Buffer Overrun Detected when starting Internet Explorer

Status
Not open for further replies.
Shawn!

Ok it is fixed, thought it might be. But I advise you again. Do not be installing or updating until you are clean. They could be compromised as soon as they are installed.

And based on just the SAS, I believe MBAM will find much more.

Mike
 
But low ram will sometimes create a condition that will cause a buffer overflow to occur because of impact on other components.
 
mflynn said:
Ouch!

Not good! May not be all of problem but it is not logical to try and repair a System issue with Malware! We need to Clean the Malware first!

We may after cleaning need to reinstall IE7 as advised by Raybay but until we are clean we do not want to install anything except Malware cleaners, as it could be compromised as soon as installed.

You owe it to yourself to do the 8 Steps now! https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/

With these exceptions!

1. You have already done CCleaner so skip that one.
2. You have already done SAS
3. Do nothing with Virus scanners or Firewalls yet.

Update SAS Scan again Quick scan this time click to remove the tracking cookies and attach another log.

Then get the HJT and MBAM installed run and logs attached!

Mike
Click to expand...

Okay, Mike,
I think I've done everything I should...I may have somehow updated before finishing with the scans, but a number of stuff was quarantined/removed. Attached are the HJT, SAS and MBAM logs.
Thanks for all your help.
-Shawn
 
HI Shawn

Had to drop out on you! Dinner and a great movie "Taken" with Liam Neeson. Fantastic movie. next "Gran Torino"

Anyway..

The updates are likely OK based on what I saw of the Malware. You were lucky this time.

OK UPDATE and run MBAM and SAS both in Quick scan mode, to confirm they come up clean.

To be sure do the 2 below and post log if they are clean we are finished.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike
 
mflynn said:
HI Shawn

Had to drop out on you! Dinner and a great movie "Taken" with Liam Neeson. Fantastic movie. next "Gran Torino"

Anyway..

The updates are likely OK based on what I saw of the Malware. You were lucky this time.

OK UPDATE and run MBAM and SAS both in Quick scan mode, to confirm they come up clean.

To be sure do the 2 below and post log if they are clean we are finished.

Download SDFix to Desktop.

http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

On Desktop run SDdFix It will run (install) then close.

Then reboot into Safe Mode

As the computer starts up, tap the F8 key several times.

On the Boot menu Choose Safe Mode.

Click thu all the prompts to get to desktop.

At Desktop
My Computer C: drive. Double-click to open.

Look for a folder called SD Fix. Double-click to enter SD Fix.

Double-click to RunThis.bat. Type Y to begin.

SD Fix does its job.

When prompted hit the enter key to restart the computer

Your computer will reboot.

On normal restart the Fixtool will run again and complete the removal process then say Finished,
Hit the Enter key to end the script and load your desktop icons.

Once the desktop is up, the SDFix report will open on screen and also be saved to the SDFix folder as Report.txt.
Attach the Report.txt file to your next post.
=========================================
Download ComboFix

NOTE: If you have had ComboFix more than a few days old delete and re-download.

Get it here: https://www.techspot.com/downloads/5587-combofix.html
Or here: http://subs.geekstogo.com/ComboFix.exe

Double click combofix.exe follow the prompts.

When finished, it will open a log.
Attach the log and a new HJT log in your next reply.

Note: Do not click combofix's window while its running. That may cause it to stall.

Mike
Click to expand...
Hi Mike,
Okay, so I did all of the above. I've attached all the logs I think I was supposed to.
Thanks,
-Shawn
 
There are no logs attached!

SDFix: browse to C:\SDFix and open Report.txt and attach!

ComboFix: browse to C:\ and find ComboFix.txt and attach!

Mike
 
mflynn said:
There are no logs attached!

SDFix: browse to C:\SDFix and open Report.txt and attach!

ComboFix: browse to C:\ and find ComboFix.txt and attach!

Mike
Click to expand...
I can't upload them, this forum says that I already uploaded them once.
I tried renaming them but that didn't work either.
So I guess they're already attached? Please advise.
 
OK open them and paste to the open screen!

If to big overlap to another post!

I think we are finished but need to be sure.

Mike
 
Report.txt log

Report.txt:

SDFix: Version 1.240
Run by John Graney on Sun 02/08/2009 at 04:47 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-08 17:20:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"

Remaining Files :



Files with Hidden Attributes :

Mon 7 Feb 2005 54,384 A..H. --- "C:\Program Files\America Online 9.0\aolphx.exe"
Mon 7 Feb 2005 156,784 A..H. --- "C:\Program Files\America Online 9.0\aoltray.exe"
Mon 7 Feb 2005 31,344 A..H. --- "C:\Program Files\America Online 9.0\RBM.exe"
Sat 24 Jan 2009 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Tue 23 Dec 2008 224 A..H. --- "C:\Program Files\Common Files\AOL\IPHSend\IPH.BAK"
Wed 4 Oct 2006 3,072,000 A..H. --- "C:\Documents and Settings\John Graney\Application Data\U3\temp\Launchpad Removal.exe"

Finished!
 
ComboFixLog.txt Part 1

ComboFixLog.txt:

ComboFix 09-02-08.02 - John Graney 2009-02-09 14:55:02.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.446.70 [GMT -5:00]
Running from: c:\documents and settings\John Graney\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\autorun.inf
c:\windows\clear.bat
c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2009-01-09 to 2009-02-09 )))))))))))))))))))))))))))))))
.

2009-02-08 16:45 . 2009-02-08 16:45 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll
2009-02-08 16:41 . 2009-02-08 16:42 <DIR> d-------- c:\windows\ERUNT
2009-02-08 16:22 . 2009-02-08 17:22 <DIR> d-------- C:\SDFix
2009-02-07 16:58 . 2009-02-07 16:58 <DIR> d-------- C:\PollManager
2009-02-07 15:49 . 2009-02-07 15:49 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\John Graney\Application Data\Malwarebytes
2009-02-07 12:46 . 2009-02-07 12:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-07 12:46 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-07 12:46 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-07 12:31 . 2009-02-07 12:31 <DIR> d-------- c:\documents and settings\All Users\Application Data\Office Genuine Advantage
2009-02-07 11:16 . 2009-02-07 11:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-02-07 11:15 . 2009-02-07 11:15 <DIR> d-------- c:\documents and settings\John Graney\Application Data\SUPERAntiSpyware.com
2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\program files\KC Softwares
2009-02-07 10:37 . 2009-02-07 10:37 <DIR> d-------- c:\documents and settings\John Graney\Application Data\KC Softwares
2009-02-07 10:26 . 2009-02-07 10:26 <DIR> d-------- c:\program files\CCleaner
2009-02-07 09:21 . 2009-02-09 14:59 <DIR> d-------- c:\windows\system32\NtmsData
2009-02-07 09:07 . 2009-02-07 09:09 14,688,256 --a------ c:\windows\sectest.db
2009-02-07 09:04 . 2009-02-09 14:55 <DIR> d-------- c:\windows\system32\CatRoot2
2009-01-31 17:13 . 2009-01-31 17:13 28,976 --ah----- c:\windows\system32\mlfcache.dat
2009-01-28 17:25 . 2009-01-28 17:26 <DIR> d-------- c:\windows\system32\Adobe
2009-01-25 13:33 . 2009-01-25 13:33 6,395 --a------ c:\windows\machine.ver
2009-01-25 13:16 . 2009-01-25 13:16 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-01-25 13:11 . 2009-01-25 13:11 <DIR> d-------- c:\windows\Logs
2009-01-25 13:10 . 2009-01-25 13:10 <DIR> d-------- c:\program files\SiSoftware
2009-01-24 18:51 . 2009-01-24 18:51 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Apple Computer
2009-01-24 18:31 . 2005-04-20 16:35 <DIR> d-------- c:\documents and settings\Administrator\WINDOWS
2009-01-24 18:31 . 2005-04-20 17:12 <DIR> d-------- c:\documents and settings\Administrator\Application Data\You've Got Pictures Screensaver
2009-01-24 18:31 . 2005-04-20 16:42 <DIR> d-------- c:\documents and settings\Administrator\Application Data\toshiba
2009-01-24 18:31 . 2005-08-19 11:45 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Intuit
2009-01-24 18:31 . 2005-04-20 17:26 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterVideo
2009-01-24 18:31 . 2005-04-20 17:08 <DIR> d-------- c:\documents and settings\Administrator\Application Data\InterTrust
2009-01-24 18:31 . 2005-08-19 10:38 <DIR> d-------- c:\documents and settings\Administrator\Application Data\AOL
2009-01-24 18:31 . 2009-01-24 18:31 <DIR> d-------- c:\documents and settings\Administrator
2009-01-24 18:07 . 2009-01-24 18:07 <DIR> d-------- c:\program files\Trend Micro
2009-01-24 18:05 . 2009-01-24 18:05 812,344 --a------ c:\program files\HJTInstall.exe
2009-01-24 10:01 . 2009-01-24 10:01 <DIR> d-------- c:\program files\Windows Media Connect 2
2009-01-24 09:59 . 2009-01-24 10:00 <DIR> d-------- c:\windows\system32\drivers\UMDF

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 20:52 --------- d-----w c:\program files\Sun
2009-02-07 20:49 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-07 20:49 --------- d-----w c:\program files\Java
2009-02-01 14:06 --------- d-----w c:\documents and settings\John Graney\Application Data\Apple Computer
2009-01-31 15:55 --------- d-----w c:\program files\FinePixViewerS
2009-01-25 19:45 --------- d-----w c:\program files\Verizon
2009-01-25 18:37 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-25 18:37 --------- d-----w c:\documents and settings\John Graney\Application Data\Symantec
2009-01-25 18:37 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-01-25 18:17 --------- d-----w c:\program files\Common Files\Adobe
2009-01-25 17:49 --------- d-----w c:\program files\Symantec
2009-01-18 18:03 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2009-01-16 12:35 --------- d-----w c:\program files\Google
2009-01-07 00:51 --------- d-----w c:\program files\AOL Radio Toolbar
2009-01-07 00:51 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Radio Toolbar
2009-01-06 21:49 --------- d-----w c:\program files\epson
2009-01-02 22:32 --------- d-----w c:\program files\TLCN2006
2008-12-25 19:56 --------- d-----w c:\documents and settings\John Graney\Application Data\FUJIFILM
2008-12-25 19:48 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-25 19:48 --------- d-----w c:\documents and settings\John Graney\Application Data\InstallShield
2008-12-13 16:18 --------- d-----w c:\program files\iTunes
2008-12-13 16:18 --------- d-----w c:\program files\iPod
2008-12-13 16:18 --------- d-----w c:\program files\Common Files\Apple
2008-12-13 16:18 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-13 16:15 --------- d-----w c:\program files\QuickTime
2008-12-13 16:10 --------- d-----w c:\program files\Safari
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-10-01 19:53 34,170 ----a-w c:\program files\adobe.zip
2008-04-29 19:01 630,784 -c--a-w c:\documents and settings\John Graney\GoToAssist_chat2way__317_en.exe
2005-04-21 01:51 105 -c--a-w c:\documents and settings\All Users\B1.bat
2002-02-20 20:39 59 -c--a-w c:\program files\quark 5 validation_serial.txt
2002-01-17 01:53 3,587,656 -c--a-w c:\program files\QuarkXPress 5.0.msi
2002-01-17 01:53 27,363,013 ----a-w c:\program files\Data.Cab
2002-01-13 04:20 62,697 -c--a-w c:\program files\setup.ini
2001-12-07 01:03 70,222 -c--a-w c:\program files\ReadMe.pdf
2001-11-14 00:13 50,280 -c--a-w c:\program files\License Agreement.pdf
2001-11-05 20:55 68,146 -c--a-w c:\program files\Contacting Quark.pdf
2001-11-03 00:00 70,929 -c--a-w c:\program files\Installation Instructions.pdf
2001-10-26 00:21 75,264 ----a-w c:\program files\About PDF Files.wri
2000-08-30 20:46 1,807,072 ------w c:\program files\vcredist.exe
2000-07-27 14:49 1,526,275 -c--a-w c:\program files\instmsiw.exe
2000-07-27 14:49 1,513,987 -c--a-w c:\program files\instmsia.exe
1998-06-17 08:00 77,878 ----a-w c:\program files\Msvcirt.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{69224684-5682-419b-9fe4-ef7946ee3319}"= "c:\program files\AOL Radio Toolbar\aolradiotb.dll" [2008-12-17 1275176]

[HKEY_CLASSES_ROOT\clsid\{69224684-5682-419b-9fe4-ef7946ee3319}]
[HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{1c3d0b2b-1b25-4b37-8bf8-7b57eba62691}]
[HKEY_CLASSES_ROOT\AOLRadioTb.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-05 68856]
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2007-08-09 1261384]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-15 1830128]




***CONTINUED IN NEXT POST***
 
ComboFixLog.txt Part 2

***REMAINDER OF LOG***


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2005-04-25 339968]
"NDSTray.exe"="c:\program files\TOSHIBA\ConfigFree\NDSTray.exe" [2005-02-08 962560]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-04-05 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-15 122880]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-11 339968]
"PINGER"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 151552]
"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2005-04-12 184320]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 688218]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"TFncKy"="c:\program files\TOSHIBA\TOSHIBA Controls\TFncKy.exe" [2004-10-25 114688]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-09-07 1077301]
"Pure Networks Port Magic"="c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe" [2005-02-07 99480]
"Notebook Maximizer"="c:\program files\Notebook Maximizer\maximizer_startup.exe" [2004-05-25 28672]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"HostManager"="c:\program files\Common Files\AOL\1170454760\ee\AOLSoftware.exe" [2007-10-08 41824]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"PDF Printer Pilot agent"="c:\program files\PDF Printer Pilot Pro\pdfpragent.exe" [2007-06-07 90112]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"EPSON Stylus C88 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIABA.EXE" [2005-01-27 98304]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-07 136600]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 c:\windows\agrsmmsg.exe]
"TPSMain"="TPSMain.exe" [2004-12-28 c:\windows\system32\TPSMain.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"NSSInstallation"="c:\windows\system32\Adobe\Shockwave 11\nssstub.exe" [2009-01-28 181624]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Exif Launcher S.lnk - c:\program files\FinePixViewerS\QuickDCF2.exe [2008-12-25 303104]
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2005-08-19 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"41651:TCP"= 41651:TCP:pORT_41651
"59496:TCP"= 59496:TCP:pORT_59496

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-05-29 388936]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Lite 2009.SP2\RpcAgentSrv.exe [2009-01-25 98488]
.
Contents of the 'Scheduled Tasks' folder

2009-02-09 c:\windows\Tasks\NSSstub.job
- c:\windows\system32\Adobe\Shockwave 11\nssstub.exe [2009-01-28 17:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.jgmachineco.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Radio Toolbar Search - c:\documents and settings\All Users\Application Data\AOL Radio Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-09 14:59:44
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\Implemented Categories]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{2D51D869-C36B-42bd-AE68-0A81BC771FA5}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\Implemented Categories]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7BED0340-176B-44bc-915E-C21C1DD6F617}\InprocServer32]
@DACL=(02 0000)
@="c:\\Program Files\\Starware\\bin\\Starware.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{CA356D79-679B-4b4c-8E49-5AF97014F4C1}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{D49E9D35-254C-4c6a-9D17-95018D228FF5}\InprocServer32]
@DACL=(02 0000)
@="c:\\PROGRAM FILES\\STARWARE\\BIN\\STARWARE.DLL"
"ThreadingModel"="Apartment"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(408)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\acs.exe
c:\progra~1\COMMON~1\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\toshiba\IVP\swupdate\swupdtmr.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\fxssvc.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\TPSBattM.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-09 15:03:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-09 20:03:34

Pre-Run: 68,343,332,864 bytes free
Post-Run: 68,317,679,616 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

252 --- E O F --- 2009-01-26 01:28:12
 
Still some residues I think!

As a coverall download Norman Malware Cleaner http://www.majorgeeks.com/download5450.html

Download then boot to safe mode only and run. Do this when you go to work or bed as it is very thorough and will take hours. Running in safe mode allows removal of some things that would give problems in normal mode but safe mode is slower also.

Mike
 
OK!

That really should do it!

If so I will post closing comments and suggestions on cleaning up some of the special tools etc. And a few other things to do to stay clean.

I do hope you expected me to be detailed and thorough!

Mike
 
Listing Viruses.....

Mike,
It finished scanning, and has been listing viruses for the past 4.5 hours.
I guess this is why you recommended setting it up and walking away from it.
Stay tuned...
 
Okay, it's done listing viruses. Quit and reboot in Normal Mode?
Or anything else first? Save a log or anything?
Please advise.
-Shawn
 
Yes save log and attach it after rebooting to normal mode!

Also a status report of how computer is working now.

Mike
 
It looked like it had stopped; suddenly, it started again.
It had just been sitting there, I didn't touch anything and actually came upstairs to use another comp to contact you!
I'm guessing just leave it alone until it stops doing anything?
-Shawn
 
It's up to you I know it is a long time, but I didn't think it would be this long!

I'll say if you do complete it you will be clean.

Mike
 
Very well. I'm gonna leave it alone and see what it's doing in the morning.
I'm not sure how to save a log though. There's only five or so buttons. Should I just copy all the data and paste into a blank .txt file?
And by status report do you simply mean how I feel the computer is behaving, or specific reports?
Thanks,
-Shawn
 
Yes how computer is working. But of course after this finishes and you check it!

There should be a log file but do your best.

The bad thing here is I believe you are clean but based of what you had that we cleaned I just wanted to be sure!

Mike
 
Mike,
Whew.
Laptop runs LIKE A DREAM. I'm not kidding, super-duper fast and responsive.
Wow. I don't know how I ever could have cleaned so much crap off this machine as you helped me to. Thank you, thank you, THANK YOU!!
Attached please find log file.
Again, whew. Thanks ever so much for your help. Of course, if more needs to be done with this, let me know. I know we're not over the finish line just yet.
-Shawn
 
Thank you for the updates. I, for one, would not have believed that a bunch of junque infestations would cause a buffer overrun... still don't understand why.
 
You did a fantastic job.

You followed directions and got the job done.

This thread is here for you to review when needed. Try to update and run MBAM and SAS once every couple of weeks or at first sign of trouble or suspicion, even the Norman once a month. Just schedule them when you are away for work or sleeping. Much better than doing them under the gun.

Thread closing ------------------------------------------------------------------------------------

Some of these tools update so often they require downloading again later if needed. But keep and run MBAM and SAS to maintain.

Remove ComboFix
Start-Run
type
combofix /u
Hit enter or click OK.

Please download OTCleanIt http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe

Save to desktop.

This will remove all the tools we used to clean your computer.

Double-click OTCleanIt.exe. Click CleanUp. Yes to the "Begin cleanup Process?"

Approve all if prompted by Firewall. Approve Widows Defender or other guards or security programs while OTCleanIt attempting access to the Internet to allow all.

If prompted to Reboot click, Yes.
OTCleanit will delete itself when finished, If not delete it by yourself.

--------------------------------------------------------------------------------------------------------
Run CCleaner again twice or more on Cleanup temps, then on left click Registry then Scan for issues also repeat till clean.

Run ATF-Cleaner http://majorgeeks.com/ATF_Cleaner_d4949.html Temp and Registry, repeatedly until no more found.

KCleaner ftp://ftp2.kcsoftwares.com/kcsoftwa/files/kcleaner.exe
Fantastic cleaner.
--------------------------------------------------------------------------------------------------------
The issues can and are likely found is in System Restore so do the below

Start-Programs-Accessories-System Tools-Disk- System Restore and create a new Restore point. Name it "After cleanup at TechSpot".

Then Start-Programs-Accessories-System Tools-Disk Cleanup
Click OK to accept C:
Select all Boxes
Then click More Options
Here click System Restore and OK to "Are you sure" and the OK to Run.

As this runs it clears all but the most recent Restore Point but it does one other thing that can contain infested files and a huge amount of disk space.

It clears what is known as Shadow copies which are used by specialized back up programs.

This is if you have the Volume Shadow Copy running which is the default.
--------------------------------------------------------------------------------------------------------

Every two weeks or so, run MBAM and SAS until clean.

They take a while, so leave scanning while you are sleeping working or watching TV. If not done under the gun they can be scheduled not to interfere with computer time.

If they find something they can not clean, then get back to us.

Additionally run CCleaner. ATF-Cleaner and KCleaner.
--------------------------------------------------------------------------------------------------------
I have been using ThreatFire for more than a year, it just went from ver 3 to ver 4.

It was designed to be used with and to co-exist with other Virus scanners.

Additionally it uses a totally different process to protect. While conventional Virus scanners work from definitions ThreatFire works on recognizing Virus/Malware activity.

It's like looking at it with 2 sets of eyes and from a different angle.

It works like some Firewalls do to learn what is good/bad.

After install it will ask you about everything that could be a security issue. For example the first time you run IE or FireFox it will prompt you. You would answer to approve and remember the setting. From then on no more prompts about IE or FireFox unless the exe changes like in an update.

As it queries you about the prompt to help you determine to approve or not you can google it with one click.

http://www.threatfire.com/Download/
-------------------------------------------------------------------------------------
Look at http://www.javacoolsoftware.com/spywareblaster.html

Run SpyBot ocassionally and use the Immunize function.
http://www.safer-networking.org/en/download/

I highly reccomend Hostman: Hostman http://majorgeeks.com/HostsMan_d4592.html

Download install run and allow it to disable DNS Client and select all Host files and then Update and install all host files.

A Disk Scan (chkdsk) and Defrag are in order.

Mike
 
Status
Not open for further replies.

Similar threads

Y
Solved Explorer.exe buffer overflow?
Replies
3
Views
2K
Broni
Broni
P
  • Locked
Inactive Laptop shutting down before scan complete (logs inside)
Replies
2
Views
2K
Broni
Broni
A
Solved My computer was hit by unknown malware
2
Replies
30
Views
11K
Broni
Broni

Latest posts

Back