BleepingComputer.com: Umm.. what is this?

Ok, I just logged on as normal, ended the normal useless tasks and I found a few unordinary ones.. first one is a .exe file I found in C:/Windows "instsp2.exe" the description is something like "Khwbx" , second found in my temp "j8ccinlc5.exe" description is the same as the name.. And while ending these tasks, I couldn't because it kept starting up again and i have found no evidece that this .exe does anything except use up a few mb of RAM.. Anyone help me?
Thanks in advance.

Sounds malware related. You should post in this forum to get further support. Am I infected? What do I do?

After a few minutes searching, I learned that "instsp2.exe" is related to the Vundo trojan.

Go get Malwarebytes' Anti-Malware and run a full scan

Downloading and running now.
And what does the Vundo trojan do?

This post has been edited by youthedog4: 05 April 2009 - 04:33 PM

From Wikipedia

Quote

Ok, here is the log from a quick scan..
Malwarebytes' Anti-Malware 1.35
Database version: 1942
Windows 6.0.6000

4/6/2009 12:25:05 PM
mbam-log-2009-04-06 (12-25-05).txt

Scan type: Quick Scan
Objects scanned: 16853
Time elapsed: 1 minute(s), 0 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 5
Registry Keys Infected: 7
Registry Values Infected: 8
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 6

Memory Processes Infected:
C:\Users\Harry\AppData\Local\Temp\j8ccinlc5.exe (Trojan.Downloader) -> Unloaded process successfully.

Memory Modules Infected:
C:\Windows\System32\zotapugi.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\bupudofa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\rizaluzo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\tovupege.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\nhser43uhjnefr.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{60abf0da-ae3b-4c64-887e-401134110841} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{60abf0da-ae3b-4c64-887e-401134110841} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{60abf0da-ae3b-4c64-887e-401134110841} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zunitadile (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\9471ffaf (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm9742cc33 (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c2ba40a2-74f3-42bd-f434-2604812c8954} (Trojan.Zlob.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows resurections (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zotapugi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\zotapugi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\zotapugi.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\bupudofa.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\bupudofa.dll -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\rizaluzo.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\Windows\System32\bupudofa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\tovupege.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Windows\System32\nhser43uhjnefr.dll (Trojan.Zlob.H) -> Delete on reboot.
C:\Windows\System32\zotapugi.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Users\Harry\AppData\Local\Temp\j8ccinlc5.exe (Trojan.Downloader) -> Delete on reboot.