Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

I-worm/Bagle.AKA and combofix......

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 3rd, 2008, 6:08 pm

Hello, first time.......

I seem to have been the lucky recipient of I-worm/Bagle.AKA

I tried the usual and it kept popping back. Here is my combofix log:

ComboFix 08-07-23.5 - HP 2008-08-04 0:28:09.3 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1301 [GMT 3:00]
Running from: C:\Users\HP\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\system32\drivers\downld

.
((((((((((((((((((((((((( Files Created from 2008-07-03 to 2008-08-03 )))))))))))))))))))))))))))))))
.

2008-08-04 00:14 . 2008-08-04 00:14 <DIR> d-------- C:\RootkitNO
2008-08-04 00:14 . 2008-08-04 00:14 123 --a------ C:\WINDOWS\rootkitno.ini
2008-08-03 23:08 . 2008-08-03 23:08 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-03 20:30 . 2008-08-04 00:22 <DIR> d-------- C:\Program Files\UnHackMe
2008-08-03 20:30 . 2008-08-03 20:30 (2) -rahs-ot- C:\WINDOWS\winstart.bat
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iTunes
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iPod
2008-07-25 11:26 . 2008-07-25 11:26 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-07-24 03:01 . 2008-05-27 07:59 106,605 --a------ C:\WINDOWS\System32\StructuredQuerySchema.bin
2008-07-24 03:01 . 2008-05-27 08:17 34,816 --a------ C:\WINDOWS\System32\msscb.dll
2008-07-24 03:01 . 2008-05-27 07:59 18,904 --a------ C:\WINDOWS\System32\StructuredQuerySchemaTrivial.bin
2008-07-24 03:01 . 2008-05-27 08:17 11,776 --a------ C:\WINDOWS\System32\msshooks.dll
2008-07-22 23:13 . 2008-07-22 23:13 <DIR> d-------- C:\Users\HP\AppData\Roaming\dvdcss
2008-07-15 00:06 . 2008-07-15 00:06 <DIR> d-------- C:\Users\HP\AppData\Roaming\Nokia Multimedia Player
2008-07-13 19:19 . 2008-07-13 19:20 <DIR> d-------- C:\Program Files\Microsoft Expression
2008-07-13 19:17 . 2008-07-17 23:58 39 --a------ C:\WINDOWS\vbaddin.ini
2008-07-13 19:16 . 2008-07-13 19:16 162 --a------ C:\WINDOWS\ODBC.INI
2008-07-12 22:22 . 2008-07-12 22:22 <DIR> d-------- C:\Program Files\Bonjour
2008-07-11 19:27 . 2008-06-26 04:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-07-11 19:27 . 2008-06-26 04:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-07-11 19:27 . 2008-06-26 06:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-07-09 17:45 . 2008-07-09 17:45 <DIR> d-------- C:\swsetup
2008-07-09 17:14 . 2008-04-26 11:25 3,600,952 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-07-09 17:14 . 2008-04-26 11:25 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-07-09 17:14 . 2008-04-26 11:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-07-09 17:14 . 2008-04-12 06:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-07-09 17:14 . 2008-05-10 06:35 564,736 --a------ C:\WINDOWS\System32\emdmgmt.dll
2008-07-09 17:14 . 2008-04-05 04:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-07-09 17:14 . 2008-04-05 06:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-07-09 17:11 . 2008-05-09 00:59 430,080 --a------ C:\WINDOWS\System32\vbscript.dll
2008-07-09 17:11 . 2008-05-09 00:59 180,224 --a------ C:\WINDOWS\System32\scrobj.dll
2008-07-09 17:11 . 2008-05-09 00:59 172,032 --a------ C:\WINDOWS\System32\scrrun.dll
2008-07-09 17:11 . 2008-05-09 00:59 155,648 --a------ C:\WINDOWS\System32\wscript.exe
2008-07-09 17:11 . 2008-05-09 00:58 135,168 --a------ C:\WINDOWS\System32\wshom.ocx
2008-07-09 17:11 . 2008-05-09 00:58 135,168 --a------ C:\WINDOWS\System32\cscript.exe
2008-07-09 17:11 . 2008-05-09 00:59 90,112 --a------ C:\WINDOWS\System32\wshext.dll
2008-07-07 23:37 . 2008-07-08 20:32 <DIR> d-------- C:\BNL BACKUP
2008-07-06 22:46 . 2008-07-06 22:46 <DIR> d-------- C:\Users\HP\AppData\Roaming\Research In Motion
2008-07-06 22:44 . 2006-10-20 10:28 26,368 --a------ C:\WINDOWS\System32\drivers\RimSerial.sys
2008-07-06 22:43 . 2008-07-06 22:43 <DIR> d-------- C:\Users\HP\AppData\Roaming\Blackberry Desktop
2008-07-06 22:42 . 2008-07-06 22:42 <DIR> d-------- C:\Program Files\Research In Motion
2008-07-06 22:42 . 2008-07-06 22:43 <DIR> d-------- C:\Program Files\Common Files\Research In Motion
2008-07-06 22:20 . 2008-07-06 22:20 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-07-05 22:08 . 2008-07-05 22:08 <DIR> d-------- C:\Users\All Users\LzG24
2008-07-05 22:08 . 2008-07-05 22:08 <DIR> d-------- C:\ProgramData\LzG24
2008-07-05 22:06 . 2008-07-05 22:06 <DIR> d-------- C:\WINDOWS\TestBank Level I - September 2008
2008-07-05 22:06 . 2008-07-05 22:06 <DIR> d-------- C:\Program Files\UpperMark, LLC
2008-07-05 21:47 . 2008-07-05 21:48 <DIR> d-------- C:\Users\All Users\WebEx
2008-07-05 21:47 . 2008-07-05 21:48 <DIR> d-------- C:\ProgramData\WebEx
2008-07-03 23:57 . 2008-07-03 23:57 <DIR> d-------- C:\Program Files\Vodei

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-03 19:24 --------- d-----w C:\Users\HP\AppData\Roaming\ChessBase
2008-08-03 13:55 --------- d-----w C:\ProgramData\Google Updater
2008-08-03 13:55 --------- d-----w C:\Program Files\Google
2008-08-02 16:45 --------- d-----w C:\Users\HP\AppData\Roaming\ContentGuard
2008-08-02 06:03 --------- d-----w C:\Users\HP\AppData\Roaming\uTorrent
2008-07-27 19:04 --------- d-----w C:\Users\HP\AppData\Roaming\Skype
2008-07-27 17:58 --------- d-----w C:\Users\HP\AppData\Roaming\skypePM
2008-07-27 14:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-25 18:00 --------- d-----w C:\ProgramData\Roxio
2008-07-25 08:26 --------- d-----w C:\Program Files\Common Files\Real
2008-07-19 07:49 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-07-14 14:54 --------- d-----w C:\Program Files\Java
2008-07-10 00:08 --------- d-----w C:\Program Files\Windows Mail
2008-07-09 14:46 --------- d-----w C:\Program Files\HP
2008-07-05 18:14 --------- d-----w C:\Program Files\Safari
2008-06-22 20:42 --------- d-----w C:\ProgramData\Nokia
2008-06-22 20:41 --------- d-----w C:\Program Files\Nokia
2008-06-22 20:40 --------- d-----w C:\ProgramData\Installations
2008-06-22 20:40 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 20:26 --------- d-----w C:\Users\HP\AppData\Roaming\Nokia
2008-06-22 20:17 0 ---ha-w C:\Windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-06-22 15:13 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-22 11:37 --------- d-----w C:\Program Files\DivX
2008-06-21 11:45 --------- d-----w C:\Program Files\uTorrent
2008-06-21 07:48 --------- d-----w C:\Program Files\QuickTime
2008-06-20 07:38 174 --sha-w C:\Program Files\desktop.ini
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Defender
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Calendar
2008-06-20 06:53 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-20 06:53 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-14 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\ProgramData\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Common Files\Palo Alto Software
2008-06-14 09:59 --------- d-----w C:\Users\HP\AppData\Roaming\bppenu11
2008-06-14 09:56 --------- d-----w C:\Program Files\Business Plan Pro
2008-06-14 09:30 --------- d-----w C:\ProgramData\IsolatedStorage
2008-06-13 20:10 --------- d-----w C:\Program Files\Common Files\Intuit
2008-06-13 20:04 --------- d-----w C:\ProgramData\PAS
2008-06-13 16:56 --------- d-----w C:\Program Files\QMwin32
2008-06-13 16:54 --------- d-----w C:\Users\HP\AppData\Roaming\SUPERAntiSpyware.com
2008-06-13 16:54 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-06-13 16:54 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\ESET
2008-06-11 21:10 --------- d-----w C:\ProgramData\ESET
2008-06-11 17:38 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-06-11 16:27 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-06-11 16:27 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-06-11 16:18 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-11 04:16 --------- d-----w C:\ProgramData\Lavasoft
2008-06-11 04:12 --------- d-----w C:\Program Files\Lavasoft
2008-06-10 20:04 96,520 ----a-w C:\Windows\system32\drivers\avgldx86.sys
2008-06-10 20:04 10,520 ----a-w C:\Windows\System32\avgrsstx.dll
2008-06-10 20:04 --------- d-----w C:\ProgramData\avg8
2008-06-10 20:04 --------- d-----w C:\Program Files\AVG
2008-06-05 11:57 --------- d-----w C:\ProgramData\Mindjet
2008-06-05 06:52 --------- d-----w C:\Users\HP\AppData\Roaming\Cogniview
2008-06-05 06:46 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-05 06:45 --------- d-----w C:\Program Files\Cogniview
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-16 08:58 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2008-05-10 03:35 885,248 ----a-w C:\Windows\System32\RacEngn.dll
2008-01-08 17:32 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-08 17:32 32 ----a-w C:\ProgramData\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot_2008-08-04_ 0.10.26.77 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-03 21:16:03 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-03 21:16:03 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-03 21:05:06 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-03 21:18:29 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-03 21:18:29 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-03 21:05:05 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-03 21:18:24 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-03 21:18:24 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-03 20:12:06 112,482 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-08-03 21:20:32 112,482 ----a-w C:\Windows\System32\perfc009.dat
- 2008-08-03 20:12:06 633,748 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-08-03 21:20:32 633,748 ----a-w C:\Windows\System32\perfh009.dat
- 2008-08-03 20:07:17 12,212 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
+ 2008-08-03 21:17:52 12,414 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
- 2008-08-03 20:07:17 71,250 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-03 21:17:52 71,330 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-03 20:07:16 38,558 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-03 21:17:51 38,886 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-01-26 09:03 708616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 19:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-04-20 04:11 151552]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe" [2007-04-25 12:36 280064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"bgsmsnd.exe"="C:\Windows\system32\bgsmsnd.exe" [2007-11-19 10:36 160136]
"MMReminderService"="C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 00:05 37392]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-10 23:04 1177368]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-28 01:59 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-28 01:59 8473120]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-28 01:59 81920]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\WINDOWS\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Palo Alto Software Update Manager 8.0.lnk - C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe [2007-02-13 12:03:24 128544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= CSvidcap.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkAndWrite]
--a------ 2008-01-08 20:35 3042816 C:\ProgramData\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-129870416-3998998155-2461932588-1001]
"EnableNotificationsRef"=dword:00000007

