Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Win32/adware.virtumonde


  • Please log in to reply
15 replies to this topic

#1 rasmalai

rasmalai

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 01 October 2007 - 03:50 AM

Nod32 keeps coming popping up with: Win32/Adware.Virtumonde.O application found in operating memory. System memory infection originated from file C:\WINDOWS\system32\hbgm.dll.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:39, on 10/1/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Eset\nod32.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: (no name) - {04CEA367-D51B-4966-BC06-790E622F0244} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A515003-F120-4E2F-9280-6C7BFF20A51E} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {32A03E53-D81B-419A-879C-D08C4D2701Ec} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {58C453CB-B862-48ED-BA5B-A1519A98FD84} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {7E210C62-AF61-4D68-BAD0-A0DFB19EC65f} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A746960-6B78-4C02-B3E9-A29B108362CB} - c:\windows\system32\qsrtjtfn.dll (file missing)
O2 - BHO: (no name) - {A6317271-D18E-4763-87B1-C9DD06F8FA23} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {AC7F6E1F-6970-4B28-BF9E-5A988821FDBD} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {B17E9573-DFAF-4FD6-92F5-09744FAF9725} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: FLV Helper - {B6DBC2BD-B4DE-B8FC-BE72-3B3A9B6358B6} - C:\WINDOWS\system\bimtcs32.dll
O2 - BHO: (no name) - {BC7EF62B-1CA3-48BA-8685-B73D8AF40D13} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {D1C48F6E-BBE2-474D-B126-EC289298236F} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {D21834F2-7303-4FA7-8C46-C6B76DB65D11} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: CIEPl Object - {F3727275-224F-4AB0-8642-7D461EFB82D8} - C:\WINDOWS\system32\hbgpm.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DllRunning] "rundll32.exe" "C:\WINDOWS\system32\qkqnjkvl.dll",setvm
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKLM\..\Run: [SpyHunter] C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter.exe
O4 - HKLM\..\Run: [startdrv] C:\WINDOWS\Temp\startdrv.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [music] C:\music.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O20 - Winlogon Notify: hbgpm - C:\WINDOWS\SYSTEM32\hbgpm.dll
O20 - Winlogon Notify: msvmon - C:\WINDOWS\SYSTEM32\msvmon.dll
O20 - Winlogon Notify: mtgjsbsc - hjkahjk.dll (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5520 bytes

thx a lot!!

in addition, sometime window tools bar and all the desktop icon is disappear and i have to use CTRL+ALT+DEL to restart and sometime it's occur immediatly after restart (so i have to restart again and again) this could be the problem from this adware?

Edited by rasmalai, 01 October 2007 - 05:10 AM.


BC AdBot (Login to Remove)

 


#2 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 01 October 2007 - 07:07 AM

Hi,

Please take note of the following:
  • I will be handling your log and helping you, please do not make any system changes yet.
  • The process is not instant. Please continue to review my answers until I tell you that your computer is clean. Be patience.
  • The fixes are specific to your problem and should only be used for this issue on this machine
  • If there's anything that you don't understand, please ask your question(s) before proceeding with the fixes.
  • Please reply to this thread. Do not start a new topic.
Please give me some time to look over your log and I will get back to you as soon as possible.

:thumbsup:
Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#3 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 01 October 2007 - 07:52 AM

thank you dude!

#4 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 01 October 2007 - 01:32 PM

Hi

Wellcome to BleepingComputer forums.

You might want to save this page on your favorites, so you can find it again when you return.

Please download Combofix to your desktop.
Doubleclick combo.exe to launch the application.
Follow the prompts that will be displayed on the screen.
Don't click on the window while the fix is running, because that will cause your system to hang.
When finished, it should produce a log, combofix.txt.
Post this log in your next reply together with a new hijackthislog.

Regards
Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#5 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 02 October 2007 - 12:31 PM

COMBOFIX LOG

ComboFix 07-10-02.2 - Administrator 2007-10-02 23:48:35.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.874.66.1033.18.241 [GMT 7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\XQFML6DT\www.broadcaster.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\Administrator\err.log
C:\Documents and Settings\Administrator\ResErrors.log
C:\Program Files\VirusProtectPro 3.6
C:\Program Files\VirusProtectPro 3.6\ignored.lst
C:\WINDOWS\144.exe
C:\WINDOWS\1800.exe
C:\WINDOWS\system32\5_exception.nls
C:\WINDOWS\system32\drivers\rbzkaart.sys
C:\WINDOWS\system32\grouppolicy\machine\scripts\scripts.ini
C:\WINDOWS\system32\hjkahjk.dll.bak
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_COIZPASZ
-------\LEGACY_RUNTIME
-------\LEGACY_RUNTIME2
-------\LEGACY_SMTPDRV
-------\LEGACY_UHAHPLGK
-------\coizpasz
-------\runtime
-------\smtpdrv
-------\uhahplgk


((((((((((((((((((((((((( Files Created from 2007-09-02 to 2007-10-02 )))))))))))))))))))))))))))))))
.

2007-10-02 23:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-01 13:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-30 14:32 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-09-28 03:12 <DIR> d-------- C:\Program Files\01-mp3search
2007-09-15 08:12 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-09 13:57 <DIR> d-------- C:\Program Files\GameHouse
2007-09-05 13:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\TrojanHunter
2007-09-05 12:58 <DIR> d-------- C:\Program Files\TrojanHunter 4.7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-07 13:40 --------- d-------- C:\Program Files\Advanced Spyware Remover Pro
2007-08-30 10:13 --------- d-------- C:\Program Files\Trojan Remover
2007-08-30 10:07 --------- d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-30 00:03 35072 --a------ C:\WINDOWS\system32\drivers\runtime2.sys
2007-08-30 00:01 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-08-30 00:01 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-08-30 00:01 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-08-29 23:57 --------- d-------- C:\Program Files\Panda Security
2007-08-28 02:26 44544 --a------ C:\WINDOWS\system32\ayvxxtbz.dll
2007-08-28 02:26 125952 --a------ C:\WINDOWS\system32\ysermlgb.dll
2007-08-27 20:34 10048 --a------ C:\WINDOWS\system32\mspriv32.dll
2007-08-17 06:16 98304 --a------ C:\WINDOWS\system32\zdjrglkb.dll
2007-08-16 03:40 43520 --a------ C:\WINDOWS\system32\vlgwsnxa.dll
2007-08-16 02:24 49088 --a------ C:\WINDOWS\system32\rt25.exe
2007-08-13 19:42 81984 --a------ C:\WINDOWS\system32\bdod.bin
2007-08-12 04:46 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-08-12 04:34 --------- d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender
2007-08-07 22:42 751616 --a------ C:\WINDOWS\system32\jxbochnp.dll
2007-08-05 14:09 --------- d-------- C:\Documents and Settings\All Users\Application Data\GRETECH
2007-08-05 14:09 --------- d-------- C:\Documents and Settings\Administrator\Application Data\GRETECH
2007-08-05 14:08 --------- d-------- C:\Program Files\GRETECH
2007-08-05 13:25 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 13:25 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-08-05 13:25 --------- d-------- C:\Program Files\Analog Devices
2007-08-05 13:16 --------- d-------- C:\Program Files\TheCleaner
2007-08-05 13:16 --------- d-------- C:\Program Files\SpaceSearcher
2007-08-04 17:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-08-04 17:24 286720 --------- C:\WINDOWS\Setup1.exe
2007-08-04 12:10 --------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
2007-06-21 05:27:47 28,526 --sha-w C:\WINDOWS\system32\msvmon.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04CEA367-D51B-4966-BC06-790E622F0244}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A515003-F120-4E2F-9280-6C7BFF20A51E}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32A03E53-D81B-419A-879C-D08C4D2701Ec}]
C:\WINDOWS\system32\eonlwlku.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{58C453CB-B862-48ED-BA5B-A1519A98FD84}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E210C62-AF61-4D68-BAD0-A0DFB19EC65f}]
C:\WINDOWS\system32\eonlwlku.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8A746960-6B78-4C02-B3E9-A29B108362CB}]
c:\windows\system32\qsrtjtfn.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A6317271-D18E-4763-87B1-C9DD06F8FA23}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AC7F6E1F-6970-4B28-BF9E-5A988821FDBD}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B17E9573-DFAF-4FD6-92F5-09744FAF9725}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B6DBC2BD-B4DE-B8FC-BE72-3B3A9B6358B6}]
2007-06-01 02:34 10240 --a------ C:\WINDOWS\system\bimtcs32.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BC7EF62B-1CA3-48BA-8685-B73D8AF40D13}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D1C48F6E-BBE2-474D-B126-EC289298236F}]
c:\windows\system32\hjkahjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F3727275-224F-4AB0-8642-7D461EFB82D8}]
2007-06-21 12:28 978413 --------- C:\WINDOWS\system32\hbgpm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 16:50]
"CnxDslTaskBar"="C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe" [2004-01-27 16:56]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-20 10:14]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" []
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 18:26]
"Anti Trojan Elite"="C:\Program Files\Anti Trojan Elite\TJEnder.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:56]
"music"="C:\music.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hbgpm]
hbgpm.dll 2007-06-21 12:28 978413 C:\WINDOWS\system32\hbgpm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msvmon]
msvmon.dll 2007-06-21 12:27 28526 C:\WINDOWS\system32\msvmon.dll

R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgN.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 ATE_PROCMON;ATE_PROCMON;\??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05bf3735-176e-11dc-a72d-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe IISDLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4071faec-0493-11dc-a6f4-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

*Newly Created Service* - UHAHPLGK
.
Contents of the 'Scheduled Tasks' folder
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At1.job"
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At100.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At101.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At102.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At103.job"
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At104.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-11 04:27:43 C:\WINDOWS\Tasks\At105.job"
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At106.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At107.job"
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At108.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At109.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At11.job"
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At110.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At111.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At112.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At113.job"
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At114.job"
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At115.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At116.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At117.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At118.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At119.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At12.job"
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At120.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At121.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At122.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At123.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At124.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At125.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At126.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At127.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:48 C:\WINDOWS\Tasks\At128.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-11 11:26:56 C:\WINDOWS\Tasks\At129.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At130.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At131.job"
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At132.job"
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At133.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At134.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At135.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At136.job"
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At137.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At138.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At139.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At140.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At141.job"
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At142.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At143.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At144.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At15.job"
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At20.job"
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At24.job"
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-08 14:06:55 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At34.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At35.job"
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At38.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At46.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At49.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-30 21:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At50.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At51.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At52.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At53.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At54.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At55.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At56.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-09 14:28:38 C:\WINDOWS\Tasks\At57.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At58.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At59.job"
"2007-08-30 22:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At60.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At61.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At62.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At63.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At64.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At65.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At66.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At67.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At68.job"
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At69.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-30 23:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At70.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At71.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At72.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At73.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At74.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At75.job"
"2007-09-30 20:00:00 C:\WINDOWS\Tasks\At76.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At77.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At78.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At79.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-31 00:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-08-31 19:44:49 C:\WINDOWS\Tasks\At80.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-09 19:58:34 C:\WINDOWS\Tasks\At81.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-15 02:00:00 C:\WINDOWS\Tasks\At82.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-17 03:00:00 C:\WINDOWS\Tasks\At83.job"
"2007-09-20 04:00:00 C:\WINDOWS\Tasks\At84.job"
- C:\WINDOWS\system32\winmds.exe
"2007-09-22 05:00:00 C:\WINDOWS\Tasks\At85.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 06:00:00 C:\WINDOWS\Tasks\At86.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 07:00:00 C:\WINDOWS\Tasks\At87.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 08:00:00 C:\WINDOWS\Tasks\At88.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 09:00:00 C:\WINDOWS\Tasks\At89.job"
- C:\WINDOWS\system32\winmds.exe
"2007-08-08 13:41:03 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\2Q72Ybxs.exe
"2007-10-01 10:00:00 C:\WINDOWS\Tasks\At90.job"
"2007-10-01 11:00:00 C:\WINDOWS\Tasks\At91.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 12:00:00 C:\WINDOWS\Tasks\At92.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 13:00:00 C:\WINDOWS\Tasks\At93.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 14:00:00 C:\WINDOWS\Tasks\At94.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 15:00:00 C:\WINDOWS\Tasks\At95.job"
"2007-10-01 16:00:00 C:\WINDOWS\Tasks\At96.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 17:00:00 C:\WINDOWS\Tasks\At97.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 18:00:00 C:\WINDOWS\Tasks\At98.job"
- C:\WINDOWS\system32\winmds.exe
"2007-10-01 19:00:00 C:\WINDOWS\Tasks\At99.job"
- C:\WINDOWS\system32\winmds.exe
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-02 23:56:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-02 23:58:36 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-02 23:58
.
--- E O F ---



Latest HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:28, on 10/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {04CEA367-D51B-4966-BC06-790E622F0244} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2A515003-F120-4E2F-9280-6C7BFF20A51E} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {32A03E53-D81B-419A-879C-D08C4D2701Ec} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {58C453CB-B862-48ED-BA5B-A1519A98FD84} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {7E210C62-AF61-4D68-BAD0-A0DFB19EC65f} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A746960-6B78-4C02-B3E9-A29B108362CB} - c:\windows\system32\qsrtjtfn.dll (file missing)
O2 - BHO: (no name) - {A6317271-D18E-4763-87B1-C9DD06F8FA23} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {AC7F6E1F-6970-4B28-BF9E-5A988821FDBD} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {B17E9573-DFAF-4FD6-92F5-09744FAF9725} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: FLV Helper - {B6DBC2BD-B4DE-B8FC-BE72-3B3A9B6358B6} - C:\WINDOWS\system\bimtcs32.dll
O2 - BHO: (no name) - {BC7EF62B-1CA3-48BA-8685-B73D8AF40D13} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {D1C48F6E-BBE2-474D-B126-EC289298236F} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: CIEPl Object - {F3727275-224F-4AB0-8642-7D461EFB82D8} - C:\WINDOWS\system32\hbgpm.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [music] C:\music.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CS2\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O20 - Winlogon Notify: hbgpm - C:\WINDOWS\SYSTEM32\hbgpm.dll
O20 - Winlogon Notify: msvmon - C:\WINDOWS\SYSTEM32\msvmon.dll
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4662 bytes

#6 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 04 October 2007 - 11:25 AM

Hi

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below,"if still present":

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {04CEA367-D51B-4966-BC06-790E622F0244} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {2A515003-F120-4E2F-9280-6C7BFF20A51E} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {32A03E53-D81B-419A-879C-D08C4D2701Ec} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {58C453CB-B862-48ED-BA5B-A1519A98FD84} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {7E210C62-AF61-4D68-BAD0-A0DFB19EC65f} - C:\WINDOWS\system32\eonlwlku.dll (file missing)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8A746960-6B78-4C02-B3E9-A29B108362CB} - c:\windows\system32\qsrtjtfn.dll (file missing)
O2 - BHO: (no name) - {A6317271-D18E-4763-87B1-C9DD06F8FA23} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {AC7F6E1F-6970-4B28-BF9E-5A988821FDBD} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {B17E9573-DFAF-4FD6-92F5-09744FAF9725} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: FLV Helper - {B6DBC2BD-B4DE-B8FC-BE72-3B3A9B6358B6} - C:\WINDOWS\system\bimtcs32.dll
O2 - BHO: (no name) - {BC7EF62B-1CA3-48BA-8685-B73D8AF40D13} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: (no name) - {D1C48F6E-BBE2-474D-B126-EC289298236F} - c:\windows\system32\hjkahjk.dll (file missing)
O2 - BHO: CIEPl Object - {F3727275-224F-4AB0-8642-7D461EFB82D8} - C:\WINDOWS\system32\hbgpm.dll
O20 - Winlogon Notify: hbgpm - C:\WINDOWS\SYSTEM32\hbgpm.dll
O20 - Winlogon Notify: msvmon - C:\WINDOWS\SYSTEM32\msvmon.dll

Click on Posted Image button. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



2. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
Now copy/paste the entire content of the codebox below into the Notepad window:

Collect:[4]
C:\WINDOWS\system32\ayvxxtbz.dll
C:\WINDOWS\system32\ysermlgb.dll
C:\WINDOWS\system32\zdjrglkb.dll
C:\WINDOWS\system32\vlgwsnxa.dll
C:\WINDOWS\system32\jxbochnp.dll
C:\WINDOWS\system32\hjkahjk.dll
C:\WINDOWS\system32\eonlwlku.dll
c:\windows\system32\qsrtjtfn.dll
C:\WINDOWS\system32\hbgpm.dll

File::
C:\WINDOWS\system32\winmds.exe
C:\WINDOWS\system32\2Q72Ybxs.exe
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At100.job
C:\WINDOWS\Tasks\At101.job
C:\WINDOWS\Tasks\At102.job
C:\WINDOWS\Tasks\At103.job
C:\WINDOWS\Tasks\At104.job
C:\WINDOWS\Tasks\At105.job
C:\WINDOWS\Tasks\At106.job
C:\WINDOWS\Tasks\At107.job
C:\WINDOWS\Tasks\At108.job
C:\WINDOWS\Tasks\At109.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At110.job
C:\WINDOWS\Tasks\At111.job
C:\WINDOWS\Tasks\At112.job
C:\WINDOWS\Tasks\At113.job
C:\WINDOWS\Tasks\At114.job
C:\WINDOWS\Tasks\At115.job
C:\WINDOWS\Tasks\At116.job
C:\WINDOWS\Tasks\At117.job
C:\WINDOWS\Tasks\At118.job
C:\WINDOWS\Tasks\At119.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At120.job
C:\WINDOWS\Tasks\At121.job
C:\WINDOWS\Tasks\At122.job
C:\WINDOWS\Tasks\At123.job
C:\WINDOWS\Tasks\At124.job
C:\WINDOWS\Tasks\At125.job
C:\WINDOWS\Tasks\At126.job
C:\WINDOWS\Tasks\At127.job
C:\WINDOWS\Tasks\At128.job
C:\WINDOWS\Tasks\At129.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At130.job
C:\WINDOWS\Tasks\At131.job
C:\WINDOWS\Tasks\At132.job
C:\WINDOWS\Tasks\At133.job
C:\WINDOWS\Tasks\At134.job
C:\WINDOWS\Tasks\At135.job
C:\WINDOWS\Tasks\At136.job
C:\WINDOWS\Tasks\At137.job
C:\WINDOWS\Tasks\At138.job
C:\WINDOWS\Tasks\At139.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At140.job
C:\WINDOWS\Tasks\At141.job
C:\WINDOWS\Tasks\At142.job
C:\WINDOWS\Tasks\At143.job
C:\WINDOWS\Tasks\At144.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At75.job
C:\WINDOWS\Tasks\At76.job
C:\WINDOWS\Tasks\At77.job
C:\WINDOWS\Tasks\At78.job
C:\WINDOWS\Tasks\At79.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At80.job
C:\WINDOWS\Tasks\At81.job
C:\WINDOWS\Tasks\At82.job
C:\WINDOWS\Tasks\At83.job
C:\WINDOWS\Tasks\At84.job
C:\WINDOWS\Tasks\At85.job
C:\WINDOWS\Tasks\At86.job
C:\WINDOWS\Tasks\At87.job
C:\WINDOWS\Tasks\At88.job
C:\WINDOWS\Tasks\At89.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At90.job
C:\WINDOWS\Tasks\At91.job
C:\WINDOWS\Tasks\At92.job
C:\WINDOWS\Tasks\At93.job
C:\WINDOWS\Tasks\At94.job
C:\WINDOWS\Tasks\At95.job
C:\WINDOWS\Tasks\At96.job
C:\WINDOWS\Tasks\At97.job
C:\WINDOWS\Tasks\At98.job
C:\WINDOWS\Tasks\At99.job
C:\WINDOWS\system32\rt25.exe
C:\WINDOWS\system32\msvmon.dll
c:\windows\system32\hjkahjk.dll
C:\WINDOWS\system32\eonlwlku.dll
c:\windows\system32\qsrtjtfn.dll
C:\WINDOWS\system\bimtcs32.dll
C:\WINDOWS\system32\hbgpm.dll
C:\WINDOWS\system32\ayvxxtbz.dll
C:\WINDOWS\system32\ysermlgb.dll
C:\WINDOWS\system32\zdjrglkb.dll
C:\WINDOWS\system32\vlgwsnxa.dll
C:\WINDOWS\system32\jxbochnp.dll
C:\WINDOWS\system32\hjkahjk.dll
C:\WINDOWS\system32\eonlwlku.dll
c:\windows\system32\qsrtjtfn.dll
C:\WINDOWS\system32\hbgpm.dll

Driver:
coizpasz
uhahplgk

Rootkit::
C:\WINDOWS\system32\drivers\runtime2.sys

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04CEA367-D51B-4966-BC06-790E622F0244}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32A03E53-D81B-419A-879C-D08C4D2701Ec}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8A746960-6B78-4C02-B3E9-A29B108362CB}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B6DBC2BD-B4DE-B8FC-BE72-3B3A9B6358B6}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F3727275-224F-4AB0-8642-7D461EFB82D8}]

  • Save the above as CFScript.txt
  • Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
  • Posted Image
  • This will start ComboFix again. Upon reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
  • When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed, and read it carefully.
  • With the above script, ComboFix will capture a file to submit for analysis.
  • Ensure you are connected to the internet and click OK.
  • A browser will open. Simply follow the instructions to copy/paste/send the requested file.

Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#7 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 04 October 2007 - 02:46 PM

COMBOFIX LOG
ComboFix 07-10-02.2 - Administrator 2007-10-05 2:35:13.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.874.66.1033.18.257 [GMT 7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\winmds.exe
C:\WINDOWS\system32\2Q72Ybxs.exe
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At100.job
C:\WINDOWS\Tasks\At101.job
C:\WINDOWS\Tasks\At102.job
C:\WINDOWS\Tasks\At103.job
C:\WINDOWS\Tasks\At104.job
C:\WINDOWS\Tasks\At105.job
C:\WINDOWS\Tasks\At106.job
C:\WINDOWS\Tasks\At107.job
C:\WINDOWS\Tasks\At108.job
C:\WINDOWS\Tasks\At109.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At110.job
C:\WINDOWS\Tasks\At111.job
C:\WINDOWS\Tasks\At112.job
C:\WINDOWS\Tasks\At113.job
C:\WINDOWS\Tasks\At114.job
C:\WINDOWS\Tasks\At115.job
C:\WINDOWS\Tasks\At116.job
C:\WINDOWS\Tasks\At117.job
C:\WINDOWS\Tasks\At118.job
C:\WINDOWS\Tasks\At119.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At120.job
C:\WINDOWS\Tasks\At121.job
C:\WINDOWS\Tasks\At122.job
C:\WINDOWS\Tasks\At123.job
C:\WINDOWS\Tasks\At124.job
C:\WINDOWS\Tasks\At125.job
C:\WINDOWS\Tasks\At126.job
C:\WINDOWS\Tasks\At127.job
C:\WINDOWS\Tasks\At128.job
C:\WINDOWS\Tasks\At129.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At130.job
C:\WINDOWS\Tasks\At131.job
C:\WINDOWS\Tasks\At132.job
C:\WINDOWS\Tasks\At133.job
C:\WINDOWS\Tasks\At134.job
C:\WINDOWS\Tasks\At135.job
C:\WINDOWS\Tasks\At136.job
C:\WINDOWS\Tasks\At137.job
C:\WINDOWS\Tasks\At138.job
C:\WINDOWS\Tasks\At139.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At140.job
C:\WINDOWS\Tasks\At141.job
C:\WINDOWS\Tasks\At142.job
C:\WINDOWS\Tasks\At143.job
C:\WINDOWS\Tasks\At144.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At75.job
C:\WINDOWS\Tasks\At76.job
C:\WINDOWS\Tasks\At77.job
C:\WINDOWS\Tasks\At78.job
C:\WINDOWS\Tasks\At79.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At80.job
C:\WINDOWS\Tasks\At81.job
C:\WINDOWS\Tasks\At82.job
C:\WINDOWS\Tasks\At83.job
C:\WINDOWS\Tasks\At84.job
C:\WINDOWS\Tasks\At85.job
C:\WINDOWS\Tasks\At86.job
C:\WINDOWS\Tasks\At87.job
