Blackcore trojan how to remove - HijackThis.log included

solxe · #1 (**permalink**) 30-08-2007, 08:24 PM

Hiya, Spybot detects Blackcore in my system, how do I remove this most efficiently?

Here's my HijackThis log

------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:12:27, on 2007-08-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
D:\Program\Diskeeper Corporation\DkService.exe
D:\Program\Eset\nod32krn.exe
C:\windows\system32\nvsvc32.exe
C:\windows\Explorer.EXE
D:\Program\Smart Guardian\ITESmart.exe
D:\Program\Eset\nod32kui.exe
C:\windows\CTHELPER.EXE
C:\windows\system32\ctfmon.exe
C:\Program\DAEMON Tools\daemon.exe
D:\Program\Launchy\Launchy.exe
D:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Styler\Styler.exe
C:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
C:\windows\System32\svchost.exe
C:\Program\MSN Messenger\msnmsgr.exe
D:\Program\Skype\Phone\Skype.exe
D:\Program\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\mstsc.exe
D:\Program\Spybot - Search & Destroy\SpybotSD.exe
D:\Program\foobar2000\foobar2000.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [SmartGuardian] D:\Program\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Program\Diskeeper Corporation\DkIcon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Genväg till Styler.lnk = C:\Program\Styler\Styler.exe
O4 - Global Startup: Launchy.lnk = D:\Program\Launchy\Launchy.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Program\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\Program\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\solxe\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136846064750
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program\Diskeeper Corporation\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\windows\system32\sfrem01.exe

--
End of file - 5506 bytes
-----

My first time posting help so please tell me if I'm going about this the wrong way.

Cheers!

Neal · #2 (**permalink**) 30-08-2007, 08:45 PM

You may want to printout the following instructions:

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to the words Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update successful message.
- Click on Scanner on the toolbar at top of this screen.
- Click on the Settings tab.
  - Under How to act?
    - Click on Recommended Action and choose Quarantine from the popup menu.
  - Under How to scan?
    - All checkboxes should be ticked.
  - Under Possibly unwanted software:
    - All checkboxes should be ticked.
  - Under Reports:
    - Select Automatically generate report after every scan and uncheck Only if threats were found.
  - Under What to scan?
    - Select Scan every file.
- Close AVG Anti-Spyware without running yet.

Now disable (turn off AVG Anti-Spyware)

Right-click the AVG Anti-Spyware Tray Icon (Bottom right corner of computer screen near clock) and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon again and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update AVG Anti-Spyware.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
______________________________

Reboot your computer in Safe Mode.If you can't go to safe mode or run from safe mode, use NORMAL MODE.

If the computer is running, shut down Windows, and then turn off the power.
Wait 30 seconds, and then turn the computer on.
Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
Ensure that the Safe Mode option is selected.
Press Enter. The computer then begins to start in Safe mode.
Login on your usual account.

______________________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
Note: If AVG Anti-Spyware screen does not fit your monitor screen Hold down the Alt button on keyboard then tap spacebar, menu should pop up then choose maximize. AVG Anti-Spyware screen should now fit to the screen a lot better.

Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.

IMPORTANT : Don't click on the "Save Scan Report" button before you hit the "Apply all Actions" button.

Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
At the bottom of the window click on the Apply all Actions button.(3)

When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop. I will need you to post this in your next reply.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.

New hijackthis log also please.

solxe · #3 (**permalink**) 30-08-2007, 10:35 PM

Did what you asked me but I couldn't save the report! it was greyed out =/.

This is what it found though:
--
Rootkit.NTRootkit
Trojan.Goldspy
Trojan.Keygen
Trojan.Regpat.a
--

Those were the most alarming, I have to mention that I had a lot of trackingcookies.

Here's another HijackThis log.

----

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:30:43, on 2007-08-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
D:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Program\Diskeeper Corporation\DkService.exe
D:\Program\Eset\nod32krn.exe
C:\windows\Explorer.EXE
D:\Program\Smart Guardian\ITESmart.exe
D:\Program\Eset\nod32kui.exe
C:\windows\CTHELPER.EXE
C:\windows\system32\ctfmon.exe
C:\Program\DAEMON Tools\daemon.exe
D:\Program\Launchy\Launchy.exe
D:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Styler\Styler.exe
C:\windows\System32\svchost.exe
C:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [SmartGuardian] D:\Program\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Program\Diskeeper Corporation\DkIcon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Genväg till Styler.lnk = C:\Program\Styler\Styler.exe
O4 - Global Startup: Launchy.lnk = D:\Program\Launchy\Launchy.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Program\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\Program\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\solxe\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136846064750
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program\Diskeeper Corporation\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\windows\system32\sfrem01.exe

--
End of file - 5400 bytes
-----

I choosed AVG Anti-spyware to save the report automatically, though I can't find it anywhere?