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1A3EA7E0-A4D1-4C19-8BD7-2FBD264B5800}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{7C735085-2FAD-4ADD-A184-E575311E89A0}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{9A38C7EF-1246-4FD5-8843-70D2FC847E05}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{81950DC3-AD62-4E1F-95B4-8AC89341A0C2}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{165AFFE7-FE9D-49F4-B47F-1B05900509D2}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C0D7782C-5D7E-4B08-A3B4-425EDAAF89D7}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C2B7AB0D-1548-45EC-88B5-33987CF45DFD}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{01ED933C-0271-40A0-8C39-D5ACEE0BED29}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{A4694F55-3626-4D97-8288-295CD7EA0996}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{10BC16D9-DCFE-4191-A65D-B6745EFA19BA}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{787E827F-22CD-4453-B0FB-B4ECAA26F83D}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{EE7CA935-49AC-4206-8CF8-6E73A3F30601}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{2690BC7D-4D6B-4A33-97D4-245F895F3708}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{68B81E44-17D9-456F-8947-F6B937B310EF}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{F6A8C056-496D-4CEC-AA2B-B1518BE8AE52}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{80B60DBF-0BCD-4898-998E-EF19580E00BB}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= UDP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"UDP Query User{A94388A6-96D8-4841-A37B-CA108FD5A3AA}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= TCP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"TCP Query User{7BD034ED-36D4-471C-B4EF-79DFE83AE717}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{9F6D97C0-BFE5-44B9-86C5-33B6BC06AC69}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{39AF88C6-EAC6-46EB-8629-3D6E5B7DD68D}"= UDP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{918F7C24-97BA-43BB-898C-7477E0C44187}"= TCP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{7077CF36-3130-4CBB-8C1C-809E6B96F867}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{018D8C02-EF30-4495-963B-06C85F4FC1A4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{4CEC7DC3-758E-4FD3-8220-3E2962F4BF6B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0CF80992-1672-47B0-9081-AF3C09EE50BF}"= UDP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7
"{61A61DFC-240C-491E-8CDF-D8CA7339B740}"= TCP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-06-10 23:04]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-10 23:04]
R2 DQLWinService;DQLWinService;C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 20:32]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2007-08-31 16:46]
S2 IntelDHSvcConf;Intel DH Service;C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-05-10 19:13]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{066bb7ba-42d0-11dd-8c1f-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a509a1b-5567-11dd-afb0-001bfce08336}]
\shell\AutoRun\command - N:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d5af417-50f8-11dd-b8c6-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a65643eb-0b02-11dd-8803-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a656440c-0b02-11dd-8803-001bfce08336}]
\shell\AutoRun\command - L:\8ng8w.com
\shell\explore\Command - L:\8ng8w.com
\shell\open\Command - L:\8ng8w.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa1e5ca0-b147-11dc-8e41-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb1e38cf-c995-11dc-b7cd-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d841311f-d0c7-11dc-a10d-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = https://mail.asiacapitalre.com/exchweb/ ... /&reason=0
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-04 00:30:18
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\Portrait Displays\Pivot Software\winphook.dll
.
Completion time: 2008-08-04 0:31:55
ComboFix-quarantined-files.txt 2008-08-03 21:31:24
ComboFix2.txt 2008-08-03 21:11:40
ComboFix3.txt 2008-06-11 18:05:31

Pre-Run: 105,064,845,312 bytes free
Post-Run: 105,029,906,432 bytes free

318 --- E O F --- 2008-07-24 00:02:15

____________

What can i do, as my security setting still won't work.......?? ;)
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm
Advertisement
Register to Remove

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 9th, 2008, 6:10 am

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.


Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly :D

I apologize for the delay in responding, but as you can probably see the forums are quite busy.
Unfortunately there are far more people needing help than there are helpers.

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe


----------------------------------------------------------------------------------------




REMOVE P2P PROGRAMS

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

emule

Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.

Post back a new HijackThis, so we can continue cleaning your pc.




A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 9th, 2008, 7:18 am

Thanks for the help!

here is my log file for hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:17:09, on 09/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe
C:\Program Files\Portrait Displays\HP My Display\dthtml.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\WINDOWS\System32\bgsmsnd.exe
C:\Program Files\Mindjet\MindManager 7\MmReminderService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
C:\Windows\ehome\ehmsas.exe
C:\WINDOWS\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\ChessBase\ChessProgram11\ChessProgram11.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mail.asiacapitalre.com/exchweb/ ... /&reason=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\Windows\system32\bgsmsnd.exe
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Palo Alto Software Update Manager 8.0.lnk = C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://uppermark.webex.com/client/T26L ... atgpc1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11614 bytes
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 9th, 2008, 8:03 am

REMOVE P2P PROGRAMS

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

uTorrent

Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.

Post back a new HijackThis, so we can continue cleaning your pc.



Please remove ALL P2P programs


Installed Programs

Please could you give me a list of the programs that are installed.
  • Start HijackThis
  • Click on the Misc Tools button
  • Click on the Open Uninstall Manager button.
You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 9th, 2008, 10:45 am

mu-torrent removed. New log and list of progs below:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:30:51, on 09/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe
C:\Program Files\Portrait Displays\HP My Display\dthtml.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\WINDOWS\System32\bgsmsnd.exe
C:\Program Files\Mindjet\MindManager 7\MmReminderService.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
C:\Windows\ehome\ehmsas.exe
C:\WINDOWS\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\conime.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\ChessBase\ChessProgram11\ChessProgram11.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mail.asiacapitalre.com/exchweb/ ... /&reason=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\Windows\system32\bgsmsnd.exe
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Palo Alto Software Update Manager 8.0.lnk = C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://uppermark.webex.com/client/T26L ... atgpc1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11532 bytes


___________

and:

2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
Ad-Aware
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Reader 7.1.0
Adobe Shockwave Player 11
Apple Mobile Device Support
Apple Software Update
AudibleManager
BlackBerry Desktop Software 4.2.1
BlackBerry Desktop Software 4.2.1
BlitzIn 2.7
Bonjour
BroadGun pdfMachine
Business Plan Pro 11.0
Camtasia Studio 5
Cogniview PDF2XL Enterprise
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Enhanced Multimedia Keyboard Solution
Fritz 11 Service Pack
Fritz11
Google Earth
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Updater
Hardware Diagnostic Tools
Heinemann Solutionbank Core C3
Heinemann Solutionbank Core C4
HIARCS 11.2 MP UCI
HijackThis 2.0.2
HP Customer Experience Enhancements
HP Customer Feedback
HP Easy Setup - Frontend
HP LaserJet P2010 Series
HP My Display
HP On-Screen Cap/Num/Scroll Lock Indicator
HP Photosmart Essential 2.0
HP Picasso Media Center Add-In
HP Update
Intel(R) Matrix Storage Manager
Intel® Viiv™ Software
iTunes
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
LG USB Modem driver
LG_MobileSync
Lizard Safeguard - PDF Viewer 2.5.77
Marketing Plan Pro 9.0
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB929729)
Microsoft Expression Web
Microsoft Expression Web
Microsoft Expression Web MUI (English)
Microsoft Expression Web Service Pack 1 (SP1)
Microsoft Expression Web Service Pack 1 (SP1)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Professional Plus 2007
Microsoft Office Project 2007 Service Pack 1 (SP1)
Microsoft Office Project 2007 Service Pack 1 (SP1)
Microsoft Office Project MUI (English) 2007
Microsoft Office Project Professional 2007
Microsoft Office Project Professional 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Visio 2007 Service Pack 1 (SP1)
Microsoft Office Visio 2007 Service Pack 1 (SP1)
Microsoft Office Visio MUI (English) 2007
Microsoft Office Visio Professional 2007
Microsoft Office Visio Professional 2007
Microsoft Office Word MUI (English) 2007
Microsoft Outlook Web Access S/MIME
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Mindjet MindManager Pro 7
Mozilla Firefox (3.0.1)
MSVC80_x86
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
muvee autoProducer 6.0
Nokia Connectivity Cable Driver
Nokia Flashing Cable Driver
Nokia Multimedia Factory
Nokia Multimedia Factory
Nokia PC Suite
Nokia PC Suite
Nokia Software Updater
NVIDIA Drivers
Palo Alto Software's Application Manager 8.2
PC Connectivity Solution
Pivot Software
Portrait Professional 6.5
Python 2.4.3
QuickTime
RealPlayer
Realtek High Definition Audio Driver
Roxio Activation Module
Roxio Creator Audio
Roxio Creator Basic v9
Roxio Creator Copy
Roxio Creator Data
Roxio Creator EasyArchive
Roxio Creator Tools
Roxio Express Labeler 3
Roxio MyDVD Basic v9
Safari
SDK
Security Update for Excel 2007 (KB946974)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB951808)
Security Update for Microsoft Office system 2007 (KB951808)
Security Update for Microsoft Office Visio 2007 (KB947590)
Security Update for Microsoft Office Word 2007 (KB950113)
Security Update for Office 2007 (KB947801)
Security Update for Visio 2007 (KB947590)
Shop for HP Supplies
Skype™ 3.6
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy
System Requirements Lab
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Office 2007 (KB946691)
Update for Office 2007 (KB946691)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb953463)
UpperMark, LLC TestBank Level I - September 2008
VideoLAN VLC media player 0.8.6c
Vodei Multimedia Processor 2.10
Windows Driver Package - Nokia Modem (03/05/2008 3.7)
Windows Driver Package - Nokia Modem (03/13/2008 6.86.0.1)
Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)
Windows Live installer
Windows Live Messenger
Windows Live OneCare safety scanner
Windows Live OneCare safety scanner
Windows Live Sign-in Assistant
Windows Media Player Firefox Plugin
WinRAR archiver
Zinio Reader
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 9th, 2008, 11:50 am

Disable Teatimer
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go To the bottom of the Vertical Panel on the Left, Click Tools
  • then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.


