enderlicious
Posts: 55 +0
I too, am having issues with malware that hijacks google results.
I first noticed something amiss, when AntiVir kept pulling up a problem, but when I said: Deny access, Delete or Move to Quarantine, it kept coming back - even when I said: Note action selected for this file. AntiVir wouldn't show me information on it.
AntiVir showed it as: C:\Documents and Settings\NetworkSerive\...\total-search[1].htm
contains pattern: HTML/Infected.WebPage.Gen2 HTML script virus (I'll try attaching it as a photo, if anyone is interested)
In the last couple of days, I noticed that google results were being hijacked, and decided I needed to get serious on this (even though my scans were showing nothing wrong with my machine, it was now obvious something is...)
I've read the updated 7-steps:
https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
And went thru them a few times (offline, because I was disabling AntiVir), because I wanted to make sure that I'd updated windows, and I also uninstalled and removed both Adobe Reader and Java (I'd removed flash awhile back, hoping some of the issues I'd been having with reduced speed / non-response from FF were flash-spam). But, I'm still having both issues.
After running Malware, Spybot S&D (and another program) both noted some changes to my registry. By reflex I say no to allowing changes, then I recognized one of the things it wanted to disable, and allowed one (or two) registry changes to go through - I never saw those registry changes tried again upon re-running MalwareBytes. Is this something MalwareBytes is doing, or is it a trojan? Because MalwareBytes certainly didn't inform me it was going to be changing my registry
Category: Firewall Authorized Applications
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\system32\sessmgr.exe:*isabledxpsp22res.dll,-22019
I'd also downloaded ComboFix (when reading some other posts, I saw it mentioned). I'd not run it, but AntiVir picks it up, and I allowed it to be deleted:
2011-05-26 infected with JAVA/AgentKF, so *something* is spreading it
2011-05-26 EXP/Pidief.13984 <- Avira detects, but claims has no information on.
2011-06-05 ComboFix sets off Antivir with this error:
ComboFix TR/Crypt.XPACK.Gen (removed)
2011-06-05
A0032832.exe TR/Crypt.XPACK.Gen (same type as ComboFix - although I don't recall downloading this, but also removed)
I'm certainly wanting to reinstall windows, however I have an old installation disk, which doesn't have the service packs. So I have to go online with no protection, and then wait for that to download (I don't have a CD burner - if I did, could I put them on a disc and then install them offline?)? That sucks. Also, AntiVir won't let you install it offline - which means I've not figured out an anti-virus solution that I can install on XP prior to getting onto the internet.
I've not yet reinstalled, because I'm trying to do so intelligently, and figure out where all of my personal data (settings, default download directories, etc) are all stored on my machine, so I get those backed up. It also appears that my attempt to make windows do an automated backup / restore points, while properly filled out in the MS scheduler-thing, never actually occurred (I had a partition set aside for a daily fully backup of my drives...)
If anyone has any pointers to reinstalling intelligently, I'll take them.
------
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6705
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
6/4/2011 11:07:34 PM
mbam-log-2011-06-04 (23-07-34).txt
Scan type: Quick scan
Objects scanned: 174199
Time elapsed: 8 minute(s), 16 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel\Homepage (PUM.Hijack.HomePageControl) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\Temp\elwx\setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
-----
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6774
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
6/5/2011 4:40:28 AM
mbam-log-2011-06-05 (04-40-28).txt
Scan type: Quick scan
Objects scanned: 172186
Time elapsed: 9 minute(s), 9 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
----------
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-04 23:27:38
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST340014AS rev.8.05
Running: yynhusl7.exe; Driver: C:\DOCUME~1\primary\LOCALS~1\Temp\ufryapog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 8237631B
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-05 04:42:18
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST340014AS rev.8.05
Running: yynhusl7.exe; Driver: C:\DOCUME~1\primary\LOCALS~1\Temp\ufryapog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 8235931B
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-06-03.01) - NTFSx86
Internet Explorer: 6.0.2900.5512
Run by primary at 23:28:15 on 2011-06-04
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.168 [GMT -7:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Spybot\TeaTimer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot\TeaTimer.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Run StartupMonitor] StartupMonitor.exe
dRun: [4ECYTQ9SIC] c:\windows\temp\Mm0.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
TCP: Interfaces\{415BB2F5-17C1-4883-9129-6D3307CCC00B} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Notify: igfxcui - igfxdev.dll
IFEO: AutorunsDisabled - ntsd -d
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\primary\application data\mozilla\firefox\profiles\k89l1yvv.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin2.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin3.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin4.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin5.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin6.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin7.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin8.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-7-7 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-7-7 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-7-7 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-7-7 56816]
.
