TechSpot

Buffer Overrun Detected when starting Internet Explorer

By spk1973
Jan 24, 2009
  1. mflynn

    mflynn TS Rookie Posts: 2,793

    Shawn!

    Ok it is fixed, thought it might be. But I advise you again. Do not be installing or updating until you are clean. They could be compromised as soon as they are installed.

    And based on just the SAS, I believe MBAM will find much more.

    Mike
     
  2. raybay

    raybay TS Evangelist Posts: 10,716   +6

    But low ram will sometimes create a condition that will cause a buffer overflow to occur because of impact on other components.
     
  3. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Okay, Mike,
    I think I've done everything I should...I may have somehow updated before finishing with the scans, but a number of stuff was quarantined/removed. Attached are the HJT, SAS and MBAM logs.
    Thanks for all your help.
    -Shawn
     
  4. mflynn

    mflynn TS Rookie Posts: 2,793

    HI Shawn

    Had to drop out on you! Dinner and a great movie "Taken" with Liam Neeson. Fantastic movie. next "Gran Torino"

    Anyway..

    The updates are likely OK based on what I saw of the Malware. You were lucky this time.

    OK UPDATE and run MBAM and SAS both in Quick scan mode, to confirm they come up clean.

    To be sure do the 2 below and post log if they are clean we are finished.

    Download SDFix to Desktop.

    http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

    On Desktop run SDdFix It will run (install) then close.

    Then reboot into Safe Mode

    As the computer starts up, tap the F8 key several times.

    On the Boot menu Choose Safe Mode.

    Click thu all the prompts to get to desktop.

    At Desktop
    My Computer C: drive. Double-click to open.

    Look for a folder called SD Fix. Double-click to enter SD Fix.

    Double-click to RunThis.bat. Type Y to begin.

    SD Fix does its job.

    When prompted hit the enter key to restart the computer

    Your computer will reboot.

    On normal restart the Fixtool will run again and complete the removal process then say Finished,
    Hit the Enter key to end the script and load your desktop icons.

    Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
    Attach the Report.txt file to your next post.
    =========================================
    Download ComboFix

    NOTE: If you have had ComboFix more than a few days old delete and re-download.

    Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
    Or here: http://subs.geekstogo.com/ComboFix.exe

    Double click combofix.exe follow the prompts.

    When finished, it will open a log.
    Attach the log and a new HJT log in your next reply.

    Note: Do not click combofix's window while its running. That may cause it to stall.

    Mike
     
  5. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Hi Mike,
    Okay, so I did all of the above. I've attached all the logs I think I was supposed to.
    Thanks,
    -Shawn
     
  6. mflynn

    mflynn TS Rookie Posts: 2,793

    There are no logs attached!

    SDFix: browse to C:\SDFix and open Report.txt and attach!

    ComboFix: browse to C:\ and find ComboFix.txt and attach!

    Mike
     
  7. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    I can't upload them, this forum says that I already uploaded them once.
    I tried renaming them but that didn't work either.
    So I guess they're already attached? Please advise.
     
  8. mflynn

    mflynn TS Rookie Posts: 2,793

    OK open them and paste to the open screen!

    If to big overlap to another post!

    I think we are finished but need to be sure.

    Mike
     
  9. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Report.txt log

    Report.txt:

    SDFix: Version 1.240
    Run by John Graney on Sun 02/08/2009 at 04:47 PM

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\SDFix

    Checking Services :


    Restoring Default Security Values
    Restoring Default Hosts File

    Rebooting


    Checking Files :

    No Trojan Files Found






    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-08 17:20:23
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"

    Remaining Files :



    Files with Hidden Attributes :

    Mon 7 Feb 2005 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
    Mon 7 Feb 2005 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
    Mon 7 Feb 2005 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
    Sat 24 Jan 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
    Tue 23 Dec 2008 224 A..H. --- "C:\Program Files\Common Files\AOL\IPHSend\IPH.BAK"
    Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\John Graney\Application Data\U3\temp\Launchpad Removal.exe"

    Finished!
     
  10. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    ComboFixLog.txt Part 1

    ComboFixLog.txt:

    ComboFix 09-02-08.02 - John Graney 2009-02-09 14:55:02.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.70 [GMT -5:00]
    Running from: c:\documents and settings\John Graney\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\autorun.inf
    c:\windows\clear.bat
    c:\windows\system32\_000006_.tmp.dll

    .
    ((((((((((((((((((((((((( Files Created from 2009-01-09 to 2009-02-09 )))))))))))))))))))))))))))))))
    .

    2009-02-08 16:45 . 2009-02-08 16:45 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
    2009-02-08 16:41 . 2009-02-08 16:42 <DIR> d-------- c:\windows\ERUNT
    2009-02-08 16:22 . 2009-02-08 17:22 <DIR> d-------- C:\SDFix
    2009-02-07 16:58 . 2009-02-07 16:58 <DIR> d-------- C:\PollManager
    2009-02-07 15:49 . 2009-02-07 15:49 73,728 --a------ c:\windows\system32\javacpl.cpl
    2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\John Graney\Application Data\Malwarebytes
    2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-02-07 12:46 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
    2009-02-07 12:46 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
    2009-02-07 12:31 . 2009-02-07 12:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
    2009-02-07 11:16 . 2009-02-07 11:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\SUPERAntiSpyware
    2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\documents and settings\John Graney\Application Data\SUPERAntiSpyware.com
    2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\program files\KC Softwares
    2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\documents and settings\John Graney\Application Data\KC Softwares
    2009-02-07 10:26 . 2009-02-07 10:26 <DIR> d-------- c:\program files\CCleaner
    2009-02-07 09:21 . 2009-02-09 14:59 <DIR> d-------- c:\windows\system32\NtmsData
    2009-02-07 09:07 . 2009-02-07 09:09 14,688,256 --a------ c:\windows\sectest.db
    2009-02-07 09:04 . 2009-02-09 14:55 <DIR> d-------- c:\windows\system32\CatRoot2
    2009-01-31 17:13 . 2009-01-31 17:13 28,976 --ah----- c:\windows\system32\mlfcache.dat
    2009-01-28 17:25 . 2009-01-28 17:26 <DIR> d-------- c:\windows\system32\Adobe
    2009-01-25 13:33 . 2009-01-25 13:33 6,395 --a------ c:\windows\machine.ver
    2009-01-25 13:16 . 2009-01-25 13:16 <DIR> d-------- c:\program files\Common Files\Adobe AIR
    2009-01-25 13:11 . 2009-01-25 13:11 <DIR> d-------- c:\windows\Logs
    2009-01-25 13:10 . 2009-01-25 13:10 <DIR> d-------- c:\program files\SiSoftware
    2009-01-24 18:51 . 2009-01-24 18:51 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Apple Computer
    2009-01-24 18:31 . 2005-04-20 16:35 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
    2009-01-24 18:31 . 2005-04-20 17:12 <DIR> d-------- c:\documents and settings\Administrator\Application Data\You've Got Pictures Screensaver
    2009-01-24 18:31 . 2005-04-20 16:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\toshiba
    2009-01-24 18:31 . 2005-08-19 11:45 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intuit
    2009-01-24 18:31 . 2005-04-20 17:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterVideo
    2009-01-24 18:31 . 2005-04-20 17:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterTrust
    2009-01-24 18:31 . 2005-08-19 10:38 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AOL
    2009-01-24 18:31 . 2009-01-24 18:31 <DIR> d-------- c:\documents and settings\Administrator
    2009-01-24 18:07 . 2009-01-24 18:07 <DIR> d-------- c:\program files\Trend Micro
    2009-01-24 18:05 . 2009-01-24 18:05 812,344 --a------ c:\program files\HJTInstall.exe
    2009-01-24 10:01 . 2009-01-24 10:01 <DIR> d-------- c:\program files\Windows Media Connect 2
    2009-01-24 09:59 . 2009-01-24 10:00 <DIR> d-------- c:\windows\system32\drivers\UMDF

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-02-07 20:52 --------- d-----w c:\program files\Sun
    2009-02-07 20:49 410,984 ----a-w c:\windows\system32\deploytk.dll
    2009-02-07 20:49 --------- d-----w c:\program files\Java
    2009-02-01 14:06 --------- d-----w c:\documents and settings\John Graney\Application Data\Apple Computer
    2009-01-31 15:55 --------- d-----w c:\program files\FinePixViewerS
    2009-01-25 19:45 --------- d-----w c:\program files\Verizon
    2009-01-25 18:37 --------- d-----w c:\program files\Common Files\Symantec Shared
    2009-01-25 18:37 --------- d-----w c:\documents and settings\John Graney\Application Data\Symantec
    2009-01-25 18:37 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
    2009-01-25 18:17 --------- d-----w c:\program files\Common Files\Adobe
    2009-01-25 17:49 --------- d-----w c:\program files\Symantec
    2009-01-18 18:03 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
    2009-01-16 12:35 --------- d-----w c:\program files\Google
    2009-01-07 00:51 --------- d-----w c:\program files\AOL Radio Toolbar
    2009-01-07 00:51 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Radio Toolbar
    2009-01-06 21:49 --------- d-----w c:\program files\epson
    2009-01-02 22:32 --------- d-----w c:\program files\TLCN2006
    2008-12-25 19:56 --------- d-----w c:\documents and settings\John Graney\Application Data\FUJIFILM
    2008-12-25 19:48 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-12-25 19:48 --------- d-----w c:\documents and settings\John Graney\Application Data\InstallShield
    2008-12-13 16:18 --------- d-----w c:\program files\iTunes
    2008-12-13 16:18 --------- d-----w c:\program files\iPod
    2008-12-13 16:18 --------- d-----w c:\program files\Common Files\Apple
    2008-12-13 16:18 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
    2008-12-13 16:15 --------- d-----w c:\program files\QuickTime
    2008-12-13 16:10 --------- d-----w c:\program files\Safari
    2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
    2008-10-01 19:53 34,170 ----a-w c:\program files\adobe.zip
    2008-04-29 19:01 630,784 -c--a-w c:\documents and settings\John Graney\GoToAssist_chat2way__317_en.exe
    2005-04-21 01:51 105 -c--a-w c:\documents and settings\All Users\B1.bat
    2002-02-20 20:39 59 -c--a-w c:\program files\quark 5 validation_serial.txt
    2002-01-17 01:53 3,587,656 -c--a-w c:\program files\QuarkXPress 5.0.msi
    2002-01-17 01:53 27,363,013 ----a-w c:\program files\Data.Cab
    2002-01-13 04:20 62,697 -c--a-w c:\program files\setup.ini
    2001-12-07 01:03 70,222 -c--a-w c:\program files\ReadMe.pdf
    2001-11-14 00:13 50,280 -c--a-w c:\program files\License Agreement.pdf
    2001-11-05 20:55 68,146 -c--a-w c:\program files\Contacting Quark.pdf
    2001-11-03 00:00 70,929 -c--a-w c:\program files\Installation Instructions.pdf
    2001-10-26 00:21 75,264 ----a-w c:\program files\About PDF Files.wri
    2000-08-30 20:46 1,807,072 ------w c:\program files\vcredist.exe
    2000-07-27 14:49 1,526,275 -c--a-w c:\program files\instmsiw.exe
    2000-07-27 14:49 1,513,987 -c--a-w c:\program files\instmsia.exe
    1998-06-17 08:00 77,878 ----a-w c:\program files\Msvcirt.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{69224684-5682-419b-9fe4-ef7946ee3319}"= "c:\program files\AOL Radio Toolbar\aolradiotb.dll" [2008-12-17 1275176]

    [HKEY_CLASSES_ROOT\clsid\{69224684-5682-419b-9fe4-ef7946ee3319}]
    [HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch.1]
    [HKEY_CLASSES_ROOT\TypeLib\{1c3d0b2b-1b25-4b37-8bf8-7b57eba62691}]
    [HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
    "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-05 68856]
    "Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-08-09 1261384]
    "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]




    ***CONTINUED IN NEXT POST***
     
  11. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    ComboFixLog.txt Part 2

    ***REMAINDER OF LOG***


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2005-04-25 339968]
    "NDSTray.exe"="c:\program files\TOSHIBA\ConfigFree\NDSTray.exe" [2005-02-08 962560]
    "Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
    "SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-15 122880]
    "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
    "PINGER"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
    "LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-04-12 184320]
    "SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 98394]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 688218]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
    "TFncKy"="c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe" [2004-10-25 114688]
    "PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
    "Pure Networks Port Magic"="c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe" [2005-02-07 99480]
    "Notebook Maximizer"="c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
    "AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
    "HostManager"="c:\program files\Common Files\AOL\1170454760\ee\AOLSoftware.exe" [2007-10-08 41824]
    "Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
    "PDF Printer Pilot agent"="c:\program files\PDF Printer Pilot Pro\pdfpragent.exe" [2007-06-07 90112]
    "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
    "EPSON Stylus C88 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE" [2005-01-27 98304]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-07 136600]
    "AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 c:\windows\agrsmmsg.exe]
    "TPSMain"="TPSMain.exe" [2004-12-28 c:\windows\system32\TPSMain.exe]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2009-01-28 181624]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2008-12-25 303104]
    RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-08-19 155648]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "41651:TCP"= 41651:TCP:pORT_41651
    "59496:TCP"= 59496:TCP:pORT_59496

    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
    R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-05-29 388936]
    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
    S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe [2009-01-25 98488]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-02-09 c:\windows\Tasks\NSSstub.job
    - c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-01-28 17:26]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.jgmachineco.com/
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: &AOL Radio Toolbar Search - c:\documents and settings\All Users\Application Data\AOL Radio Toolbar\ieToolbar\resources\en-US\local\search.html
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-02-09 14:59:44
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\Implemented Categories]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\InprocServer32]
    @DACL=(02 0000)
    @="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
    "ThreadingModel"="Apartment"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\Implemented Categories]
    @DACL=(02 0000)

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\InprocServer32]
    @DACL=(02 0000)
    @="c:\\Program Files\\Starware\\bin\\Starware.dll"
    "ThreadingModel"="Apartment"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CA356D79-679B-4b4c-8E49-5AF97014F4C1}\InprocServer32]
    @DACL=(02 0000)
    @="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
    "ThreadingModel"="Apartment"

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{D49E9D35-254C-4c6a-9D17-95018D228FF5}\InprocServer32]
    @DACL=(02 0000)
    @="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
    "ThreadingModel"="Apartment"
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(408)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    c:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\acs.exe
    c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
    c:\windows\system32\DVDRAMSV.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\toshiba\IVP\swupdate\swupdtmr.exe
    c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
    c:\windows\wanmpsvc.exe
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\fxssvc.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\system32\TPSBattM.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-02-09 15:03:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-02-09 20:03:34

    Pre-Run: 68,343,332,864 bytes free
    Post-Run: 68,317,679,616 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

    252 --- E O F --- 2009-01-26 01:28:12
     
     
  12. mflynn

    mflynn TS Rookie Posts: 2,793

    Still some residues I think!

    As a coverall download Norman Malware Cleaner http://www.majorgeeks.com/download5450.html

    Download then boot to safe mode only and run. Do this when you go to work or bed as it is very thorough and will take hours. Running in safe mode allows removal of some things that would give problems in normal mode but safe mode is slower also.

    Mike
     
  13. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Thanks, Mike. I will do that this morning and report back this afternoon/evening.
     
  14. mflynn

    mflynn TS Rookie Posts: 2,793

    OK!

    That really should do it!

    If so I will post closing comments and suggestions on cleaning up some of the special tools etc. And a few other things to do to stay clean.

    I do hope you expected me to be detailed and thorough!

    Mike
     
  15. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Listing Viruses.....

    Mike,
    It finished scanning, and has been listing viruses for the past 4.5 hours.
    I guess this is why you recommended setting it up and walking away from it.
    Stay tuned...
     
  16. mflynn

    mflynn TS Rookie Posts: 2,793

    Yes exactly just hang in there!

    Mike
     
  17. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Okay, it's done listing viruses. Quit and reboot in Normal Mode?
    Or anything else first? Save a log or anything?
    Please advise.
    -Shawn
     
  18. mflynn

    mflynn TS Rookie Posts: 2,793

    Yes save log and attach it after rebooting to normal mode!

    Also a status report of how computer is working now.

    Mike
     
  19. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    It looked like it had stopped; suddenly, it started again.
    It had just been sitting there, I didn't touch anything and actually came upstairs to use another comp to contact you!
    I'm guessing just leave it alone until it stops doing anything?
    -Shawn
     
  20. mflynn

    mflynn TS Rookie Posts: 2,793

    It's up to you I know it is a long time, but I didn't think it would be this long!

    I'll say if you do complete it you will be clean.

    Mike
     
  21. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Very well. I'm gonna leave it alone and see what it's doing in the morning.
    I'm not sure how to save a log though. There's only five or so buttons. Should I just copy all the data and paste into a blank .txt file?
    And by status report do you simply mean how I feel the computer is behaving, or specific reports?
    Thanks,
    -Shawn
     
  22. mflynn

    mflynn TS Rookie Posts: 2,793

    Yes how computer is working. But of course after this finishes and you check it!

    There should be a log file but do your best.

    The bad thing here is I believe you are clean but based of what you had that we cleaned I just wanted to be sure!

    Mike
     
  23. spk1973

    spk1973 TS Rookie Topic Starter Posts: 52

    Mike,
    Whew.
    Laptop runs LIKE A DREAM. I'm not kidding, super-duper fast and responsive.
    Wow. I don't know how I ever could have cleaned so much crap off this machine as you helped me to. Thank you, thank you, THANK YOU!!
    Attached please find log file.
    Again, whew. Thanks ever so much for your help. Of course, if more needs to be done with this, let me know. I know we're not over the finish line just yet.
    -Shawn
     
  24. raybay

    raybay TS Evangelist Posts: 10,716   +6

    Thank you for the updates. I, for one, would not have believed that a bunch of junque infestations would cause a buffer overrun... still don't understand why.
     
  25. mflynn

    mflynn TS Rookie Posts: 2,793

    You did a fantastic job.

    You followed directions and got the job done.

    This thread is here for you to review when needed. Try to update and run MBAM and SAS once every couple of weeks or at first sign of trouble or suspicion, even the Norman once a month. Just schedule them when you are away for work or sleeping. Much better than doing them under the gun.

    Thread closing ------------------------------------------------------------------------------------

    Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

    Remove ComboFix
    Start-Run
    type
    combofix /u
    Hit enter or click OK.

    Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

    Save to desktop.

    This will remove all the tools we used to clean your computer.

    Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

    Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

    If prompted to Reboot click, Yes.
    OTCleanit will delete itself when finished, If not delete it by yourself.

    --------------------------------------------------------------------------------------------------------
    Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

    Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

    KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
    Fantastic cleaner.
    --------------------------------------------------------------------------------------------------------
    The issues can and are likely found is in System Restore so do the below

    Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

    Then Start-Programs-Accessories-System Tools-Disk Cleanup
    Click OK to accept C:
    Select all Boxes
    Then click More Options
    Here click System Restore and OK to "Are you sure" and the OK to Run.

    As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

    It clears what is known as Shadow copies which are used by specialized back up programs.

    This is if you have the Volume Shadow Copy running which is the default.
    --------------------------------------------------------------------------------------------------------

    Every two weeks or so, run MBAM and SAS until clean.

    They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

    If they find something they can not clean, then get back to us.

    Additionally run CCleaner. ATF-Cleaner and KCleaner.
    --------------------------------------------------------------------------------------------------------
    I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

    It was designed to be used with and to co-exist with other Virus scanners.

    Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

    It's like looking at it with 2 sets of eyes and from a different angle.

    It works like some Firewalls do to learn what is good/bad.

    After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

    As it queries you about the prompt to help you determine to approve or not you can google it with one click.

    http://www.threatfire.com/Download/
    -------------------------------------------------------------------------------------
    Look at http://www.javacoolsoftware.com/spywareblaster.html

    Run SpyBot ocassionally and use the Immunize function.
    http://www.safer-networking.org/en/download/

    I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

    Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

    A Disk Scan (chkdsk) and Defrag are in order.

    Mike
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.