Update Adobe Acrobat Reader

There is a newer version of Adobe Acrobat Reader available.
  • Please go to this link Adobe Acrobat Reader Download Link
  • Click Download
  • On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
  • Click the Continue button
  • Click Run, and click Run again
  • Next click the Install Now button and follow the on screen prompts

When the installation is complete go to Add/Remove Programs and uninstall all previous versions.
Remove Programs

Now click Start---Control Panel. Double click Add or Remove Programs (XP) / Programs and Features (Vista) . If any of the following programs are listed there,
click on the program to highlight it, and click on remove.
  • Java(TM) 6 Update 3
    Java(TM) 6 Update 5
Now close the Control Panel.


Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


Download and Run ComboFix
Please delete the copy of ComboFix that you have and download an updated copy from one of the links below
    Please visit this webpage for instructions on using ComboFix:
    http://www.bleepingcomputer.com/combofi ... e-combofix

    ComboFix.exe 1
    ComboFix.exe 2
    ComboFix.exe 3

  • You must download it to and run it from your Desktop
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
ComboFix SHOULD NOT be used unless requested by a forum helper
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 9th, 2008, 3:56 pm

Log files:

Malwarebytes' Anti-Malware 1.24
Database version: 1034
Windows 6.0.6001 Service Pack 1

22:41:42 09/08/2008
mbam-log-8-9-2008 (22-41-42).txt

Scan type: Full Scan (C:\|D:\|J:\|K:\|L:\|)
Objects scanned: 299133
Time elapsed: 2 hour(s), 35 minute(s), 41 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\System32\drivers\downld (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
J:\SOFTWARE UPDATES\WIWRAR\WinRAR.v3.51.WinALL.Cracked-CORE\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.
K:\System Volume Information\_restore{8603B48F-AC5B-4061-BAB0-116D68B94B96}\RP76\A0044394.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

____________

ComboFix log:

ComboFix 08-08-08.08 - HP 2008-08-09 22:46:01.4 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1171 [GMT 3:00]
Running from: C:\Users\HP\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-07-09 to 2008-08-09 )))))))))))))))))))))))))))))))
.

2008-08-09 21:09 . 2008-08-09 21:09 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-09 19:47 . 2008-08-09 19:47 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Users\HP\AppData\Roaming\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 19:34 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\System32\drivers\mbamswissarmy.sys
2008-08-09 19:34 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\System32\drivers\mbam.sys
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\Users\All Users\NOS
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\ProgramData\NOS
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\Program Files\NOS
2008-08-09 18:00 . 2008-08-09 18:00 200,846 --a------ C:\Program Files\RuntimeSetup.exe
2008-08-09 17:59 . 2008-08-09 17:59 <DIR> d-------- C:\Program Files\BPP i-Pass
2008-08-09 17:58 . 2008-08-09 17:59 <DIR> d-------- C:\Program Files\i-assess
2008-08-09 14:16 . 2008-08-09 14:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-09 00:41 . 2008-08-09 06:59 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-08-05 06:08 . 2008-08-05 06:08 <DIR> d-------- C:\Users\All Users\Avg8
2008-08-05 06:08 . 2008-08-05 06:08 <DIR> d-------- C:\ProgramData\Avg8
2008-08-04 13:25 . 2008-08-04 13:25 <DIR> d-------- C:\Users\All Users\Kaspersky Lab Setup Files
2008-08-04 13:25 . 2008-08-04 13:25 <DIR> d-------- C:\ProgramData\Kaspersky Lab Setup Files
2008-08-04 06:38 . 2008-08-04 06:38 <DIR> d-------- C:\Deckard
2008-08-04 00:14 . 2008-08-04 00:14 <DIR> d-------- C:\RootkitNO
2008-08-04 00:14 . 2008-08-04 00:14 123 --a------ C:\WINDOWS\rootkitno.ini
2008-08-03 23:08 . 2008-08-03 23:08 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-03 20:30 . 2008-08-04 00:22 <DIR> d-------- C:\Program Files\UnHackMe
2008-08-03 20:30 . 2008-08-03 20:30 (2) -rahs-ot- C:\WINDOWS\winstart.bat
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iTunes
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iPod
2008-07-25 11:26 . 2008-07-25 11:26 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-07-24 03:01 . 2008-05-27 07:59 106,605 --a------ C:\WINDOWS\System32\StructuredQuerySchema.bin
2008-07-24 03:01 . 2008-05-27 08:17 34,816 --a------ C:\WINDOWS\System32\msscb.dll
2008-07-24 03:01 . 2008-05-27 07:59 18,904 --a------ C:\WINDOWS\System32\StructuredQuerySchemaTrivial.bin
2008-07-24 03:01 . 2008-05-27 08:17 11,776 --a------ C:\WINDOWS\System32\msshooks.dll
2008-07-22 23:13 . 2008-07-22 23:13 <DIR> d-------- C:\Users\HP\AppData\Roaming\dvdcss
2008-07-15 00:06 . 2008-07-15 00:06 <DIR> d-------- C:\Users\HP\AppData\Roaming\Nokia Multimedia Player
2008-07-13 19:19 . 2008-07-13 19:20 <DIR> d-------- C:\Program Files\Microsoft Expression
2008-07-13 19:17 . 2008-07-17 23:58 39 --a------ C:\WINDOWS\vbaddin.ini
2008-07-13 19:16 . 2008-07-13 19:16 162 --a------ C:\WINDOWS\ODBC.INI
2008-07-12 22:22 . 2008-07-12 22:22 <DIR> d-------- C:\Program Files\Bonjour
2008-07-11 19:27 . 2008-06-26 04:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-07-11 19:27 . 2008-06-26 04:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-07-11 19:27 . 2008-06-26 06:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll
2008-07-09 17:45 . 2008-07-09 17:45 <DIR> d-------- C:\swsetup
2008-07-09 17:14 . 2008-04-26 11:25 3,600,952 --a------ C:\WINDOWS\System32\ntkrnlpa.exe
2008-07-09 17:14 . 2008-04-26 11:25 3,549,240 --a------ C:\WINDOWS\System32\ntoskrnl.exe
2008-07-09 17:14 . 2008-04-26 11:26 891,448 --a------ C:\WINDOWS\System32\drivers\tcpip.sys
2008-07-09 17:14 . 2008-04-12 06:32 784,896 --a------ C:\WINDOWS\System32\rpcrt4.dll
2008-07-09 17:14 . 2008-05-10 06:35 564,736 --a------ C:\WINDOWS\System32\emdmgmt.dll
2008-07-09 17:14 . 2008-04-05 04:21 72,192 --a------ C:\WINDOWS\System32\drivers\pacer.sys
2008-07-09 17:14 . 2008-04-05 06:34 15,360 --a------ C:\WINDOWS\System32\pacerprf.dll
2008-07-09 17:11 . 2008-05-09 00:59 430,080 --a------ C:\WINDOWS\System32\vbscript.dll
2008-07-09 17:11 . 2008-05-09 00:59 180,224 --a------ C:\WINDOWS\System32\scrobj.dll
2008-07-09 17:11 . 2008-05-09 00:59 172,032 --a------ C:\WINDOWS\System32\scrrun.dll
2008-07-09 17:11 . 2008-05-09 00:59 155,648 --a------ C:\WINDOWS\System32\wscript.exe
2008-07-09 17:11 . 2008-05-09 00:58 135,168 --a------ C:\WINDOWS\System32\wshom.ocx
2008-07-09 17:11 . 2008-05-09 00:58 135,168 --a------ C:\WINDOWS\System32\cscript.exe
2008-07-09 17:11 . 2008-05-09 00:59 90,112 --a------ C:\WINDOWS\System32\wshext.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-09 19:20 --------- d-----w C:\Users\HP\AppData\Roaming\Skype
2008-08-09 19:06 --------- d-----w C:\Users\HP\AppData\Roaming\ChessBase
2008-08-09 18:30 --------- d-----w C:\Users\HP\AppData\Roaming\skypePM
2008-08-09 16:59 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-09 16:49 --------- d-----w C:\Program Files\Java
2008-08-09 16:46 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-09 16:19 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-08-09 15:00 1,068 ----a-w C:\Program Files\runtimesetup.ini
2008-08-09 14:29 --------- d-----w C:\Users\HP\AppData\Roaming\uTorrent
2008-08-09 11:11 --------- d-----w C:\ProgramData\eMule
2008-08-08 23:16 --------- d-----w C:\ProgramData\Google Updater
2008-08-07 04:00 --------- d-----w C:\ProgramData\Roxio
2008-08-03 13:55 --------- d-----w C:\Program Files\Google
2008-08-02 16:45 --------- d-----w C:\Users\HP\AppData\Roaming\ContentGuard
2008-07-27 14:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-25 08:26 --------- d-----w C:\Program Files\Common Files\Real
2008-07-19 07:49 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-07-10 00:08 --------- d-----w C:\Program Files\Windows Mail
2008-07-09 14:46 --------- d-----w C:\Program Files\HP
2008-07-06 19:46 --------- d-----w C:\Users\HP\AppData\Roaming\Research In Motion
2008-07-06 19:43 --------- d-----w C:\Users\HP\AppData\Roaming\Blackberry Desktop
2008-07-06 19:43 --------- d-----w C:\Program Files\Common Files\Research In Motion
2008-07-06 19:42 --------- d-----w C:\Program Files\Research In Motion
2008-07-05 19:08 --------- d-----w C:\ProgramData\LzG24
2008-07-05 19:06 --------- d-----w C:\Program Files\UpperMark, LLC
2008-07-05 18:48 --------- d-----w C:\ProgramData\WebEx
2008-07-05 18:14 --------- d-----w C:\Program Files\Safari
2008-07-03 20:57 --------- d-----w C:\Program Files\Vodei
2008-06-22 20:42 --------- d-----w C:\ProgramData\Nokia
2008-06-22 20:41 --------- d-----w C:\Program Files\Nokia
2008-06-22 20:40 --------- d-----w C:\ProgramData\Installations
2008-06-22 20:40 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 20:26 --------- d-----w C:\Users\HP\AppData\Roaming\Nokia
2008-06-22 20:17 0 ---ha-w C:\Windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-06-22 15:13 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-22 11:37 --------- d-----w C:\Program Files\DivX
2008-06-21 07:48 --------- d-----w C:\Program Files\QuickTime
2008-06-20 07:38 174 --sha-w C:\Program Files\desktop.ini
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Defender
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Calendar
2008-06-20 06:53 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-20 06:53 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-14 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\ProgramData\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Common Files\Palo Alto Software
2008-06-14 09:59 --------- d-----w C:\Users\HP\AppData\Roaming\bppenu11
2008-06-14 09:56 --------- d-----w C:\Program Files\Business Plan Pro
2008-06-14 09:30 --------- d-----w C:\ProgramData\IsolatedStorage
2008-06-13 20:10 --------- d-----w C:\Program Files\Common Files\Intuit
2008-06-13 20:04 --------- d-----w C:\ProgramData\PAS
2008-06-13 16:56 --------- d-----w C:\Program Files\QMwin32
2008-06-13 16:54 --------- d-----w C:\Users\HP\AppData\Roaming\SUPERAntiSpyware.com
2008-06-13 16:54 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-06-13 16:54 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\ESET
2008-06-11 21:10 --------- d-----w C:\ProgramData\ESET
2008-06-11 17:38 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-06-11 16:18 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-11 04:16 --------- d-----w C:\ProgramData\Lavasoft
2008-06-11 04:12 --------- d-----w C:\Program Files\Lavasoft
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-16 08:58 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2008-05-10 03:35 885,248 ----a-w C:\Windows\System32\RacEngn.dll
2008-01-08 17:32 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-08 17:32 32 ----a-w C:\ProgramData\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot_2008-08-04_ 0.10.26.77 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-20 13:04:32 1,523,536 ----a-w C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
+ 2008-03-24 16:33:02 1,527,056 ----a-w C:\Windows\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
+ 2008-08-09 18:09:20 27,136 ----a-r C:\Windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2007-12-12 12:06:42 295,606 ----a-r C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe
+ 2008-08-09 16:59:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-09 16:59:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-03 21:05:06 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-09 17:01:45 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-09 17:01:45 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-03 21:05:05 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-09 17:01:40 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-09 17:01:40 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-03 13:52:21 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-08 23:16:31 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-03 13:52:21 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-08 23:16:31 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-03 13:52:21 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-08 23:16:31 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-03 20:59:30 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-09 19:45:47 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
- 2008-07-26 17:12:00 1,787,576 ----a-w C:\Windows\System32\FNTCACHE.DAT
+ 2008-08-09 17:00:12 1,787,608 ----a-w C:\Windows\System32\FNTCACHE.DAT
+ 2008-03-25 02:32:44 218,496 ----a-r C:\Windows\System32\Macromed\Flash\FlashUtil9f.exe
- 2008-01-12 16:20:49 74,649 ----a-w C:\Windows\System32\Macromed\Flash\uninstall_activeX.exe
+ 2008-08-09 17:54:21 74,649 ----a-w C:\Windows\System32\Macromed\Flash\uninstall_activeX.exe
- 2008-08-03 20:12:06 112,482 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-08-09 17:06:26 112,482 ----a-w C:\Windows\System32\perfc009.dat
- 2008-08-03 20:12:06 633,748 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-08-09 17:06:26 633,748 ----a-w C:\Windows\System32\perfh009.dat
- 2008-07-26 16:46:07 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2008-08-09 16:58:19 6,553,600 ----a-w C:\Windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2008-08-03 20:07:17 12,212 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
+ 2008-08-09 17:01:47 12,522 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
- 2008-08-03 20:07:17 71,250 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-09 17:01:46 71,330 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-07-10 00:08:51 3,296 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
+ 2008-08-05 20:03:51 3,296 ----a-w C:\Windows\System32\WDI\ERCQueuedResolutions.dat
- 2008-08-03 20:07:16 38,558 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-09 17:01:45 39,286 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-08-03 13:27:16 258,382 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
+ 2008-08-06 15:46:43 264,886 ----a-w C:\Windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_FastS4.bin
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-01-26 09:03 708616]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 19:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-04-20 04:11 151552]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe" [2007-04-25 12:36 280064]
"bgsmsnd.exe"="C:\Windows\system32\bgsmsnd.exe" [2007-11-19 10:36 160136]
"MMReminderService"="C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 00:05 37392]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-28 01:59 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-28 01:59 8473120]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-28 01:59 81920]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\WINDOWS\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Palo Alto Software Update Manager 8.0.lnk - C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe [2007-02-13 12:03:24 128544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= CSvidcap.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkAndWrite]
--a------ 2008-01-08 20:35 3042816 C:\ProgramData\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-129870416-3998998155-2461932588-1001]
"EnableNotificationsRef"=dword:0000000d

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1A3EA7E0-A4D1-4C19-8BD7-2FBD264B5800}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{7C735085-2FAD-4ADD-A184-E575311E89A0}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{9A38C7EF-1246-4FD5-8843-70D2FC847E05}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{81950DC3-AD62-4E1F-95B4-8AC89341A0C2}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{165AFFE7-FE9D-49F4-B47F-1B05900509D2}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C0D7782C-5D7E-4B08-A3B4-425EDAAF89D7}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C2B7AB0D-1548-45EC-88B5-33987CF45DFD}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{01ED933C-0271-40A0-8C39-D5ACEE0BED29}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{A4694F55-3626-4D97-8288-295CD7EA0996}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{10BC16D9-DCFE-4191-A65D-B6745EFA19BA}C:\\program files\\emule\\emule.exe"= UDP:C:\program files\emule\emule.exe:eMule
"UDP Query User{787E827F-22CD-4453-B0FB-B4ECAA26F83D}C:\\program files\\emule\\emule.exe"= TCP:C:\program files\emule\emule.exe:eMule
"TCP Query User{EE7CA935-49AC-4206-8CF8-6E73A3F30601}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{2690BC7D-4D6B-4A33-97D4-245F895F3708}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{68B81E44-17D9-456F-8947-F6B937B310EF}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{F6A8C056-496D-4CEC-AA2B-B1518BE8AE52}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{80B60DBF-0BCD-4898-998E-EF19580E00BB}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= UDP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"UDP Query User{A94388A6-96D8-4841-A37B-CA108FD5A3AA}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= TCP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"TCP Query User{7BD034ED-36D4-471C-B4EF-79DFE83AE717}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{9F6D97C0-BFE5-44B9-86C5-33B6BC06AC69}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{39AF88C6-EAC6-46EB-8629-3D6E5B7DD68D}"= UDP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{918F7C24-97BA-43BB-898C-7477E0C44187}"= TCP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{7077CF36-3130-4CBB-8C1C-809E6B96F867}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{018D8C02-EF30-4495-963B-06C85F4FC1A4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{4CEC7DC3-758E-4FD3-8220-3E2962F4BF6B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0CF80992-1672-47B0-9081-AF3C09EE50BF}"= UDP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7
"{61A61DFC-240C-491E-8CDF-D8CA7339B740}"= TCP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7

R2 DQLWinService;DQLWinService;C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 20:32]
R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2007-08-31 16:46]
R3 MBAMSwissArmy;MBAMSwissArmy;C:\Windows\system32\drivers\mbamswissarmy.sys [2008-07-30 20:07]
S2 IntelDHSvcConf;Intel DH Service;C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-05-10 19:13]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-06-26 10:24]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{066bb7ba-42d0-11dd-8c1f-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a509a1b-5567-11dd-afb0-001bfce08336}]
\shell\AutoRun\command - N:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d5af417-50f8-11dd-b8c6-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a65643eb-0b02-11dd-8803-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a656440c-0b02-11dd-8803-001bfce08336}]
\shell\AutoRun\command - L:\8ng8w.com
\shell\explore\Command - L:\8ng8w.com
\shell\open\Command - L:\8ng8w.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa1e5ca0-b147-11dc-8e41-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb1e38cf-c995-11dc-b7cd-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d841311f-d0c7-11dc-a10d-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

*Newly Created Service* - MBAMSWISSARMY
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\HP\AppData\Roaming\Mozilla\Firefox\Profiles\b6l9gxoz.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com.bh/
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1265.1931\npCIDetect12.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Microsoft Silverlight\2.0.30523.8\npctrl.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np32asw.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npdbplug.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-09 22:49:08
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\Portrait Displays\Pivot Software\winphook.dll
.
Completion time: 2008-08-09 22:50:45
ComboFix-quarantined-files.txt 2008-08-09 19:50:14
ComboFix2.txt 2008-08-03 21:31:56
ComboFix3.txt 2008-08-03 21:11:40
ComboFix4.txt 2008-06-11 18:05:31

Pre-Run: 105,810,448,384 bytes free
Post-Run: 105,898,975,232 bytes free

353 --- E O F --- 2008-07-24 00:02:15

______________________

HijackThis log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:55:09, on 09/08/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\WINDOWS\RtHDVCpl.exe
C:\Program Files\Portrait Displays\Pivot Software\wpCtrl.exe
C:\Program Files\Portrait Displays\HP My Display\dthtml.exe
C:\WINDOWS\System32\bgsmsnd.exe
C:\Program Files\Mindjet\MindManager 7\MmReminderService.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
C:\Windows\ehome\ehmsas.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\hp\kbd\kbd.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\System32\rundll32.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\conime.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://mail.asiacapitalre.com/exchweb/ ... /&reason=0
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: pdfMachine - {56CF4856-ECB4-4e46-A897-A378821F97B9} - C:\Windows\system32\bgstb.dll
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [CCUTRAYICON] FactoryMode
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT HPW] C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [bgsmsnd.exe] C:\Windows\system32\bgsmsnd.exe
O4 - HKLM\..\Run: [MMReminderService] C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')
O4 - Global Startup: Palo Alto Software Update Manager 8.0.lnk = C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MIC273~1\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resour ... cctrl2.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDow ... eqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDow ... rtScan.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.co ... nos/gp.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://uppermark.webex.com/client/T26L ... atgpc1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Intel(R) Alert Service (AlertService) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\CCU\AlertService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DQLWinService - Unknown owner - C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel DH Service (IntelDHSvcConf) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel(R) Software Services Manager (ISSM) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\ISSM.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel(R) Viiv(TM) Media Server (M1 Server) - Unknown owner - C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe
O23 - Service: Intel(R) Application Tracker (MCLServiceATL) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\MCLServiceATL.exe
O23 - Service: Intel(R) Remoting Service (Remote UI Service) - Intel(R) Corporation - C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11742 bytes
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 10th, 2008, 8:05 am

Disable Teatimer
First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go To the bottom of the Vertical Panel on the Left, Click Tools
  • then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.


Custom CFScript
  • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

    Code: Select all
    File::
    L:\8ng8w.com
    Folder::
    C:\Users\HP\AppData\Roaming\uTorrent
    C:\ProgramData\eMule
    C:\program files\emule
    
    Registry::
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"=-
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Adobe Reader Speed Launcher"=-
    "SunJavaUpdateSched"=-
    
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
    "TCP Query User{10BC16D9-DCFE-4191-A65D-B6745EFA19BA}C:\\program files\\emule\\emule.exe"=-
    "UDP Query User{787E827F-22CD-4453-B0FB-B4ECAA26F83D}C:\\program files\\emule\\emule.exe"=-
    
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a656440c-0b02-11dd-8803-001bfce08336}]
    
    

  • Save this as CFScript.txt and place it on your desktop.


    Image


  • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
  • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
  • When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper




Please note:- Due to the restrictions on Vista, all tools should be started by Right-Click >>> Run As Administrator
Fix With HJT

Close all other windows and then start HiJack This
Click Do A System Scan Only
When it has finished scanning put a check next to the following lines IF still present
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~3.0_0\bin\ssv.dll

- Close ALL open windows (especially Internet Explorer!)-
Now click Fix checked
Click yes to any prompts
Close HijackThis




Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)

NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partne ... bscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs.
  • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 10th, 2008, 11:57 pm

Logs:

ComboFix 08-08-09.06 - HP 2008-08-10 16:40:56.5 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.1409 [GMT 3:00]
Running from: C:\Users\HP\Desktop\ComboFix.exe
Command switches used :: C:\Users\HP\Desktop\CFScript.txt
* Created a new restore point

FILE ::
L:\8ng8w.com
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\eMule
C:\Users\HP\AppData\Roaming\uTorrent
C:\Users\HP\AppData\Roaming\uTorrent\A Sperm-Load a Day Part 1.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Andy McKee.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Anouar Brahem - Le pas du cat noir.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Brian Kennedy - A Better Man [1996].torrent
C:\Users\HP\AppData\Roaming\uTorrent\Brian Kennedy - Now That I Know What I Want [Bonus Tracks].torrent
C:\Users\HP\AppData\Roaming\uTorrent\ecm.torrent
C:\Users\HP\AppData\Roaming\uTorrent\fairytale.avi.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Luz Casal - Vida Toxica - 2007 (Etmusica.com).rar.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Microsoft OFFICE 2007 [FULL] + SERIAL KEYS.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Microsoft Office 2007 Complete Third Edition.torrent
C:\Users\HP\AppData\Roaming\uTorrent\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Runrig - Everything You See (2007).rar.torrent
C:\Users\HP\AppData\Roaming\uTorrent\Runrig - Year Of The Flood (2008) - Celtic [www.torrentazos.com].torrent
C:\Users\HP\AppData\Roaming\uTorrent\The Motels - Essential Collection.torrent
C:\Windows\system32\drivers\downld

.
((((((((((((((((((((((((( Files Created from 2008-07-10 to 2008-08-10 )))))))))))))))))))))))))))))))
.

2008-08-10 16:38 . 2008-08-10 16:40 <DIR> d-------- C:\327882R2FWJFW
2008-08-09 21:09 . 2008-08-09 21:09 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-09 19:47 . 2008-08-09 19:47 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Users\HP\AppData\Roaming\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-09 19:34 . 2008-08-09 19:34 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-09 19:34 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\System32\drivers\mbamswissarmy.sys
2008-08-09 19:34 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\System32\drivers\mbam.sys
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\Users\All Users\NOS
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\ProgramData\NOS
2008-08-09 19:23 . 2008-08-09 19:23 <DIR> d-------- C:\Program Files\NOS
2008-08-09 18:00 . 2008-08-09 18:00 200,846 --a------ C:\Program Files\RuntimeSetup.exe
2008-08-09 17:59 . 2008-08-09 17:59 <DIR> d-------- C:\Program Files\BPP i-Pass
2008-08-09 17:58 . 2008-08-09 17:59 <DIR> d-------- C:\Program Files\i-assess
2008-08-09 14:16 . 2008-08-09 14:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-09 00:41 . 2008-08-09 06:59 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-08-05 06:08 . 2008-08-05 06:08 <DIR> d-------- C:\Users\All Users\Avg8
2008-08-05 06:08 . 2008-08-05 06:08 <DIR> d-------- C:\ProgramData\Avg8
2008-08-04 13:25 . 2008-08-04 13:25 <DIR> d-------- C:\Users\All Users\Kaspersky Lab Setup Files
2008-08-04 13:25 . 2008-08-04 13:25 <DIR> d-------- C:\ProgramData\Kaspersky Lab Setup Files
2008-08-04 06:38 . 2008-08-04 06:38 <DIR> d-------- C:\Deckard
2008-08-04 00:14 . 2008-08-04 00:14 <DIR> d-------- C:\RootkitNO
2008-08-04 00:14 . 2008-08-04 00:14 123 --a------ C:\WINDOWS\rootkitno.ini
2008-08-03 23:08 . 2008-08-03 23:08 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-03 20:30 . 2008-08-04 00:22 <DIR> d-------- C:\Program Files\UnHackMe
2008-08-03 20:30 . 2008-08-03 20:30 (2) -rahs-ot- C:\WINDOWS\winstart.bat
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iTunes
2008-08-01 23:47 . 2008-08-01 23:47 <DIR> d-------- C:\Program Files\iPod
2008-07-25 11:26 . 2008-07-25 11:26 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-07-24 03:01 . 2008-05-27 07:59 106,605 --a------ C:\WINDOWS\System32\StructuredQuerySchema.bin
2008-07-24 03:01 . 2008-05-27 08:17 34,816 --a------ C:\WINDOWS\System32\msscb.dll
2008-07-24 03:01 . 2008-05-27 07:59 18,904 --a------ C:\WINDOWS\System32\StructuredQuerySchemaTrivial.bin
2008-07-24 03:01 . 2008-05-27 08:17 11,776 --a------ C:\WINDOWS\System32\msshooks.dll
2008-07-22 23:13 . 2008-07-22 23:13 <DIR> d-------- C:\Users\HP\AppData\Roaming\dvdcss
2008-07-15 00:06 . 2008-07-15 00:06 <DIR> d-------- C:\Users\HP\AppData\Roaming\Nokia Multimedia Player
2008-07-13 19:19 . 2008-07-13 19:20 <DIR> d-------- C:\Program Files\Microsoft Expression
2008-07-13 19:17 . 2008-07-17 23:58 39 --a------ C:\WINDOWS\vbaddin.ini
2008-07-13 19:16 . 2008-07-13 19:16 162 --a------ C:\WINDOWS\ODBC.INI
2008-07-12 22:22 . 2008-07-12 22:22 <DIR> d-------- C:\Program Files\Bonjour
2008-07-11 19:27 . 2008-06-26 04:45 12,240,896 --a------ C:\WINDOWS\System32\NlsLexicons0007.dll
2008-07-11 19:27 . 2008-06-26 04:45 2,644,480 --a------ C:\WINDOWS\System32\NlsLexicons0009.dll
2008-07-11 19:27 . 2008-06-26 06:29 801,280 --a------ C:\WINDOWS\System32\NaturalLanguage6.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-10 13:07 --------- d-----w C:\ProgramData\Spybot - Search & Destroy
2008-08-10 13:05 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-10 00:17 --------- d-----w C:\ProgramData\Google Updater
2008-08-09 19:20 --------- d-----w C:\Users\HP\AppData\Roaming\Skype
2008-08-09 19:06 --------- d-----w C:\Users\HP\AppData\Roaming\ChessBase
2008-08-09 18:30 --------- d-----w C:\Users\HP\AppData\Roaming\skypePM
2008-08-09 16:49 --------- d-----w C:\Program Files\Java
2008-08-09 16:46 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-09 15:00 1,068 ----a-w C:\Program Files\runtimesetup.ini
2008-08-07 04:00 --------- d-----w C:\ProgramData\Roxio
2008-08-03 13:55 --------- d-----w C:\Program Files\Google
2008-08-02 16:45 --------- d-----w C:\Users\HP\AppData\Roaming\ContentGuard
2008-07-27 14:13 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-25 08:26 --------- d-----w C:\Program Files\Common Files\Real
2008-07-19 07:49 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-07-10 00:08 --------- d-----w C:\Program Files\Windows Mail
2008-07-09 14:46 --------- d-----w C:\Program Files\HP
2008-07-06 19:46 --------- d-----w C:\Users\HP\AppData\Roaming\Research In Motion
2008-07-06 19:43 --------- d-----w C:\Users\HP\AppData\Roaming\Blackberry Desktop
2008-07-06 19:43 --------- d-----w C:\Program Files\Common Files\Research In Motion
2008-07-06 19:42 --------- d-----w C:\Program Files\Research In Motion
2008-07-05 19:08 --------- d-----w C:\ProgramData\LzG24
2008-07-05 19:06 --------- d-----w C:\Program Files\UpperMark, LLC
2008-07-05 18:48 --------- d-----w C:\ProgramData\WebEx
2008-07-05 18:14 --------- d-----w C:\Program Files\Safari
2008-07-03 20:57 --------- d-----w C:\Program Files\Vodei
2008-06-22 20:42 --------- d-----w C:\ProgramData\Nokia
2008-06-22 20:41 --------- d-----w C:\Program Files\Nokia
2008-06-22 20:40 --------- d-----w C:\ProgramData\Installations
2008-06-22 20:40 --------- d-----w C:\Program Files\Common Files\Nokia
2008-06-22 20:26 --------- d-----w C:\Users\HP\AppData\Roaming\Nokia
2008-06-22 20:17 0 ---ha-w C:\Windows\system32\drivers\Msft_User_PCCSWpdDriver_01_05_00.Wdf
2008-06-22 15:13 0 ---ha-w C:\Windows\system32\drivers\Msft_User_WpdFs_01_00_00.Wdf
2008-06-22 11:37 --------- d-----w C:\Program Files\DivX
2008-06-21 07:48 --------- d-----w C:\Program Files\QuickTime
2008-06-20 07:38 174 --sha-w C:\Program Files\desktop.ini
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Sidebar
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Photo Gallery
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Defender
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Collaboration
2008-06-20 07:30 --------- d-----w C:\Program Files\Windows Calendar
2008-06-20 06:53 82,432 ----a-w C:\Windows\System32\axaltocm.dll
2008-06-20 06:53 101,888 ----a-w C:\Windows\System32\ifxcardm.dll
2008-06-14 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\ProgramData\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Palo Alto Software
2008-06-14 21:09 --------- d-----w C:\Program Files\Common Files\Palo Alto Software
2008-06-14 09:59 --------- d-----w C:\Users\HP\AppData\Roaming\bppenu11
2008-06-14 09:56 --------- d-----w C:\Program Files\Business Plan Pro
2008-06-14 09:30 --------- d-----w C:\ProgramData\IsolatedStorage
2008-06-13 20:10 --------- d-----w C:\Program Files\Common Files\Intuit
2008-06-13 20:04 --------- d-----w C:\ProgramData\PAS
2008-06-13 16:56 --------- d-----w C:\Program Files\QMwin32
2008-06-13 16:54 --------- d-----w C:\Users\HP\AppData\Roaming\SUPERAntiSpyware.com
2008-06-13 16:54 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-06-13 16:54 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-11 21:11 --------- d-----w C:\Users\HP\AppData\Roaming\ESET
2008-06-11 21:10 --------- d-----w C:\ProgramData\ESET
2008-06-11 17:38 --------- d-----w C:\ProgramData\SUPERAntiSpyware.com
2008-06-11 16:18 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-06-11 04:16 --------- d-----w C:\ProgramData\Lavasoft
2008-06-11 04:12 --------- d-----w C:\Program Files\Lavasoft
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-05-30 23:22 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-05-30 23:22 815,104 ----a-w C:\Windows\System32\divx_xx0a.dll
2008-05-30 23:22 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-05-30 23:22 683,520 ----a-w C:\Windows\System32\DivX.dll
2008-05-30 23:22 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-05-30 23:22 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-05-30 23:22 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-05-30 23:22 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-05-30 23:22 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-05-27 05:21 1,582,592 ----a-w C:\Windows\System32\tquery.dll
2008-05-27 05:21 1,418,240 ----a-w C:\Windows\System32\mssrch.dll
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\SearchFilterHost.exe
2008-05-27 05:17 87,552 ----a-w C:\Windows\System32\mssitlb.dll
2008-05-27 05:17 754,176 ----a-w C:\Windows\System32\propsys.dll
2008-05-27 05:17 60,416 ----a-w C:\Windows\System32\msscntrs.dll
2008-05-27 05:17 6,103,040 ----a-w C:\Windows\System32\chtbrkr.dll
2008-05-27 05:17 32,768 ----a-w C:\Windows\System32\mssprxy.dll
2008-05-27 05:17 313,344 ----a-w C:\Windows\System32\thawbrkr.dll
2008-05-27 05:17 301,568 ----a-w C:\Windows\System32\srchadmin.dll
2008-05-27 05:17 194,560 ----a-w C:\Windows\System32\offfilt.dll
2008-05-27 05:17 143,872 ----a-w C:\Windows\System32\korwbrkr.dll
2008-05-27 05:17 1,671,680 ----a-w C:\Windows\System32\chsbrkr.dll
2008-05-22 22:22 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-05-22 22:22 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-05-22 22:20 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-05-22 22:20 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-05-22 22:19 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-05-22 22:19 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-05-22 22:19 161,096 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-05-22 22:18 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2008-05-16 08:58 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2008-05-10 03:35 885,248 ----a-w C:\Windows\System32\RacEngn.dll
2008-05-10 03:35 564,736 ----a-w C:\Windows\System32\emdmgmt.dll
2008-01-08 17:32 32 ----a-w C:\Users\All Users\ezsid.dat
2008-01-08 17:32 32 ----a-w C:\ProgramData\ezsid.dat
.

