WiredWX Hobby Weather ToolsLog in

 


Desot, Rootkit, Porntube...HELPPPPP

2 posters

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyDesot, Rootkit, Porntube...HELPPPPP

more_horiz
I probably have 25 different viruses on my machine. I can still get online, but this desot.exe is preventing me from access HIJACK this or any other executable. They will download but I can't open them. I am accessing the internet through safe mode with networking.

Please is there anything that I can do?

I would appreciate any help you may provide! Let me think Let me think

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Welcome to GeekPolice. We are here to save you money. Our expertise here can help you get rid of threats.

From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by a Tech Staff member, administrator, or moderator. Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.

As this topic is for you only, I just need to issue a warning to outside readers:
Roger that Warning: Instructions issued in this topic are for this user only. We are not responsible for damages, so if you need help; please register for this site, and start a new topic requesting help.




Please download ComboFixDesot, Rootkit, Porntube...HELPPPPP Combofix by sUBs
From BleepingComputer.com

Please save the file to your Desktop, but rename it first:

Desot, Rootkit, Porntube...HELPPPPP Cf110
Desot, Rootkit, Porntube...HELPPPPP Cf210

Important information about ComboFix

Before the download:
  • Please copy and paste these instructions to Notepad and save to your Desktop, or print them - for easier access.
  • It is important to rename ComboFix before the download.
  • Please do not rename ComboFix to other names, but only the one indicated.

After the download:
  • Close any open browsers.
  • Very Important: Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Please visit here if you don't know how.
  • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
  • Please do not attempt to re-connect your machine back to the Internet until ComboFix has completely finished.
  • If there is no Internet connection after running ComboFix, then restart your computer to restore back your connection.

Running ComboFix:
  • Double click on svchost.exe & follow the prompts.
  • It will attempt to install the Recovery Console:

Desot, Rootkit, Porntube...HELPPPPP Cf410
Desot, Rootkit, Porntube...HELPPPPP Cf510

  • When ComboFix finishes, it will produce a report for you.
  • Please post the "C:\Combo-Fix.txt" in your next reply.


Troubleshooting ComboFix

Safe Mode:

If you still cannot get ComboFix to run, try booting into Safe Mode, and run it there.

(To boot into Safe Mode, tap F8 after BIOS, and just before the Windows
logo appears. A list of options will appear, select "Safe Mode.")

Re-downloading:

If this doesn't work either, try the same method (above method), but try to download it again, except name
ComboFix.exe to iexplore.exe, explorer.exe, or winlogon.exe.

Malware is known for blocking all "user" processes, except for its whitelist of system important processes such as iexplore.exe, explorer.exe, winlogon.exe.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
I could not get Combo/svchost.exe file to open. I was able to download it, rename it, but once I opened it, I always get the awful desot error.

I tried to attach the screenshot but can't.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Please reboot to Safe Mode with Networking (tap the F8 key just before Windows starts to load and select the Safe Mode with Networking option from the menu).

Please navigate to c:\WINDOWS\System32 and delete the following file in that folder:
desot.exe

Then, while in Safe Mode with Networking, run ComboFix as noted above.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
says that it is not accessible, access denied

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Hi

Please follow this article to take ownership of the file. It must be deleted.

http://support.microsoft.com/kb/308421

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
You guys are the absoƖute BEST...I have been dealing with 402 infected files for almost 2 months with no money to take my laptop to the shop!

You all are Godsends!!! I am so thankful!!! Finally I was able to run Hijackthis...here is the log
ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:16:59 AM, on 10/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\Explorer.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\DOCUME~1\user\LOCALS~1\Temp\Temporary Directory 1 for HiJackThis[1].zip\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
F2 - REG:system.ini: Shell=Explorer.exe rundll32.exe tapi.nfo beforeglav
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twext.exe,C:\WINDOWS\system32\sdra64.exe,
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0988.2\msneshellx.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [INPROCOMMWireless] C:\Program Files\Atheros\Wireless\Utility\WlanUtil.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16
O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\CF11957.exe" /c "C:\svchost.exe\C.bat"
O4 - HKLM\..\Run: [DLBUCATS] rundll32 C:\WINDOWS\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16
O4 - HKLM\..\RunOnce: [SafetyCenter] C:\Program Files\SafetyCenter\start.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NordBull] C:\WINDOWS\msa.exe
O4 - HKCU\..\Run: [minix32] C:\WINDOWS\system32\minix32.exe
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\user\protect.dll,_IWMPEvents@16
O4 - HKCU\..\Run: [Yjafosi8kdf98winmdkmnkmfnwe] C:\DOCUME~1\user\LOCALS~1\Temp\setup.exe
O4 - HKCU\..\Run: [Active Security] "C:\Program Files\Active Security\asecurity.exe" -noscan
O4 - HKCU\..\Run: [AdobeUpdater6] "C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe"
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\11d9db9c-3f06-4cd2-938f-dc7c338b093b.exe
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [Google Update] "C:\Documents and Settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [NordBull] C:\WINDOWS\msa.exe (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [minix32] C:\WINDOWS\system32\minix32.exe (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [autochk] rundll32.exe C:\DOCUME~1\user\protect.dll,_IWMPEvents@16 (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [Yjafosi8kdf98winmdkmnkmfnwe] C:\DOCUME~1\user\LOCALS~1\Temp\setup.exe (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [Active Security] "C:\Program Files\Active Security\asecurity.exe" -noscan (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [AdobeUpdater6] "C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe" (User '?')
O4 - HKUS\S-1-5-21-790525478-688789844-1343024091-1004\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\11d9db9c-3f06-4cd2-938f-dc7c338b093b.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [NordBull] C:\WINDOWS\TEMP\fhtyxhtsnn.exe (User '?')
O4 - HKUS\.DEFAULT\..\Run: [NordBull] C:\WINDOWS\TEMP\fhtyxhtsnn.exe (User 'Default user')
O4 - S-1-5-21-790525478-688789844-1343024091-1004 Startup: ChkDisk.dll (User '?')
O4 - S-1-5-21-790525478-688789844-1343024091-1004 Startup: ChkDisk.lnk = ? (User '?')
O4 - S-1-5-18 Startup: ChkDisk.dll (User '?')
O4 - S-1-5-18 Startup: ChkDisk.lnk = ? (User '?')
O4 - .DEFAULT Startup: ChkDisk.dll (User 'Default user')
O4 - .DEFAULT Startup: ChkDisk.lnk = ? (User 'Default user')
O4 - Startup: ChkDisk.dll
O4 - Startup: ChkDisk.lnk = ?
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://ciscosales.webex.com/client/T26LSP49EP12/webex/ieatgpc.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: AntipyProex (AntipPro2009_100) - Unknown owner - C:\WINDOWS\svchast.exe (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: dlbu_device - - C:\WINDOWS\system32\dlbucoms.exe
O23 - Service: fastnetsrv Service (fastnetsrv) - Sigma Designs In - C:\WINDOWS\system32\FastNetSrv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Net Login (NetLogin) - Unknown owner - C:\WINDOWS\svchost.exe (file missing)
O23 - Service: WDefend - Unknown owner - C:\WINDOWS\svohost.exe (file missing)

