also @ TechSpot: Google quietly adds conversational search to Chrome 27

TechSpot

TechSpot News Products Downloads Forums

About
Sign in

Welcome to TechSpot

Why should I register?

Sign up for a new account or log in here:

Forgot your password?

Couldn't sign you in, please try again.

Buffer Overrun Detected when starting Internet Explorer

Discussion in 'Windows OS' started by spk1973, Jan 24, 2009.

Page 2 of 3

raybay TechSpot Evangelist Posts: 10,720 +6

If you installed Internet Explorer 7 over an existing install of Internet Explorer 6.1, Use Add or Remove in the Control panel to remove Internet Explorer 7.
Then reboot and try your system without Internet Explorer 7...

Then if it works, reinstall Internet Explorer 7 after using CCleaner to clean, then Defragment, then a reboot.

raybay, Feb 7, 2009

#21
mflynn Newcomer, in training Posts: 2,793

Ram will not fix a Buffer overflow!

And he can not access updates at this point. That is what we want to do fix the Buffer overflow then do the Windows Updates.

Mike

mflynn, Feb 7, 2009

#22
spk1973 Newcomer, in training Posts: 52

mflynn said: ↑

Ok that usually does it.

So do the below..

Temp files can cause this so clean up deeply with these

CCleaner http://www.ccleaner.com/download/builds get the SLIM at bottom of screen.
Run CCleaner twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.
-------------------------------------------
Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html
Temp and Registry, repeatedly until no more found including FF and Opera (but here do not clear Passwords).
-------------------------------------------
KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner. Run Analyze and clean.
-------------------------------------------
Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "Cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.

After the above reboot and test for the Buffer Overrun. before continuing below but even if fixed I advise the below!

-------------------------------------------
Finally run SAS http://www.techspot.com/downloads/2695-superantispyware.html
I am recommending this for one of its repair tools, but go ahead and do a Malware scan and post the results (this will tell us if we have malware that could cause this issue). We may not need the tools from SAS if the other above works.

Mike

OK, so I did everything above, and there were 159 files detected by SAS. I've attached the scanner log. What next?
Thanks for your help so far. I think I might be getting to the problem slowly but surely.

spk1973, Feb 7, 2009

#23
mflynn Newcomer, in training Posts: 2,793

Ouch!

Not good! May not be all of problem but it is not logical to try and repair a System issue with Malware! We need to Clean the Malware first!

We may after cleaning need to reinstall IE7 as advised by Raybay but until we are clean we do not want to install anything except Malware cleaners, as it could be compromised as soon as installed.

You owe it to yourself to do the 8 Steps now! http://www.techspot.com/vb/topic58138.html

With these exceptions!

1. You have already done CCleaner so skip that one.
2. You have already done SAS
3. Do nothing with Virus scanners or Firewalls yet.

Update SAS Scan again Quick scan this time click to remove the tracking cookies and attach another log.

Then get the HJT and MBAM installed run and logs attached!

Mike

mflynn, Feb 7, 2009

#24
spk1973 Newcomer, in training Posts: 52

mflynn said: ↑

Ouch!

Not good! May not be all of problem but it is not logical to try and repair a System issue with Malware! We need to Clean the Malware first!

We may after cleaning need to reinstall IE7 as advised by Raybay but until we are clean we do not want to install anything except Malware cleaners, as it could be compromised as soon as installed.

You owe it to yourself to do the 8 Steps now! http://www.techspot.com/vb/topic58138.html

With these exceptions!

1. You have already done CCleaner so skip that one.
2. You have already done SAS
3. Do nothing with Virus scanners or Firewalls yet.

Update SAS Scan again Quick scan this time click to remove the tracking cookies and attach another log.

Then get the HJT and MBAM installed run and logs attached!

Mike

Thanks, Mike. I quarantined/removed the bad files, but I'm gonna go through the steps you mentioned.
By the way IE WORKS!!!!!! YOOHOO!!! I have visited the update page and gotten critical updates and was working through the custom updates but it won't let me install this one:
Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update (KB951847) x86
Thanks so much for your (and raybay and joebeard's) help. I will post later today with the results from the 8 steps, HJT and MBAM logs attached. It's great that IE works but my end goal of all this is to clean this computer good. It certainly appears that I'm getting there.
Thanks again,
-Shawn

spk1973, Feb 7, 2009

#25

mflynn Newcomer, in training Posts: 2,793

Shawn!

Ok it is fixed, thought it might be. But I advise you again. Do not be installing or updating until you are clean. They could be compromised as soon as they are installed.

And based on just the SAS, I believe MBAM will find much more.

Mike

mflynn, Feb 7, 2009

#26

raybay TechSpot Evangelist Posts: 10,720 +6

But low ram will sometimes create a condition that will cause a buffer overflow to occur because of impact on other components.

raybay, Feb 7, 2009

#27
spk1973 Newcomer, in training Posts: 52

mflynn said: ↑

Ouch!

Not good! May not be all of problem but it is not logical to try and repair a System issue with Malware! We need to Clean the Malware first!

We may after cleaning need to reinstall IE7 as advised by Raybay but until we are clean we do not want to install anything except Malware cleaners, as it could be compromised as soon as installed.

You owe it to yourself to do the 8 Steps now! http://www.techspot.com/vb/topic58138.html

With these exceptions!

1. You have already done CCleaner so skip that one.
2. You have already done SAS
3. Do nothing with Virus scanners or Firewalls yet.

Update SAS Scan again Quick scan this time click to remove the tracking cookies and attach another log.

Then get the HJT and MBAM installed run and logs attached!

Mike

Okay, Mike,
I think I've done everything I should...I may have somehow updated before finishing with the scans, but a number of stuff was quarantined/removed. Attached are the HJT, SAS and MBAM logs.
Thanks for all your help.
-Shawn

spk1973, Feb 7, 2009

#28
mflynn Newcomer, in training Posts: 2,793

HI Shawn

Had to drop out on you! Dinner and a great movie "Taken" with Liam Neeson. Fantastic movie. next "Gran Torino"

Anyway..

The updates are likely OK based on what I saw of the Malware. You were lucky this time.

OK UPDATE and run MBAM and SAS both in Quick scan mode, to confirm they come up clean.

To be sure do the 2 below and post log if they are clean we are finished.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike

mflynn, Feb 7, 2009

#29
spk1973 Newcomer, in training Posts: 52

mflynn said: ↑

HI Shawn

Had to drop out on you! Dinner and a great movie "Taken" with Liam Neeson. Fantastic movie. next "Gran Torino"

Anyway..

The updates are likely OK based on what I saw of the Malware. You were lucky this time.

OK UPDATE and run MBAM and SAS both in Quick scan mode, to confirm they come up clean.

To be sure do the 2 below and post log if they are clean we are finished.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike

Hi Mike,
Okay, so I did all of the above. I've attached all the logs I think I was supposed to.
Thanks,
-Shawn

spk1973, Feb 9, 2009

#30
mflynn Newcomer, in training Posts: 2,793

There are no logs attached!

SDFix: browse to C:\SDFix and open Report.txt and attach!

ComboFix: browse to C:\ and find ComboFix.txt and attach!

Mike

mflynn, Feb 9, 2009

#31
spk1973 Newcomer, in training Posts: 52

mflynn said: ↑

There are no logs attached!

SDFix: browse to C:\SDFix and open Report.txt and attach!

ComboFix: browse to C:\ and find ComboFix.txt and attach!

Mike

I can't upload them, this forum says that I already uploaded them once.
I tried renaming them but that didn't work either.
So I guess they're already attached? Please advise.

spk1973, Feb 9, 2009

#32
mflynn Newcomer, in training Posts: 2,793

OK open them and paste to the open screen!

If to big overlap to another post!

I think we are finished but need to be sure.

Mike

mflynn, Feb 9, 2009

#33
spk1973 Newcomer, in training Posts: 52

Report.txt log

Report.txt:

SDFix: Version 1.240
Run by John Graney on Sun 02/08/2009 at 04:47 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Checking Files :

No Trojan Files Found

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 17:20:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabledxpsp2res.dll,-22019"

Remaining Files :

Files with Hidden Attributes :

Mon 7 Feb 2005 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
Mon 7 Feb 2005 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
Mon 7 Feb 2005 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
Sat 24 Jan 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 23 Dec 2008 224 A..H. --- "C:\Program Files\Common Files\AOL\IPHSend\IPH.BAK"
Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\John Graney\Application Data\U3\temp\Launchpad Removal.exe"

Finished!

spk1973, Feb 9, 2009

#34
spk1973 Newcomer, in training Posts: 52

ComboFixLog.txt Part 1

ComboFixLog.txt:

ComboFix 09-02-08.02 - John Graney 2009-02-09 14:55:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.70 [GMT -5:00]
Running from: c:\documents and settings\John Graney\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\autorun.inf
c:\windows\clear.bat
c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-01-09 to 2009-02-09 )))))))))))))))))))))))))))))))
.

2009-02-08 16:45 . 2009-02-08 16:45 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-02-08 16:41 . 2009-02-08 16:42 <DIR> d-------- c:\windows\ERUNT
2009-02-08 16:22 . 2009-02-08 17:22 <DIR> d-------- C:\SDFix
2009-02-07 16:58 . 2009-02-07 16:58 <DIR> d-------- C:\PollManager
2009-02-07 15:49 . 2009-02-07 15:49 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\John Graney\Application Data\Malwarebytes
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-07 12:46 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-07 12:46 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-07 12:31 . 2009-02-07 12:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-02-07 11:16 . 2009-02-07 11:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\documents and settings\John Graney\Application Data\SUPERAntiSpyware.com
2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\program files\KC Softwares
2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\documents and settings\John Graney\Application Data\KC Softwares
2009-02-07 10:26 . 2009-02-07 10:26 <DIR> d-------- c:\program files\CCleaner
2009-02-07 09:21 . 2009-02-09 14:59 <DIR> d-------- c:\windows\system32\NtmsData
2009-02-07 09:07 . 2009-02-07 09:09 14,688,256 --a------ c:\windows\sectest.db
2009-02-07 09:04 . 2009-02-09 14:55 <DIR> d-------- c:\windows\system32\CatRoot2
2009-01-31 17:13 . 2009-01-31 17:13 28,976 --ah----- c:\windows\system32\mlfcache.dat
2009-01-28 17:25 . 2009-01-28 17:26 <DIR> d-------- c:\windows\system32\Adobe
2009-01-25 13:33 . 2009-01-25 13:33 6,395 --a------ c:\windows\machine.ver
2009-01-25 13:16 . 2009-01-25 13:16 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-01-25 13:11 . 2009-01-25 13:11 <DIR> d-------- c:\windows\Logs
2009-01-25 13:10 . 2009-01-25 13:10 <DIR> d-------- c:\program files\SiSoftware
2009-01-24 18:51 . 2009-01-24 18:51 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Apple Computer
2009-01-24 18:31 . 2005-04-20 16:35 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
2009-01-24 18:31 . 2005-04-20 17:12 <DIR> d-------- c:\documents and settings\Administrator\Application Data\You've Got Pictures Screensaver
2009-01-24 18:31 . 2005-04-20 16:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\toshiba
2009-01-24 18:31 . 2005-08-19 11:45 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intuit
2009-01-24 18:31 . 2005-04-20 17:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterVideo
2009-01-24 18:31 . 2005-04-20 17:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterTrust
2009-01-24 18:31 . 2005-08-19 10:38 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AOL
2009-01-24 18:31 . 2009-01-24 18:31 <DIR> d-------- c:\documents and settings\Administrator
2009-01-24 18:07 . 2009-01-24 18:07 <DIR> d-------- c:\program files\Trend Micro
2009-01-24 18:05 . 2009-01-24 18:05 812,344 --a------ c:\program files\HJTInstall.exe
2009-01-24 10:01 . 2009-01-24 10:01 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-01-24 09:59 . 2009-01-24 10:00 <DIR> d-------- c:\windows\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 20:52 --------- d-----w c:\program files\Sun
2009-02-07 20:49 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-07 20:49 --------- d-----w c:\program files\Java
2009-02-01 14:06 --------- d-----w c:\documents and settings\John Graney\Application Data\Apple Computer
2009-01-31 15:55 --------- d-----w c:\program files\FinePixViewerS
2009-01-25 19:45 --------- d-----w c:\program files\Verizon
2009-01-25 18:37 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-25 18:37 --------- d-----w c:\documents and settings\John Graney\Application Data\Symantec
2009-01-25 18:37 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-01-25 18:17 --------- d-----w c:\program files\Common Files\Adobe
2009-01-25 17:49 --------- d-----w c:\program files\Symantec
2009-01-18 18:03 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2009-01-16 12:35 --------- d-----w c:\program files\Google
2009-01-07 00:51 --------- d-----w c:\program files\AOL Radio Toolbar
2009-01-07 00:51 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Radio Toolbar
2009-01-06 21:49 --------- d-----w c:\program files\epson
2009-01-02 22:32 --------- d-----w c:\program files\TLCN2006
2008-12-25 19:56 --------- d-----w c:\documents and settings\John Graney\Application Data\FUJIFILM
2008-12-25 19:48 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-25 19:48 --------- d-----w c:\documents and settings\John Graney\Application Data\InstallShield
2008-12-13 16:18 --------- d-----w c:\program files\iTunes
2008-12-13 16:18 --------- d-----w c:\program files\iPod
2008-12-13 16:18 --------- d-----w c:\program files\Common Files\Apple
2008-12-13 16:18 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-13 16:15 --------- d-----w c:\program files\QuickTime
2008-12-13 16:10 --------- d-----w c:\program files\Safari
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-10-01 19:53 34,170 ----a-w c:\program files\adobe.zip
2008-04-29 19:01 630,784 -c--a-w c:\documents and settings\John Graney\GoToAssist_chat2way__317_en.exe
2005-04-21 01:51 105 -c--a-w c:\documents and settings\All Users\B1.bat
2002-02-20 20:39 59 -c--a-w c:\program files\quark 5 validation_serial.txt
2002-01-17 01:53 3,587,656 -c--a-w c:\program files\QuarkXPress 5.0.msi
2002-01-17 01:53 27,363,013 ----a-w c:\program files\Data.Cab
2002-01-13 04:20 62,697 -c--a-w c:\program files\setup.ini
2001-12-07 01:03 70,222 -c--a-w c:\program files\ReadMe.pdf
2001-11-14 00:13 50,280 -c--a-w c:\program files\License Agreement.pdf
2001-11-05 20:55 68,146 -c--a-w c:\program files\Contacting Quark.pdf
2001-11-03 00:00 70,929 -c--a-w c:\program files\Installation Instructions.pdf
2001-10-26 00:21 75,264 ----a-w c:\program files\About PDF Files.wri
2000-08-30 20:46 1,807,072 ------w c:\program files\vcredist.exe
2000-07-27 14:49 1,526,275 -c--a-w c:\program files\instmsiw.exe
2000-07-27 14:49 1,513,987 -c--a-w c:\program files\instmsia.exe
1998-06-17 08:00 77,878 ----a-w c:\program files\Msvcirt.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{69224684-5682-419b-9fe4-ef7946ee3319}"= "c:\program files\AOL Radio Toolbar\aolradiotb.dll" [2008-12-17 1275176]

[HKEY_CLASSES_ROOT\clsid\{69224684-5682-419b-9fe4-ef7946ee3319}]
[HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{1c3d0b2b-1b25-4b37-8bf8-7b57eba62691}]
[HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-05 68856]
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-08-09 1261384]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]

***CONTINUED IN NEXT POST***

spk1973, Feb 9, 2009

#35
spk1973 Newcomer, in training Posts: 52

ComboFixLog.txt Part 2

***REMAINDER OF LOG***

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2005-04-25 339968]
"NDSTray.exe"="c:\program files\TOSHIBA\ConfigFree\NDSTray.exe" [2005-02-08 962560]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-15 122880]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
"PINGER"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-04-12 184320]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 688218]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"TFncKy"="c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe" [2004-10-25 114688]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
"Pure Networks Port Magic"="c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe" [2005-02-07 99480]
"Notebook Maximizer"="c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"HostManager"="c:\program files\Common Files\AOL\1170454760\ee\AOLSoftware.exe" [2007-10-08 41824]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"PDF Printer Pilot agent"="c:\program files\PDF Printer Pilot Pro\pdfpragent.exe" [2007-06-07 90112]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"EPSON Stylus C88 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE" [2005-01-27 98304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-07 136600]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 c:\windows\agrsmmsg.exe]
"TPSMain"="TPSMain.exe" [2004-12-28 c:\windows\system32\TPSMain.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2009-01-28 181624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2008-12-25 303104]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-08-19 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"41651:TCP"= 41651:TCPORT_41651
"59496:TCP"= 59496:TCPORT_59496

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-05-29 388936]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe [2009-01-25 98488]
.
Contents of the 'Scheduled Tasks' folder

2009-02-09 c:\windows\Tasks\NSSstub.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-01-28 17:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.jgmachineco.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Radio Toolbar Search - c:\documents and settings\All Users\Application Data\AOL Radio Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-09 14:59:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\Implemented Categories]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\Implemented Categories]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\InprocServer32]
@DACL=(02 0000)
@="c:\\Program Files\\Starware\\bin\\Starware.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CA356D79-679B-4b4c-8E49-5AF97014F4C1}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{D49E9D35-254C-4c6a-9D17-95018D228FF5}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(408)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\acs.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\fxssvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\TPSBattM.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-09 15:03:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-09 20:03:34

Pre-Run: 68,343,332,864 bytes free
Post-Run: 68,317,679,616 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

252 --- E O F --- 2009-01-26 01:28:12

spk1973, Feb 9, 2009

#36
mflynn Newcomer, in training Posts: 2,793

Still some residues I think!

As a coverall download Norman Malware Cleaner http://www.majorgeeks.com/download5450.html

Download then boot to safe mode only and run. Do this when you go to work or bed as it is very thorough and will take hours. Running in safe mode allows removal of some things that would give problems in normal mode but safe mode is slower also.

Mike

mflynn, Feb 10, 2009

#37
spk1973 Newcomer, in training Posts: 52

Thanks, Mike. I will do that this morning and report back this afternoon/evening.

spk1973, Feb 10, 2009

#38
mflynn Newcomer, in training Posts: 2,793

OK!

That really should do it!

If so I will post closing comments and suggestions on cleaning up some of the special tools etc. And a few other things to do to stay clean.

I do hope you expected me to be detailed and thorough!

Mike

mflynn, Feb 10, 2009

#39
spk1973 Newcomer, in training Posts: 52

Listing Viruses.....

Mike,
It finished scanning, and has been listing viruses for the past 4.5 hours.
I guess this is why you recommended setting it up and walking away from it.
Stay tuned...

spk1973, Feb 10, 2009

#40

Page 2 of 3

Topic Status:: Not open for further replies.

Add New Comment

	Social Login & Guest Posting			TechSpot Members Login here or sign up for free, it takes about a minute.
Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.