¿Trojan Clocked, Rootkit?

Welcome to Major Geeks!


You need to attach the rest of the logs that were requested in the READ & RUN ME. The full first logs from the below are required:

• SUPERAntiSpyware
• Malwarebytes
• ComboFix
• RootRepeal

As far as the "DhcpNameServer" = 173.193.227.124 173.192.105.217 setting is concerned, what is the DNS server address that you ISP expects you to use? These address are for SoftLayer Technologies in Dallas Texas which is not even in the same country as you. Thus I'm wondering if you ISP outsource from somewhere else.
There is nothing wrong with your [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost] registry key. You should not be experimenting in the registry unless you are an Expert in Windows. If you touch the wrong thing, you could make your PC unusable.

Because you do not have enough memory to properly run Windows XP and your other applications. Your logs show

Code:

Memoria física total 512.00 MB 
Memoria física disponible 108.08 MB

You need to at least double this to 1 GB but 2 GB is highly recommended.

 

Actually it is important that you attach the first logs so we can see what was found and removed on the first run. Even attach them if nothing is found as stated in the instructions.

Not sure what you mean by "according to Google". You need to be very careful what you read since many people have no idea what they are talking about. However we still need to see all of your logs to know exactly what is going on with your PC.

Have you attempted to flush your DNS cache to see if those entries go away.


Click Start > Run and type in cmd

• Click OK.
• This will open a command prompt.
• Type or copy and paste the following line in the command window:
  ipconfig /flushdns
• Hit Enter
• Exit the command window

Yes but every software update for Windows and other applications you have installed, adds more of a burden to your system making it get slower and slower. Eventually you just hit the proverbial "straw that breaks the camels back". And you said things are normal after you startup. The big demand on your system is occuring as applications all try to grab lots of memory as your PC starts up and you don't have enough memory, thus it slows things down as applications need to swap out from memory to disk ( virtual memory ) and this takes more time.

 

The below log from SUPERAntiSpyware should be attach which shows much more being found the logs you attached.

Code:

"C:\Documents and Settings\HP_Propietario\Datos de programa\SUPERAntiSpyware.com\SUPERAntiSpyware\Logs\"
Feb 23 2011  15209 "SUPERAntiSpyware Scan Log - 02-23-2011 - 19-45-14.log"

You should not be editing the registry on your own with explicit instruction given directly to you. If you deleted everything given in that link, you have deleted some required Windows registry keys.

What day did the infection occur? I'm guess on or before Feb 21 when you started downloading all kinds of security programs???

Also I strongly advise you to cleanup your Desktop. Remove eveything but links to run programs. Do not download and save programs here and defintely do not use it for long term storage. You need to keep ComboFix.exe and other tools we asked you to save there for now as we may need them, but we will be removing it when we are finished with your cleanup. A cluttered Desktop is malware's playground and it can also cause performance degradation especially when you start saving large files here like you are doing. Normal Malware remover is over 100MB and I don't recommend that program anyway due to too many false detections.

 

Are any scans you have perform (like a full scan with Kaspersky) or any online scanners, picking up a Virut infection. You have bunch of system files showing up with incorrect sizes and they may be infected. For example the below is a small sample that I can quickly see as incorrect.

Code:

=======================================================================                                         
"C:\WINDOWS\explorer.exe" 1035776 13/06/2007 08:22 
"C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe" 1035776 13/06/2007 08:10 
"C:\WINDOWS\ERDNT\cache\explorer.exe" 1035776 13/06/2007 08:22 
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\explorer.exe" 1036288 13/04/2008 21:18 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\explorer.exe" 1036288 13/04/2008 21:18 
"C:\WINDOWS\system32\dllcache\explorer.exe" 1035776 13/06/2007 08:22
=======================================================================
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\proquota.exe" 50688 13/04/2008 21:19 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\proquota.exe" 50688 13/04/2008 21:19 
"C:\WINDOWS\system32\proquota.exe" 50688 19/08/2004 16:00 
=======================================================================
"C:\WINDOWS\regedit.exe" 152064 19/08/2004 16:00 
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\regedit.exe" 152064 13/04/2008 21:19 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\regedit.exe" 152064 13/04/2008 21:19 
=======================================================================
"C:\WINDOWS\$hf_mig$\KB956572\SP2QFE\services.exe" 111104 09/02/2009 04:53 
"C:\WINDOWS\$hf_mig$\KB956572\SP3GDR\services.exe" 111104 09/02/2009 06:23 
"C:\WINDOWS\$hf_mig$\KB956572\SP3QFE\services.exe" 111104 09/02/2009 06:16 
"C:\WINDOWS\ERDNT\cache\services.exe" 111104 09/02/2009 05:08 
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\services.exe" 109056 13/04/2008 21:19 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\services.exe" 109056 13/04/2008 21:19 
"C:\WINDOWS\system32\services.exe" 111104 09/02/2009 05:08 
"C:\WINDOWS\system32\dllcache\services.exe" 111104 09/02/2009 05:08 
=======================================================================
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\userinit.exe" 26624 13/04/2008 21:19 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\userinit.exe" 26624 13/04/2008 21:19 
"C:\WINDOWS\system32\userinit.exe" 25088 19/08/2004 16:00 
=======================================================================
"C:\WINDOWS\SoftwareDistribution\Download\c6accdcd02a08bf2b2edd97027272422\winlogon.exe" 510976 13/04/2008 21:19 
"C:\WINDOWS\SoftwareDistribution\Download\c90143e38809b5ce94759a9bc8b1e3be\winlogon.exe" 510976 13/04/2008 21:19 
"C:\WINDOWS\system32\winlogon.exe" 505344 19/08/2004 16:00

If you do have a Virut or any other PE system file infector, you will have to reinstall to properly recover. Also if you did have that infection mentioned in the links I edited in to my message, then it also may be wise to insure your security and reinstall too.

 

Your replies keep getting caught in moderation. This is the second time and I guess it's because of your use of

 

I repeat! Some of those keys are necessary Windows keys. Since you did not clearly say EXACTLY what you deleted, I can only assume you removed everything listed.

Okay then part of what I was getting at was you installed many things after this data including Kaspersky and all of them have affect your startup time which is compounded by the limited memory.

I don't know. All I know is your file sizes do not seem correct. Some forms of Virut are not detected by antivirus programs. It is also possible that the files for your language are different sizes and that you do not have a Virut infection at all. If no scans have detected Virut at all then they may not be infected with Virut.

Yes it means format and reinstall from scratch. Very little can be saved. Only personal data and pictures. Virut can be carried in many differnt types of files but most commonly it infects all executable type files like .exe, .com, .dat, .dll, .scr but many more can be infected. If it is Virut, there is no other option and it will just get worse over time if it is Virut.

If your only problem is the slow startup time then just uninstall all the stuff you installed since Feb 6th like Kaspersky and other programs and see if your startup time improves. As I keep saying, you don't have enough memory and that is going to slow down startup. You cannot compare to what you "used to have" because you have changed what is on your system and no longer have the same system.

However as I stated before the other possible infection you had ( the one in the links I edited into a previous message ), indicate that you could have had or still may have, some aspects of an infection that could be dangerous to your financial security and as such, a reinstall may be prudent anyway. And in addition it would be wise to check with all your financial institutions ( credit cards, banks,....etc) for illegal activities. Also you should use a different know clean PC to change ALL passwords for all accounts.

 

These are not malware issues. You should post you questions/problems with them in the Software Forum.

Not according to any of the logs you have posted. If you had malware, we would have noticed it. You do not appear to have any current malware since the file lengths I question may just be due to the non-English version of Windows and scans indicated they were clean. It is not impossible that you just have residual damage from previous malware or from some changes that you made on your own outside of what was done in this forum.

Then again, likely residual damage or maybe you did not get some items uninstall. Seems your best bet would be to reinstall as there is nothing being found in any of your logs that is a problem other than too little memory.

I don't think this is really a malware problem but we can try removing it with the below. But do note that if you find that you cannot connect to the internet afterwards then this DNS setting was needed and you will have to reestablish your DNS settings.

Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.
Now download the current version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one.

Run MGtools.exe ( Note: If using Vista or Win7, make sure UAC is still disabled. Also don't double click on it, use right click and select Run As Administrator )

Now attach the below log:

• C:\ComboFix.txt
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

This appears to be your required DNS server addresses from your ISP.

Let's run another fix and also and a few follow up scans.


Uninstall Spybot - Search & Destroy 1.4 which is years out of date.
Now we need to use ComboFix

• Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
  • If it is not on your Desktop, the below will not work.
• Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
• If ComboFix tells you it has expired or need to be updated to a new version, make sure you allow it to update.
• Open Notepad and copy/paste the text in the below quote box into it:

• Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
• At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
• You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
• Now use your mouse to drag CFscript.txt on top of ComboFix.exe
• Follow the prompts.
• When it finishes, a log will be produced named c:\combofix.txt
• I will ask for this log below

Note:

Do not mouseclick combofix's window while it is running. That may cause it to stall.

Please download ATF Cleaner by Atribune. This program does not require an installation. The executable actually runs the program.

NOTE: This program is for Windows XP and Windows 2000 only. ATF Cleaner will remove all files from the items that are checked so if you have some cookies you'd like to save. Please move them to a different directory first.

• Double-click ATF-Cleaner.exe to run the program.
• Under Main choose: Select All
• Click the Empty Selected button.

If you use Firefox browser

• Click Firefox at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

• Click Opera at the top and choose: Select All
• Click the Empty Selected button.
  • NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main ATF Cleaner menu to close the program.

Now let's flush the Java Cache

• Click Start > Settings > Control Panel
• Double click the Java icon (be patient, it may take a while to open)
• Now click the General tab and under the Temporary Internet File area
• Click the Settings button and then click the Delete Files... button.
• In the next popup click OK.

If you have multiple Java plugin icons in Control Panel follow the above to clear all their caches.


Now let's flush the FireFox Cache
To flush your FireFox Cache:

• click Tools
• select Options
• select Privacy
• in the section labeled Private Data click Clear Now
  

Now let's flush the Internet Explorer Cache
To flush your Internet Explorer Cache:

• click Tools
• Internet Options
• Now on the General tab and click Delete Files and select Delete all Offline content too
• Click OK.
• When it finishes Click OK.

Now run Ccleaner!


Now download HostsXpert and then follow the below steps.

• Unzip HostsXpert.zip
• It will create a folder named HostsXpert in whatever folder you extract it to.
• Run HostsXpert.exe by double clicking on it.
• Click the Make Writeable? button. (if you only see a Make Read-Only selection, it is already writeable so skip this button).
• Click Restore Microsoft's Hosts File and then click OK.
• Click the X to exit the program

Now run this >> GMER - running with a random name and attach the log from GMER

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\ComboFix.txt
• the log from GMER
• C:\MGlogs.zip

Make sure you tell me how things are working now!

 

You did not rerun GetLogs.bat and thus your MGlogs.zip file was not updated.

Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista or Win7, don't double click, use right click and select Run As Administrator).

Then attach the below logs:

• C:\MGlogs.zip

 

Not a topic for this forum since it is not due to malware. Your PC needs more memory to run efficiently.

Your logs may be clean. I say maybe because ComboFix thinks your Registry Editor ( regedit.exe ) is infected but this could just be due to the non-English version of Windows being used or it could be due to what I worried about earlier. You could scan regedit.exe at http://www.virustotal.com/ to see if any problems are detected.


Any remaining issues are due to problems with Windows itself and may require a repair or a reinstall which you can discuss in the Software Forum.

 

You're welcome.

It is time to do our final steps:

1. We recommend you keep SUPERAntiSpyware and Malwarebytes Anti-Malware for scanning/removal of malware. Unless you purchase them, they provide no protection. They do not use any significant amount of resources ( except a little disk space ) until you run a scan.
2. If we had you use ComboFix, uninstall ComboFix (This uninstall will only work as written if you installed ComboFix on your Desktop like we requested.)
   • Click START then RUN and enter the below into the run box and then click OK. Note the quotes are required
   • "%userprofile%\Desktop\combofix" /uninstall
     • Notes: The space between the combofix" and the /uninstall, it must be there.
     • This will uninstall ComboFix and also reset hidden files and folders settings back to Windows defaults.
3. Go back to step 6 oof the READ ME and renable your Disk Emulation software with Defogger if you had disabled it.
4. Any other miscellaneous tools we may have had you install or download can be uninstalled and deleted.
5. If we had you download any registry patches like fixme.reg or fixWLK.reg (or any others), you can delete these files now.
6. If running Vista, it is time to make sure you have reenabled UAC by double clicking on the C:\MGtools\enableUAC.reg file and allowing it to be added to the registry.
7. Go to add/remove programs and uninstall HijackThis.
8. Goto the C:\MGtools folder and find the MGclean.bat file. Double click on this file to run this cleanup program that will remove files and folders
   related to MGtools and some other items from our cleaning procedures.
9. If you are running Win 7, Vista, Windows XP or Windows ME, do the below:
   • Refer to the cleaning procedures pointed to by step 7 of the READ ME
     for your Window version and see the instructions to Disable System Restore which will flush your Restore Points.
   • Then reboot and Enable System Restore to create a new clean Restore Point.
10. After doing the above, you should work thru the below link:
    • How to Protect yourself from malware!

 

Interesting. I'm happy to hear you have it resolved. And thanks for the update.

Yes we have seen quite a few DNS poisoning infections which have infected routers and sometimes modems. The IP addressed shown in yours however are not any of the ones that have been seen, so this is a first. I will have to add them to a list of items scanned for and recognized by MGtools.