--
End of file - 7391 bytes

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Hi

Please run ComboFix as noted above.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
ComboFix 09-10-13.01 - user 10/14/2009 4:43.1.1 - NTFSx86 NETWORK
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\afonyte.vbs
c:\documents and settings\All Users\Application Data\kaporu.reg
c:\documents and settings\user\Application Data\avajimum.reg
c:\documents and settings\user\Application Data\ejeh.inf
c:\documents and settings\user\Application Data\gehyjicyzu.reg
c:\documents and settings\user\Application Data\twain_32
c:\documents and settings\user\Application Data\twain_32\user.ds
c:\documents and settings\user\Application Data\xybu.bat
c:\documents and settings\user\Cookies\amocypi.lib
c:\documents and settings\user\Cookies\dawadotyz.com
c:\documents and settings\user\Cookies\fohuguguga._sy
c:\documents and settings\user\Cookies\hilekeq.dat
c:\documents and settings\user\Cookies\tojil.vbs
c:\documents and settings\user\Local Settings\Application Data\kefohuw.reg
c:\documents and settings\user\Local Settings\Application Data\vozajub.inf
c:\documents and settings\user\Local Settings\Temporary Internet Files\adeloh.scr
c:\documents and settings\user\Local Settings\Temporary Internet Files\cojozytaqa.sys
c:\documents and settings\user\Local Settings\Temporary Internet Files\efefidet.bin
c:\documents and settings\user\Local Settings\Temporary Internet Files\otyvi.ban
c:\documents and settings\user\Local Settings\Temporary Internet Files\utohoju.pif
c:\documents and settings\user\Local Settings\Temporary Internet Files\utomon.dll
c:\documents and settings\user\Local Settings\Temporary Internet Files\webex.ini
c:\documents and settings\user\protect.dll
c:\documents and settings\user\Start Menu\Programs\Startup\ChkDisk.dll
c:\documents and settings\user\Start Menu\Programs\Startup\ChkDisk.lnk
c:\program files\Common Files\ipit.vbs
c:\program files\PC_Antispyware2010
c:\program files\PC_Antispyware2010\AVEngn.dll
c:\program files\PC_Antispyware2010\data\daily.cvd
c:\program files\PC_Antispyware2010\htmlayout.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\PC_Antispyware2010\PC_Antispyware2010.cfg
c:\program files\PC_Antispyware2010\pthreadVC2.dll
c:\program files\PC_Antispyware2010\Uninstall.exe
c:\program files\PC_Antispyware2010\wscui.cpl
c:\program files\Protection System
c:\program files\Protection System\blacklist.cga
c:\program files\Protection System\core.cga
c:\program files\Protection System\firewall.dll
c:\program files\Protection System\help.ico
c:\program files\Protection System\protection system extension
c:\program files\SafetyCenter
c:\program files\SafetyCenter\main.ico
c:\program files\SafetyCenter\new.exe
c:\program files\SafetyCenter\protector.exe
c:\program files\SafetyCenter\sound.wav
c:\program files\SafetyCenter\start.exe
c:\program files\SafetyCenter\uninstall.exe
c:\program files\Windows Antivirus Pro
c:\program files\Windows Antivirus Pro\msvcm80.dll
c:\program files\Windows Antivirus Pro\msvcp80.dll
c:\program files\Windows Antivirus Pro\msvcr80.dll
c:\program files\Windows Antivirus Pro\tmp\dbsinit.exe
c:\program files\Windows Antivirus Pro\tmp\images\i1.gif
c:\program files\Windows Antivirus Pro\tmp\images\i2.gif
c:\program files\Windows Antivirus Pro\tmp\images\i3.gif
c:\program files\Windows Antivirus Pro\tmp\images\j1.gif
c:\program files\Windows Antivirus Pro\tmp\images\j2.gif
c:\program files\Windows Antivirus Pro\tmp\images\j3.gif
c:\program files\Windows Antivirus Pro\tmp\images\jj1.gif
c:\program files\Windows Antivirus Pro\tmp\images\jj2.gif
c:\program files\Windows Antivirus Pro\tmp\images\jj3.gif
c:\program files\Windows Antivirus Pro\tmp\images\l1.gif
c:\program files\Windows Antivirus Pro\tmp\images\l2.gif
c:\program files\Windows Antivirus Pro\tmp\images\l3.gif
c:\program files\Windows Antivirus Pro\tmp\images\pix.gif
c:\program files\Windows Antivirus Pro\tmp\images\t1.gif
c:\program files\Windows Antivirus Pro\tmp\images\t2.gif
