Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

New to Forum, posting log for first time

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: New to Forum, posting log for first time

Unread postby ITIS367JOE » March 18th, 2008, 12:16 am

I just needed to close threatfire to run this, thought I had posted this a few days ago,

Joe

ComboFix 08-03-05.1 - Owner 2008-03-15 12:40:12.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.331 [GMT -6:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
.

2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-09 21:50 . 2008-03-09 21:50 <DIR> d-------- C:\Program Files\CCleaner
2008-03-05 00:54 . 2008-03-05 00:54 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-04 22:53 . 2008-03-04 23:25 1,302,976 ---hs---- C:\WINDOWS\system32\xeoepbco.ini
2008-02-22 12:38 . 2008-02-28 18:09 143 --a------ C:\WINDOWS\BMffb48e05.xml

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 18:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-14 03:41 3,888 ----a-w C:\WINDOWS\viassary-hp.reg
2008-03-14 03:41 --------- d-----w C:\Program Files\Easy Internet signup
2008-03-08 05:07 --------- d-----w C:\Program Files\Yahoo!
2008-03-08 04:57 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-03-07 00:45 --------- d-----w C:\Program Files\MSN Messenger
2008-03-07 00:45 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-06 01:42 --------- d-----w C:\Program Files\ThreatFire
2008-03-03 02:20 --------- d-----w C:\Program Files\SealedMedia
2008-03-01 16:39 28,256 ----a-w C:\WINDOWS\system32\drivers\MxlW2k.sys
2008-02-15 17:21 41,280 ----a-w C:\WINDOWS\system32\drivers\TfSysMon.sys
2008-02-15 17:21 33,088 ----a-w C:\WINDOWS\system32\drivers\TfNetMon.sys
2008-02-15 17:21 12,608 ----a-w C:\WINDOWS\system32\drivers\TfKbMon.sys
2008-02-15 17:20 51,520 ----a-w C:\WINDOWS\system32\drivers\TfFsMon.sys
2008-02-14 05:33 --------- d-----w C:\Program Files\Common Files\RuleSpace
2008-02-14 05:32 --------- d-----w C:\Program Files\Common Files\Aluria
2008-02-14 05:24 --------- d-----w C:\Program Files\Common Files\Authentium Shared
2008-02-14 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-14 05:20 --------- d-----w C:\Program Files\McAfee
2008-02-14 05:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-08 06:14 --------- d-----w C:\Program Files\Google
2008-01-26 19:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\SealedMedia
2008-01-26 03:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\PoivY
2008-01-26 03:42 --------- d-----w C:\Program Files\PoivY.com
2008-01-22 06:53 --------- d-----w C:\Program Files\a-squared Free
2008-01-21 03:11 155,648 ----a-w C:\WINDOWS\system32\igfxtray.exe
2008-01-21 03:11 118,784 ----a-w C:\WINDOWS\system32\hkcmd.exe
2008-01-18 03:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\Lavasoft
2008-01-18 03:54 --------- d-----w C:\Program Files\Lavasoft
2008-01-18 03:49 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 05:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-16 14:12 103,936 ----a-w C:\WINDOWS\system32\HFX2C5A.tmp
2008-01-15 23:25 81,920 ----a-w C:\WINDOWS\system32\ps2.exe
2008-01-15 23:25 483,328 ----a-w C:\WINDOWS\system32\hphmon05.exe
2008-01-15 03:25 --------- d-----w C:\Program Files\Microsoft Picture It! 7
2008-01-11 04:11 10 ----a-w C:\Program Files\.autoreg
2007-07-07 02:10 456,192 --sh--r C:\WINDOWS\cnetmgr.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-05_19.49.52.31 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-13 00:23:58 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-03-12 06:33:57 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-02-13 00:23:57 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-03-12 06:33:57 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-02-13 00:23:58 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-03-12 06:33:57 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-02-13 00:23:58 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-03-12 06:33:57 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-02-13 00:23:58 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-03-12 06:33:57 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-02-13 00:23:58 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-03-12 06:33:58 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-02-13 00:23:58 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-03-12 06:33:57 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-02-13 00:23:58 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-03-12 06:33:58 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-02-13 00:23:57 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-03-12 06:33:57 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-02-13 00:23:57 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-03-12 06:33:57 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-01-15 03:23:14 22,798 ----a-r C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00544}\MsblIco.Exe
+ 2008-03-07 00:54:30 22,798 ----a-r C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00544}\MsblIco.Exe
+ 2008-01-15 23:25:21 212,992 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
+ 2008-01-15 23:25:18 52,736 ----a-w C:\WINDOWS\system\hpsysdrv.exe
+ 2004-08-04 07:56:57 13,824 -c--a-w C:\WINDOWS\system32\dllcache\wscntfy.exe
- 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-01-15 23:25:23 196,608 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"Router"="C:\Program Files\Router\Router.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2008-01-15 17:25 2185800]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-03-05 19:23 171448]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2008-01-15 17:25 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-20 21:11 118784]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2008-01-12 12:56 90112]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 17:25 483328]
"KBD"="C:\HP\KBD\KBD.EXE" [2008-01-12 12:56 61440]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2008-01-12 12:56 45056]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-12 12:57 151597]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2008-01-15 17:25 212992]
"VTTimer"="VTTimer.exe" []
"LTMSG"="LTMSG.exe" [2003-07-14 18:52 40960 C:\WINDOWS\ltmsg.exe]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2008-01-15 17:25 81920]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2008-01-15 17:25 196608]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-20 21:11 155648]
"ESP"="c:\Program Files\Cox\Applications\app\start.exe" [ ]
"sealmon"="C:\Program Files\SealedMedia\sealmon.exe" [ ]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 17:37 53248]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 07:35:01 557056]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

R0 GRFILTER;Authentium NDIS Driver;C:\WINDOWS\system32\drivers\GRFILTER.sys [2007-05-09 13:41]
R0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMon.sys [2008-02-15 11:20]
R0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSysMon.sys [2008-02-15 11:21]
R2 GRTdiMon;Authentium TDI Mon;C:\WINDOWS\system32\Drivers\GRTdiMon.sys [2007-05-09 13:41]
R2 ThreatFire;ThreatFire;C:\Program Files\ThreatFire\TFService.exe service []
R3 TfNetMon;TfNetMon;C:\WINDOWS\System32\drivers\TfNetMon.sys [2008-02-15 11:21]
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 03:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 03:15]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 04:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-14 03:41:40 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2003-10-14 13:32:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 12:45:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-15 12:48:51
ComboFix-quarantined-files.txt 2008-03-15 18:48:43
ComboFix2.txt 2008-03-15 18:32:29
ComboFix3.txt 2008-03-07 00:59:44
ComboFix4.txt 2008-03-06 01:51:01
.
2008-03-12 06:35:25 --- E O F ---
ITIS367JOE
Active Member
 
Posts: 8
Joined: March 5th, 2008, 2:46 am
Advertisement
Register to Remove

Re: New to Forum, posting log for first time

Unread postby dan12 » March 18th, 2008, 7:51 am

Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Jotti

Please visit Jotti
Copy/paste the the following file path into the window
C:\WINDOWS\cnetmgr.exe
Click Submit/Send File
Please post back, to let me know the results.

Please do the same for the following file
C:\WINDOWS\system32\xeoepbco.ini
C:\WINDOWS\BMffb48e05.xml


If Jotti is too busy please try Virustotal
User avatar
dan12
MRU Honors Grad Emeritus
 
Posts: 6123
Joined: March 30th, 2006, 3:22 am
Location: Leicestershire

Re: New to Forum, posting log for first time

Unread postby Elrond » March 25th, 2008, 10:24 am

Due to lack of response this topic is now closed.

If you still need help open a new thread in the Malware Removal forum and wait for a new helper.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Elrond
User avatar
Elrond
Admin/Teacher Emeritus
 
Posts: 8818
Joined: February 17th, 2005, 9:14 pm
Location: Jerusalem

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 28 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware