Thread: "Antivirus XP" turns to system shutdown, unable to dl, blocking websites?
View Single Post
•
•
Join Date: Aug 2008
Posts: 10
Reputation: agent rotary is an unknown quantity at this point 
Solved Threads: 0
agent rotary agent rotary is offline Offline
Newbie Poster

Re: "Antivirus XP" turns to system shutdown, unable to dl, blocking websites?

 
0
  #8
Aug 30th, 2008
Thanks again, crunchie. The computer appears to be not restarting itself as long as I'm in safe mode. However, when not in safe mode, the system seeks to reboot in less than five minutes and often less than three.

Notably, I don't appear to have a rdssrv.exe or hdfkt.dll. I double-checked my logs, the files you listed, and my folder multiple times to ensure I wasn't making any errors. Would that possibly be the error?


Here's what combofix had to say:
ComboFix 08-08-29.02 - Madame Rotary 2008-08-30  1:27:05.1 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.780 [GMT -4:00]
Running from: C:\Documents and Settings\Madame Rotary\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\bin.clearspring.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\interclick.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\interclick.com\ud.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\static.youku.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\#SharedObjects\JTFW6MTY\static.youku.com\v\swf\qplayer.swf\youku.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com
C:\Documents and Settings\Madame Rotary\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#static.youku.com\settings.sol
C:\Program Files\Altnet
C:\Program Files\Altnet\DBBackup\Sigfiles.db
C:\Program Files\Altnet\Download Manager\adm25.dll
C:\Program Files\Altnet\Download Manager\adm4.dll
C:\Program Files\Altnet\Download Manager\adm4005.exe
C:\Program Files\Altnet\Download Manager\admdata.dll
C:\Program Files\Altnet\Download Manager\admdloader.dll
C:\Program Files\Altnet\Download Manager\admfdi.dll
C:\Program Files\Altnet\Download Manager\admprog.dll
C:\Program Files\Altnet\Download Manager\altnetuninstall.exe
C:\Program Files\Altnet\Download Manager\asm.exe
C:\Program Files\Altnet\Download Manager\asmend.exe
C:\Program Files\Altnet\Download Manager\asmps.dll
C:\Program Files\Altnet\Download Manager\dminfo3.cab
C:\Program Files\Altnet\Download Manager\dminstall7.cab
C:\Program Files\Altnet\Download Manager\dmsetup.bmp
C:\Program Files\Altnet\Download Manager\dmsetupbig.bmp
C:\Program Files\Altnet\Download Manager\jsinstall.cab
C:\Program Files\Altnet\Download Manager\jslegals.txt
C:\Program Files\Altnet\Download Manager\selectdir.txt
C:\Program Files\Altnet\Download Manager\selectdir1st.txt
C:\Program Files\Altnet\Download Manager\Thumbs.db
C:\WINDOWS\cdmxtras
C:\WINDOWS\cdmxtras\uninst.exe
C:\WINDOWS\Fonts\acrsec.fon
C:\WINDOWS\Fonts\acrsecB.fon
C:\WINDOWS\Fonts\acrsecI.fon
C:\WINDOWS\system32\AdCache
C:\WINDOWS\system32\cache329

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Service_tdssserv


(((((((((((((((((((((((((   Files Created from 2008-07-28 to 2008-08-30  )))))))))))))))))))))))))))))))
.

2008-08-30 01:20 . 2008-08-30 01:20	<DIR>	d---s----	C:\Documents and Settings\Madame Rotary\UserData
2008-08-30 00:13 . 2008-08-30 00:13	552	--a------	C:\WINDOWS\system32\d3d8caps.dat
2008-08-29 23:41 . 2007-02-13 15:14	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Snapfish
2008-08-29 23:41 . 2007-01-15 13:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Simple Star
2008-08-29 23:41 . 2007-01-15 13:46	<DIR>	d--------	C:\Documents and Settings\Administrator\Application Data\Ahead
2008-08-29 23:41 . 2008-08-29 23:41	<DIR>	d--------	C:\Documents and Settings\Administrator
2008-08-29 09:52 . 2008-08-29 09:52	<DIR>	d--------	C:\WINDOWS\ERUNT
2008-08-28 14:25 . 2008-08-28 14:25	<DIR>	dr-------	C:\Program Files\Norton Support
2008-08-28 12:00 . 2008-08-29 23:32	86,528	--a------	C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys
2008-08-28 12:00 . 2008-08-28 12:00	3	--a------	C:\temp.tmp
2008-08-27 23:47 . 2008-08-27 23:51	<DIR>	d--------	C:\fixwareout
2008-08-27 23:30 . 2008-08-27 23:30	<DIR>	d--------	C:\Program Files\Trend Micro
2008-08-27 13:17 . 2008-08-27 13:20	<DIR>	d--------	C:\Program Files\XoftSpySE
2008-08-27 01:50 . 2008-08-27 01:50	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\NVIDIA
2008-08-26 15:41 . 2008-08-26 15:41	<DIR>	d--------	C:\Program Files\Symantec
2008-08-26 15:41 . 2008-08-26 15:43	<DIR>	d--------	C:\Program Files\Common Files\Symantec Shared
2008-08-26 15:41 . 2008-08-26 15:41	124,464	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-26 15:41 . 2008-08-26 15:41	60,808	--a------	C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-26 15:41 . 2008-08-26 15:41	35,888	-ra------	C:\WINDOWS\system32\drivers\SymIM.sys
2008-08-26 15:41 . 2008-08-26 15:41	10,635	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-26 15:41 . 2008-08-26 15:41	806	--a------	C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\WINDOWS\system32\drivers\NIS
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\Windows Sidebar
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\NortonInstaller
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Program Files\Norton Internet Security
2008-08-26 15:40 . 2008-08-26 15:42	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Symantec
2008-08-26 15:40 . 2008-08-26 15:40	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\NortonInstaller
2008-08-26 15:40 . 2008-08-26 15:41	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Norton
2008-08-26 01:24 . 2008-08-27 23:48	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Application Data\COMCASTTOOLBAR
2008-08-26 01:24 . 2008-08-28 23:28	12,288	--a------	C:\WINDOWS\system32\tdssserf.dll
2008-08-07 11:36 . 2008-08-07 11:36	<DIR>	d--------	C:\My Music
2008-07-21 16:03 . 2008-07-21 16:15	<DIR>	d--------	C:\WINDOWS\system32\CatRoot_bak
2008-07-04 12:43 . 2008-07-04 12:43	<DIR>	d--------	C:\Documents and Settings\Madame Rotary\Application Data\Amazon
2008-07-04 12:38 . 2008-07-04 12:38	<DIR>	d--------	C:\Program Files\Amazon

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-29 06:52	---------	d-----w	C:\Program Files\Trillian
2008-08-29 05:03	---------	d-----w	C:\Program Files\Java
2008-08-23 15:25	---------	d-----w	C:\Documents and Settings\Madame Rotary\Application Data\uTorrent
2008-07-20 04:20	---------	d-----w	C:\Program Files\ABC Amber LIT Converter
2008-06-13 06:49	3,532	----a-w	C:\drmHeader.bin
.

------- Sigcheck -------

2008-04-13 20:12  507904  ed0ef0a136dec83df69f04118870003e	C:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\winlogon.exe
2008-08-26 01:24  502272  9b1bd82bd0761b5ba986af66d2809c30	C:\WINDOWS\system32\winlogon.exe
2004-08-04 08:00  502272  01c3346c241652f43aed8e2149881bfe	C:\WINDOWS\system32\dllcache\winlogon.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe" [2005-02-25 20:28 212992]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 10:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 13:22 7700480]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 05:46 196608]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-28 00:01 185896]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 08:00 158208]
"nwiz"="nwiz.exe" [2006-10-22 13:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-10-22 13:22 86016 C:\WINDOWS\system32\nvmctray.dll]

C:\Documents and Settings\Madame Rotary\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\z2yhfmbkp2z.sys]
@="\??\C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\utorrent.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Trillian\\trillian.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Documents and Settings\\Madame Rotary\\My Documents\\my games\\Nintendo Games\\EMULATOR1 - NESTICLE.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\services.exe"=

R0 SymEFA;Symantec Extended File Attributes;C:\WINDOWS\system32\drivers\NIS\1000000.078\SYMEFA.SYS [2008-08-26 15:41]
S1 BHDrvx86;Symantec Heuristics Driver;C:\WINDOWS\system32\drivers\NIS\1000000.078\BHDrvx86.sys [2008-08-26 15:41]
S1 ccHP;Symantec Hash Provider;C:\WINDOWS\system32\drivers\NIS\1000000.078\ccHPx86.sys [2008-08-26 15:41]
S1 IDSxpx86;IDSxpx86;C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20080822.001\IDSxpx86.sys [2008-08-26 15:41]
S2 Norton Internet Security;Norton Internet Security;C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe /s Norton Internet Security /m C:\Program Files\Norton Internet Security\Engine\16.0.0.120\diMaster.dll []
S2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
S2 z2yhfmbkp2z.sys;z2yhfmbkp2z.sys;C:\WINDOWS\system32\drivers\z2yhfmbkp2z.sys [2008-08-29 23:32]
S3 MRVW225;D-Link AirPlus G DWL-G122 Wireless USB Dirver for Windows XP;C:\WINDOWS\system32\DRIVERS\MRVW225.sys [2005-09-30 21:42]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f8ef482-bee2-11db-963f-0018f39d11f4}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-30 C:\WINDOWS\Tasks\XoftSpySE 2.job
- C:\Program Files\XoftSpySE\XoftSpy.exe [2008-08-19 18:37]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = www.google.com
R0 -: HKLM-Main,Start Page = www.google.com
R0 -: HKLM-Main,Window Title = Windows Internet Explorer provided by Comcast
R1 -: HKCU-Internet Settings,ProxyOverride = *.local

O16 -: {EF148DBB-5B6D-4130-B2A1-661571E86260} - hxxp://download-games.pogo.com/online2/pogo/mahjong_escape_ancient/PTGameLauncher.cab
C:\WINDOWS\Downloaded Program Files\PTGameLauncher.inf
C:\WINDOWS\Downloaded Program Files\PTGameLauncher.dll

And of course, Hijack this:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:54, on 2008-08-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - (no file)
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\coIEPlg.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKLM\..\RunOnce: [ ] C:\WINDOWS\System32\cmd.exe /C del /Q C:\WINDOWS\system32\rdssrv.exe C:\WINDOWS\system32\rdshost.dll C:\WINDOWS\system32\hdfkt.dll
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://smg.photobucket.com
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/onlin...meLauncher.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.0.0.120\ccSvcHst.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 4901 bytes
Reply With Quote