Cloaked Malware Weathereye.exe

Question

matthewh 0 Newbie Poster

14 Years Ago

Here is my DDS log. I have a Malwarebytes log being scanned and generated now.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_22
Run by Lawrie at 18:24:53 on 2011-12-14
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.200 [GMT -5:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
FW: Panda Titanium 2005 Personal Firewall *Disabled*
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost.exe -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Intel Audio Studio\IntelAudioStudio.exe
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\WINDOWS\Logi_MwX.Exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\WDBtnMgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Prevx\prevx.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
.
============== Pseudo HJT Report ===============
.
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
uRun: [updateMgr] "c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [WeatherEye] c:\documents and settings\lawrie\local settings\application data\theweathernetwork\weathereye\WeatherEye.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IntelAudioStudio] "c:\program files\intel audio studio\IntelAudioStudio.exe" TRAY
mRun: [zBrowser Launcher] c:\program files\logitech\itouch\iTouch.exe
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [InCD] c:\program files\ahead\incd\InCD.exe
mRun: [RemoteControl] "c:\program files\cyberlink dvd solution\powerdvd\PDVDServ.exe"
mRun: [WD Button Manager] WDBtnMgr.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRun: [Picasa Media Detector] c:\program files\picasa2\PicasaMediaDetector.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://
DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} - hxxp://
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} - hxxp://
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer =
TCP: Interfaces\{4E7EBF69-18C4-4F49-B622-198142487CE0} : DhcpNameServer =
Name-Space Handler: ftp\* - {419A0123-4312-1122-A0C0-434FDA6DA542} - c:\program files\coreftp\pftpns.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\lawrie\application data\mozilla\firefox\profiles\qsw3tpjt.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage -
FF - prefs.js: keyword.URL - hxxp://
FF - plugin: c:\program files\google\update\\npGoogleUpdate3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npMozCouponPrinter.dll
.
---- FIREFOX POLICIES ----

.
============= SERVICES / DRIVERS ===============
.
R0 pxscan;pxscan;c:\windows\system32\drivers\pxscan.sys [2011-12-7 32008]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2011-4-18 165648]
R1 MpKsl94aacb5f;MpKsl94aacb5f;c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\MpKsl94aacb5f.sys [2011-12-14 29904]
R1 pxrts;pxrts;c:\windows\system32\drivers\pxrts.sys [2011-12-7 76696]
R3 pxkbf;pxkbf;c:\windows\system32\drivers\pxkbf.sys [2011-12-7 26096]
R4 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2011-12-2 41272]
S1 MpKsl0418cd42;MpKsl0418cd42;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0fe6058b-312a-4633-822d-cb407f300ec2}\mpksl0418cd42.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0fe6058b-312a-4633-822d-cb407f300ec2}\MpKsl0418cd42.sys [?]
S1 MpKsl2b66c255;MpKsl2b66c255;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{065a3632-bbc1-4417-9a27-680177ea7f14}\mpksl2b66c255.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{065a3632-bbc1-4417-9a27-680177ea7f14}\MpKsl2b66c255.sys [?]
S1 MpKsl39960356;MpKsl39960356;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{679cc9d9-016e-414e-9e8c-341756951724}\mpksl39960356.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{679cc9d9-016e-414e-9e8c-341756951724}\MpKsl39960356.sys [?]
S1 MpKsl3b8bd022;MpKsl3b8bd022;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{785317fa-63f2-4907-9fcd-67c8db524acd}\mpksl3b8bd022.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{785317fa-63f2-4907-9fcd-67c8db524acd}\MpKsl3b8bd022.sys [?]
S1 MpKsl6ea4a3bf;MpKsl6ea4a3bf;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0dac2ad5-8139-43c7-8c49-d073f7eee6f8}\mpksl6ea4a3bf.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{0dac2ad5-8139-43c7-8c49-d073f7eee6f8}\MpKsl6ea4a3bf.sys [?]
S1 MpKsl6f061df9;MpKsl6f061df9;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2e54a826-09dc-4bbe-895b-30bd378b0b17}\mpksl6f061df9.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2e54a826-09dc-4bbe-895b-30bd378b0b17}\MpKsl6f061df9.sys [?]
S1 MpKsl7e5cfe6a;MpKsl7e5cfe6a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6091a6f1-7a53-43e8-8409-c1f433c56be2}\mpksl7e5cfe6a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{6091a6f1-7a53-43e8-8409-c1f433c56be2}\MpKsl7e5cfe6a.sys [?]
S1 MpKsl9203b812;MpKsl9203b812;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{607f046e-8f9d-4962-9003-5cc92df0b3fe}\mpksl9203b812.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{607f046e-8f9d-4962-9003-5cc92df0b3fe}\MpKsl9203b812.sys [?]
S1 MpKsl95dda91f;MpKsl95dda91f;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53c76f8d-f035-40df-90af-1f92d80ea62d}\mpksl95dda91f.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{53c76f8d-f035-40df-90af-1f92d80ea62d}\MpKsl95dda91f.sys [?]
S1 MpKslcc4edd54;MpKslcc4edd54;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{feac4d9f-412f-4bef-b743-1523844a6537}\mpkslcc4edd54.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{feac4d9f-412f-4bef-b743-1523844a6537}\MpKslcc4edd54.sys [?]
S1 MpKslcc719199;MpKslcc719199;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{073fbcbb-953c-420a-9c16-ea27cba692fc}\mpkslcc719199.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{073fbcbb-953c-420a-9c16-ea27cba692fc}\MpKslcc719199.sys [?]
S1 MpKslff54bff6;MpKslff54bff6;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4ce088b5-7c0f-4341-9039-29d11fae253a}\mpkslff54bff6.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{4ce088b5-7c0f-4341-9039-29d11fae253a}\MpKslff54bff6.sys [?]
S3 exdisk;Express Disk Service;c:\windows\system32\drivers\exdisk.sys [2005-12-29 14074]
.
=============== File Associations ===============
.
.scr=AutoCADScriptFile
.
=============== Created Last 30 ================
.
2011-12-14 22:47:41 29904 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\MpKsl94aacb5f.sys
2011-12-14 22:47:38 56200 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\offreg.dll
2011-12-14 20:43:29 -------- d-----w- c:\program files\Trend Micro
2011-12-14 04:31:27 -------- d-----w- C:\ERDNT
2011-12-14 04:31:24 -------- d-----w- c:\windows\ERUNT
2011-12-14 04:31:19 -------- d-----w- C:\!FixIEDef
2011-12-14 04:06:17 -------- d-sha-r- C:\cmdcons
2011-12-14 02:59:52 6823496 ----a-w- c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ce156117-c7ba-4f24-ac78-b3fd4bcadcae}\mpengine.dll
2011-12-14 02:51:02 -------- d-----w- c:\program files\CCleaner
2011-12-07 23:08:50 32008 ----a-w- c:\windows\system32\drivers\pxscan.sys
2011-12-07 23:08:49 76696 ----a-w- c:\windows\system32\drivers\pxrts.sys
2011-12-07 23:08:49 26096 ----a-w- c:\windows\system32\drivers\pxkbf.sys
2011-12-07 23:08:47 -------- d-----w- c:\program files\Prevx
2011-12-07 22:54:46 -------- d-----w- c:\documents and settings\all users\application data\PrevxCSI
2011-12-07 22:49:21 -------- d-----w- c:\documents and settings\lawrie\Program Files
2011-12-06 23:03:18 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys
2011-12-06 23:03:18 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys
2011-12-06 23:03:11 14592 -c--a-w- c:\windows\system32\dllcache\kbdhid.sys
2011-12-06 23:03:11 14592 ----a-w- c:\windows\system32\drivers\kbdhid.sys
2011-12-06 14:29:12 -------- d-----w- C:\bd_logs
2011-12-02 22:51:49 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
.
==================== Find3M ====================
.
2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37:08 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52:02 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13:22 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2004-10-01 20:00:16 40960 ----a-w- c:\program files\Uninstall_CDS.exe
1997-07-21 23:30:54 1045776 --sha-w- c:\windows\system32\Msjet35.dll
1997-06-23 07:00:00 123664 --sha-w- c:\windows\system32\Msjint35.dll
1997-06-23 16:06:50 24848 --sha-w- c:\windows\system32\Msjter35.dll
1997-06-23 16:06:50 252176 --sha-w- c:\windows\system32\Msrd2x35.dll
1997-06-23 16:06:50 287504 --sha-w- c:\windows\system32\Msxbse35.dll
.
============= FINISH: 18:27:21.57 ===============

microsoft:windows storage:data-protection virus-malware

attach.txt (20.43 KB)

The attachment preview is chopped off after the first 10 KB. Please download the entire file.

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 12/28/2005 5:09:24 PM
System Uptime: 12/14/2011 5:47:21 PM (1 hours ago)
.
Motherboard: Intel Corporation |  | D945GTP
Processor:               Intel(R) Pentium(R) 4 CPU 3.00GHz | J3E1 | 3000/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 466 GiB total, 321.146 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E978-E325-11CE-BFC1-08002BE10318}
Description: Communications Port
Device ID: ACPI\PNP0501\1
Manufacturer: (Standard port types)
Name: Communications Port (COM1)
PNP Device ID: ACPI\PNP0501\1
Service: Serial
.
==== System Restore Points ===================
.
RP320: 12/14/2011 5:23:48 PM - System Checkpoint
.
==== Installed Programs ======================
.
.
2570
2570_Help
2570Trb
32 Bit HP CIO Components Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0.9
Adobe Photoshop Album Starter Edition 3.2
AIO_Scan
AiO_Scan_CDA
AiOSoftwareNPI
AnswerWorks Runtime
Apple Mobile Device Support
Apple Software Update
AppleWorks 6
Ask Toolbar
Autodesk Architectural Desktop 3
Bonjour
BufferChm
Camera Support Core Library
Camera Window DS
Camera Window DVC
Camera Window MC
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DS for ZoomBrowser EX
Canon Camera Window MC 5 for ZoomBrowser EX
Canon MovieEdit Task for ZoomBrowser EX
Canon PhotoRecord
Canon RAW Image Task for ZoomBrowser EX
Canon Utilities PhotoStitch 3.1
Canon ZoomBrowser EX
CCleaner
Citrix Presentation Server Client
Compatibility Pack for the 2007 Office system
Copy
Core FTP LE 1.3c
Core FTP LE 2.1
Coupon Printer for Windows
CP_Package_Variety1
CP_Package_Variety2
CP_Package_Variety3
Critical Update for Windows Media Player 11 (KB959772)
CustomerResearchQFolder
CutePDF Writer 2.7
Destination Component
DeviceDiscovery
DeviceManagementQFolder
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DNA
DocumentViewer
DocumentViewerQFolder
DVD Solution
F2100
F2100_doccd
F2100_Help
Fax_CDA
FileMaker Pro 5.5
Free Spider
GdiplusUpgrade
getPlus(R)_ocx
Google Desktop
Google Toolbar for Internet Explorer
Google Update Helper
High Definition Audio Driver Package - KB835221
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB942288-v3)
Hotfix for Windows XP (KB945060-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 9.0
HP Deskjet All-In-One Software 9.0
HP Document Viewer 5.3
HP Imaging Device Functions 9.0
HP Photosmart Essential 3.5
HP Product Assistant
HP PSC & OfficeJet 5.3.A
HP Solution Center 9.0
HP Update
HPDiagnosticAlert
HPPhotoSmartDiscLabelContent1
HPPhotosmartEssential
HPProductAssistant
HPSSupply
InCD
Intel Audio Studio 2.0
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 22
Logitech iTouch Software
Logitech MouseWare 9.79.1 
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Malwarebytes' Anti-Malware version 1.51.2.1300
MarketResearch
Maxthon Browser (remove only)
MetaFrame Presentation Server Web Client for Win32
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft National Language Support Downlevel APIs
Microsoft Office File Validation Add-In
Microsoft Office Standard Edition 2003
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual Studio Tools for Applications 2.0 Runtime
Microsoft Works 6-9 Converter
MobileMe Control Panel
MovieEdit Task
Mozilla Firefox 8.0 (x86 en-US)
MSN
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP2 Parser and SDK
MSXML 6 Service Pack 2 (KB954459)
Multimedia Launcher
NewCopy_CDA
OpenOffice.org 3.3
PhotoStitch
Picasa 2
PowerDVD
PowerProducer
Prevx
ProductContextNPI
PSSWCORE
QuickTime
RAW Image Task 2.1
Readme
Rogers Yahoo! Applications
RPS CRT
Scan
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft Windows (KB2564958)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB923561)
S

2 Contributors
2 Replies
305 Views
2 Days Discussion Span
Latest Post 14 Years Ago Latest Post by jholland1964

Dani AI

Generated 9 Months Ago

Thread summary and context: posted DDS and a Malwarebytes scan showing a stubborn startup item named WeatherEye while Malwarebytes reported no detections; closed the thread and suggested consolidating help elsewhere. That combination — an obvious Run/Startup entry but no AV hits — is a common pattern for “cloaked” persistence: a benign-sounding name, placement in a per-user folder, and behavior that evades signature-only scans.

Recommended troubleshooting workflow (concise, ordered):

Confirm the executable’s true location and file properties (digital signature, publisher, file size and timestamps). Legitimate weather clients usually show a publisher and a standard Program Files install path.
Capture a live view with a tool that shows parent/child process and network activity (Process Explorer or equivalent). Note the parent process, open handles, and any outbound connections.
Harvest the file hash and submit it to a multi-engine scanner (VirusTotal) rather than relying on one local scanner. Multiple engines raise the chance of detection.
Use Autoruns (Sysinternals) to identify and disable startup persistence across Run keys, Scheduled Tasks, Services and AppInit DLLs; do not delete until the file is analyzed or quarantined.
Boot to Safe Mode or scan from rescue media (offline) to detect rootkits or locked files, then remove persistence entries, stop the process, and delete the file if analysis confirms it is malicious.
After removal, wipe infected System Restore points, update all definitions, re-scan with at least two different on-demand engines, and monitor the system for reappearance.

Clarifying notes and cautions: cloaked malware frequently spoofs names and timestamps; verify signatures and vendor presence in Add/Remove Programs before deletion. Cross-posting (as noted by ) often produces conflicting advice — a single consolidated thread with full outputs from Autoruns, Process Explorer, and the file hash expedites accurate diagnosis. If evidence of compromise is strong or data is sensitive, a clean OS reinstall is the safest outcome.

All 2 Replies

jholland1964 650 Posting Expert

14 Years Ago

matthewh, When doing a search for your problem the first two links shown on the results page led to threads made by you for this same problem, word for word, at two other forums.

Since you have identical threads on this problem running at bleepingcomputer and malwarebytes.com I suggest that you continue at ONE of those. At MBA-M you have given more information than you have given here or at bleepingcomputer and without full information given helpers cannot offer proper assistance.

It is never advisable to post the same problem at multiple forums. Unless helpers "stumble" on this fact like I did you may receive conflicting advice and double or triple your problems if you follow all advice from all of the forums.

I am closing this thread here and I suggest that continue at one of the others.

Edited 14 Years Ago by jholland1964 because: n/a

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

matthewh 0 Newbie Poster · Answer 1 · 2011-12-15T08:23:14+00:00

Here is a Malwarebytes log. It did not detect anything.

Malwarebytes' Anti-Malware 1.51.2.1300
www.malwarebytes.org

Database version: 8372

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

12/14/2011 7:09:58 PM
mbam-log-2011-12-14 (19-09-58).txt

Scan type: Full scan (C:\|)
Objects scanned: 317054
Time elapsed: 51 minute(s), 9 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Cloaked Malware Weathereye.exe

Dani AI

Recommended Answers Collapse Answers

All 2 Replies

Recommended Answers