Thanks for helping me =)

Neal · #4 (**permalink**) 30-08-2007, 11:29 PM

Might try doing a search for scan report by going to start>search<type in "scan report" and see if that shows it.

Did AVG quarantine all it found?

1. Download this file - COMBOFIX
2. Double click combofix.exe & follow the prompts.
3. When finished, it will produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Post a new hijackthis log also please.

solxe · #5 (**permalink**) 30-08-2007, 11:53 PM

Can't find scan report anywhere! I think you can't save the report if you are in safe mode, because when I am in xp in normally the "save report" button isn't greyed out.

But yea it quarantined everything and I have included an attachment with the quarantined items. (the cookies were deleted)

Heres the log of the "combofix.exe"

---

ComboFix 07-08-30.3 - "solxe" 2007-08-31 0:40:51.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1053.18.608 [GMT 2:00]

((((((((((((((((((((((((( Files Created from 2007-07-28 to 2007-08-30 )))))))))))))))))))))))))))))))

2007-08-31 00:40 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-30 21:48 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-08-30 21:36 <KAT> d-------- C:\DOCUME~1\solxe\APPLIC~1\SiteAdvisor
2007-08-30 21:36 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SiteAdvisor
2007-08-30 21:36 <KAT> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-08-21 22:59 <KAT> d-------- C:\DOCUME~1\solxe\Skrivbord
2007-08-21 17:27 <KAT> d-------- C:\DOCUME~1\solxe\APPLIC~1\Bioshock
2007-08-21 17:21 443,752 --a------ C:\WINDOWS\system32\d3dx10_34.dll
2007-08-21 17:21 3,497,832 --a------ C:\WINDOWS\system32\d3dx9_34.dll
2007-08-21 17:21 266,088 --a------ C:\WINDOWS\system32\xactengine2_8.dll
2007-08-21 17:21 18,280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll
2007-08-21 17:21 1,124,720 --a------ C:\WINDOWS\system32\D3DCompiler_34.dll

(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))

2007-08-30 21:51 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\Skype
2007-08-30 21:50 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\foobar2000
2007-08-29 17:06 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\Launchy
2007-08-27 12:16 --------- d-------- D:\Program\cpu-z-131
2007-08-26 17:16 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\Hamachi
2007-08-26 14:09 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\SharpReader
2007-08-26 04:34 --------- d-------- C:\DOCUME~1\solxe\APPLIC~1\uTorrent
2007-08-23 22:26 --------- d--h----- D:\Program\InstallShield Installation Information
2007-08-23 20:46 --------- d-------- D:\Program\AGEIA Technologies
2007-08-23 20:46 --------- d-------- C:\Program\Delade filer\Wise Installation Wizard
2007-08-21 12:28 108144 --a------ C:\windows\system32\CmdLineExt.dll
2007-08-17 20:42 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Skype
2007-08-15 15:39 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-08-15 15:38 --------- d-------- D:\Program\MSXML 4.0
2007-08-14 15:14 --------- d-------- D:\Program\Combined Community Codec Pack
2007-08-13 00:10 --------- d-------- D:\Program\foobar2000
2007-08-11 23:40 --------- d-------- D:\Program\Sony
2007-07-30 19:19 92504 --a------ C:\windows\system32\cdm.dll
2007-07-30 19:19 549720 --a------ C:\windows\system32\wuapi.dll
2007-07-30 19:19 53080 --a------ C:\windows\system32\wuauclt.exe
2007-07-30 19:19 43352 --a------ C:\windows\system32\wups2.dll
2007-07-30 19:19 325976 --a------ C:\windows\system32\wucltui.dll
2007-07-30 19:19 271224 --a------ C:\windows\system32\mucltui.dll
2007-07-30 19:19 207736 --a------ C:\windows\system32\muweb.dll
2007-07-30 19:19 203096 --a------ C:\windows\system32\wuweb.dll
2007-07-30 19:19 1712984 --a------ C:\windows\system32\wuaueng.dll
2007-07-30 19:18 33624 --a------ C:\windows\system32\wups.dll
2007-07-29 18:46 --------- d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-26 08:10 1104896 --a------ C:\windows\system32\msxml3.dll
2007-06-19 15:32 282112 --a------ C:\windows\system32\gdi32.dll
2007-06-13 15:23 1033728 --a------ C:\windows\explorer.exe
2007-01-15 17:36 1 --a------ C:\DOCUME~1\solxe\SI.bin
2005-05-13 16:12:00 217,073 --sha-r C:\windows\meta4.exe
2005-10-24 10:13:58 66,560 --sha-r C:\windows\MOTA113.exe
2005-10-13 20:27:00 422,400 --sha-r C:\windows\x2.64.exe
2005-10-07 18:14:52 308,224 --sha-r C:\windows\system32\avisynth.dll
2005-07-14 11:31:20 27,648 --sha-r C:\windows\system32\AVSredirect.dll
2005-06-26 14:32:28 616,448 --sha-r C:\windows\system32\cygwin1.dll
2005-06-21 21:37:42 45,568 --sha-r C:\windows\system32\cygz.dll
2004-01-24 23:00:00 70,656 --sha-r C:\windows\system32\i420vfw.dll
2006-04-27 09:24:24 2,945,024 --sha-r C:\windows\system32\Smab.dll
2005-02-28 12:16:22 240,128 --sha-r C:\windows\system32\x.264.exe
2004-01-24 23:00:00 70,656 --sha-r C:\windows\system32\yv12vfw.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SmartGuardian"="D:\Program\Smart Guardian\ITESmart.exe" [2003-09-30 19:01]
"nod32kui"="D:\Program\Eset\nod32kui.exe" [2005-09-25 19:39]
"CTHelper"="CTHELPER.EXE" [2006-06-01 11:34 C:\WINDOWS\CTHELPER.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
"ISUSScheduler"="C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" [2005-08-11 15:30]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-01-23 15:44 C:\WINDOWS\KHALMNPR.Exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 13:22 C:\WINDOWS\system32\nvmctray.dll]
"DiskeeperSystray"="D:\Program\Diskeeper Corporation\DkIcon.exe" [2006-06-07 13:35]
"ISUSPM Startup"="C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" [2005-08-11 15:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\windows\system32\ctfmon.exe" [2004-08-04 01:34]
"DAEMON Tools"="C:\Program\DAEMON Tools\daemon.exe" [2006-11-12 12:48]

C:\DOCUME~1\solxe\START-~1\Program\AUTOST~1\
Genv„g till Styler.lnk - C:\Program\Styler\Styler.exe [2006-05-03 10:48:46]

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"NoSharedDocuments"=01000000
"NoResolveTrack"=1 (0x1)
"NoResolveSearch"=1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\WdfLoadGroup"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
"D:\Program\Adobe\Adobe Photoshop Lightroom\apdproxy.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
"D:\Program\Creative\MediaSource\Detector\CTDetect .exe" /R

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET]
"D:\Program\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
"D:\Program\Creative\Sync Manager Unicode\CTSyncU.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
CTXFIHLP.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
D:\Program\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
"C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Norton Ghost"=2 (0x2)
"Bonjour Service"=2 (0x2)
"Creative Service for CDROM Access"=2 (0x2)

R1 papycpu2;papycpu2;C:\windows\system32\drivers\papy cpu2.sys
R2 {95808DC4-FA4A-4c74-92FE-5B863F82066B};{95808DC4-FA4A-4c74-92FE-5B863F82066B};\??\D:\Program\CyberLink\PowerDVD\00 0.fcl
R2 LBeepKE;LBeepKE;C:\windows\system32\Drivers\LBeepK E.sys
R3 ha20x2k;Creative 20X HAL Driver;C:\windows\system32\drivers\ha20x2k.sys
R3 iteio;iteio;\??\C:\WINDOWS\system32\drivers\iteio. sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\windows\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\windows\system32\drivers\WmXlCore.sys
S1 ATITool;ATITool Overclocking Utility;C:\windows\system32\DRIVERS\ATITool.sys
S1 nvport;NVIDIA PORT IO Control Driver;\??\C:\WINDOWS\system32\Drivers\nvport.sys
S3 agony;agony;\??\C:\WINDOWS\system32\agony.sys
S3 leafnets;Leaf Networks Adapter;C:\windows\system32\DRIVERS\leafnets.sys
S3 LUsbFilt;Logitech SetPoint KMDF USB Filter;C:\windows\system32\Drivers\LUsbFilt.Sys
S3 NPUSB;NPUSB;C:\windows\system32\DRIVERS\npusb.sys
S3 papycpu;papycpu;C:\windows\system32\drivers\papycp u.sys
S3 pfsvgae;pfsvgae;\??\C:\DOCUME~1\solxe\LOKALA~1\Tem p\pfsvgae.sys
S3 SaiH0464;SaiH0464;C:\windows\system32\DRIVERS\SaiH 0464.sys
S3 uisp;Motorola USB ICP driver;C:\windows\system32\Drivers\usbicp.sys
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\windows\system32\drivers\WmFilter.sys
S3 WmHidLo;Logitech Gaming USB Filter Driver;C:\windows\system32\drivers\WmHidLo.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\windows\system32\drivers\WmVirHid.sys
S3 WPRO_40_755;WinPcap Packet Driver (WPRO_40_755);C:\windows\system32\drivers\WPRO_40_ 755.sys
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21;C:\windows\system32\DRIVERS\xusb21.sys

*Newly Created Service* - CATCHME

************************************************** ************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-31 00:43:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************

Completion time: 2007-08-31 0:43:33
C:\ComboFix-quarantined-files.txt ... 2007-08-31 00:43

--- E O F ---
-------

And here is a new HijackThis log

---------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:44:45, on 2007-08-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
D:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
D:\Program\Diskeeper Corporation\DkService.exe
D:\Program\Eset\nod32krn.exe
D:\Program\Eset\nod32kui.exe
C:\windows\CTHELPER.EXE
C:\windows\system32\ctfmon.exe
C:\Program\DAEMON Tools\daemon.exe
D:\Program\Launchy\Launchy.exe
D:\Program\Logitech\SetPoint\SetPoint.exe
C:\Program\Styler\Styler.exe
C:\windows\System32\svchost.exe
C:\Program\Delade filer\Logitech\khalshared\KHALMNPR.EXE
C:\windows\explorer.exe
C:\windows\system32\Notepad.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [SmartGuardian] D:\Program\Smart Guardian\ITESmart.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program\Delade filer\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DiskeeperSystray] "D:\Program\Diskeeper Corporation\DkIcon.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program\Delade filer\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Genväg till Styler.lnk = C:\Program\Styler\Styler.exe
O4 - Global Startup: Launchy.lnk = D:\Program\Launchy\Launchy.exe
O4 - Global Startup: Logitech SetPoint.lnk = D:\Program\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\Program\MICROS~1\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: E&xportera till Microsoft Excel - res://D:\Program\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: Skicka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Ski&cka till OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Program\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\solxe\Start-meny\Program\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1136846064750
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Diskeeper - Diskeeper Corporation - D:\Program\Diskeeper Corporation\DkService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program\Delade filer\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\windows\system32\nvsvc32.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\windows\system32\sfrem01.exe

--
End of file - 5320 bytes

solxe · #6 (**permalink**) 31-08-2007, 02:41 PM

Also a problem has risen from all this.
When I open "My computer" and doubleklick on a drive, it opens a new explorer with a tree and "my documents" as the folder.
To be able to access my drives I now need to "right-klick" and choose "open".

What could have made this problem and does anyone know how to fix it?

Neal · #7 (**permalink**) 31-08-2007, 08:44 PM

Don't know why on that maybe because of some infection has caused it.

Download AVG Anti-Rootkit Beta from beta.grisoft.cz/beta/betarep.files/antirootkit/AVG_AntiRootkit_1.0.0.13.exe and save it to your Desktop.

Close all open programs as this will require a reboot.

Double click AVG_AntiRootkit_1.0.0.13.exe to install the program.
(By default this will be to C:\Program Files\GRISOFT\AVG Anti-Rootkit Beta.)

Once the program has installed, you will be prompted to reboot - please allow this to happen.
When the PC has rebooted, click the AVG Anti-Rootkit Beta shortcut that is now on your desktop.

Click Perform in-depth search and put your feet up as this can take a while.
Once the scan has completed, if any files have been detected, click Save result to file and save the log to somewhere convenient.
If anything has been detected, copy and paste the log into your next reply. If not, just let me know.

solxe · #8 (**permalink**) 01-09-2007, 10:38 AM

It didn't find any rootkits, does this mean I'm clean?

Neal · #9 (**permalink**) 01-09-2007, 11:33 PM

Not sure yet, I'm very cautious that there may still be a rootkit and here is what I would like for you to do.

Do another scan with AVG anti-spyware 7.5 again following the above instructions and pay special attention to this:

IMPORTANT : Don't click on the "Save Scan Report" button before you hit the "Apply all Actions" button. So maybe a scan report can be made.

See if AVG detects the rootkit again. Thanks.

solxe · #10 (**permalink**) 02-09-2007, 12:22 AM

Quote:

Originally Posted by Neal

Not sure yet, I'm very cautious that there may still be a rootkit and here is what I would like for you to do.

Do another scan with AVG anti-spyware 7.5 again following the above instructions and pay special attention to this:

IMPORTANT : Don't click on the "Save Scan Report" button before you hit the "Apply all Actions" button. So maybe a scan report can be made.

See if AVG detects the rootkit again. Thanks.

I just did one before you posted and nothing was found except some usual tracking cookies.

I'm doing another full scan to be sure.

The wierd thing is the drive problem I am having and I notices that when I right-click on a drive, the first thing listed on the context menu says :"search..."
So something has gone broken there.

Also for the first time in a very long time I bluescreened while in windows playing with photoshop, but these problems aren't actually related with malware/virus issues so I don't expect you to know an answer to them.

Maybe it's just time for a clean fresh reinstall of windows xp, I've had it installed way over a year already so maybe some quirks and issues are finally starting to show.