 Virtumonde-vundo Infection-hijack This Log File |
Welcome Guest ( Log In | Click here to Register a free account now! )
Register a free account to unlock additional features at BleepingComputer.com
Welcome to Bleeping Computer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.
Forum Guidelines
Read this topic before posting a log. DO NOT post a ComboFix log unless requested to. Only members of the HijackThis Team or Moderators are allowed to help people with logs. Anyone else should refrain from posting to another user's log. When posting a log please put the type of infection you have in the topic title. IE: Winfixer, Virtumonde, WinTools, WebSearch, Home Search Assistant, etc. Do not bump your topic. We try to resolve logs on a first come/first served basis. By bumping your log you will be pushed back in line due to the new date of your bump.
  |
 Jan 28 2008, 08:21 PM
Post
#31
|
|
|
Member  Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474  |
Not sure why as I didn't manually delete or even try to delete them. |
 |
 
|
|
Jan 28 2008, 08:43 PM
Post
#32
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
QUOTE Combo Fix it also tried to change my Default Search engine settings Yes, ComboFix will reset default search settings to default MS values. Reason why I asked how you knew was that I was trying to ascertain if any 3rd party program was interfering with ComboFix. ComboFix's log looks okay. Just that niggling orphaned registry entry that needs fixing. When our previous attempt failed, I thought that your infection may have regenerated. ComboFix shows that you're still okay. Lets take another whack at clearing that stubborn registry entry. CODE @echo off set "key=hklm\system\currentcontrolset\control\lsa" swreg acl "%key%" /reset /q swreg query "%key%" /v "authentication packages" >log.txt call :WriteLog swreg delete "%key%" /v "authentication packages" swreg delete "%key%" /v "reg_multi_sz" >nul 2>&1 swreg add "%key%" /v "authentication packages" /t reg_multi_sz /d "msv1_0" swreg query "%key%" /v "authentication packages" >>log.txt call :WriteLog swreg acl "%key%" /ro:f /ra:f /q swreg acl "%key%" >>log.txt Start Notepad log.txt Nircmd wait 1500 del log.txt del %0 :WriteLog echo.>>log.txt echo.============>>log.txt echo.>>log.txt |
|
|
|
|
Jan 29 2008, 01:55 AM
Post
#33
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
Hi sUBs,
I take it that you want me to save this code in notepad as before i.e. save as fix.bat and choose to "Save type as - all files"? Benny |
|
|
|
|
Jan 29 2008, 01:59 AM
Post
#34
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
Yes, that's correct. Sorry for being presumptuous.
|
|
|
|
|
Jan 29 2008, 02:15 AM
Post
#35
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
Ok here is the log file of that fix.bat
Benny SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ ******************************************************************************* Registrykey: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Permissions: ******************************************************************************* Username Type Permissions Inheritance ******************************************************************************* MARKYS\Users Allowed Read This Key Only (Inherited) MARKYS\Users Allowed Special (Unknown) Subkeys only (Inherited) MARKYS\Administrators Allowed Full Control This Key Only (Inherited) MARKYS\Administrators Allowed Special (Unknown) Subkeys only (Inherited) NT AUTHORITY\SYSTEM Allowed Full Control This Key Only (Inherited) NT AUTHORITY\SYSTEM Allowed Special (Unknown) Subkeys only (Inherited) \CREATOR OWNER Allowed Special (Unknown) Subkeys only (Inherited) Perms No Auditing set Owner: Administrators (MARKYS\Administrators) |
|
|
|
|
Jan 29 2008, 02:26 AM
Post
#36
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
Log appears incomplete. Could I trouble you to do it once more.
|
|
|
|
|
Jan 29 2008, 03:19 AM
Post
#37
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
Ok here it is but I think it's the same as the one before.
Benny SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ ******************************************************************************* Registrykey: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Permissions: ******************************************************************************* Username Type Permissions Inheritance ******************************************************************************* MARKYS\Users Allowed Read This Key Only (Inherited) MARKYS\Users Allowed Special (Unknown) Subkeys only (Inherited) MARKYS\Administrators Allowed Full Control This Key Only (Inherited) MARKYS\Administrators Allowed Special (Unknown) Subkeys only (Inherited) NT AUTHORITY\SYSTEM Allowed Full Control This Key Only (Inherited) NT AUTHORITY\SYSTEM Allowed Special (Unknown) Subkeys only (Inherited) \CREATOR OWNER Allowed Special (Unknown) Subkeys only (Inherited) Perms No Auditing set Owner: Administrators (MARKYS\Administrators) |
|
|
|
|
Jan 29 2008, 03:59 AM
Post
#38
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
Here's what it looks like when I ran it on my machine. There's a before & after section.
QUOTE SteelWerX Registry Console Tool 2.0
Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ ******************************************************************************* Registrykey: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Permissions: ******************************************************************************* Username Type Permissions Inheritance ******************************************************************************* sUBs-PC\Users Allowed Read This Key Only (Inherited) sUBs-PC\Users Allowed Special (Unknown) Subkeys only (Inherited) sUBs-PC\Power Users Allowed Read This Key Only (Inherited) sUBs-PC\Power Users Allowed Special (Unknown) Subkeys only (Inherited) sUBs-PC\Administrators Allowed Full Control This Key Only (Inherited) sUBs-PC\Administrators Allowed Special (Unknown) Subkeys only (Inherited) NT AUTHORITY\SYSTEM Allowed Full Control This Key Only (Inherited) NT AUTHORITY\SYSTEM Allowed Special (Unknown) Subkeys only (Inherited) \CREATOR OWNER Allowed Special (Unknown) Subkeys only (Inherited) Perms No Auditing set Owner: Administrators (sUBs-PC\Administrators) |
|
|
|
|
Jan 29 2008, 08:32 AM
Post
#39
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
I've run it a 3rd time and I think it's the same as before but I've posted the new one again anyway.
When I save the file the encoding is ANSI. There are 3 other codes Unicode, Unicode big endian and CTF-8. I take it that ANSI is the one I want? Benny SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ SteelWerX Registry Console Tool 2.0 Written by Bobbi Flekman 2006 © HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa authentication packages REG_MULTI_SZ msv1_0\0\0 ============ ******************************************************************************* Registrykey: HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Permissions: ******************************************************************************* Username Type Permissions Inheritance ******************************************************************************* MARKYS\Users Allowed Read This Key Only (Inherited) MARKYS\Users Allowed Special (Unknown) Subkeys only (Inherited) MARKYS\Administrators Allowed Full Control This Key Only (Inherited) MARKYS\Administrators Allowed Special (Unknown) Subkeys only (Inherited) NT AUTHORITY\SYSTEM Allowed Full Control This Key Only (Inherited) NT AUTHORITY\SYSTEM Allowed Special (Unknown) Subkeys only (Inherited) \CREATOR OWNER Allowed Special (Unknown) Subkeys only (Inherited) Perms No Auditing set Owner: Administrators (MARKYS\Administrators) |
|
|
|
|
Jan 29 2008, 11:40 AM
Post
#40
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
Looking at it again then I think the last fix.bat is what you are looking for.
I'll check in again in 4 or 5 hours to see if it was. Benny |
|
|
|
|
Jan 29 2008, 03:01 PM
Post
#41
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
Yes, that's the correct one. The malware entry has been removed.
 How's the machine now? |
|
|
|
|
Jan 29 2008, 05:23 PM
Post
#42
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
To be honest the machine seems fine and has done so since you very kindly wrote that script for me to drag into ComboFix last weekend.
I take it that my computer is now clean and I'll go ahead and make a new systems restore point to reflect that? I would like to thankyou very much for your time, efforts and patience with me over this. All your help has been greatly appreciated and over the next couple of days I will make a donation to this site to reflect that. Thanks once again to you and to jpshortstuff for all his help as well. Many Thanks Benny |
|
|
|
|
Jan 29 2008, 05:51 PM
Post
#43
|
|
|
Forum Addict Group: HJT Team Posts: 2,153 Joined: 19-May 05 Member No.: 20,675 |
Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved. |
|
|
|
|
Jan 29 2008, 06:07 PM
Post
#44
|
|
 WhatTheTech Teacher Group: HJT Team Posts: 374 Joined: 15-June 07 From: UK Member No.: 136,795 |
Thanks to sUBs for donating his expertise here, we're lucky we have people like you around to step in
This post has been edited by jpshortstuff: Jan 29 2008, 06:08 PM -------------------- |
|
|
|
|
Jan 29 2008, 06:50 PM
Post
#45
|
|
|
Member Group: Members Posts: 26 Joined: 23-January 08 Member No.: 185,474 |
Thankyou to sUBs for your final post in this thread and for the tips on how to delete ComboFix and the Virus/Malware stuff etc etc although I did follow very similar lines before my computer got infected but I will be doubley sure to do so from now onwards.
Also just to ditto jpshortstuff's comments about sUBs help that he gave me in this thread and I am forever in gratitude to you for this. Lastly just to thank jpshortstuff again who helped me out also and got the ball rolling. Thanks guys. Benny |
|
|
|
|
1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)
0 Members:
| Lo-Fi Version | Time is now: 4th July 2009 - 12:49 AM |
© 2003-2009 All Rights Reserved Bleeping Computer LLC.