Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

HiJackThis log file

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Re: HiJackThis log file

Unread postby jmw3 » September 27th, 2009, 9:00 pm

Hi

Those screen shots aren't telling me a lot as I cannot see the full registry key. Catchme is OK as it is a part of the tools we use.

CFScript
Delete the copy of ComboFix you have & download it again:
Link 1
Link 2
Close any open browsers & make sure you Anti-Virus & Anti-Spyware programs are fully disabled.
Open notepad and copy/paste the text in the code box below into it:

Code: Select all
File::
c:\windows\fdgg34353edfgdfdf
c:\windows\0535251103110107106.yux
c:\windows\system32\drivers\kgpcpy.cfg
Folder::
c:\windows\fdgg34353edfgdfdf
DDS::
uSearch Page = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com
mDefault_Search_URL = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com
mSearch Page = hxxp://red.clientapps.yahoo.com/customi ... .yahoo.com
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

Save this as CFScript.txt, in the same location as ComboFix.exe

Image

Referring to the picture above, drag CFScript into ComboFix.exe
When finished, it shall produce a log for you at "C:\ComboFix.txt"
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
A word of warning: Neither I nor sUBs are responsible for any damage you may cause to your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


Malwarebytes' Anti-Malware
Download Malwarebytes' Anti-Malware here & save to your desktop.
  • Double-click mbam-setup.exe & follow the prompts to install the program
  • At the end, be sure a checkmark is placed next to:
    Update Malwarebytes' Anti-Malware
    Launch Malwarebytes' Anti-Malware
  • Then click Finish
  • If an update is found, it will download and install the latest version
  • Once the program has loaded, select Perform full scan, then click Scan
  • When the scan is complete, click OK, then Show Results to view the results
  • Be sure that everything is checked, and click Remove Selected
  • When completed, a log will open in Notepad. Please copy & paste the log back into your next reply
    Note:
  • The log is automatically saved by Malwarebytes' Anti-Malware & can be viewed by clicking the Logs tab
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either & let Malwarebytes' Anti-Malware proceed with the disinfection process.
If asked to restart the computer, please do so. Failure to reboot will prevent MBAM from removing all the malware.
If you receive an (Error Loading) error on reboot please reboot a second time . It is normal for this error to occur once & does not need to be reported unless it returns on future reboots.


To post in next reply:
ComboFix log
Malwarebytes' log
User avatar
jmw3
MRU Emeritus
MRU Emeritus
 
Posts: 4621
Joined: February 12th, 2008, 2:36 am
Location: Port Hedland, Western Australia
Advertisement
Register to Remove

Re: HiJackThis log file

Unread postby theresamisu » September 28th, 2009, 10:36 pm

Hi:

note: i did all the "what to do if your computer is running slow" but it was still in really good shape from the last time i did those things before i started posting in this board. it is still rather slow starting programs, however, including internet explorer. do you think its ok for me to update to IE 8?

Here are the logs you requested.

Please note that i leave on holiday starting wednesday so i may not reply again until the middle of next week. i much appreciate your help so far and would like you to keep the correspondence open until we have completed it all.

thanks!


Malwarebytes' Anti-Malware 1.41
Database version: 2869
Windows 5.1.2600 Service Pack 3

9/28/2009 9:37:27 PM
mbam-log-2009-09-28 (21-37-27).txt

Scan type: Full Scan (C:\|)
Objects scanned: 177475
Time elapsed: 28 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066732.exe (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1617\A0066733.exe (Worm.KoobFace) -> Quarantined and deleted successfully.

-----------------------------------------------------------
ComboFix 09-09-28.01 - TMW 09/28/2009 20:44.3.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.213 [GMT -6:00]
Running from: c:\documents and settings\TMW\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\TMW\Desktop\CFScript.txt

FILE ::
"c:\windows\0535251103110107106.yux"
"c:\windows\fdgg34353edfgdfdf"
"c:\windows\system32\drivers\kgpcpy.cfg"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\0535251103110107106.yux
c:\windows\fdgg34353edfgdfdf
c:\windows\system32\drivers\kgpcpy.cfg

.
((((((((((((((((((((((((( Files Created from 2009-08-28 to 2009-09-29 )))))))))))))))))))))))))))))))
.

2009-09-23 02:26 . 2009-09-23 02:26 -------- d-----w- c:\program files\ESET
2009-09-18 01:32 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll
2009-09-13 17:33 . 2009-09-13 17:33 -------- d-----w- c:\program files\iPhone Configuration Utility
2009-09-13 17:27 . 2009-09-13 17:27 -------- d-----w- c:\program files\iPod
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\program files\iTunes
2009-09-13 17:27 . 2009-09-13 17:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-09-13 17:18 . 2009-09-13 17:18 -------- d-----w- c:\program files\Bonjour
2009-09-13 17:15 . 2009-09-13 17:17 -------- d-----w- c:\program files\QuickTime
2009-09-11 01:23 . 2009-09-11 01:23 -------- d-----w- c:\program files\AVG
2009-09-11 01:21 . 2009-09-11 15:33 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-09-11 00:48 . 2009-09-11 00:48 -------- d-----w- c:\program files\MSSOAP
2009-09-11 00:47 . 2009-09-11 00:47 -------- d-----w- c:\program files\Webroot
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\TMW\Application Data\Malwarebytes
2009-09-10 23:13 . 2009-09-10 23:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-10 01:42 . 2009-09-11 01:10 -------- d-----w- c:\documents and settings\All Users\Application Data\SITEguard
2009-09-10 01:41 . 2009-09-10 01:41 -------- d-----w- c:\program files\Common Files\iS3
2009-09-10 01:41 . 2009-09-29 02:27 -------- d-----w- c:\documents and settings\All Users\Application Data\STOPzilla!
2009-09-10 01:18 . 2009-09-11 16:15 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-10 00:06 . 2009-09-10 00:06 -------- d-----w- c:\documents and settings\TMW\Local Settings\Application Data\Mozilla
2009-09-08 23:52 . 2009-09-08 23:52 -------- d-sh--w- c:\documents and settings\TMW\IECompatCache
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-04 01:34 . 2009-06-26 16:50 81920 ----a-w- c:\windows\system32\dllcache\ieencode.dll
2009-09-03 00:10 . 2009-09-03 00:10 -------- d-----w- c:\program files\Safari

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 23:25 . 2005-03-03 01:35 -------- d-----w- c:\program files\Java
2009-09-18 10:10 . 2008-08-09 14:42 -------- d-----w- c:\program files\MozyHome
2009-09-15 13:10 . 2008-11-28 21:55 -------- d-----w- c:\documents and settings\TMW\Application Data\Apple Computer
2009-09-13 17:27 . 2008-11-28 21:53 -------- d-----w- c:\program files\Common Files\Apple
2009-09-11 15:55 . 2005-04-27 02:57 -------- d-----w- c:\program files\Nero
2009-09-11 15:53 . 2009-04-01 00:20 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-09-11 00:42 . 2006-06-08 02:10 -------- d-----w- c:\program files\Trend Micro
2009-09-05 16:19 . 2005-03-10 18:49 73688 -c--a-w- c:\documents and settings\TMW\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-29 01:42 . 2009-04-11 14:27 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-08-29 01:42 . 2008-11-28 21:53 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-08-14 12:58 . 2009-09-10 01:19 7396 ----a-w- c:\windows\system32\drivers\pctcore.cat
2009-08-12 01:31 . 2009-05-10 15:36 -------- d-----w- c:\program files\Google
2009-08-12 01:10 . 2009-04-01 00:20 -------- d-----w- c:\program files\McAfee
2009-08-12 01:08 . 2006-05-24 22:50 -------- d-----w- c:\program files\CoffeeCup Software
2009-08-05 09:01 . 2004-08-04 11:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-31 21:23 . 2009-03-14 22:31 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 2004-08-04 11:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 05:43 . 2004-08-04 11:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2006-06-06 02:46 . 2006-06-06 02:46 88 --sh--r- c:\windows\SYSTEM32\84D9348185.sys
2006-06-06 02:46 . 2006-06-06 02:44 3350 --sha-w- c:\windows\SYSTEM32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-09-21_23.57.25 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-29 02:33 . 2009-09-29 02:33 16384 c:\windows\Temp\Perflib_Perfdata_f4.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 32768 c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2005-03-10 18:29 . 2009-09-28 08:00 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
- 2005-03-10 18:29 . 2009-09-21 23:55 16384 c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
+ 2009-09-29 02:32 . 2009-09-29 02:32 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2009-06-13 15:56 . 2009-06-13 15:56 38240 c:\windows\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2006-10-27 02:49 . 2006-10-27 02:49 509200 c:\windows\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6021\WRD12CVR.DLL
+ 2009-04-04 13:35 . 2009-04-04 13:35 38325760 c:\windows\Installer\fbae641.msp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4a9d-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4a9d-BDFE-192AAD5099B1}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40f7-AB77-51FF9D6DEB20}]
2009-09-14 19:04 2847032 ----a-w- c:\program files\MozyHome\mozyshell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IAAnotif"="c:\program files\Intel\Intel Application Accelerator\iaanotif.exe" [2004-03-23 135168]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-08-25 339968]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-04 221184]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2005-03-03 26112]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-08-13 122939]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 110592]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 57344]
"NapsterShell"="c:\program files\Napster\napster.exe" [2008-05-29 323216]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-09 305440]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]

c:\documents and settings\TMW\Start Menu\Programs\Startup\
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-5-10 333088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyHome Status.lnk - c:\program files\MozyHome\mozystat.exe [2009-9-14 2891576]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2005-4-16 118784]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 mozyFilter;mozyFilter;c:\windows\SYSTEM32\DRIVERS\mozy.sys [8/9/2008 8:42 AM 54776]
R2 WUSB54GSVC;WUSB54GSVC;c:\program files\Wireless-G USB Network Adapter\WLService.exe [8/16/2005 6:26 PM 41025]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
.
Contents of the 'Scheduled Tasks' folder

2009-09-26 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://yahoo.sbc.com/dsl
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
FF - ProfilePath - c:\documents and settings\TMW\Application Data\Mozilla\Firefox\Profiles\dwjhl18j.default\
FF - prefs.js: keyword.URL - hxxp://us.yhs.search.yahoo.com/avg/sear ... -web_us&p=
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-28 20:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-09-29 20:53
ComboFix-quarantined-files.txt 2009-09-29 02:52
ComboFix2.txt 2009-09-23 01:32
ComboFix3.txt 2009-09-22 00:03

Pre-Run: 40,354,213,888 bytes free
Post-Run: 40,408,223,744 bytes free

161 --- E O F --- 2009-09-29 02:32
theresamisu
Active Member
 
Posts: 10
Joined: September 11th, 2009, 12:30 pm

Re: HiJackThis log file

Unread postby jmw3 » September 29th, 2009, 11:45 am

Hi
Please note that i leave on holiday starting wednesday so i may not reply again until the middle of next week. i much appreciate your help so far and would like you to keep the correspondence open until we have completed it all.
Sure no problem at all.
The last ComboFix log looks good. I don't believe the system slowness your experiencing is malware related. When you can, post a new HijackThis log. We'll see if you can stop a few things from running which may help.
User avatar
jmw3
MRU Emeritus
MRU Emeritus
 
Posts: 4621
Joined: February 12th, 2008, 2:36 am
Location: Port Hedland, Western Australia

Re: HiJackThis log file

Unread postby NonSuch » October 11th, 2009, 4:00 am

Due to inactivity, which has exceeded the time requested, this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.
User avatar
NonSuch
Administrator
Administrator
 
Posts: 27301
Joined: February 23rd, 2005, 7:08 am
Location: California
Advertisement
Register to Remove

Previous

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: No registered users and 40 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware