Cloaked Malware Weathereye.exe

[matthewh]

Here is my DDS log. I have a Malwarebytes log being scanned and generated now.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Run by Lawrie at 18:24:53 on 2011-12-14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.200 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Panda Titanium 2005 Personal Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Logi_MwX.Exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\WDBtnMgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
.
============== Pseudo HJT Report ===============
.
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [WeatherEye] c:\documents and settings\lawrie\local settings\application data\theweathernetwork\weathereye\WeatherEye.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IntelAudioStudio] "c:\program files\intel audio studio\IntelAudioStudio.exe" TRAY
mRun: [zBrowser Launcher] c:\program files\logitech\itouch\iTouch.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [InCD] c:\program files\ahead\incd\InCD.exe
mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://upload.facebook.com/controls/FacebookPhotoUploader3.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{4E7EBF69-18C4-4F49-B622-198142487CE0} : DhcpNameServer = 192.168.1.1
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\lawrie\application data\mozilla\firefox\profiles\qsw3tpjt.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=
FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
.
---- FIREFOX POLICIES ----

.
============= SERVICES / DRIVERS ===============
.
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2011-12-7 32008]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl94aacb5f;MpKsl94aacb5f;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\MpKsl94aacb5f.sys [2011-12-14 29904]
R1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-12-7 76696]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-12-7 26096]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-12-2 41272]
S1 MpKsl0418cd42;MpKsl0418cd42;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0fe6058b-312a-4633-822d-cb407f300ec2}\mpksl0418cd42.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0fe6058b-312a-4633-822d-cb407f300ec2}\MpKsl0418cd42.sys [?]
S1 MpKsl2b66c255;MpKsl2b66c255;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{065a3632-bbc1-4417-9a27-680177ea7f14}\mpksl2b66c255.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{065a3632-bbc1-4417-9a27-680177ea7f14}\MpKsl2b66c255.sys [?]
S1 MpKsl39960356;MpKsl39960356;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{679cc9d9-016e-414e-9e8c-341756951724}\mpksl39960356.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{679cc9d9-016e-414e-9e8c-341756951724}\MpKsl39960356.sys [?]
S1 MpKsl3b8bd022;MpKsl3b8bd022;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{785317fa-63f2-4907-9fcd-67c8db524acd}\mpksl3b8bd022.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{785317fa-63f2-4907-9fcd-67c8db524acd}\MpKsl3b8bd022.sys [?]
S1 MpKsl6ea4a3bf;MpKsl6ea4a3bf;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0dac2ad5-8139-43c7-8c49-d073f7eee6f8}\mpksl6ea4a3bf.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0dac2ad5-8139-43c7-8c49-d073f7eee6f8}\MpKsl6ea4a3bf.sys [?]
S1 MpKsl6f061df9;MpKsl6f061df9;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2e54a826-09dc-4bbe-895b-30bd378b0b17}\mpksl6f061df9.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2e54a826-09dc-4bbe-895b-30bd378b0b17}\MpKsl6f061df9.sys [?]
S1 MpKsl7e5cfe6a;MpKsl7e5cfe6a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6091a6f1-7a53-43e8-8409-c1f433c56be2}\mpksl7e5cfe6a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6091a6f1-7a53-43e8-8409-c1f433c56be2}\MpKsl7e5cfe6a.sys [?]
S1 MpKsl9203b812;MpKsl9203b812;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{607f046e-8f9d-4962-9003-5cc92df0b3fe}\mpksl9203b812.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{607f046e-8f9d-4962-9003-5cc92df0b3fe}\MpKsl9203b812.sys [?]
S1 MpKsl95dda91f;MpKsl95dda91f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53c76f8d-f035-40df-90af-1f92d80ea62d}\mpksl95dda91f.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53c76f8d-f035-40df-90af-1f92d80ea62d}\MpKsl95dda91f.sys [?]
S1 MpKslcc4edd54;MpKslcc4edd54;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{feac4d9f-412f-4bef-b743-1523844a6537}\mpkslcc4edd54.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{feac4d9f-412f-4bef-b743-1523844a6537}\MpKslcc4edd54.sys [?]
S1 MpKslcc719199;MpKslcc719199;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{073fbcbb-953c-420a-9c16-ea27cba692fc}\mpkslcc719199.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{073fbcbb-953c-420a-9c16-ea27cba692fc}\MpKslcc719199.sys [?]
S1 MpKslff54bff6;MpKslff54bff6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4ce088b5-7c0f-4341-9039-29d11fae253a}\mpkslff54bff6.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4ce088b5-7c0f-4341-9039-29d11fae253a}\MpKslff54bff6.sys [?]
S3 exdisk;Express Disk Service;c:\windows\system32\drivers\exdisk.sys [2005-12-29 14074]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-12-14 22:47:41 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\MpKsl94aacb5f.sys
2011-12-14 22:47:38 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\offreg.dll
2011-12-14 20:43:29 -------- d-----w- c:\program files\Trend Micro
2011-12-14 04:31:27 -------- d-----w- C:\ERDNT
2011-12-14 04:31:24 -------- d-----w- c:\windows\ERUNT
2011-12-14 04:31:19 -------- d-----w- C:\!FixIEDef
2011-12-14 04:06:17 -------- d-sha-r- C:\cmdcons
2011-12-14 02:59:52 6823496 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\mpengine.dll
2011-12-14 02:51:02 -------- d-----w- c:\program files\CCleaner
2011-12-07 23:08:50 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-12-07 23:08:49 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-12-07 23:08:49 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-12-07 23:08:47 -------- d-----w- c:\program files\Prevx
2011-12-07 22:54:46 -------- d-----w- c:\documents and settings\all users\application data\PrevxCSI
2011-12-07 22:49:21 -------- d-----w- c:\documents and settings\lawrie\Program Files
2011-12-06 23:03:18 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-12-06 23:03:18 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-12-06 23:03:11 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-12-06 23:03:11 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-12-06 14:29:12 -------- d-----w- C:\bd_logs
2011-12-02 22:51:49 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
==================== Find3M ====================
.
2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2004-10-01 20:00:16 40960 ----a-w- c:\program files\Uninstall_CDS.exe
1997-07-21 23:30:54 1045776 --sha-w- c:\windows\system32\Msjet35.dll
1997-06-23 07:00:00 123664 --sha-w- c:\windows\system32\Msjint35.dll
1997-06-23 16:06:50 24848 --sha-w- c:\windows\system32\Msjter35.dll
1997-06-23 16:06:50 252176 --sha-w- c:\windows\system32\Msrd2x35.dll
1997-06-23 16:06:50 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.
============= FINISH: 18:27:21.57 ===============

[matthewh]

Here is a Malwarebytes log. It did not detect anything.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8372

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/14/2011 7:09:58 PM
mbam-log-2011-12-14 (19-09-58).txt

Scan type: Full scan (C:\|)
Objects scanned: 317054
Time elapsed: 51 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

[jholland1964]

matthewh, When doing a search for your problem the first two links shown on the results page led to threads made by you for this same problem, word for word, at two other forums.

Since you have identical threads on this problem running at bleepingcomputer and malwarebytes.com I suggest that you continue at ONE of those. At MBA-M you have given more information than you have given here or at bleepingcomputer and without full information given helpers cannot offer proper assistance.

It is never advisable to post the same problem at multiple forums. Unless helpers "stumble" on this fact like I did you may receive conflicting advice and double or triple your problems if you follow all advice from all of the forums.

I am closing this thread here and I suggest that continue at one of the others.