((((((((((((((((((((((((((((( snapshot_2008-08-09_22.49.34.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-09 16:59:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-10 13:28:47 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-08-09 16:59:45 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-08-10 13:28:47 2,048 --sha-w C:\Windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-08-09 17:01:45 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-10 13:31:15 262,144 --sha-w C:\Windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-08-10 13:31:15 262,144 ---ha-w C:\Windows\ServiceProfiles\LocalService\ntuser.dat.LOG1
- 2008-08-09 17:01:40 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-10 13:31:10 262,144 --sha-w C:\Windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-08-10 13:31:10 262,144 ---ha-w C:\Windows\ServiceProfiles\NetworkService\ntuser.dat.LOG1
- 2008-08-08 23:16:31 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-08-10 00:16:50 16,384 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-08-08 23:16:31 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-10 00:16:50 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-08-08 23:16:31 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-08-10 00:16:50 32,768 --sha-w C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-08-09 19:45:47 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-10 13:40:51 262,144 ----a-w C:\Windows\System32\config\systemprofile\ntuser.dat
+ 2008-08-10 13:40:51 262,144 ---ha-w C:\Windows\System32\config\systemprofile\ntuser.dat.LOG1
- 2008-08-09 17:06:26 112,482 ----a-w C:\Windows\System32\perfc009.dat
+ 2008-08-10 13:33:16 112,482 ----a-w C:\Windows\System32\perfc009.dat
- 2008-08-09 17:06:26 633,748 ----a-w C:\Windows\System32\perfh009.dat
+ 2008-08-10 13:33:16 633,748 ----a-w C:\Windows\System32\perfh009.dat
- 2008-08-09 17:01:47 12,522 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
+ 2008-08-10 13:30:37 12,680 ----a-w C:\Windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-129870416-3998998155-2461932588-1001_UserData.bin
- 2008-08-09 17:01:46 71,330 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-08-10 13:30:37 71,330 ----a-w C:\Windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-08-09 17:01:45 39,286 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-08-10 13:30:36 39,508 ----a-w C:\Windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]
"PC Suite Tray"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-03-28 11:20 1079296]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe" [2008-03-26 18:41 1232896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CCUTRAYICON"="FactoryMode" [X]
"KBD"="C:\HP\KBD\KbdStub.EXE" [2006-12-08 19:16 65536]
"OsdMaestro"="C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 13:59 118784]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-04-20 04:11 151552]
"PivotSoftware"="C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 12:17 694008]
"DT HPW"="C:\Program Files\Portrait Displays\HP My Display\DTHtml.exe" [2007-04-25 12:36 280064]
"bgsmsnd.exe"="C:\Windows\system32\bgsmsnd.exe" [2007-11-19 10:36 160136]
"MMReminderService"="C:\Program Files\Mindjet\MindManager 7\MMReminderService.exe" [2007-05-18 00:05 37392]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-08-28 01:59 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-08-28 01:59 8473120]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-08-28 01:59 81920]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 11:26 4874240 C:\WINDOWS\RtHDVCpl.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 02:17 55824 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2008-03-26 18:41 1232896]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Palo Alto Software Update Manager 8.0.lnk - C:\Program Files\Common Files\Palo Alto Software\8.0\PAS8_UD.exe [2007-02-13 12:03:24 128544]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= CSvidcap.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TalkAndWrite]
--a------ 2008-01-08 20:35 3042816 C:\ProgramData\Skype\Plugins\Plugins\1163D2B46CC742E5A3CC9E4157887751\TalkAndWrite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-129870416-3998998155-2461932588-1001]
"EnableNotificationsRef"=dword:0000000e

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1A3EA7E0-A4D1-4C19-8BD7-2FBD264B5800}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{7C735085-2FAD-4ADD-A184-E575311E89A0}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\TSHWMDTCP.exe:SPCM
"{9A38C7EF-1246-4FD5-8843-70D2FC847E05}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{81950DC3-AD62-4E1F-95B4-8AC89341A0C2}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Media Server\bin\mediaserver.exe:Intel(R) Viiv(TM) Media Server
"{165AFFE7-FE9D-49F4-B47F-1B05900509D2}"= UDP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C0D7782C-5D7E-4B08-A3B4-425EDAAF89D7}"= TCP:C:\Program Files\Intel\IntelDH\Intel Media Server\Shells\Remote UI Service.exe:Intel(R) Remoting Service
"{C2B7AB0D-1548-45EC-88B5-33987CF45DFD}"= TCP:9442:127.0.0.1:Intel(R) Viiv(TM) Media Server Discovery
"{01ED933C-0271-40A0-8C39-D5ACEE0BED29}"= TCP:1900:LocalSubnet:LocalSubnet:Intel(R) Viiv(TM) Media Server UPnP Discovery
"{A4694F55-3626-4D97-8288-295CD7EA0996}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"TCP Query User{EE7CA935-49AC-4206-8CF8-6E73A3F30601}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{2690BC7D-4D6B-4A33-97D4-245F895F3708}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{68B81E44-17D9-456F-8947-F6B937B310EF}C:\\program files\\real\\realplayer\\realplay.exe"= UDP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{F6A8C056-496D-4CEC-AA2B-B1518BE8AE52}C:\\program files\\real\\realplayer\\realplay.exe"= TCP:C:\program files\real\realplayer\realplay.exe:RealPlayer
"TCP Query User{80B60DBF-0BCD-4898-998E-EF19580E00BB}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= UDP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"UDP Query User{A94388A6-96D8-4841-A37B-CA108FD5A3AA}C:\\program files\\internet chess club\\blitzin 2.6\\blitzin26.exe"= TCP:C:\program files\internet chess club\blitzin 2.6\blitzin26.exe:BlitzIn 2.5 ICC Client
"TCP Query User{7BD034ED-36D4-471C-B4EF-79DFE83AE717}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"UDP Query User{9F6D97C0-BFE5-44B9-86C5-33B6BC06AC69}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath
"{39AF88C6-EAC6-46EB-8629-3D6E5B7DD68D}"= UDP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{918F7C24-97BA-43BB-898C-7477E0C44187}"= TCP:C:\WINDOWS\System32\spool\drivers\w32x86\3\HP2014MC.EXE:SMLMProxy Module - HP2014MC.EXE
"{7077CF36-3130-4CBB-8C1C-809E6B96F867}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{018D8C02-EF30-4495-963B-06C85F4FC1A4}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{4CEC7DC3-758E-4FD3-8220-3E2962F4BF6B}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{0CF80992-1672-47B0-9081-AF3C09EE50BF}"= UDP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7
"{61A61DFC-240C-491E-8CDF-D8CA7339B740}"= TCP:C:\Program Files\Internet Chess Club\BlitzIn 2.7\BlitzIn27.exe:BlitzIn 2.7