c:\program files\Windows Antivirus Pro\tmp\images\up1.gif
c:\program files\Windows Antivirus Pro\tmp\images\up2.gif
c:\program files\Windows Antivirus Pro\tmp\images\w1.gif
c:\program files\Windows Antivirus Pro\tmp\images\w11.gif
c:\program files\Windows Antivirus Pro\tmp\images\w2.gif
c:\program files\Windows Antivirus Pro\tmp\images\w3.gif
c:\program files\Windows Antivirus Pro\tmp\images\w3.jpg
c:\program files\Windows Antivirus Pro\tmp\images\wt1.gif
c:\program files\Windows Antivirus Pro\tmp\images\wt2.gif
c:\program files\Windows Antivirus Pro\tmp\images\wt3.gif
c:\program files\Windows Antivirus Pro\tmp\wispex.html
c:\program files\Windows Antivirus Pro\Windows Antivirus Pro.exe
c:\program files\Windows Police Pro
c:\program files\Windows Police Pro\msvcm80.dll
c:\program files\Windows Police Pro\msvcp80.dll
c:\program files\Windows Police Pro\msvcr80.dll
c:\program files\Windows Police Pro\windows Police Pro.exe
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
c:\windows\system32\autochk.dll
c:\windows\system32\camikojyf.bat
c:\windows\system32\certstore.dat
c:\windows\system32\config\systemprofile\protect.dll
c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Antivirus Pro
c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Antivirus Pro\Windows Antivirus Pro.lnk
c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro
c:\windows\system32\config\systemprofile\Start Menu\Programs\Windows Police Pro\Windows Police Pro.lnk
c:\windows\system32\dddesot.dll
c:\windows\system32\drivers\kbiwkmsnruakvs.sys
c:\windows\system32\drivers\UACewfvdiuxyv.sys
c:\windows\system32\emehigav.bat
c:\windows\system32\FInstall.sys
c:\windows\system32\images
c:\windows\system32\images\i1.gif
c:\windows\system32\images\i2.gif
c:\windows\system32\images\i3.gif
c:\windows\system32\images\j1.gif
c:\windows\system32\images\j2.gif
c:\windows\system32\images\j3.gif
c:\windows\system32\images\jj1.gif
c:\windows\system32\images\jj2.gif
c:\windows\system32\images\jj3.gif
c:\windows\system32\images\l1.gif
c:\windows\system32\images\l2.gif
c:\windows\system32\images\l3.gif
c:\windows\system32\images\pix.gif
c:\windows\system32\images\t1.gif
c:\windows\system32\images\t2.gif
c:\windows\system32\images\up1.gif
c:\windows\system32\images\up2.gif
c:\windows\system32\images\w1.gif
c:\windows\system32\images\w11.gif
c:\windows\system32\images\w2.gif
c:\windows\system32\images\w3.gif
c:\windows\system32\images\w3.jpg
c:\windows\system32\images\wt1.gif
c:\windows\system32\images\wt2.gif
c:\windows\system32\images\wt3.gif
c:\windows\system32\Install.txt
c:\windows\system32\kbiwkmaeoufoew.dll
c:\windows\system32\kbiwkmcmqshixw.dll
c:\windows\system32\kbiwkmjbpjhlgr.dat
c:\windows\system32\kbiwkmlexgbrqh.dll
c:\windows\system32\kbiwkmlheaibmq.dll
c:\windows\system32\kbiwkmpdmyfxep.dat
c:\windows\system32\kbiwkmrttkbmwn.dll
c:\windows\system32\kbiwkmswwkedie.dll
c:\windows\system32\kbiwkmxgufasww.dll
c:\windows\system32\kbiwkmxnbmnepy.dll
c:\windows\system32\kbiwkmxuwbardk.dll
c:\windows\system32\lowsec
c:\windows\system32\mndisk.sys
c:\windows\system32\nuar.old
c:\windows\system32\onhelp.htm
c:\windows\system32\pump.exe
c:\windows\system32\schtml
c:\windows\system32\skynet.dat
c:\windows\system32\sonhelp.htm
c:\windows\system32\sysnet.dat
c:\windows\system32\twain_32
c:\windows\system32\UACbrxrjkwmyx.dll
c:\windows\system32\UACiloafqxhpl.dll
c:\windows\system32\UACkfjpibmuwy.dll
c:\windows\system32\UACkmodmplsbb.dll
c:\windows\system32\UACvngmtsgldn.dat
c:\windows\system32\wiawow32.sys
c:\windows\system32\wisdstr.exe
c:\windows\system32\wispex.html
c:\windows\system32\wiwow64.exe
c:\windows\system32\wscsvc32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_ANTIPPRO2009_100
-------\Legacy_IAS
-------\Legacy_kbiwkmbltprqxf
-------\Legacy_MNDISK
-------\Legacy_UACd.sys
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Service_6to4
-------\Service_AntipPro2009_100
-------\Service_kbiwkmbltprqxf
-------\Service_mndisk
-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-09-14 to 2009-10-14 )))))))))))))))))))))))))))))))
.

2009-10-14 07:25 . 2009-10-14 07:25 -------- d-----w- c:\windows\srchasst
2009-10-13 15:38 . 2009-10-14 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\97062428
2009-10-09 17:43 . 2009-10-09 17:43 654336 ----a-w- c:\windows\system32\plugie.dll
2009-09-14 13:30 . 2009-09-14 13:31 -------- d-----w- c:\windows\sv3999

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-14 08:54 . 2009-08-24 06:25 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-14 08:21 . 2008-10-01 20:21 -------- d-----w- c:\program files\dl_Cats
2009-10-11 06:05 . 2009-08-24 18:55 664 ----a-w- c:\documents and settings\user\Local Settings\Application Data\d3d9caps.dat
2009-09-25 02:19 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee
2009-09-05 04:24 . 2009-09-05 04:24 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-09-03 07:47 . 2009-09-03 07:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-27 01:48 . 2009-08-27 01:48 68256 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 21:46 . 2009-08-27 03:34 3185678 ----a-w- C:\ComboFix.exe
2009-08-25 20:38 . 2009-08-25 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-25 18:07 . 2009-08-25 18:04 -------- d-----w- c:\program files\Common Files\McAfee
2009-08-25 18:05 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee.com
2009-08-25 16:00 . 2009-08-25 16:00 10213 ----a-w- c:\documents and settings\user\Application Data\exyl.com
2009-08-25 16:00 . 2009-08-25 16:00 19725 ----a-w- c:\documents and settings\user\Application Data\nybiqom.dat
2009-08-25 16:00 . 2009-08-25 16:00 15871 ----a-w- c:\documents and settings\All Users\Application Data\orolozu.com
2009-08-25 16:00 . 2009-08-25 16:00 19218 ----a-w- c:\program files\Common Files\acivyvove._dl
2009-08-25 16:00 . 2009-08-25 16:00 13919 ----a-w- c:\program files\Common Files\ihemotyxuc.dat
2009-08-25 15:57 . 2009-08-25 15:57 164864 ----a-w- c:\windows\system32\unz2.exe
2009-08-25 15:57 . 2009-08-25 15:57 164864 ----a-w- c:\windows\system32\unz1.exe
2009-08-25 04:55 . 2009-08-25 04:55 -------- d-----w- c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-08-24 20:59 . 2009-08-24 20:59 -------- d-----w- c:\program files\Trend Micro
2009-08-24 13:38 . 2009-08-24 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-24 13:24 . 2009-08-24 18:06 812344 ----a-w- C:\HJTInstall.exe
2009-08-24 13:10 . 2009-08-24 13:11 389120 ----a-w- c:\windows\system32\CF17216.exe
2009-08-24 06:25 . 2009-08-24 06:25 -------- d-----w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-08-24 05:59 . 2009-08-24 05:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-24 05:11 . 2009-08-24 05:11 19114 ----a-w- c:\documents and settings\user\Application Data\kanikurucu.sys
2009-08-23 22:27 . 2009-08-23 22:27 19382 ----a-w- c:\documents and settings\All Users\Application Data\lularipiz.bin
2009-08-23 22:27 . 2009-08-23 22:27 19353 ----a-w- c:\windows\cyxa.pif
2009-08-23 22:27 . 2009-08-23 22:27 19223 ----a-w- c:\documents and settings\user\Application Data\ixymahese.com
2009-08-23 22:27 . 2009-08-23 22:27 18265 ----a-w- c:\documents and settings\All Users\Application Data\ycefatu.exe
2009-08-23 22:27 . 2009-08-23 22:27 17765 ----a-w- c:\documents and settings\user\Local Settings\Application Data\micir.exe
2009-08-23 22:27 . 2009-08-23 22:27 13340 ----a-w- c:\documents and settings\user\Application Data\jyty.dll
2009-08-23 22:27 . 2009-08-23 22:27 11097 ----a-w- c:\documents and settings\user\Local Settings\Application Data\bicecy.exe
2009-08-23 22:27 . 2009-08-23 22:27 10698 ----a-w- c:\windows\system32\tira.sys
2009-08-23 22:27 . 2009-08-23 22:27 10135 ----a-w- c:\documents and settings\All Users\Application Data\xijerasip.pif
2009-08-23 21:38 . 2009-08-23 21:38 16229 ----a-w- c:\documents and settings\user\Local Settings\Application Data\ijuha.scr
2009-08-23 21:38 . 2009-08-23 21:38 18106 ----a-w- c:\program files\Common Files\igalywygak._dl
2009-08-23 21:38 . 2009-08-23 21:38 10129 ----a-w- c:\documents and settings\All Users\Application Data\avydoryxap.bin
2009-08-23 00:03 . 2008-07-17 16:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-16 17:32 . 2009-08-30 00:51 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-09 133104]
"AdobeUpdater6"="c:\program files\Common Files\Adobe\Updater6\Adobe_Updater.exe" [2009-03-16 2521464]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\11d9db9c-3f06-4cd2-938f-dc7c338b093b.exe" [2009-08-05 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-20 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-16 148888]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"DLBUCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll" [2007-02-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dlbucoms.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 NetLogin;Net Login;c:\windows\svchost.exe [x]
R2 WDefend;WDefend;c:\windows\svohost.exe [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-08-05 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-08-05 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-08-05 74480]
S2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe [2008-04-14 14336]
S2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-08-04 94720]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\DRIVERS\ozscr.sys [2008-01-17 92550]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - BTWSRV

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
BtwSrv
.
Contents of the 'Scheduled Tasks' folder

2009-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004Core.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004UA.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]

2009-08-25 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 02:26]

2009-08-25 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 02:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone: microsoft.com\office
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKCU-Run-Active Security - c:\program files\Active Security\asecurity.exe
HKLM-Run-INPROCOMMWireless - c:\program files\Atheros\Wireless\Utility\WlanUtil.exe
HKU-Default-Run-autochk - c:\windows\system32\config\SYSTEM~1\protect.dll
SafeBoot-mfehidk
SafeBoot-mfehidk.sys
SafeBoot-mferkdk
SafeBoot-mferkdk.sys
SafeBoot-mfetdik
SafeBoot-mfetdik.sys
AddRemove-HijackThis - c:\documents and settings\user\My Documents\Downloads\HijackThis.exe
AddRemove-PC_Antispyware2010 - c:\program files\PC_Antispyware2010\Uninstall.exe
AddRemove-TPS Electronic Financial Worksheets_is1 - g:\tps financial worksheets\unins000.exe
AddRemove-VLC media player - c:\program files\VideoLAN\VLC\uninstall.exe
AddRemove-Win Antivirus Pro - c:\program files\Windows Antivirus Pro\AntiSpyware_Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 04:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBUCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(700)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1892)
c:\windows\system32\mshtml.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\dlbucoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\McAfee\MPF\MpfSrv.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\progra~1\McAfee\MSC\mcupdmgr.exe
c:\windows\system32\opeia.exe
c:\progra~1\McAfee\MSC\mcupdui.exe
c:\windows\system32\lsm32.sys
.
**************************************************************************
.
Completion time: 2009-10-14 5:23 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-14 10:22

Pre-Run: 9,851,875,328 bytes free
Post-Run: 10,654,420,992 bytes free

385 --- E O F --- 2009-04-16 01:50

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Hi

Open notepad and copy/paste the text in the quotebox below into it:

http://www.geekpolice.net/virus-spyware-malware-removal-f11/desot-rootkit-porntubehelppppp-t15177.htm

DirLook::
c:\windows\sv3999
c:\documents and settings\All Users\Application Data\97062428

File::
c:\documents and settings\user\Application Data\nybiqom.dat
c:\documents and settings\user\Application Data\exyl.com
c:\documents and settings\All Users\Application Data\orolozu.com
c:\program files\Common Files\acivyvove._dl
c:\program files\Common Files\ihemotyxuc.dat
c:\windows\system32\unz2.exe
c:\windows\system32\unz1.exe
c:\documents and settings\user\Application Data\kanikurucu.sys
c:\documents and settings\All Users\Application Data\lularipiz.bin
c:\windows\cyxa.pif
c:\documents and settings\user\Application Data\ixymahese.com
c:\documents and settings\All Users\Application Data\ycefatu.exe
c:\documents and settings\user\Local Settings\Application Data\micir.exe
c:\documents and settings\user\Application Data\jyty.dll
c:\documents and settings\user\Local Settings\Application Data\bicecy.exe
c:\windows\system32\tira.sys
c:\documents and settings\All Users\Application Data\xijerasip.pif
c:\documents and settings\user\Local Settings\Application Data\ijuha.scr
c:\program files\Common Files\igalywygak._dl
c:\documents and settings\All Users\Application Data\avydoryxap.bin
c:\windows\svohost.exe
c:\windows\svchost.exe
c:\windows\system32\opeia.exe

Rootkit::
c:\windows\system32\lsm32.sys

Driver::
BtwSrv

DDS::
Trusted Zone: microsoft.com\office

Suspect::
c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
c:\windows\system32\CF17216.exe


Save this as CFScript.txt


Desot, Rootkit, Porntube...HELPPPPP Cfscriptb4

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

  • Ensure you are connected to the internet and click OK on the message box.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
ComboFix 09-10-13.04 - user 10/14/2009 10:02.3.1 - NTFSx86 NETWORK
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

FILE ::
"c:\documents and settings\All Users\Application Data\avydoryxap.bin"
"c:\documents and settings\All Users\Application Data\lularipiz.bin"
"c:\documents and settings\All Users\Application Data\orolozu.com"
"c:\documents and settings\All Users\Application Data\xijerasip.pif"
"c:\documents and settings\All Users\Application Data\ycefatu.exe"
"c:\documents and settings\user\Application Data\exyl.com"
"c:\documents and settings\user\Application Data\ixymahese.com"
"c:\documents and settings\user\Application Data\jyty.dll"
"c:\documents and settings\user\Application Data\kanikurucu.sys"
"c:\documents and settings\user\Application Data\nybiqom.dat"
"c:\documents and settings\user\Local Settings\Application Data\bicecy.exe"
"c:\documents and settings\user\Local Settings\Application Data\ijuha.scr"
"c:\documents and settings\user\Local Settings\Application Data\micir.exe"
"c:\program files\Common Files\acivyvove._dl"
"c:\program files\Common Files\igalywygak._dl"
"c:\program files\Common Files\ihemotyxuc.dat"
"c:\windows\cyxa.pif"
"c:\windows\svchost.exe"
"c:\windows\svohost.exe"
"c:\windows\system32\opeia.exe"
"c:\windows\system32\tira.sys"
"c:\windows\system32\unz1.exe"
"c:\windows\system32\unz2.exe"

file zipped: c:\windows\system32\CF17216.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\avydoryxap.bin
c:\documents and settings\All Users\Application Data\lularipiz.bin
c:\documents and settings\All Users\Application Data\orolozu.com
c:\documents and settings\All Users\Application Data\xijerasip.pif
c:\documents and settings\All Users\Application Data\ycefatu.exe
c:\documents and settings\user\Application Data\exyl.com
c:\documents and settings\user\Application Data\ixymahese.com
c:\documents and settings\user\Application Data\jyty.dll
c:\documents and settings\user\Application Data\kanikurucu.sys
c:\documents and settings\user\Application Data\nybiqom.dat
c:\documents and settings\user\Local Settings\Application Data\bicecy.exe
c:\documents and settings\user\Local Settings\Application Data\ijuha.scr
c:\documents and settings\user\Local Settings\Application Data\micir.exe
c:\program files\Common Files\acivyvove._dl
c:\program files\Common Files\igalywygak._dl
c:\program files\Common Files\ihemotyxuc.dat
c:\windows\cyxa.pif
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\opeia.exe
c:\windows\system32\tira.sys
c:\windows\system32\unz1.exe
c:\windows\system32\unz2.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BTWSRV
-------\Service_BtwSrv


((((((((((((((((((((((((( Files Created from 2009-09-14 to 2009-10-14 )))))))))))))))))))))))))))))))
.

2009-10-14 07:25 . 2009-10-14 07:25 -------- d-----w- c:\windows\srchasst
2009-10-13 15:38 . 2009-10-14 08:49 -------- d-----w- c:\documents and settings\All Users\Application Data\97062428
2009-10-09 17:43 . 2009-10-09 17:43 654336 ----a-w- c:\windows\system32\plugie.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-14 08:54 . 2009-08-24 06:25 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-14 08:21 . 2008-10-01 20:21 -------- d-----w- c:\program files\dl_Cats
2009-10-11 06:05 . 2009-08-24 18:55 664 ----a-w- c:\documents and settings\user\Local Settings\Application Data\d3d9caps.dat
2009-09-25 02:19 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee
2009-09-05 04:24 . 2009-09-05 04:24 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-09-03 07:47 . 2009-09-03 07:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-27 01:48 . 2009-08-27 01:48 68256 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 21:46 . 2009-08-27 03:34 3185678 ----a-w- C:\ComboFix.exe
2009-08-25 20:38 . 2009-08-25 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-25 18:07 . 2009-08-25 18:04 -------- d-----w- c:\program files\Common Files\McAfee
2009-08-25 18:05 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee.com
2009-08-25 04:55 . 2009-08-25 04:55 -------- d-----w- c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-08-24 20:59 . 2009-08-24 20:59 -------- d-----w- c:\program files\Trend Micro
2009-08-24 13:38 . 2009-08-24 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-24 13:24 . 2009-08-24 18:06 812344 ----a-w- C:\HJTInstall.exe
2009-08-24 13:10 . 2009-08-24 13:11 389120 ----a-w- c:\windows\system32\CF17216.exe
2009-08-24 06:25 . 2009-08-24 06:25 -------- d-----w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-08-24 05:59 . 2009-08-24 05:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-23 00:03 . 2008-07-17 16:01 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-16 17:32 . 2009-08-30 00:51 120136 ----a-w- c:\windows\system32\drivers\Mpfp.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\documents and settings\All Users\Application Data\97062428 ----


---- Directory of c:\windows\sv3999 ----

2009-09-14 13:31 . 2009-10-09 11:54 57344 ----a-w- c:\windows\sv3999\isvchost.exe


((((((((((((((((((((((((((((( SnapShot@2009-10-14_09.59.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-14 15:13 . 2009-10-14 15:13 16384 c:\windows\Temp\Perflib_Perfdata_1d4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-09 133104]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\11d9db9c-3f06-4cd2-938f-dc7c338b093b.exe" [2009-08-05 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-20 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-16 148888]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-07-10 645328]
"DLBUCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll" [2007-02-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dlbucoms.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

R2 NetLogin;Net Login;c:\windows\svchost.exe [x]
R2 WDefend;WDefend;c:\windows\svohost.exe [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-08-05 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-08-05 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-08-05 74480]
S2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-08-04 94720]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\DRIVERS\ozscr.sys [2008-01-17 92550]
S4 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe [2008-04-14 14336]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - BTWSRV
.
Contents of the 'Scheduled Tasks' folder

2009-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004Core.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004UA.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]

2009-08-25 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 02:26]

2009-08-25 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-08-25 02:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 10:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBUCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Re-running ComboFix to remove infections:

  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    Folder::
    c:\windows\sv3999
    c:\windows\srchasst
    c:\documents and settings\All Users\Application Data\97062428

    File::
    c:\windows\system32\plugie.dll

    FileLook::
    svchost.exe
    svohost.exe
  4. Save this as CFScript.txt, in the same location as ComboFix.exe

    Desot, Rootkit, Porntube...HELPPPPP Cf010

  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
ComboFix 09-10-14.01 - user 10/14/2009 17:09.4.1 - NTFSx86
Running from: c:\documents and settings\user\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt

FILE ::
"c:\windows\system32\plugie.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\97062428
c:\windows\Install.txt
c:\windows\sv3999
c:\windows\sv3999\isvchost.exe
c:\windows\system32\FInstall.sys
c:\windows\system32\Install.txt
c:\windows\system32\plugie.dll
c:\windows\TEMP\mta13187.dll

.
((((((((((((((((((((((((( Files Created from 2009-09-14 to 2009-10-14 )))))))))))))))))))))))))))))))
.

2009-10-14 20:29 . 2009-10-14 20:29 -------- d-----w- c:\windows\LastGood.Tmp
2009-10-14 07:25 . 2009-10-14 07:25 -------- d-----w- c:\windows\srchasst

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-14 20:29 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee
2009-10-14 08:54 . 2009-08-24 06:25 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-10-14 08:21 . 2008-10-01 20:21 -------- d-----w- c:\program files\dl_Cats
2009-10-11 06:05 . 2009-08-24 18:55 664 ----a-w- c:\documents and settings\user\Local Settings\Application Data\d3d9caps.dat
2009-09-05 04:24 . 2009-09-05 04:24 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap
2009-09-03 07:47 . 2009-09-03 07:47 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-08-27 01:48 . 2009-08-27 01:48 68256 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-26 21:46 . 2009-08-27 03:34 3185678 ----a-w- C:\ComboFix.exe
2009-08-25 20:38 . 2009-08-25 17:32 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2009-08-25 18:07 . 2009-08-25 18:04 -------- d-----w- c:\program files\Common Files\McAfee
2009-08-25 18:05 . 2009-08-25 18:03 -------- d-----w- c:\program files\McAfee.com
2009-08-25 04:55 . 2009-08-25 04:55 -------- d-----w- c:\documents and settings\user\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2009-08-24 20:59 . 2009-08-24 20:59 -------- d-----w- c:\program files\Trend Micro
2009-08-24 13:38 . 2009-08-24 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-24 13:24 . 2009-08-24 18:06 812344 ----a-w- C:\HJTInstall.exe
2009-08-24 13:10 . 2009-08-24 13:11 389120 ----a-w- c:\windows\system32\CF17216.exe
2009-08-24 06:25 . 2009-08-24 06:25 -------- d-----w- c:\documents and settings\user\Application Data\SUPERAntiSpyware.com
2009-08-24 05:59 . 2009-08-24 05:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-08-23 00:03 . 2008-07-17 16:01 -------- d--h--w- c:\program files\InstallShield Installation Information
.

((((((((((((((((((((((((((((( SnapShot@2009-10-14_09.59.57 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-04 10:00 . 2004-08-04 10:00 94208 c:\windows\system32\FastNetSrv.exe
+ 2009-10-14 15:47 . 2009-10-14 15:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-07-17 15:43 . 2009-10-14 15:43 98304 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-07-17 15:43 . 2009-10-14 07:31 98304 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-10-14 15:47 . 2009-10-14 15:43 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-08-04 10:00 . 2004-08-04 10:00 131072 c:\windows\system32\wmdtc.exe
+ 2004-08-04 10:00 . 2004-08-04 10:00 131072 c:\windows\system32\opeia.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-09 133104]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\11d9db9c-3f06-4cd2-938f-dc7c338b093b.exe" [2009-08-05 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-11-11 344064]
"NeroCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-20 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-16 148888]
"DLBUCATS"="c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll" [2007-02-12 73728]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 17:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\dlbucoms.exe"=

R2 0092171255552200mcinstcleanup;McAfee Application Installer Cleanup (0092171255552200);c:\windows\TEMP\009217~1.EXE [x]
R2 NetLogin;Net Login;c:\windows\svchost.exe [x]
R2 WDefend;WDefend;c:\windows\svohost.exe [x]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-08-05 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-08-05 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-08-05 74480]
S2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-08-04 94208]
S3 OZSCR;O2Micro SmartCardBus Smartcard Reader;c:\windows\system32\DRIVERS\ozscr.sys [2008-01-17 92550]
S4 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe [2008-04-14 14336]


--- Other Services/Drivers In Memory ---

*NewlyCreated* - 0092171255552200MCINSTCLEANUP
*NewlyCreated* - BTWSRV

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
BtwSrv
.
Contents of the 'Scheduled Tasks' folder

2009-09-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004Core.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]

2009-10-13 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-790525478-688789844-1343024091-1004UA.job
- c:\documents and settings\user\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-09 20:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = iexplore
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
.
- - - - ORPHANS REMOVED - - - -

SafeBoot-mcmscsvc
SafeBoot-MCODS



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-14 17:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLBUCATS = rundll32 c:\windows\system32\spool\DRIVERS\W32X86\3\DLBUtime.dll,_RunDLLEntry@16???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"Installed"="1"
"NoChange"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(696)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3936)
c:\windows\system32\mshtml.dll
c:\windows\IME\SPGRMR.DLL
c:\program files\Common Files\Microsoft Shared\INK\SKCHUI.DLL
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\scardsvr.exe
c:\windows\system32\dlbucoms.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
c:\windows\system32\wmdtc.exe
c:\program files\Java\jre6\bin\jucheck.exe
c:\windows\system32\lsm32.sys
.
**************************************************************************
.
Completion time: 2009-10-14 17:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-14 22:27
ComboFix2.txt 2009-10-14 15:38
ComboFix3.txt 2009-10-14 10:23

Pre-Run: 10,639,077,376 bytes free
Post-Run: 10,633,576,448 bytes free

173 --- E O F --- 2009-04-16 01:50

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Desot, Rootkit, Porntube...HELPPPPP Mbamicontw5 Please download Malwarebytes Anti-Malware from here.

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Full Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
  • Please save the log to a location you will remember.
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

descriptionDesot, Rootkit, Porntube...HELPPPPP EmptyRe: Desot, Rootkit, Porntube...HELPPPPP

more_horiz
Malwarebytes' Anti-Malware 1.41
Database version: 2963
Windows 5.1.2600 Service Pack 3

10/14/2009 6:47:36 PM
mbam-log-2009-10-14 (18-47-36).txt

Scan type: Full Scan (C:\|)
Objects scanned: 129366
Time elapsed: 52 minute(s), 5 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 2
Registry Keys Infected: 13
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 66

Memory Processes Infected:
C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\WINDOWS\system32\FastNetSrv.exe (Backdoor.Bot) -> Unloaded process successfully.
C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\BtwSrv.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\BtwSrv.dllx (Trojan.Agent) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\btwsrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\btwsrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\btwsrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\fastnetsrv (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\fastnetsrv (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\fastnetsrv (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{25ecc7c8-331f-4758-8371-1d34c1e6a983} (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MyComputer\NameSpace\{25ecc7c8-331f-4758-8371-1d34c1e6a983} (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\NetworkNeighborhood\NameSpace\{25ecc7c8-331f-4758-8371-1d34c1e6a983} (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_BTWSRV (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NetLogin (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Windows antiVirus pro (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_FASTNETSRV (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mEv (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Ulrn (Malware.Trace) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\Update (Malware.Trace) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mBt (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\udfa (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\mfa (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\wmdtc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\BtwSrv.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\system32\BtwSrv.dllx (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FastNetSrv.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\user\protect.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\user\Start Menu\Programs\Startup\ChkDisk.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\PC_Antispyware2010\htmlayout.dll.vir (Rogue.AntiVirusPro) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\PC_Antispyware2010\Uninstall.exe.vir (Rogue.PC_AntiSpyware2010) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\PC_Antispyware2010\wscui.cpl.vir (Rogue.HomeAntiVirus) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Protection System\protection system extension.vir (ProtectionSystem) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\SafetyCenter\new.exe.vir (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\SafetyCenter\protector.exe.vir (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\SafetyCenter\start.exe.vir (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\SafetyCenter\uninstall.exe.vir (Rogue.SafetyCenter) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Windows Antivirus Pro\Windows Antivirus Pro.exe.vir (Antivirus2009) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Windows Antivirus Pro\tmp\dbsinit.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\Windows Police Pro\windows Police Pro.exe.vir (Rogue.WindowsPolicePro) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Downloaded Program Files\popcaploader.dll.vir (Adware.PopCap) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmswwkedie.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\autochk.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dddesot.dll.vir (Rogue.ASC-AntiSpyware) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmaeoufoew.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmcmqshixw.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmlexgbrqh.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmlheaibmq.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmrttkbmwn.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmxgufasww.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmxnbmnepy.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kbiwkmxuwbardk.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\mndisk.sys.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\opeia.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\plugie.dll.vir (Rogue.ASC-AntiSpyware) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACiloafqxhpl.dll.vir (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkfjpibmuwy.dll.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\UACkmodmplsbb.dll.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wiawow32.sys.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wisdstr.exe.vir (Rogue.PC_AntiSpyware2010) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wiwow64.exe.vir (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wscsvc32.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\config\systemprofile\protect.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\kbiwkmsnruakvs.sys.vir (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000002.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000003.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000004.old (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000006.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000009.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000318.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000348.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0000362.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0001335.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0001336.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0001337.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0001915.dll (Rogue.ASC-AntiSpyware) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0002007.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{1E30FE5B-B713-4154-AC7E-8D5EDFD9D3B1}\RP1\A0002008.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\opeia.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dvdpaly.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\EvdoServer.dllx (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lsm32.sys (Backdoor.Bot) -> Delete on reboot.
C:\WINDOWS\system32\dllcache\beep.sys (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\config\systemprofile\Start Menu\Programs\Startup\ChkDisk.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\temp\t4m0_151216525912.bk.old (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\FInstall.sys (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\user\Cookies\yguryby.exe (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
C:\Documents and Settings\user\My Documents\downloads\winlogon.scr (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Desktop\winlogon.exe (Heuristics.Reserved.Word.Exploit) -> Quarantined and deleted successfully.
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum