This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

New to Forum, posting log for first time

34 min read

This thread's last reply is from March 25, 2008, 2:24 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

ITIS367JOE
March 18, 2008, 4:16 AM UTC
I just needed to close threatfire to run this, thought I had posted this a few days ago,

Joe

ComboFix 08-03-05.1 - Owner 2008-03-15 12:40:12.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.331 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
.

2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-03-09 22:25 . 2008-03-09 22:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-03-09 21:50 . 2008-03-09 21:50 <DIR> d-------- C:\Program Files\CCleaner
2008-03-05 00:54 . 2008-03-05 00:54 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-04 22:53 . 2008-03-04 23:25 1,302,976 ---hs---- C:\WINDOWS\system32\xeoepbco.ini
2008-02-22 12:38 . 2008-02-28 18:09 143 --a------ C:\WINDOWS\BMffb48e05.xml

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 18:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-14 03:41 3,888 ----a-w C:\WINDOWS\viassary-hp.reg
2008-03-14 03:41 --------- d-----w C:\Program Files\Easy Internet signup
2008-03-08 05:07 --------- d-----w C:\Program Files\Yahoo!
2008-03-08 04:57 --------- d--h--r C:\Documents and Settings\Owner\Application Data\yahoo!
2008-03-07 00:45 --------- d-----w C:\Program Files\MSN Messenger
2008-03-07 00:45 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-06 01:42 --------- d-----w C:\Program Files\ThreatFire
2008-03-03 02:20 --------- d-----w C:\Program Files\SealedMedia
2008-03-01 16:39 28,256 ----a-w C:\WINDOWS\system32\drivers\MxlW2k.sys
2008-02-15 17:21 41,280 ----a-w C:\WINDOWS\system32\drivers\TfSysMon.sys
2008-02-15 17:21 33,088 ----a-w C:\WINDOWS\system32\drivers\TfNetMon.sys
2008-02-15 17:21 12,608 ----a-w C:\WINDOWS\system32\drivers\TfKbMon.sys
2008-02-15 17:20 51,520 ----a-w C:\WINDOWS\system32\drivers\TfFsMon.sys
2008-02-14 05:33 --------- d-----w C:\Program Files\Common Files\RuleSpace
2008-02-14 05:32 --------- d-----w C:\Program Files\Common Files\Aluria
2008-02-14 05:24 --------- d-----w C:\Program Files\Common Files\Authentium Shared
2008-02-14 05:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-02-14 05:20 --------- d-----w C:\Program Files\McAfee
2008-02-14 05:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-02-08 06:14 --------- d-----w C:\Program Files\Google
2008-01-26 19:46 --------- d-----w C:\Documents and Settings\Owner\Application Data\SealedMedia
2008-01-26 03:47 --------- d-----w C:\Documents and Settings\Owner\Application Data\PoivY
2008-01-26 03:42 --------- d-----w C:\Program Files\PoivY.com
2008-01-22 06:53 --------- d-----w C:\Program Files\a-squared Free
2008-01-21 03:11 155,648 ----a-w C:\WINDOWS\system32\igfxtray.exe
2008-01-21 03:11 118,784 ----a-w C:\WINDOWS\system32\hkcmd.exe
2008-01-18 03:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\Lavasoft
2008-01-18 03:54 --------- d-----w C:\Program Files\Lavasoft
2008-01-18 03:49 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-17 05:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-16 14:12 103,936 ----a-w C:\WINDOWS\system32\HFX2C5A.tmp
2008-01-15 23:25 81,920 ----a-w C:\WINDOWS\system32\ps2.exe
2008-01-15 23:25 483,328 ----a-w C:\WINDOWS\system32\hphmon05.exe
2008-01-15 03:25 --------- d-----w C:\Program Files\Microsoft Picture It! 7
2008-01-11 04:11 10 ----a-w C:\Program Files\.autoreg
2007-07-07 02:10 456,192 --sh--r C:\WINDOWS\cnetmgr.exe
.

((((((((((((((((((((((((((((( snapshot@2008-03-05_19.49.52.31 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-02-13 00:23:58 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-03-12 06:33:57 12,288 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-02-13 00:23:57 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-03-12 06:33:57 135,168 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-02-13 00:23:58 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-03-12 06:33:57 11,264 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-02-13 00:23:58 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-03-12 06:33:57 27,136 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-02-13 00:23:58 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-03-12 06:33:57 4,096 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-02-13 00:23:58 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-03-12 06:33:58 794,624 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-02-13 00:23:58 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-03-12 06:33:57 249,856 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-02-13 00:23:58 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-03-12 06:33:58 23,040 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-02-13 00:23:57 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-03-12 06:33:57 286,720 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-02-13 00:23:57 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-03-12 06:33:57 409,600 ----a-r C:\WINDOWS\Installer\{91120409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-01-15 03:23:14 22,798 ----a-r C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00544}\MsblIco.Exe
+ 2008-03-07 00:54:30 22,798 ----a-r C:\WINDOWS\Installer\{ABEB838C-A1A7-4C5D-B7E1-8B4314B00544}\MsblIco.Exe
+ 2008-01-15 23:25:21 212,992 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
+ 2008-01-15 23:25:18 52,736 ----a-w C:\WINDOWS\system\hpsysdrv.exe
+ 2004-08-04 07:56:57 13,824 -c--a-w C:\WINDOWS\system32\dllcache\wscntfy.exe
- 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-01-15 23:25:23 196,608 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"Router"="C:\Program Files\Router\Router.exe" [ ]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2008-01-15 17:25 2185800]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-03-05 19:23 171448]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43 4670704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [2008-01-15 17:25 52736]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-20 21:11 118784]
"CamMonitor"="c:\Program Files\HP\Digital Imaging\Unload\hpqcmon.exe" [2008-01-12 12:56 90112]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 17:25 483328]
"KBD"="C:\HP\KBD\KBD.EXE" [2008-01-12 12:56 61440]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2008-01-12 12:56 45056]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-01-12 12:57 151597]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2008-01-15 17:25 212992]
"VTTimer"="VTTimer.exe" []
"LTMSG"="LTMSG.exe" [2003-07-14 18:52 40960 C:\WINDOWS\ltmsg.exe]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2008-01-15 17:25 81920]
"HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb04.exe" [2008-01-15 17:25 196608]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-20 21:11 155648]
"ESP"="c:\Program Files\Cox\Applications\app\start.exe" [ ]
"sealmon"="C:\Program Files\SealedMedia\sealmon.exe" [ ]
"mmtask"="C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe" [2003-07-23 17:37 53248]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2003-10-14 07:35:01 557056]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=

R0 GRFILTER;Authentium NDIS Driver;C:\WINDOWS\system32\drivers\GRFILTER.sys [2007-05-09 13:41]
R0 TfFsMon;TfFsMon;C:\WINDOWS\system32\drivers\TfFsMon.sys [2008-02-15 11:20]
R0 TfSysMon;TfSysMon;C:\WINDOWS\system32\drivers\TfSysMon.sys [2008-02-15 11:21]
R2 GRTdiMon;Authentium TDI Mon;C:\WINDOWS\system32\Drivers\GRTdiMon.sys [2007-05-09 13:41]
R2 ThreatFire;ThreatFire;C:\Program Files\ThreatFire\TFService.exe service []
R3 TfNetMon;TfNetMon;C:\WINDOWS\System32\drivers\TfNetMon.sys [2008-02-15 11:21]
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 03:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 03:15]

.
Contents of the 'Scheduled Tasks' folder
"2008-03-11 04:36:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-14 03:41:40 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2003-10-14 13:32:36 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 12:45:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-15 12:48:51
ComboFix-quarantined-files.txt 2008-03-15 18:48:43
ComboFix2.txt 2008-03-15 18:32:29
ComboFix3.txt 2008-03-07 00:59:44
ComboFix4.txt 2008-03-06 01:51:01
.
2008-03-12 06:35:25 --- E O F ---
dan12
March 18, 2008, 11:51 AM UTC
Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Jotti

Please visit Jotti
Copy/paste the the following file path into the window
C:\WINDOWS\cnetmgr.exe
Click Submit/Send File
Please post back, to let me know the results.

Please do the same for the following file
C:\WINDOWS\system32\xeoepbco.ini
C:\WINDOWS\BMffb48e05.xml

If Jotti is too busy please try Virustotal
Elrond
March 25, 2008, 2:24 PM UTC
Due to lack of response this topic is now closed.

If you still need help open a new thread in the Malware Removal forum and wait for a new helper.

If you have been helped and wish to donate to help with the costs of this volunteer site, please read Donations For Malware Removal

Elrond