R2 DQLWinService;DQLWinService;C:\Program Files\Common Files\Intel\IntelDH\NMS\AdpPlugins\DQLWinService.exe [2006-09-03 20:32]
S2 IntelDHSvcConf;Intel DH Service;C:\Program Files\Intel\IntelDH\Intel Media Server\Tools\IntelDHSvcConf.exe [2006-05-10 19:13]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-06-26 10:24]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{066bb7ba-42d0-11dd-8c1f-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3a509a1b-5567-11dd-afb0-001bfce08336}]
\shell\AutoRun\command - N:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5d5af417-50f8-11dd-b8c6-001bfce08336}]
\shell\AutoRun\command - M:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a65643eb-0b02-11dd-8803-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{aa1e5ca0-b147-11dc-8e41-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cb1e38cf-c995-11dc-b7cd-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d841311f-d0c7-11dc-a10d-001bfce08336}]
\shell\AutoRun\command - L:\LaunchU3.exe -a
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-10 16:43:40
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-10 16:45:15
ComboFix-quarantined-files.txt 2008-08-10 13:44:46
ComboFix2.txt 2008-08-09 19:50:47
ComboFix3.txt 2008-08-03 21:31:56
ComboFix4.txt 2008-08-03 21:11:40
ComboFix5.txt 2008-08-10 13:40:10

Pre-Run: 107,324,784,640 bytes free
Post-Run: 107,286,519,808 bytes free

321 --- E O F --- 2008-07-24 00:02:15

_______________

Kaspersky Log


--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, August 11, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, August 10, 2008 14:19:24
Records in database: 1078892
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\

Scan statistics:
Files scanned: 278462
Threat name: 11
Infected objects: 53
Suspicious objects: 0
Duration of the scan: 09:23:06


File name / Threat name / Threats count
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar Infected: Trojan.SymbOS.Blocker.a 1
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL Infected: Trojan.SymbOS.Blocker.a 1
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst Infected: Email-Worm.Win32.NetSky.q 1
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst Infected: Email-Worm.Win32.Mydoom.l 1
C:\BNL BACKUP\MAIL BACKUP\MAIL\backup2008.06 BNL.pst Infected: Trojan-Spy.HTML.Chasfraud.g 1
C:\Program Files\Spybot - Search & Destroy\VMLCJJL.scr Infected: Trojan-Downloader.Win32.Bagle.wv 1
C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\downld\11817793.exe.vir Infected: Email-Worm.Win32.Bagle.of 1
C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\downld\11821942.exe.vir Infected: Email-Worm.Win32.Bagle.of 1
C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\hldrrr.exe.vir Infected: Trojan-Downloader.Win32.Bagle.wv 1
C:\QooBox\Quarantine\Registry_backups\Legacy_SROSA.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp 1
C:\QooBox\Quarantine\Registry_backups\Service_srosa.reg.dat Infected: Trojan-Downloader.Win32.Bagle.hp 1
C:\Users\HP\AppData\Local\Microsoft\Outlook\Outlook.pst Infected: Trojan-Spy.HTML.Chasfraud.g 1
J:\EMULE\TEMP\018.part Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm 1
J:\EMULE\NEW INCOMING\DivX.Pro.v6.5.Incl.Keygen-SSG.rar Infected: not-a-virus:PSWTool.Win32.GetPass.h 1
J:\EMULE\NEW INCOMING\NoClone Enterprise Edition 4.1.27.zip Infected: Trojan-Downloader.Win32.Bagle.wv 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD16-Alternative Investments\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD15-Derivatives\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD14-Fixed Income Securities 2\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD13-Fixed Income Securities 1\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD12-Securities Markets and Equity Investments\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD11-Portfolio Management and Securities Markets\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD9-Financial Statement Analysis 4\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD8-Financial Statement Analysis 3\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD7-Financial Statement Analysis 2\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD6-Financial Statement Analysis 1\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD5-Economics 2\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD4-Economics 1\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD3-Quantitative Methods 2\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD2-Quantitative Methods 1\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD10-Corporate Finance\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD1-Ethics and GIPS\jukebox\setup.exe Infected: Trojan-Banker.Win32.Banbra.bxt 1
J:\SOFTWARE UPDATES\DivX\SSG-Keygen.exe Infected: not-a-virus:PSWTool.Win32.GetPass.h 1
J:\SOFTWARE UPDATES\NOCLONE\NoClone Enterprise Edition 4.1.27.exe Infected: Trojan-Downloader.Win32.Bagle.wv 1
K:\BACKUP D\EMULE\TEMP\018.part Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm 1
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar Infected: Trojan.SymbOS.Blocker.a 1
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL Infected: Trojan.SymbOS.Blocker.a 1
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst Infected: Email-Worm.Win32.NetSky.q 1
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst Infected: Email-Worm.Win32.Mydoom.l 1
K:\BNL BACKUP\MAIL BACKUP\MAIL\backup2008.06 BNL.pst Infected: Trojan-Spy.HTML.Chasfraud.g 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part01.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part02.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part03.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part04.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part05.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part06.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part07.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part08.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part09.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part10.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part11.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part12.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part13.rar Infected: Trojan.Win32.Inject.dfq 1
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part14.rar Infected: Trojan.Win32.Inject.dfq 1

The selected area was scanned.
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 11th, 2008, 5:10 am

Re.
J:\EMULE\NEW INCOMING\DivX.Pro.v6.5.Incl.Keygen-SSG.rar --> PSWTool.Win32.GetPass.h 1
J:\SOFTWARE UPDATES\DivX\SSG-Keygen.exe --> PSWTool.Win32.GetPass.h 1



I can't provide help for those using any form of cracked software or Operating Systems.

In doing the crack, the 'cracker' has broken the 'End User Licence Agreement' (EULA) of the product.
The distribution and use of cracked copies is illegal in almost every developed country.
They are also one of the biggest causes of infection.

This applies to Cracks, Keygens and Warez

I will remove these files, and I will continue to help you at this time
BUT, if I see any evidence of other similar files/programs this topic will be locked

In the future I strongly suggest you stay away from using cracks and/or Keygens.



----------------------------------------------------------- ----------------------------------------------------------- -----------------------------------------------------------


There is evidence of infected E-Mails in your Outlook box and backups.
I recommend that you delete any E-Mails that you don't need from Outlook and then delete the following files

C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst
C:\BNL BACKUP\MAIL BACKUP\MAIL\backup2008.06 BNL.pst
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\backup.pst
K:\BNL BACKUP\MAIL BACKUP\MAIL\backup2008.06 BNL.pst



[b]OTMoveIt

Please download OTMoveIt2 by OldTimer and save it to your desktop
  • Double-click OTMoveIt2.exe to run it.
  • Copy the lines in the codebox below.
Code: Select all

C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL
C:\Program Files\Spybot - Search & Destroy\VMLCJJL.scr
J:\EMULE\TEMP\018.part
J:\EMULE\NEW INCOMING\DivX.Pro.v6.5.Incl.Keygen-SSG.rar
J:\EMULE\NEW INCOMING\NoClone Enterprise Edition 4.1.27.zip
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD16-Alternative Investments\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD15-Derivatives\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD14-Fixed Income Securities 2\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD13-Fixed Income Securities 1\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD12-Securities Markets and Equity Investments\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD11-Portfolio Management and Securities Markets\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD9-Financial Statement Analysis 4\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD8-Financial Statement Analysis 3\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD7-Financial Statement Analysis 2\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD6-Financial Statement Analysis 1\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD5-Economics 2\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD4-Economics 1\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD3-Quantitative Methods 2\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD2-Quantitative Methods 1\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD10-Corporate Finance\jukebox\setup.exe
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD1-Ethics and GIPS\jukebox\setup.exe
J:\SOFTWARE UPDATES\DivX\SSG-Keygen.exe
J:\SOFTWARE UPDATES\NOCLONE\NoClone Enterprise Edition 4.1.27.exe
K:\BACKUP D\EMULE\TEMP\018.part
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part01.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part02.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part03.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part04.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part05.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part06.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part07.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part08.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part09.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part10.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part11.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part12.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part13.rar
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part14.rar

  • Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan << LINK
  • Click the Scan Now button
  • Follow the prompts to install the Active X if necessary
  • Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
  • When the scan is finished, a report will be generated
  • Next to Scan Details click the small Save button and save the report to your desktop.
  • Please post the report in your reply.
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 11th, 2008, 2:37 pm

Hi there, yes point taken about the d*mned keygens, cracks etc. Not all mine but I take responsibilty:

Here are the scans the ActiveScan instructions were not exactly as given but i got a log file.

From OTMoveIt2:

C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar moved successfully.
< C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL >
LoadLibrary failed for C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL NOT unregistered.
C:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL moved successfully.
C:\Program Files\Spybot - Search & Destroy\VMLCJJL.scr moved successfully.
J:\EMULE\TEMP\018.part moved successfully.
J:\EMULE\NEW INCOMING\DivX.Pro.v6.5.Incl.Keygen-SSG.rar moved successfully.
J:\EMULE\NEW INCOMING\NoClone Enterprise Edition 4.1.27.zip moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD16-Alternative Investments\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD15-Derivatives\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD14-Fixed Income Securities 2\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD13-Fixed Income Securities 1\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD12-Securities Markets and Equity Investments\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 2\CD11-Portfolio Management and Securities Markets\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD9-Financial Statement Analysis 4\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD8-Financial Statement Analysis 3\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD7-Financial Statement Analysis 2\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD6-Financial Statement Analysis 1\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD5-Economics 2\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD4-Economics 1\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD3-Quantitative Methods 2\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD2-Quantitative Methods 1\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD10-Corporate Finance\jukebox\setup.exe moved successfully.
J:\PROFESSIONAL\CFA\DVD 1\Video 1\CD1-Ethics and GIPS\jukebox\setup.exe moved successfully.
J:\SOFTWARE UPDATES\DivX\SSG-Keygen.exe moved successfully.
J:\SOFTWARE UPDATES\NOCLONE\NoClone Enterprise Edition 4.1.27.exe moved successfully.
K:\BACKUP D\EMULE\TEMP\018.part moved successfully.
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\new ngage\NGAGE_COPY_The_Elder_Scrolls.rar moved successfully.
< K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL >
LoadLibrary failed for K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL NOT unregistered.
K:\BNL BACKUP\BACKUP\POB\ALI NOOR\Documents and Settings\Ali Noor\Desktop\Symbian series\ngage2\The_Elder_Scrolls_Travels_Shadowkey[www.N-symbian.com]\system\libs\ECOM.DLL moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part01.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part02.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part03.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part04.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part05.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part06.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part07.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part08.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part09.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part10.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part11.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part12.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part13.rar moved successfully.
K:\MU-TORRENTS\DOWNLOADS\MICROSOFT.PROJECT.PROFESSIONAL.2007-EcHoS\echos-mpp2007.part14.rar moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08112008_165617

____________________

And ActiveScan log:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-08-11 21:08:41
PROTECTIONS: 1
MALWARE: 25
SUSPECTS: 6
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Windows Defender 1.1.3520.0 No No
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00098232 W32/Netsky.P.worm Virus No 0 Yes No personal folders\deleted items\re: here\information_bnl.zip[document.txt .exe]
00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@casalemedia[2].txt
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@247realmedia[1].txt
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@tribalfusion[2].txt
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@mediaplex[1].txt
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@com[1].txt
00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@xiti[1].txt
00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\hp@perf.overture[1].txt
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@burstnet[2].txt
00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@serving-sys[1].txt
00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@stat.onestat[2].txt
00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@media.adrevolver[3].txt
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@statse.webtrendslive[2].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@realmedia[2].txt
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@zedo[2].txt
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@adrevolver[1].txt
00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Users\HP\AppData\Roaming\Microsoft\Windows\Cookies\Low\hp@www6.addfreestats[1].txt
00360535 W32/Mydoom.DN.worm Virus No 0 Yes No personal folders\inbox\returned mail: see transcript for details\.zip[.htm .pif]
00378640 W32/Maximus.A Virus No 0 Yes No bnl bACKUP 2008.06\Inbox\2007-01\RE: ESSA NAIM (ex employee) COURT CASE
00378640 W32/Maximus.A Virus No 0 Yes No Personal Folders\Inbox\2007-01\RE: ESSA NAIM (ex employee) COURT CASE
00378640 W32/Maximus.A Virus No 0 Yes No bnl bACKUP 2008.06\Inbox\2007-01\RE: ESSA NAIM (ex employee) COURT CASE
00530786 W32/Maximus.A Virus No 0 Yes No Personal Folders\Inbox\2007-01\YASER AHMED RABIA-GRAND CHANGE
00530786 W32/Maximus.A Virus No 0 Yes No bnl bACKUP 2008.06\Inbox\2007-01\YASER AHMED RABIA-GRAND CHANGE
00530786 W32/Maximus.A Virus No 0 Yes No bnl bACKUP 2008.06\Inbox\2007-01\YASER AHMED RABIA-GRAND CHANGE
01176994 Bck/VB.XB Virus/Trojan No 0 No No J:\SOFTWARE UPDATES\ANTI VIRUS PROGS\01ComboFix.exe[327882R2FWJFW\NirCmdC.cfexe]
02898934 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\mdelk.exe.vir
02898934 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\downld\11821942.exe.vir
02898934 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\downld\11817793.exe.vir
02898935 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\srosa.sys.zip[srosa.sys]
02898935 W32/Bagle.RP.worm Virus/Worm No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\srosa.sys.vir
03275963 Generic Trojan Virus/Trojan No 0 No No J:\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar[WRar351it.exe]
03275963 Generic Trojan Virus/Trojan No 0 No No K:\BACKUP D\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar[WRar351it.exe]
03469544 W32/Bagle.KV.worm Virus No 1 Yes No C:\_OTMoveIt\MovedFiles\08112008_165617\SOFTWARE UPDATES\NOCLONE\NoClone Enterprise Edition 4.1.27.exe
03469544 W32/Bagle.KV.worm Virus No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\System32\drivers\hldrrr.exe.vir
03469544 W32/Bagle.KV.worm Virus No 1 Yes No C:\_OTMoveIt\MovedFiles\08112008_165617\Program Files\Spybot - Search & Destroy\VMLCJJL.scr
03469544 W32/Bagle.KV.worm Virus No 1 Yes No C:\_OTMoveIt\MovedFiles\08112008_165617\EMULE\NEW INCOMING\NoClone Enterprise Edition 4.1.27.zip[NoClone Enterprise Edition 4.1.27.exe]
;===================================================================================================================================================================================
SUSPECTS
Sent Location ��e=p�
s5
;===================================================================================================================================================================================
No C:\hp\bin\KillIt.exe ��e=p�
s5
No C:\Users\HP\AppData\Local\Mozilla\Firefox\Profiles\b6l9gxoz.default\Cache\1DDA904Fd01 ��e=p�
s5
No C:\_OTMoveIt\MovedFiles\08112008_165617\EMULE\NEW INCOMING\DivX.Pro.v6.5.Incl.Keygen-SSG.rar[SSG-Keygen.exe]
No C:\_OTMoveIt\MovedFiles\08112008_165617\SOFTWARE UPDATES\DivX\SSG-Keygen.exe ��e=p�
s5
;===================================================================================================================================================================================
VULNERABILITIES
Id Severity Description ��e=p�
s5
;===================================================================================================================================================================================
;===================================================================================================================================================================================
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 11th, 2008, 3:08 pm

OTMoveIt

  • Double-click OTMoveIt2.exe to run it.
  • Copy the lines in the codebox below.
Code: Select all
J:\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar
J:\SOFTWARE UPDATES\ANTI VIRUS PROGS\01ComboFix.exe
K:\BACKUP D\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar

  • Return to OTMoveIt2, right click in the Paste List of Files/Folders to Move window (under the yellow bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar), and paste it in your next reply.
  • Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 11th, 2008, 3:13 pm

Log file:

J:\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar moved successfully.
J:\SOFTWARE UPDATES\ANTI VIRUS PROGS\01ComboFix.exe moved successfully.
K:\BACKUP D\EMULE\NEW INCOMING\winrar_v3.51.ITA+Reg_key.rar moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08112008_221143
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm

Re: I-worm/Bagle.AKA and combofix......

Unread postby Katana » August 11th, 2008, 4:22 pm

Congratulations your logs look clean :D

Let's see if I can help you keep it that way

First lets tidy up :D


  • This will clear your System Volume Information restore points and remove all the infected files that were quarantined
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the /U, it needs to be there.
    • Image
You can also delete any logs we have produced, and empty your Recycle bin.


Open OTMoveIt Click Cleanup,
it will now connect to the internet and get a list of files to delete.
When a box pops up click YES.


Enable Teatimer

  • RIGHT click Link >>> HERE <<< Link and select "save as" and save it to your desktop
  • Double click ResetTeaTimer.bat
  • Open Spybot S&D
  • Click Mode, check Advanced Mode
  • Go To Left Panel, Click Tools, then also in left panel, click Resident
  • If your firewall raises a question, say OK
  • check the box labeled Resident Tea-Timer and OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
  • You can now delete ResetTeaTimer.bat



The following is some info to help you stay safe and clean.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partne ... bscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware
    AntiSpyware is not the same thing as Antivirus.
    Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
    You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
    Most of the programs in this list have a free (for Home Users ) and paid versions,
    it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
  • Spybot - Search & Destroy <<< A must have program
    • It includes host protection and registry protection
    • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
  • MalwareBytes Anti-malware <<< A New and effective program
  • a-squared Free <<< A good "realtime" or "on demand" scanner
  • superantispyware <<< A good "realtime" or "on demand" scanner

Prevention
    These programs don't detect malware, they help stop it getting on your machine in the first place.
    Each does a different job, so you can have more than one
  • Winpatrol
    • An excellent startup manager and then some !!
    • Notifies you if programs are added to startup
    • Allows delayed startup
    • A must have addition
  • SpywareBlaster 4.0
    • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
  • SpywareGuard 2.2
    • SpywareGuard provides real-time protection against spyware.
    • Not required if you have other "realtime" antispyware or Winpatrol
  • ZonedOut
    • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
  • MVPS HOSTS
    • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
    • For information on how to download and install, please read this tutorial by WinHelp2002.
    • Not required if you are using other host file protections

Internet Browsers
    Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
    Using a different web browser can help stop malware getting on your machine.
    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      1. From within Internet Explorer click on the Tools menu and then click on Options.
      2. Click once on the Security tab
      3. Click once on the Internet icon so it becomes highlighted.
      4. Click once on the Custom Level button.
        • Change the Download signed ActiveX controls to Prompt
        • Change the Download unsigned ActiveX controls to Disable
        • Change the Initialise and script ActiveX controls not marked as safe to Disable
        • Change the Installation of desktop items to Prompt
        • Change the Launching programs and files in an IFRAME to Prompt
        • Change the Navigate sub-frames across different domains to Prompt
        • When all these settings have been made, click on the OK button.
        • If it prompts you as to whether or not you want to save the settings, press the Yes button.
      5. Next press the Apply button and then the OK to exit the Internet Properties page.
    If you are still using IE6 then either update, or get one of the following.
    • FireFox
      • With many addons available that make customization easy this is a very popular choice
      • NoScript and AdBlockPlus addons are essential
    • Opera
      • Another popular alternative
    • Netscape
      • Another popular alternative
      • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies
    Temporary Internet Files are mainly the files that are downloaded when you open a web page.
    Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
    It is a good idea to empty the Temporary Internet Files folder on a regular basis.

    Tracking Cookies are files that websites use to monitor which sites you visit and how often.
    A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
    CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

    Both of these can be cleaned manually, but a quicker option is to use a program
  • ATF Cleaner
    • Free and very simple to use
  • CCleaner
    • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'
User avatar
Katana
MRU Teacher Emeritus
 
Posts: 6412
Joined: November 10th, 2006, 5:00 pm
Location: Manchester

Re: I-worm/Bagle.AKA and combofix......

Unread postby pobmalware » August 11th, 2008, 4:51 pm

Ooof! I was holding my breath there...but I have one small query..........? I can't start my windows firewall from control panel, security center, ... it just says it can't turn on Windows firewall... is that normal?
pobmalware
Active Member
 
Posts: 12
Joined: August 3rd, 2008, 6:02 pm
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 62 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware