The system is as if it keeps on rebooting then it closes all files opened.
There is a yellow and blue pop-up the warn me of a virus that come up after n few minutes after starting the computer then the screen turns blue and I can do nothing futher, the backround also turn blue. When I ran Trend It luckily did the scan with only trend open and the popup. The Pop up read Warning! Spyware detected on your computer! Install an antivirus or spyware remover to clean your computer.
I am running Windows XP Professional. Please find attached the report from Combofix.
The virus found from Trend is Pak_Generic.
If you require more information please do not hesitate to contact me
Please help me to resolve this problem as quickly as possible.
Thank you
ComboFix Log file
ComboFix 08-06-16.2 - Hassib 2008-06-17 3:31:05.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1256.216.1036.18.403 [GMT 2:00]
Endroit: C:\Documents and Settings\Hassib\Bureau\ComboFix.exe
Command switches used :: C:\Documents and Settings\Hassib\Bureau\WinXP_EN_PRO_BF.EXE
* Création d'un nouveau point de restauration
.
(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Hassib\Application Data\tazebama
C:\Documents and Settings\Hassib\Application Data\tazebama\tazebama.log
C:\Documents and Settings\Hassib\Application Data\tazebama\zPharaoh.dat
C:\Program Files\BurstWriting
C:\Program Files\BurstWriting\uninstall.dat
C:\WINDOWS\rs.txt
C:\WINDOWS\system32\673351
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\opnkHXpq.dll
C:\WINDOWS\system32\qpXHknpo.ini
C:\WINDOWS\system32\qpXHknpo.ini2
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DHLP
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-05-17 to 2008-06-17 ))))))))))))))))))))))))))))))))))))
.
2008-06-16 15:45 . 2008-06-16 15:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-16 05:12 . 2008-02-15 23:39 138,384 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-06-16 05:12 . 2008-02-15 23:39 52,496 --a------ C:\WINDOWS\system32\drivers\tmactmon.sys
2008-06-16 05:12 . 2008-02-15 23:39 52,240 --a------ C:\WINDOWS\system32\drivers\tmevtmgr.sys
2008-06-16 05:10 . 2008-06-17 03:06 <REP> d-------- C:\Program Files\Trend Micro
2008-06-15 00:51 . 2008-06-15 00:53 10,752 --a------ C:\WINDOWS\DCEBoot.exe
2008-06-15 00:31 . 2008-06-17 02:45 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2008-06-12 16:59 . 2008-06-15 11:25 <REP> d-------- C:\Documents and Settings\Hassib\.housecall6.6
2008-06-12 16:58 . 2008-06-12 16:58 <REP> d-------- C:\WINDOWS\Sun
2008-06-12 16:58 . 2005-04-13 03:48 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-06-12 16:57 . 2008-06-12 16:58 <REP> d-------- C:\Program Files\Java
2008-06-12 16:55 . 2008-06-12 16:55 <REP> d-------- C:\Program Files\Fichiers communs\Java
2008-06-12 15:30 . 2008-06-14 22:04 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-06-12 14:39 . 2008-06-12 14:45 <REP> d-------- C:\Program Files\Google
2008-06-12 14:39 . 2008-06-12 14:48 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-06-12 14:22 . 2008-06-12 14:22 0 --a------ C:\LOG75.tmp
2008-06-01 11:19 . 2008-06-01 11:19 0 --a------ C:\LOG1EA.tmp
2008-06-01 10:23 . 2008-06-12 15:35 <REP> d-------- C:\Ad-Aware SE Professional
2008-06-01 10:21 . 2008-06-01 10:21 <REP> d-------- C:\Inetpub
2008-06-01 10:02 . 2008-06-01 10:02 0 --a------ C:\LOG45.tmp
2008-05-22 21:33 . 2008-05-22 21:33 0 --a------ C:\LOG2A5.tmp
2008-05-21 12:45 . 2008-05-21 12:45 <REP> d-------- C:\Documents and Settings\Hassib\Application Data\Lavasoft
2008-05-20 18:09 . 2008-05-20 18:09 <REP> d-------- C:\Documents and Settings\All Users\Application Data\AntiVir PersonalEdition Classic
2008-05-20 17:47 . 2008-05-20 17:47 0 --a------ C:\LOG22.tmp
2008-05-20 17:45 . 2008-06-01 11:18 <REP> d-------- C:\Documents and Settings\Hassib\Application Data\U3
2008-05-20 14:38 . 2008-05-20 14:44 <REP> d--h----- C:\WINDOWS\$hf_mig$
2008-05-19 23:06 . 2008-05-20 14:32 4,212 ---h----- C:\WINDOWS\system32\imlictbl.dat
2008-05-19 20:32 . 2007-11-14 16:04 99,816 --a------ C:\WINDOWS\system32\~GLH0025.TMP
2008-05-19 20:31 . 2007-11-14 16:04 275,944 --a------ C:\WINDOWS\system32\~GLH0019.TMP
2008-05-19 20:31 . 2007-11-14 16:04 83,432 --a------ C:\WINDOWS\system32\~GLH0014.TMP
2008-05-19 20:17 . 2006-07-21 10:27 72,704 -----c--- C:\WINDOWS\system32\dllcache\hlink.dll
2008-05-19 20:14 . 2007-03-17 15:44 293,376 -----c--- C:\WINDOWS\system32\dllcache\winsrv.dll
2008-05-19 20:01 . 2008-05-19 20:01 268 --ah----- C:\sqmdata03.sqm
2008-05-19 20:01 . 2008-05-19 20:01 244 --ah----- C:\sqmnoopt03.sqm
2008-05-19 20:00 . 2004-07-27 14:56 110,950 --a------ C:\WINDOWS\system32\zlimclnup.exe
2008-05-19 19:59 . 2008-05-20 19:20 <REP> d-------- C:\Program Files\IMsecure
2008-05-19 19:59 . 2004-09-30 11:21 2,200,832 --a------ C:\WINDOWS\system32\imslsp.dll
2008-05-19 19:59 . 2004-09-30 11:21 345,352 --a------ C:\WINDOWS\system32\lockbox.dll
2008-05-19 19:59 . 1996-08-09 03:30 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll
2008-05-19 19:57 . 2004-09-30 11:21 603,400 --a------ C:\WINDOWS\system32\imsinstall.dll
2008-05-19 19:50 . 2008-05-19 19:50 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-05-19 19:48 . 2008-05-21 11:44 355,043 --ah----- C:\WINDOWS\system32\vsconfig.xml
2008-05-19 19:20 . 2008-05-21 11:51 <REP> d-------- C:\WINDOWS\Internet Logs
2008-05-19 17:50 . 2007-01-23 21:31 546,304 -----c--- C:\WINDOWS\system32\dllcache\hhctrl.ocx
2008-05-19 17:19 . 2008-05-20 18:14 <REP> d--hs---- C:\AntivirusOrdi
2008-05-19 17:18 . 2008-05-19 17:18 <REP> d-------- C:\WINDOWS\system32\Engines
2008-05-19 17:17 . 2001-03-08 19:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-05-19 16:21 . 2007-07-30 19:19 38,232 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-05-19 16:21 . 2007-07-30 19:20 30,040 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-05-19 16:21 . 2007-07-30 19:19 30,040 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-05-19 16:21 . 2007-07-30 19:18 21,336 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-05-19 15:42 . 2008-05-22 16:13 <REP> d-------- C:\Program Files\Fichiers communs\ReparateurDeSysteme
2008-05-19 15:42 . 2008-05-20 18:21 <REP> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
2008-05-19 15:10 . 2008-05-19 15:10 0 --a------ C:\winxplogon.sys
2008-05-19 14:53 . 2008-05-19 14:53 <REP> d-------- C:\WINDOWS\system32\LogFiles
2008-05-19 13:31 . 2008-05-20 17:43 269,334 --a------ C:\WINDOWS\system32\ctfmonb.bmp
2008-05-19 13:31 . 2008-05-20 17:44 160,256 --a------ C:\WINDOWS\system32\blackster.scr
2008-05-19 13:15 . 2008-05-20 18:46 <REP> d---s---- C:\Documents and Settings\Hassib\UserData
.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-12 14:32 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-06-12 14:32 --------- d-----w C:\Program Files\Fichiers communs\Symantec Shared
2008-05-20 17:27 --------- d-----w C:\Program Files\Winamp
2008-05-20 17:26 --------- d-----w C:\Program Files\MSN Messenger
2008-05-20 16:24 --------- d-----w C:\Documents and Settings\Hassib\Application Data\Skype
2008-05-20 16:24 --------- d-----w C:\Documents and Settings\Hassib\Application Data\ITEDO
2008-05-20 16:23 --------- d-----w C:\Documents and Settings\Hassib\Application Data\DassaultSystemes
2008-05-20 16:23 --------- d-----w C:\Documents and Settings\Hassib\Application Data\AdobeUM
2008-05-20 16:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2008-05-20 16:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\DassaultSystemes
2008-05-20 16:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-05-10 16:17 0 ----a-w C:\Documents and Settings\MyDocuments\readthis.doc.exe
2008-05-10 16:17 0 ----a-w C:\Documents and Settings\MyDocuments\Readme.doc .exe
2008-05-02 14:22 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-05-02 14:21 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-05-02 14:17 1,169,240 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
.
- Code: Select all
<pre> ----a-w 0 2008-05-10 16:17:05 C:\Documents and Settings\MyDocuments\Readme.doc .exe </pre>
------- Sigcheck -------
2006-03-09 10:25 578048 0df75fb73f705b011630159a43d7c354 C:\WINDOWS\system32\user32.dll
2006-04-12 20:13 667648 241dbc4c2714b2f39afded49459ed420 C:\WINDOWS\system32\wininet.dll
2006-02-14 21:56 359808 667192a11db19f36624119c0dd4de4f2 C:\WINDOWS\system32\drivers\tcpip.sys
2006-05-09 10:11 2017280 50b3a210b6fa8d3089a36a32e7d8b21f C:\WINDOWS\system32\ntkrnlpa.exe
2006-03-09 10:25 2137600 e75f7aa5a33479f29c636fd0890f5762 C:\WINDOWS\system32\ntoskrnl.exe
.
((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{132F969E-2442-47BE-8CC8-955483AF951B}]
C:\WINDOWS\fvowketqfgq.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SuperCopier2.exe"="C:\Program Files\SuperCopier2\SuperCopier2.exe" [2006-07-07 18:45 1052672]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]
"FrameWorkService"="" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-12 14:39 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Fichiers communs\Symantec Shared\ccApp.exe" [ ]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 21:33 125168]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 21:24 32768]
"RTHDCPL"="RTHDCPL.EXE" [2007-11-06 11:50 16855552 C:\WINDOWS\RTHDCPL.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-12-11 22:05 344064]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY" [ ]
"FrameWorkService"="" []
"UADCcw"="C:\Program Files\AdvancedCleaner Free\UADCcw.exe" [ ]
"BMN"="C:\Program Files\Fichiers communs\AntivirusOrdi\bm.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"UfSeAgnt.exe"="C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe" [2008-02-16 00:56 1398024]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 17:09 15360]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Config"="C:\WINDOWS\system32\run.cmd" [2006-02-14 12:24 248]
"nlsf"="cmd.exe" [2004-08-19 17:09 400896 C:\WINDOWS\system32\cmd.exe]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-19 16:52 44544]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoStrCmpLogical"= 0 (0x0)
"NoInstrumentation"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"MemCheckBoxInRunDlg"= 1 (0x1)
"NoSMBalloonTip"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"1"= cmd.exe
"2"= mmc.exe
"3"= rstrui.exe
"4"= regedit.exe
"5"= regedt32.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mpfanvqg"= {0332C26B-A151-4352-A2D3-4A76A5490BC4} - C:\WINDOWS\mpfanvqg.dll [ ]
"vbksrofa"= {B05FDAF4-A03F-4F67-A74B-6A45A8428BB3} - C:\WINDOWS\vbksrofa.dll [ ]
"AvpPrx"= {a7afcc91-b39d-4cc0-bbf2-d4712a39d03a} - C:\WINDOWS\Resources\AvpPrx.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdcDus]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"DisablePagingExecutive"=dword:00000001
"SecondLevelDataCache"=dword:00000200
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 15:22]
R2 BBDemon;Backbone Service;"C:\Program Files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe" -service []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{623506b4-a33b-11dc-a6d2-001b24510921}]
\Shell\AutoRun\command - E:\zPharaoh.exe
\Shell\explore\command - E:\zPharaoh.exe
\Shell\open\command - E:\zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{623506b9-a33b-11dc-a6d2-001b24510921}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL antihost.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84918836-cb54-11dc-a711-001b24510921}]
\Shell\AutoRun\command - qd.cmd
\Shell\explore\Command - qd.cmd
\Shell\open\Command - qd.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f24ea9e-ccbd-11dc-a714-001b24510921}]
\Shell\AutoRun\command - zPharaoh.exe
\Shell\explore\command - zPharaoh.exe
\Shell\open\command - zPharaoh.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f24eaa1-ccbd-11dc-a714-001b24510921}]
\Shell\AutoRun\command - E:\m1t8ta.com
\Shell\explore\Command - E:\m1t8ta.com
\Shell\open\Command - E:\m1t8ta.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98a899ce-1a7b-11dd-a769-001b24510921}]
\Shell\AutoRun\command - E:\u2.cmd
\Shell\explore\Command - E:\u2.cmd
\Shell\open\Command - E:\u2.cmd
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbc59340-cb69-11dc-a712-001b24510921}]
\Shell\AutoRun\command - E:\ntde1ect.com
\Shell\explore\Command - E:\ntde1ect.com
\Shell\open\Command - E:\ntde1ect.com
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-17 06:09:55
Windows 5.1.2600 Service Pack 2 NTFS
Balayage processus cach‚s ...
Balayage cach‚ autostart entries ...
Balayage des fichiers cach‚s ...
Scan termin‚ avec succŠs
Les fichiers cach‚s: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mchInjDrv]
"ImagePath"="\??\C:\DOCUME~1\Hassib\LOCALS~1\Temp\mc26.tmp"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe
C:\Program Files\Trend Micro\BM\TMBMSRV.exe
C:\WINDOWS\system32\WLTRAY.EXE
C:\WINDOWS\system32\msiexec.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\Internet Security\TmProxy.exe
C:\Program Files\Fichiers communs\Microsoft Shared\Source Engine\OSE.EXE
.
**************************************************************************
.
Temps d'accomplissement: 2008-06-17 6:17:03 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-17 04:16:46
Pre-Run: 40,206,090,240 octets libres
Post-Run: 40,675,491,840 octets libres
WinXP_EN_PRO_BF.EXE
;
;Warning: Boot.ini is used on Windows XP and earlier operating systems.
;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.
;
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professionnel" /NOEXECUTE=OPTIN /FASTDETECT
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
260 --- E O F --- 2008-05-20 12:44:35
