Help removing msa.exe, cannot run or rename hijackthis.

September 29, 2009, 11:00 PM UTC

Hello,

A friend of mine called me for assistance with her computer, and I went over to help her out.

Avast!'s registration had expired, and therefore something must have gotten in -- anyway, Avast! was disabled, and I couldn't run HJT (even with renaming it), nor MalwareBytes (again, even with renaming it). I renamed and ran ComboFix (because that was the only thing that would function); it detected rootkit activity, rebooted the computer, and then ran. I rebooted again and tried to run MWB or HJT again, no soap. I can't even rename them now, it says that access is denied. I tried running CFix again, but that didn't help. Stupidly, I didn't save the first log, so all I have is the log from the most recent run, included below.

I'm running XP in Safe Mode logged in as Administrator. No networking, no nothing - this box has been quarantined until we sort this.

Thanks in advance for your help,
MC

--ComboFix log follows:

ComboFix 09-09-28.01 - Kay1 09/29/2009 15:17.2.1 - NTFSx86

Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.223.5 [GMT -7:00]

Running from: c:\documents and settings\[removed]\Desktop\cfix.exe

AV: avast! antivirus 4.8.1335 [VPS 090929-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}

.



(((((((((((((((((((((((((   Files Created from 2009-08-28 to 2009-09-29  )))))))))))))))))))))))))))))))

.



2009-09-29 20:35 . 2009-09-29 20:35	--------	d-----w-	c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-09-29 20:35 . 2009-09-29 20:35	--------	d-----w-	c:\documents and settings\Administrator.KAY\Application Data\SUPERAntiSpyware.com

2009-09-29 20:31 . 2009-09-29 20:31	--------	d-----w-	c:\documents and settings\Administrator.KAY\Application Data\Malwarebytes

2009-09-29 20:31 . 2009-09-29 20:31	--------	d-----w-	c:\program files\poo

2009-09-29 19:57 . 2009-09-29 19:57	--------	d-----w-	c:\documents and settings\Kay1\Application Data\Malwarebytes

2009-09-29 19:57 . 2009-09-10 21:54	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys

2009-09-29 19:57 . 2009-09-29 20:19	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware

2009-09-29 19:57 . 2009-09-29 19:57	--------	d-----w-	c:\documents and settings\All Users\Application Data\Malwarebytes

2009-09-29 19:57 . 2009-09-10 21:53	19160	----a-w-	c:\windows\system32\drivers\mbam.sys

2009-09-28 05:10 . 2009-09-29 20:22	0	----a-r-	c:\windows\win32k.sys

2009-09-09 08:51 . 2009-06-21 21:44	153088	-c----w-	c:\windows\system32\dllcache\triedit.dll



.

((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-09-29 22:03 . 2009-02-07 21:49	256	----a-w-	c:\windows\system32\pool.bin

2009-09-29 21:34 . 2009-03-01 01:39	--------	d-----w-	c:\program files\Trend Micro

2009-09-06 01:21 . 2005-04-11 13:48	34528	----a-w-	c:\documents and settings\Kay1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

2009-08-29 02:28 . 2009-08-20 19:58	--------	d-----w-	c:\program files\eGames

2009-08-23 00:18 . 2009-08-23 00:18	--------	d-----w-	c:\program files\MSBuild

2009-08-23 00:18 . 2009-08-23 00:18	--------	d-----w-	c:\program files\Reference Assemblies

2009-08-22 23:58 . 2009-08-22 23:58	4096	----a-w-	c:\windows\d3dx.dat

2009-08-05 09:01 . 2003-03-31 12:00	204800	----a-w-	c:\windows\system32\mswebdvd.dll

2009-07-17 19:01 . 2003-03-31 12:00	58880	----a-w-	c:\windows\system32\atl.dll

2009-07-12 19:21 . 2004-08-16 00:00	233472	----a-w-	c:\windows\system32\wmpdxm.dll

.



(((((((((((((((((((((((((((((   SnapShot@2009-09-29_21.12.44   )))))))))))))))))))))))))))))))))))))))))

.

+ 2009-09-29 22:03 . 2009-09-29 22:03	16384              c:\windows\Temp\Perflib_Perfdata_528.dat

.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown 

REGEDIT4



[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]



[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]

"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]



c:\documents and settings\All Users\Start Menu\Programs\Startup\

Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2007-8-17 1447184]

ZDWLan Utility.lnk - c:\program files\ZyDAS Technology Corporation\ZyDAS_802.11g_Utility\ZDWlan.exe [2008-5-3 471040]



[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup



[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Microsoft Games\\Age of Mythology\\aomx.exe"=



R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2/28/2009 7:18 PM 114768]

R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2/28/2009 7:18 PM 20560]

S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys [?]

S3 SASENUM;SASENUM;\??\c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\ADMINI~1.KAY\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS [?]

.

Contents of the 'Scheduled Tasks' folder



2009-09-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://m.www.yahoo.com/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}

mStart Page = hxxp://qwest.live.com

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

.



**************************************************************************



catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-09-29 15:24

Windows 5.1.2600 Service Pack 3 NTFS



scanning hidden processes ...  



scanning hidden autostart entries ... 



scanning hidden files ...  



scan completed successfully

hidden files: 0



**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------



- - - - - - - > 'explorer.exe'(3384)

c:\windows\system32\WININET.dll

c:\windows\system32\ieframe.dll

.

Completion time: 2009-09-29 15:28

ComboFix-quarantined-files.txt  2009-09-29 22:28

ComboFix2.txt  2009-09-29 21:26



Pre-Run: 27,014,672,384 bytes free

Post-Run: 26,986,725,376 bytes free



99	--- E O F ---	2009-09-09 10:05