Using Combofix to remove Winivstr.exe

Question

I keep getting a Spyware detected warning on my computer.  I downloaded Spybot to try to remove the issue but it would not start up.   I ran Combofix to try to resolve the issue not realizing how powerful Combofix is.  Any help would be greatly appreciated.     Logfile of Trend Micro HijackThis v2.0.2Scan saved at 15:25, on 2008-07-23Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16674)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXEC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\explorer.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005O2 - BHO: SITEguard BHO - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - C:\Program Files\STOPzilla!\SZSG.dllO2 - BHO: STOPzilla Browser Helper Object - {E3215F20-3212-11D6-9F8B-00D0B743919D} - C:\Program Files\STOPzilla!\SZIEBHO.dllO3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dllO4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO10 - Unknown file in Winsock LSP: c:\program files\common files\is3\anti-spyware\is3lsp.dllO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1210114172359O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Premier.localO17 - HKLM\Software\..\Telephony: DomainName = Premier.localO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Premier.localO17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = Premier.localO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Symantec System Center Discovery Service (NSCTOP) - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXEO23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 7260 bytes

bamajim · Answer

Bryan00001 Using Combofix unsupervised is not a good idea. If you ran Combofix, post the C:\ Combofix.txt log Microsoft MVP Consumer-Security CastleCops Instructor   'The world is what you make of it'

bamajim · Answer

Bryan00001

You are welcome

I need you to help us out with some research

Please go HERE

Put Your Name, and Dell HJT forum

and In the file to submit box, click Browse.Using Windows Explorer
Locate the file

C:\WINDOWS\buritos.exe

In the comments tell them that I asked you to upload the file
Then Select Send File.

Once you've sent it I will get right back to you

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Bryan00001 · Answer

Bamajim,

I appreciate your help. The Combofix Log is below.

ComboFix 08-07-22.4 - jm 2008-07-23 11:57:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.211 [GMT -6:00]
Running from: C:\Documents and Settings\jm.PREMIER\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jm.PREMIER\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dllcache\beep.sys
C:\Documents and Settings\bt\Application Data\wsnpoem
C:\Documents and Settings\bt\Application Data\wsnpoem\audio.dll
C:\Documents and Settings\bt\Application Data\wsnpoem\video.dll
C:\WINDOWS\system32\SZComp5.dll
C:\WINDOWS\system32\winivstr.exe

.
((((((((((((((((((((((((( Files Created from 2008-06-23 to 2008-07-23 )))))))))))))))))))))))))))))))
.

2008-07-23 09:17 . 2008-07-23 10:44 1,176 --a------ C:\WINDOWS\system32\drivers\kgpcpy.cfg
2008-07-23 09:16 . 2008-07-23 10:56

d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-07-23 09:15 . 2008-07-23 09:15 d-------- C:\Program Files\STOPzilla!
2008-07-23 09:15 . 2008-07-23 09:15 d-------- C:\Program Files\Common Files\iS3
2008-07-23 09:15 . 2008-07-23 12:02 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-07-23 08:54 . 2008-07-23 09:03 d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-23 08:54 . 2008-07-23 11:06 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-23 08:52 . 2008-07-23 08:52 15,083,520 --a------ C:\spybotsd160.exe
2008-07-22 11:10 . 2008-07-22 11:12 d-------- C:\Program Files\LiveUpdate Administration
2008-07-22 11:10 . 2002-01-09 01:53 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-07-22 10:58 . 2008-07-22 10:58 0 --a------ C:\WINDOWS\VPC32.INI
2008-07-22 10:36 . 2008-07-22 10:36 d-------- C:\Program Files\ACW
2008-07-22 09:42 . 2008-05-06 15:32 d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-07-22 09:42 . 2008-07-22 09:42 d-------- C:\Documents and Settings\Administrator
2008-07-22 09:38 . 2008-05-06 15:32 d-------- C:\Documents and Settings\bt\Application Data\Intel
2008-07-22 09:38 . 2008-07-22 09:38 d-------- C:\Documents and Settings\bt
2008-07-22 08:48 . 2008-07-23 08:57 9,216 --a------ C:\WINDOWS\system32\buritos.exe
2008-07-22 08:48 . 2008-07-23 08:57 9,216 --a------ C:\WINDOWS\buritos.exe
2008-07-07 09:13 . 2008-02-28 13:26 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-07-07 09:13 . 2008-02-28 13:01 774,144 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-07-03 15:41 . 2008-07-03 15:41 258,048 -ra------ C:\WINDOWS\system32\SZBase5.dll
2008-06-26 10:56 . 2008-06-26 10:56 364,544 -ra------ C:\WINDOWS\system32\IS3DBA5.dll
2008-06-26 10:56 . 2008-06-26 10:56 126,976 -ra------ C:\WINDOWS\system32\IS3HTUI5.dll
2008-06-26 10:55 . 2008-06-26 10:55 372,736 -ra------ C:\WINDOWS\system32\IS3UI5.dll
2008-06-26 10:55 . 2008-06-26 10:55 61,440 -ra------ C:\WINDOWS\system32\IS3Hks5.dll
2008-06-26 10:55 . 2008-06-26 10:55 23,040 -ra------ C:\WINDOWS\system32\IS3XDat5.dll
2008-06-26 10:54 . 2008-06-26 10:54 196,608 -ra------ C:\WINDOWS\system32\IS3Win325.dll
2008-06-26 10:54 . 2008-06-26 10:54 94,208 -ra------ C:\WINDOWS\system32\IS3Inet5.dll
2008-06-26 10:54 . 2008-06-26 10:54 90,112 -ra------ C:\WINDOWS\system32\IS3Svc5.dll
2008-06-26 10:50 . 2008-06-26 10:50 708,608 -ra------ C:\WINDOWS\system32\IS3Base5.dll
2008-06-25 16:26 . 2008-06-25 16:26 d-------- C:\Program Files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-23 18:02 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-22 17:01 --------- d-----w C:\Program Files\Symantec
2008-07-22 17:00 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-07 15:14 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-07 15:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-03 13:45 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-09 10:53 90,112 ------w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53 430,080 ------w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53 180,224 ------w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53 172,032 ------w C:\WINDOWS\system32\scrrun.dll
2008-05-08 16:21 20,264 ----a-w C:\Documents and Settings\jm.PREMIER\Application Data\GDIPFONTCACHEV1.DAT
2008-05-08 11:24 155,648 ------w C:\WINDOWS\system32\wscript.exe
2008-05-07 18:43 6,131,912 ----a-w C:\R111827.EXE
2008-05-07 09:07 135,168 ------w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll
2008-05-07 01:22 48,768 ------w C:\WINDOWS\system32\S32EVNT1.DLL
2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 18:12 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 11:19 819200]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 11:17 970752]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-06-06 17:09 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-06-06 17:06 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-06-06 17:10 118784]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 16:33 52840]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-10-07 20:48 125368]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"=

R0 szkg5;szkg;C:\WINDOWS\system32\DRIVERS\szkg.sys [2008-05-13 10:03]
R1 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2007-09-27 15:49]
S3 DCALEXICO;DCALEXICO;C:\WINDOWS\system32\drivers\DCalexico.sys []
S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2005-11-08 09:58]
.
- - - - ORPHANS REMOVED - - - -

Toolbar-SITEguard - (no file)
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-23 12:05:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\Symantec\SYMANT~1\NscTop.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Symantec AntiVirus\DoScan.exe
.
**************************************************************************
.
Completion time: 2008-07-23 12:08:49 - machine was rebooted [jm]
ComboFix-quarantined-files.txt 2008-07-23 18:08:36

Pre-Run: 70,224,482,304 bytes free
Post-Run: 70,170,615,808 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

163 --- E O F --- 2008-07-09 22:28:30

bamajim · Answer

Bryan00001

Thanks. Got the file.

1. Open NotePad (not wordpad). Copy and paste the following into Notepad

File::
C:\WINDOWS\VPC32.INI
C:\WINDOWS\system32\buritos.exe
C:\WINDOWS\buritos.exe

Save the File as CFScript(exactly as shown no spaces) ->> Save it to your Desktop

Using the Image as a reference, drag CFScript into ComboFix.exe

user posted image

You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply

2. Rerun Hijackthis and post a fresh Hijackthis log as well

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Bryan00001 · Answer

Here is the Combofix Log.

ComboFix 08-07-23.5 - jm 2008-07-24 10:28:33.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.180 [GMT -6:00]
Running from: C:\Documents and Settings\jm.PREMIER\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jm.PREMIER\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\buritos.exe
C:\WINDOWS\system32\buritos.exe
C:\WINDOWS\VPC32.INI
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\buritos.exe
C:\WINDOWS\system32\buritos.exe
C:\WINDOWS\VPC32.INI

.
((((((((((((((((((((((((( Files Created from 2008-06-24 to 2008-07-24 )))))))))))))))))))))))))))))))
.

2008-07-24 09:11 . 2008-04-13 12:39 14,592 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-24 09:11 . 2008-04-13 12:39 14,592 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-24 09:01 . 2008-05-06 15:32

d-------- C:\Documents and Settings\ks\Application Data\Intel
2008-07-24 09:01 . 2008-07-24 09:01 d-------- C:\Documents and Settings\ks
2008-07-23 15:24 . 2008-07-23 15:24 d-------- C:\Program Files\Trend Micro
2008-07-23 09:16 . 2008-07-23 10:56 d-------- C:\Documents and Settings\All Users\Application Data\SITEguard
2008-07-23 09:15 . 2008-07-23 09:15 d-------- C:\Program Files\Common Files\iS3
2008-07-23 09:15 . 2008-07-24 10:26 d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-07-23 08:54 . 2008-07-24 10:27 d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-23 08:54 . 2008-07-24 10:27 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-23 08:52 . 2008-07-23 08:52 15,083,520 --a------ C:\spybotsd160.exe
2008-07-22 11:10 . 2008-07-22 11:12 d-------- C:\Program Files\LiveUpdate Administration
2008-07-22 11:10 . 2002-01-09 01:53 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-07-22 10:36 . 2008-07-22 10:36 d-------- C:\Program Files\ACW
2008-07-22 09:42 . 2008-05-06 15:32 d-------- C:\Documents and Settings\Administrator\Application Data\Intel
2008-07-22 09:42 . 2008-07-22 09:42 d-------- C:\Documents and Settings\Administrator
2008-07-22 09:38 . 2008-05-06 15:32 d-------- C:\Documents and Settings\bt\Application Data\Intel
2008-07-22 09:38 . 2008-07-22 09:38 d-------- C:\Documents and Settings\bt
2008-07-07 09:13 . 2008-02-28 13:26 1,414,440 --a------ C:\WINDOWS\system32\ShellManager310E2D762.dll
2008-07-07 09:13 . 2008-02-28 13:01 774,144 --a------ C:\WINDOWS\system32\NEROINSTAEC43759.DB
2008-06-25 16:26 . 2008-06-25 16:26 d-------- C:\Program Files\MSXML 4.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-24 15:07 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-07-22 17:01 --------- d-----w C:\Program Files\Symantec
2008-07-22 17:00 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-07-07 15:14 --------- d-----w C:\Program Files\Common Files\Nero
2008-07-07 15:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-03 13:45 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-09 10:53 90,112 ------w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53 430,080 ------w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53 180,224 ------w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53 172,032 ------w C:\WINDOWS\system32\scrrun.dll
2008-05-08 16:21 20,264 ----a-w C:\Documents and Settings\jm.PREMIER\Application Data\GDIPFONTCACHEV1.DAT
2008-05-08 11:24 155,648 ------w C:\WINDOWS\system32\wscript.exe
2008-05-07 18:43 6,131,912 ----a-w C:\R111827.EXE
2008-05-07 09:07 135,168 ------w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12 1,288,192 ------w C:\WINDOWS\system32\quartz.dll
2008-05-07 01:22 48,768 ------w C:\WINDOWS\system32\S32EVNT1.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 18:12 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 11:19 819200]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 11:17 970752]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-06-06 17:09 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-06-06 17:06 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-06-06 17:10 118784]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-05-29 16:33 52840]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2007-10-07 20:48 125368]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\SonicWALL\\SonicWALL Global VPN Client\\SWGVpnClient.exe"=

R1 RCFOX;SonicWALL IPsec Driver;C:\WINDOWS\system32\Drivers\RCFOX.sys [2007-09-27 15:49]
S3 DCALEXICO;DCALEXICO;C:\WINDOWS\system32\drivers\DCalexico.sys []
S3 rcvpn;SonicWALL VPN Adapter;C:\WINDOWS\system32\DRIVERS\rcvpn.sys [2005-11-08 09:58]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-24 10:30:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
-> C:\Program Files\Common Files\iS3\Anti-Spyware\SGPRXY.DLL
-> C:\Program Files\Common Files\iS3\Anti-Spyware\detoured.dll
-> C:\Program Files\Common Files\iS3\Anti-Spyware\iS3SploitChecker.dll
-> C:\Program Files\Common Files\iS3\Anti-Spyware\iS3SiteBlocker.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Program Files\Common Files\iS3\Anti-Spyware\iS3lsp.dll
.
Completion time: 2008-07-24 10:31:39
ComboFix-quarantined-files.txt 2008-07-24 16:31:33
ComboFix2.txt 2008-07-23 18:08:51

Pre-Run: 70,221,000,704 bytes free
Post-Run: 70,227,263,488 bytes free

126 --- E O F --- 2008-07-09 22:28:30

Bryan00001 · Answer

Here is the HiJackThis Log File:   Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:34, on 2008-07-24Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16674)Boot mode: Normal Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\Program Files\Intel\Wireless\Bin\WLKeeper.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exeC:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXEC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\system32\msiexec.exeC:\WINDOWS\system32
otepad.exeC:\WINDOWS\explorer.exeC:\Program Files\Microsoft Office\Office10\OUTLOOK.EXEC:\Program Files\Microsoft Office\Office10\WINWORD.EXEC:\Program Files\Internet Explorer\IEXPLORE.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005O4 - HKLM\..\Run: [IntelZeroConfig] 'C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe'O4 - HKLM\..\Run: [IntelWireless] 'C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe' /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [ccApp] 'C:\Program Files\Common Files\Symantec Shared\ccApp.exe'O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe'O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXEO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1210114172359O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = Premier.localO17 - HKLM\Software\..\Telephony: DomainName = Premier.localO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = Premier.localO17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = Premier.localO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: Symantec System Center Discovery Service (NSCTOP) - Symantec Corporation - C:\PROGRA~1\Symantec\SYMANT~1\NSCTOP.EXEO23 - Service: SonicWall VPN Client Service (RampartSvc) - SonicWALL, Inc. - C:\Program Files\SonicWALL\SonicWALL Global VPN Client\RampartSvc.exeO23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe --End of file - 5907 bytes

bamajim · Answer

Bryan00001

Good work. How' s your PC running at this point?

Please perform an Ewido Online Malware Scan

When a dialog box appears asking you if you would like to download and install the ewido anti-spyware online scanner please click Yes to allow the download.
Click on Start Scan.
after the scan completes it will produce a log for you, copy and paste the results of that scan as a reply to this thread
If any infections are found, (After you save the logfile), Click on Remove Infections.

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Bryan00001 · Answer

Bamajim,   The computer is working really well.  I thought I saved the log report but I accidentally did not before I Removed Infections.    I appreciate all your help.   Thanks again, Bryan00001

bamajim · Answer

Bryan00001

You are most welcome

You may now remove/delete/uninstall the tools we used to clean your PC

Now that your log is clean

There are some final notes:

Lets create a clean System Restore point
the instructions are here

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components and update.

Updating Java:

Download the latest version of
Java Runtime Environment (JRE) 6.u7.
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the " Download" button to the right.
Check the box that says: " Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u7-windowsi586-p.exe to install the newest version.

Update your Anti Virus Software

Use and maintain a Firewall

Visit Microsoft's Windows Update Site Frequently for critical updates

Backup your Important Documents and Files on a regular basis

To a disc or a USB key, not your Hardrive

You may want to read this article" So how did I get infected in the first place" by Tony Klein

surf safe

Microsoft MVP Consumer-Security

CastleCops Instructor

"The world is what you make of it"

Virus & Spyware

Was this post helpful?