context menu item: Handy Password: Autosubmit - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_autologin.html
    O8 - Extra context menu item: Handy Password: Fill - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_fill.html
    O8 - Extra context menu item: Handy Password: Fill with - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_fillwith.html
    O8 - Extra context menu item: Handy Password: Lock/Unlock - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_lock.html
    O8 - Extra context menu item: Handy Password: Save - res://C:\Program Files\Handy Password\handypasswordtoolbar.dll/menu_save.html
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: Cobian Backup 9 service (CobianBackupAmanita) - Luis Cobian - C:\Program Files\Cobian Backup 9\cbService.exe
    O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
    O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe
    O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 7742 bytes 
    Malwarebytes' Anti-Malware 1.42
Database version: 3449
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/29/2009 8:56:10 AM
mbam-log-2009-12-29 (08-56-10).txt

Scan type: Quick Scan
Objects scanned: 106259
Time elapsed: 7 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)
  • chiazchiaz
    edited December 2009
    Hi,

    Thanks for posting the logs. I removed the code tags to make it easier for me to read.


    Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

    It's IMPORTANT to carry out the instructions in the sequence listed below.


    First, please go to http://virusscan.jotti.org , click on Browse, and upload the following file for analysis:

    c:\windows\system32\dadbd_g.dll

    Then click Submit. Allow the file to be scanned, and then please Copy/Paste the results here for me to see.

    If Jotti is busy, please go to http://www.virustotal.com.


    Next,
    1. Close any open browsers.
    2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

    Open *notepad* and copy/paste the text in the quotebox below into it:
    FCopy::
c:\windows\ServicePackFiles\i386\termsrv.dll|c:\windows\system32\termsrv.dll

    Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.


    CFScript.gif

    Refering to the picture above, drag CFScript.txt into ComboFix.exe


    When finished, it shall produce a log for you at C:\ComboFix.txt

    Please copy and paste the ComboFix.txt in your new reply, along with the Jotti/VirusTotal results.

    *Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall. Altering this script in any way could damage your computer.*
  • jbake3jbake3 The Bayou
    edited December 2009
    Sorry about the code tags, thought it would save space. I guess it is kind of hard to read through, lol!! Here are the log files:

    Jotti:
    Filename: dadbd_g.dll
    Status:
    Scan finished. 0 out of 20 scanners reported malware.
    Scan taken on: Tue 29 Dec 2009 17:03:17 (CET) Permalink
    File size: 23 bytes
    Filetype: Unknown
    MD5: 018917dd32b4a0ca0377cb11074777da
    SHA1: 1bf109a230b4e5575751debb79c41af8a79531c9

    ComboFix 09-12-28.06 - Owner 12/29/2009 10:27:11.2.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.623 [GMT -6:00]
    Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt
    AV: ESET Smart Security 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
    FW: ESET Personal firewall *disabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    FCopy

    c:\windows\ServicePackFiles\i386\termsrv.dll --> c:\windows\system32\termsrv.dll
    .
    ((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-29 )))))))))))))))))))))))))))))))
    .

    2009-12-24 20:03 . 2009-12-24 20:03 4844296 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
    2009-12-24 13:55 . 2009-12-24 13:55 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2009-12-24 13:55 . 2009-12-24 13:55
    d
    w- c:\program files\TrendMicro
    2009-12-24 13:24 . 2009-12-24 13:24
    d
    w- c:\documents and settings\LocalService\Local Settings\Application Data\ESET
    2009-12-24 13:22 . 2009-12-24 13:22
    d
    w- c:\documents and settings\Owner\Local Settings\Application Data\ESET
    2009-12-24 13:21 . 2009-12-24 13:21
    d
    w- c:\documents and settings\Owner\Application Data\ESET
    2009-12-24 13:20 . 2009-12-24 13:20
    d
    w- c:\program files\ESET
    2009-12-24 13:20 . 2009-12-24 13:20
    d
    w- c:\documents and settings\All Users\Application Data\ESET
    2009-12-04 12:14 . 2009-12-04 12:14
    d
    w- c:\windows\system32\XPSViewer
    2009-12-04 12:14 . 2009-12-04 12:14
    d
    w- c:\program files\MSBuild
    2009-12-04 12:13 . 2009-12-04 12:13
    d
    w- c:\program files\Reference Assemblies
    2009-12-04 12:13 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
    2009-12-04 12:12 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
    2009-12-04 12:12 . 2008-07-06 12:06 117760
    w- c:\windows\system32\prntvpt.dll
    2009-12-04 12:12 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
    2009-12-04 12:12 . 2008-07-06 10:50 597504
    w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
    2009-12-04 12:12 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
    2009-12-04 12:12 . 2008-07-06 12:06 575488
    w- c:\windows\system32\xpsshhdr.dll
    2009-12-04 12:12 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
    2009-12-04 12:12 . 2008-07-06 12:06 1676288
    w- c:\windows\system32\xpssvcs.dll
    2009-12-04 12:12 . 2009-12-04 12:13
    d
    w- C:\2ab32667ffec93eacf31a4
    2009-12-04 12:08 . 2009-12-04 12:08
    d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-12-03 04:02 . 2009-12-03 04:02
    d
    w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
    2009-12-03 03:53 . 2009-12-03 03:53
    d-sh--w- c:\documents and settings\Default User\IETldCache
    2009-12-02 23:33 . 2009-10-29 07:45 594432 -c----w- c:\windows\system32\dllcache\msfeeds.dll
    2009-12-02 23:33 . 2009-10-29 07:45 55296 -c----w- c:\windows\system32\dllcache\msfeedsbs.dll
    2009-12-02 23:25 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
    2009-12-02 23:20 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
    2009-12-02 23:12 . 2009-08-07 01:23 215920 ----a-w- c:\windows\system32\muweb.dll
    2009-12-02 23:12 . 2009-08-07 01:23 274288 ----a-w- c:\windows\system32\mucltui.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-12-29 16:18 . 2008-03-05 03:45
    d
    w- c:\program files\Mozilla Thunderbird
    2009-12-29 14:57 . 2008-03-30 17:33
    d
    w- c:\documents and settings\Owner\Application Data\OpenOffice.org2
    2009-12-29 14:28 . 2008-03-12 20:59
    d
    w- c:\documents and settings\Owner\Application Data\Canon
    2009-12-29 13:59 . 2008-03-30 17:34 1 ----a-w- c:\documents and settings\Owner\Application Data\OpenOffice.org2\user\uno_packages\cache\stamp.sys
    2009-12-28 13:08 . 2008-11-30 00:17
    d
    w- c:\program files\Spybot - Search & Destroy
    2009-12-24 20:05 . 2009-09-01 19:06
    d
    w- c:\program files\Malwarebytes' Anti-Malware
    2009-12-24 13:14 . 2008-12-23 14:34
    d
    w- c:\documents and settings\All Users\Application Data\Norton
    2009-12-24 13:14 . 2008-12-23 14:25
    d
    w- c:\documents and settings\All Users\Application Data\NortonInstaller
    2009-12-24 12:22 . 2009-02-07 13:58
    d
    w- c:\documents and settings\All Users\Application Data\Lue
    2009-12-16 22:56 . 2009-11-20 16:25
    d
    w- c:\program files\Google
    2009-12-15 01:08 . 2008-03-04 20:50 30632 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-12-10 02:37 . 2009-07-06 18:49
    d
    w- c:\documents and settings\All Users\Application Data\Microsoft Help
    2009-12-04 13:57 . 2009-07-06 18:56
    d
    w- c:\program files\Microsoft Works
    2009-12-03 22:14 . 2009-09-01 19:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2009-12-03 22:13 . 2009-09-01 19:06 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
    2009-11-20 16:50 . 2009-11-20 16:50
    d
    w- c:\documents and settings\All Users\Application Data\TechSmith
    2009-11-20 16:50 . 2009-11-20 16:50
    d
    w- c:\program files\TechSmith
    2009-11-20 16:49 . 2009-11-20 16:49
    d
    w- c:\program files\Common Files\Wise Installation Wizard
    2009-11-16 15:06 . 2009-11-16 15:06 55768 ----a-w- c:\windows\system32\drivers\epfwtdi.sys
    2009-11-16 15:06 . 2009-11-16 15:06 135048 ----a-w- c:\windows\system32\drivers\epfw.sys
    2009-11-16 15:03 . 2009-11-16 15:03 108792 ----a-w- c:\windows\system32\drivers\ehdrv.sys
    2009-11-16 14:56 . 2009-11-16 14:56 116520 ----a-w- c:\windows\system32\drivers\eamon.sys
    2009-11-14 16:03 . 2009-11-14 16:00
    d
    w- c:\program files\Garmin
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\documents and settings\Owner\Application Data\GARMIN
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\program files\Garmin GPS Plugin
    2009-11-14 16:00 . 2009-11-14 16:00
    d
    w- c:\program files\DIFX
    2009-11-12 19:59 . 2008-03-30 17:26
    d
    w- c:\program files\Java
    2009-11-12 19:58 . 2009-11-12 19:58 152576 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-12 19:45 . 2009-11-12 19:45 79488 ----a-w- c:\documents and settings\Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-10-29 07:45 . 2004-08-12 14:09 916480
    w- c:\windows\system32\wininet.dll
    2009-10-21 05:38 . 2004-08-12 14:06 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 05:38 . 2004-08-12 13:57 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 16:20 . 2004-08-12 13:57 265728 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:30 . 2004-08-12 14:02 270336 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:38 . 2004-08-12 14:04 149504 ----a-w- c:\windows\system32\rastls.dll
    2009-10-12 13:38 . 2004-08-12 14:04 79872 ----a-w- c:\windows\system32\raschap.dll
    2009-10-11 10:17 . 2008-12-22 23:04 411368 ----a-w- c:\windows\system32\deploytk.dll
    2008-03-06 05:03 . 2008-03-06 05:03 23 --sha-w- c:\windows\system32\dadbd_g.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HandyPassword"="c:\program files\Handy Password\HandyPassword.exe" [2008-04-29 3719768]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-22 1191936]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
    "egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    2008-10-21 17:09 50472 ----a-w- c:\program files\AIM6\aim6.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
    2004-04-11 16:43 53248
    w- c:\program files\CyberLink\PowerDVD\DVDLauncher.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    2008-04-14 00:12 1695232
    w- c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
    2008-04-17 23:27 9117696 ----a-w- c:\program files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AIM6\\aim6.exe"=
    "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
    "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

    R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [11/16/2009 9:03 AM 108792]
    R2 CobianBackupAmanita;Cobian Backup 9 service;c:\program files\Cobian Backup 9\cbService.exe [2/11/2009 4:26 PM 583168]
    R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [11/16/2009 9:04 AM 735960]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/20/2009 10:25 AM 133104]
    S3 PTDMBus;PANTECH USB Modem Composite Device Driver ;c:\windows\system32\drivers\PTDMBus.sys [3/4/2008 4:45 PM 29952]
    S3 PTDMMdm;PANTECH USB Modem Drivers ;c:\windows\system32\drivers\PTDMMdm.sys [3/4/2008 4:45 PM 41856]
    S3 PTDMVsp;PANTECH USB Modem Serial Port ;c:\windows\system32\drivers\PTDMVsp.sys [3/4/2008 4:45 PM 39936]
    S3 PTDMWWAN;PANTECH USB Modem WWAN Driver;c:\windows\system32\drivers\PTDMWWAN.sys [3/4/2008 4:45 PM 59520]
    .
    Supplementary Scan
    .
    uStart Page = hxxp://www.yahoo.com/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
    IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
    IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
    IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
    IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
    IE: Handy Password: Autosubmit - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_autologin.html
    IE: Handy Password: Fill - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_fill.html
    IE: Handy Password: Fill with - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_fillwith.html
    IE: Handy Password: Lock/Unlock - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_lock.html
    IE: Handy Password: Save - c:\program files\Handy Password\handypasswordtoolbar.dll/menu_save.html
    FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\yli3ak9y.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrie7&query=
    FF - prefs.js: browser.search.selectedEngine - Google
    FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
    FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50fftrab&query=
    FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.
    - - - - ORPHANS REMOVED - - - -

    URLSearchHooks-HookURL - (no file)
    URLSearchHooks-Rank - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-12-29 10:31
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    DLLs Loaded Under Running Processes

    - - - - - - - > 'explorer.exe'(424)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    .
    Completion time: 2009-12-29 10:32:45
    ComboFix-quarantined-files.txt 2009-12-29 16:32
    ComboFix2.txt 2009-12-29 15:14

    Pre-Run: 58,423,058,432 bytes free
    Post-Run: 58,409,033,728 bytes free

    - - End Of File - - 39E8166A19538CA9F05FB92704AF36C4
  • chiazchiaz
    edited December 2009
    OK....let's have you go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.

    Also how's your PC running at this point in time?
  • jbake3jbake3 The Bayou
    edited December 2009
    PC is running good. I am still occasionally getting a warning from ESET. Here is the log from Panda. It took a very long time to run the full scan:

    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2009-12-29 15:09:24
    PROTECTIONS: 1
    MALWARE: 2
    SUSPECTS: 2
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    ESET Smart Security 4.0 4.0 Yes Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00168056 Cookie/YieldManager TrackingCookie No 0 Yes No c:\documents and settings\owner\cookies\owner@ad.yieldmanager[2].txt
    03074964 Trj/CI.A Virus/Trojan No 0 Yes No c:\qoobox\quarantine\c\windows\system32\termsrv.dll.vir
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location
    ;===================================================================================================================================================================================
    No c:\documents and settings\owner\desktop\combofix.exe[32788r22fwjfw\pev.exe]
    No c:\windows\pev.exe
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
  • chiazchiaz
    edited December 2009
    It's time to remove ComboFix.

    Go to to Start > Run
    Type in box

    combofix /uninstall

    Note: the space between the X and the /u

    Press Enter.

    This command will:

    Delete the following:
    ComboFix and its associated files and folders.
    VundoFix backups, if present
    The C:\Deckard folder, if present
    The C:_OtMoveIt folder, if present

    Reset the clock settings.
    Hide file extensions, if required.
    Hide System/Hidden files, if required.
    Reset System Restore.



    Please let me know the exact message that ESET is still giving.
  • jbake3jbake3 The Bayou
    edited December 2009
    All done. Thanks a-lot chiaz. I will let you know exactly what eset says when it gives me another warning. I appreciate all your help. You folks really are great for doing this pro-bono. I will definitely be donating as soon as possible. Thanks again.
  • chiazchiaz
    edited December 2009
    I will keep this thread open for a few days, please update me. :)
  • jbake3jbake3 The Bayou
    edited December 2009
    Looks like it is all cleared up chiaz. No warnings and everything is running smoothly. Thank You, Happy New Year!!!!!!!!!
  • chiazchiaz
    edited December 2009
    You're welcome jbake3.

    I'll move this to the Resolved section shortly.
Sign In or Register to comment.