=============== Created Last 30 ================
.
2011-06-05 05:57:58 -------- d-----w- c:\documents and settings\primary\application data\Malwarebytes
2011-06-05 05:57:39 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-05 05:57:38 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-06-05 05:57:35 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-05 05:57:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
.
==================== Find3M ====================
.
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST340014AS rev.8.05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x823764D0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8237c7f0]; MOV EAX, [0x8237c86c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x82387AB8]
3 CLASSPNP[0xF84C5FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x822E7290]
\Driver\atapi[0x823DD9D8] -> IRP_MJ_CREATE -> 0x823764D0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8237631B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 23:29:31.89 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-03.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 7/7/2009 11:31:05 AM
System Uptime: 6/4/2011 11:08:12 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0D7726
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 9 GiB total, 1.376 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 4 GiB total, 4.007 GiB free.
F: is FIXED (NTFS) - 10 GiB total, 1.108 GiB free.
G: is FIXED (NTFS) - 14 GiB total, 7.962 GiB free.
H: is Removable
L: is Removable
M: is Removable
N: is Removable
O: is Removable
P: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318}
Description: Communications Port
Device ID: ACPI\PNP0501\1
Manufacturer: (Standard port types)
Name: Communications Port (COM1)
PNP Device ID: ACPI\PNP0501\1
Service: Serial
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
7-Zip 4.65
Adobe Reader 9.1
Apple Application Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Broadcom Gigabit Integrated Controller
CDBurnerXP
DiscWizard for Windows
Eusing Free Registry Cleaner
Exact Audio Copy 0.99pb5
Exifer
GIMP 2.6.6
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB979306)
Intel(R) Graphics Media Accelerator Driver
iolo technologies' System Mechanic
Java Auto Updater
Java(TM) 6 Update 20
Malwarebytes' Anti-Malware version 1.51.0.1200
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox 4.0.1 (x86 en-US)
OpenOffice.org 3.2
PartitionMagic
PowerQuest PartitionMagic 8.0
QuickTime
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
SoundMAX
Spybot - Search & Destroy
SSH Secure Shell
StartupMonitor
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
WebFldrs XP
Winamp
Windows Media Format Runtime
.
==== Event Viewer Messages From Past Week ========
.
6/4/2011 4:49:17 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'desktop.ini' on the volume 'HarddiskVolume6'. It has stopped monitoring the volume.
6/4/2011 11:08:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
6/4/2011 11:08:45 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
6/4/2011 1:57:07 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'daisy_data' on the volume 'HarddiskVolume3'. It has stopped monitoring the volume.
6/3/2011 8:28:43 PM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 4 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 2 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 2 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 3 time(s).
6/1/2011 5:05:11 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
5/29/2011 6:42:05 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dnscache service.
.
==== End Of File ===========================
I first noticed something amiss, when AntiVir kept pulling up a problem, but when I said: Deny access, Delete or Move to Quarantine, it kept coming back - even when I said: Note action selected for this file. AntiVir wouldn't show me information on it.
AntiVir showed it as: C:\Documents and Settings\NetworkSerive\...\total-search[1].htm
contains pattern: HTML/Infected.WebPage.Gen2 HTML script virus (I'll try attaching it as a photo, if anyone is interested)
In the last couple of days, I noticed that google results were being hijacked, and decided I needed to get serious on this (even though my scans were showing nothing wrong with my machine, it was now obvious something is...)
I've read the updated 7-steps:
https://www.techspot.com/community/...lware-removal-preliminary-instructions.58138/
And went thru them a few times (offline, because I was disabling AntiVir), because I wanted to make sure that I'd updated windows, and I also uninstalled and removed both Adobe Reader and Java (I'd removed flash awhile back, hoping some of the issues I'd been having with reduced speed / non-response from FF were flash-spam). But, I'm still having both issues.
After running Malware, Spybot S&D (and another program) both noted some changes to my registry. By reflex I say no to allowing changes, then I recognized one of the things it wanted to disable, and allowed one (or two) registry changes to go through - I never saw those registry changes tried again upon re-running MalwareBytes. Is this something MalwareBytes is doing, or is it a trojan? Because MalwareBytes certainly didn't inform me it was going to be changing my registry
Category: Firewall Authorized Applications
C:\WINDOWS\system32\sessmgr.exe
C:\WINDOWS\system32\sessmgr.exe:*
isabledxpsp22res.dll,-22019I'd also downloaded ComboFix (when reading some other posts, I saw it mentioned). I'd not run it, but AntiVir picks it up, and I allowed it to be deleted:
2011-05-26 infected with JAVA/AgentKF, so *something* is spreading it
2011-05-26 EXP/Pidief.13984 <- Avira detects, but claims has no information on.
2011-06-05 ComboFix sets off Antivir with this error:
ComboFix TR/Crypt.XPACK.Gen (removed)
2011-06-05
A0032832.exe TR/Crypt.XPACK.Gen (same type as ComboFix - although I don't recall downloading this, but also removed)
I'm certainly wanting to reinstall windows, however I have an old installation disk, which doesn't have the service packs. So I have to go online with no protection, and then wait for that to download (I don't have a CD burner - if I did, could I put them on a disc and then install them offline?)? That sucks. Also, AntiVir won't let you install it offline - which means I've not figured out an anti-virus solution that I can install on XP prior to getting onto the internet.
I've not yet reinstalled, because I'm trying to do so intelligently, and figure out where all of my personal data (settings, default download directories, etc) are all stored on my machine, so I get those backed up. It also appears that my attempt to make windows do an automated backup / restore points, while properly filled out in the MS scheduler-thing, never actually occurred (I had a partition set aside for a daily fully backup of my drives...)
If anyone has any pointers to reinstalling intelligently, I'll take them.
------
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6705
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
6/4/2011 11:07:34 PM
mbam-log-2011-06-04 (23-07-34).txt
Scan type: Quick scan
Objects scanned: 174199
Time elapsed: 8 minute(s), 16 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SETUP.EXE (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\control panel\Homepage (PUM.Hijack.HomePageControl) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\WINDOWS\Temp\elwx\setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
-----
Malwarebytes' Anti-Malware 1.51.0.1200
www.malwarebytes.org
Database version: 6774
Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512
6/5/2011 4:40:28 AM
mbam-log-2011-06-05 (04-40-28).txt
Scan type: Quick scan
Objects scanned: 172186
Time elapsed: 9 minute(s), 9 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
----------
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-04 23:27:38
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST340014AS rev.8.05
Running: yynhusl7.exe; Driver: C:\DOCUME~1\primary\LOCALS~1\Temp\ufryapog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8237631B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 8237631B
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
GMER 1.0.15.15640 - http://www.gmer.net
Rootkit quick scan 2011-06-05 04:42:18
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e ST340014AS rev.8.05
Running: yynhusl7.exe; Driver: C:\DOCUME~1\primary\LOCALS~1\Temp\ufryapog.sys
---- Disk sectors - GMER 1.0.15 ----
Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior
---- Devices - GMER 1.0.15 ----
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 8235931B
Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-e 8235931B
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- EOF - GMER 1.0.15 ----
.
DDS (Ver_2011-06-03.01) - NTFSx86
Internet Explorer: 6.0.2900.5512
Run by primary at 23:28:15 on 2011-06-04
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.168 [GMT -7:00]
.
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\StartupMonitor.exe
C:\Program Files\Spybot\TeaTimer.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot\SDHelper.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [SpybotSD TeaTimer] c:\program files\spybot\TeaTimer.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Run StartupMonitor] StartupMonitor.exe
dRun: [4ECYTQ9SIC] c:\windows\temp\Mm0.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot\SDHelper.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
TCP: Interfaces\{415BB2F5-17C1-4883-9129-6D3307CCC00B} : DhcpNameServer = 68.105.28.12 68.105.29.12 68.105.28.11
Notify: igfxcui - igfxdev.dll
IFEO: AutorunsDisabled - ntsd -d
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\primary\application data\mozilla\firefox\profiles\k89l1yvv.default\
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin2.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin3.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin4.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin5.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin6.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin7.dll
FF - plugin: f:\applications\quicktime\plugins\npqtplugin8.dll
.
============= SERVICES / DRIVERS ===============
.
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-7-7 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-7-7 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-7-7 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-7-7 56816]
.
=============== Created Last 30 ================
.
2011-06-05 05:57:58 -------- d-----w- c:\documents and settings\primary\application data\Malwarebytes
2011-06-05 05:57:39 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-06-05 05:57:38 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
2011-06-05 05:57:35 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-06-05 05:57:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
.
==================== Find3M ====================
.
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: ST340014AS rev.8.05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x823764D0]<<
_asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x8237c7f0]; MOV EAX, [0x8237c86c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x82387AB8]
3 CLASSPNP[0xF84C5FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x822E7290]
\Driver\atapi[0x823DD9D8] -> IRP_MJ_CREATE -> 0x823764D0
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8237631B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 23:29:31.89 ===============
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-03.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 7/7/2009 11:31:05 AM
System Uptime: 6/4/2011 11:08:12 PM (0 hours ago)
.
Motherboard: Dell Inc. | | 0D7726
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 9 GiB total, 1.376 GiB free.
D: is CDROM ()
E: is FIXED (NTFS) - 4 GiB total, 4.007 GiB free.
F: is FIXED (NTFS) - 10 GiB total, 1.108 GiB free.
G: is FIXED (NTFS) - 14 GiB total, 7.962 GiB free.
H: is Removable
L: is Removable
M: is Removable
N: is Removable
O: is Removable
P: is Removable
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318}
Description: Communications Port
Device ID: ACPI\PNP0501\1
Manufacturer: (Standard port types)
Name: Communications Port (COM1)
PNP Device ID: ACPI\PNP0501\1
Service: Serial
.
==== System Restore Points ===================
.
No restore point in system.
.
==== Installed Programs ======================
.
7-Zip 4.65
Adobe Reader 9.1
Apple Application Support
Apple Software Update
Avira AntiVir Personal - Free Antivirus
Broadcom Gigabit Integrated Controller
CDBurnerXP
DiscWizard for Windows
Eusing Free Registry Cleaner
Exact Audio Copy 0.99pb5
Exifer
GIMP 2.6.6
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB979306)
Intel(R) Graphics Media Accelerator Driver
iolo technologies' System Mechanic
Java Auto Updater
Java(TM) 6 Update 20
Malwarebytes' Anti-Malware version 1.51.0.1200
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox 4.0.1 (x86 en-US)
OpenOffice.org 3.2
PartitionMagic
PowerQuest PartitionMagic 8.0
QuickTime
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
SoundMAX
Spybot - Search & Destroy
SSH Secure Shell
StartupMonitor
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
WebFldrs XP
Winamp
Windows Media Format Runtime
.
==== Event Viewer Messages From Past Week ========
.
6/4/2011 4:49:17 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'desktop.ini' on the volume 'HarddiskVolume6'. It has stopped monitoring the volume.
6/4/2011 11:08:58 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: PCIIde
6/4/2011 11:08:45 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
6/4/2011 1:57:07 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC000007F' while processing the file 'daisy_data' on the volume 'HarddiskVolume3'. It has stopped monitoring the volume.
6/3/2011 8:28:43 PM, error: Service Control Manager [7034] - The System Event Notification service terminated unexpectedly. It has done this 4 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The Network Location Awareness (NLA) service terminated unexpectedly. It has done this 2 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The Cryptographic Services service terminated unexpectedly. It has done this 2 time(s).
6/3/2011 7:57:34 PM, error: Service Control Manager [7034] - The COM+ Event System service terminated unexpectedly. It has done this 3 time(s).
6/1/2011 5:05:11 PM, error: Service Control Manager [7034] - The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s).
5/29/2011 6:42:05 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dnscache service.
.
==== End Of File ===========================