C:\WINDOWS\Tasks\At88.job
C:\WINDOWS\Tasks\At89.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At90.job
C:\WINDOWS\Tasks\At91.job
C:\WINDOWS\Tasks\At92.job
C:\WINDOWS\Tasks\At93.job
C:\WINDOWS\Tasks\At94.job
C:\WINDOWS\Tasks\At95.job
C:\WINDOWS\Tasks\At96.job
C:\WINDOWS\Tasks\At97.job
C:\WINDOWS\Tasks\At98.job
C:\WINDOWS\Tasks\At99.job
C:\WINDOWS\system32\rt25.exe
C:\WINDOWS\system32\msvmon.dll
c:\windows\system32\hjkahjk.dll
C:\WINDOWS\system32\eonlwlku.dll
c:\windows\system32\qsrtjtfn.dll
C:\WINDOWS\system\bimtcs32.dll
C:\WINDOWS\system32\hbgpm.dll
C:\WINDOWS\system32\ayvxxtbz.dll
C:\WINDOWS\system32\ysermlgb.dll
C:\WINDOWS\system32\zdjrglkb.dll
C:\WINDOWS\system32\vlgwsnxa.dll
C:\WINDOWS\system32\jxbochnp.dll
C:\WINDOWS\system32\hjkahjk.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system\bimtcs32.dll
C:\WINDOWS\system32\ayvxxtbz.dll
C:\WINDOWS\system32\drivers\runtime2.sys
C:\WINDOWS\system32\hbgpm.dll
C:\WINDOWS\system32\jxbochnp.dll
C:\WINDOWS\system32\msvmon.dll
C:\WINDOWS\system32\rt25.exe
C:\WINDOWS\system32\vlgwsnxa.dll
C:\WINDOWS\system32\ysermlgb.dll
C:\WINDOWS\system32\zdjrglkb.dll
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At100.job
C:\WINDOWS\Tasks\At101.job
C:\WINDOWS\Tasks\At102.job
C:\WINDOWS\Tasks\At103.job
C:\WINDOWS\Tasks\At104.job
C:\WINDOWS\Tasks\At105.job
C:\WINDOWS\Tasks\At106.job
C:\WINDOWS\Tasks\At107.job
C:\WINDOWS\Tasks\At108.job
C:\WINDOWS\Tasks\At109.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At110.job
C:\WINDOWS\Tasks\At111.job
C:\WINDOWS\Tasks\At112.job
C:\WINDOWS\Tasks\At113.job
C:\WINDOWS\Tasks\At114.job
C:\WINDOWS\Tasks\At115.job
C:\WINDOWS\Tasks\At116.job
C:\WINDOWS\Tasks\At117.job
C:\WINDOWS\Tasks\At118.job
C:\WINDOWS\Tasks\At119.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At120.job
C:\WINDOWS\Tasks\At121.job
C:\WINDOWS\Tasks\At122.job
C:\WINDOWS\Tasks\At123.job
C:\WINDOWS\Tasks\At124.job
C:\WINDOWS\Tasks\At125.job
C:\WINDOWS\Tasks\At126.job
C:\WINDOWS\Tasks\At127.job
C:\WINDOWS\Tasks\At128.job
C:\WINDOWS\Tasks\At129.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At130.job
C:\WINDOWS\Tasks\At131.job
C:\WINDOWS\Tasks\At132.job
C:\WINDOWS\Tasks\At133.job
C:\WINDOWS\Tasks\At134.job
C:\WINDOWS\Tasks\At135.job
C:\WINDOWS\Tasks\At136.job
C:\WINDOWS\Tasks\At137.job
C:\WINDOWS\Tasks\At138.job
C:\WINDOWS\Tasks\At139.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At140.job
C:\WINDOWS\Tasks\At141.job
C:\WINDOWS\Tasks\At142.job
C:\WINDOWS\Tasks\At143.job
C:\WINDOWS\Tasks\At144.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At75.job
C:\WINDOWS\Tasks\At76.job
C:\WINDOWS\Tasks\At77.job
C:\WINDOWS\Tasks\At78.job
C:\WINDOWS\Tasks\At79.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At80.job
C:\WINDOWS\Tasks\At81.job
C:\WINDOWS\Tasks\At82.job
C:\WINDOWS\Tasks\At83.job
C:\WINDOWS\Tasks\At84.job
C:\WINDOWS\Tasks\At85.job
C:\WINDOWS\Tasks\At86.job
C:\WINDOWS\Tasks\At87.job
C:\WINDOWS\Tasks\At88.job
C:\WINDOWS\Tasks\At89.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At90.job
C:\WINDOWS\Tasks\At91.job
C:\WINDOWS\Tasks\At92.job
C:\WINDOWS\Tasks\At93.job
C:\WINDOWS\Tasks\At94.job
C:\WINDOWS\Tasks\At95.job
C:\WINDOWS\Tasks\At96.job
C:\WINDOWS\Tasks\At97.job
C:\WINDOWS\Tasks\At98.job
C:\WINDOWS\Tasks\At99.job

.
((((((((((((((((((((((((( Files Created from 2007-09-04 to 2007-10-04 )))))))))))))))))))))))))))))))
.

2007-10-02 23:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-01 13:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-30 14:32 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-09-15 08:12 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-09 13:57 <DIR> d-------- C:\Program Files\GameHouse
2007-09-05 13:00 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\TrojanHunter
2007-09-05 12:58 <DIR> d-------- C:\Program Files\TrojanHunter 4.7

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-07 13:40 --------- d-------- C:\Program Files\Advanced Spyware Remover Pro
2007-08-30 10:13 --------- d-------- C:\Program Files\Trojan Remover
2007-08-30 10:07 --------- d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-30 00:01 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-08-30 00:01 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-08-30 00:01 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-08-29 23:57 --------- d-------- C:\Program Files\Panda Security
2007-08-27 20:34 10048 --a------ C:\WINDOWS\system32\mspriv32.dll
2007-08-13 19:42 81984 --a------ C:\WINDOWS\system32\bdod.bin
2007-08-12 04:46 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-08-12 04:34 --------- d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender
2007-08-05 14:09 --------- d-------- C:\Documents and Settings\All Users\Application Data\GRETECH
2007-08-05 14:09 --------- d-------- C:\Documents and Settings\Administrator\Application Data\GRETECH
2007-08-05 14:08 --------- d-------- C:\Program Files\GRETECH
2007-08-05 13:25 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-05 13:25 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-08-05 13:25 --------- d-------- C:\Program Files\Analog Devices
2007-08-05 13:16 --------- d-------- C:\Program Files\TheCleaner
2007-08-05 13:16 --------- d-------- C:\Program Files\SpaceSearcher
2007-08-04 17:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-08-04 17:24 286720 --------- C:\WINDOWS\Setup1.exe
2007-08-04 12:10 --------- d-------- C:\Documents and Settings\Administrator\Application Data\AdobeUM
.

((((((((((((((((((((((((((((( snapshot@2007-10-02_23.57.41.21 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 32,768 2007-10-04 19:16:21 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-10-04 19:16:21 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w 49,152 2007-10-04 19:16:21 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
----a-w 32,768 2007-10-02 16:56:01 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-10-02 16:56:01 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
----a-w 49,152 2007-10-02 16:56:01 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 16:50]
"CnxDslTaskBar"="C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe" [2004-01-27 16:56]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-20 10:14]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" []
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 18:26]
"Anti Trojan Elite"="C:\Program Files\Anti Trojan Elite\TJEnder.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:56]
"music"="C:\music.exe" []

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hbgpm]
hbgpm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msvmon]
msvmon.dll

R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgN.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 ATE_PROCMON;ATE_PROCMON;\??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05bf3735-176e-11dc-a72d-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe IISDLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4071faec-0493-11dc-a6f4-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-05 02:42:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-05 2:43:40 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-05 02:43
C:\ComboFix2.txt ... 2007-10-02 23:58
.
--- E O F ---

#8 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 04 October 2007 - 02:47 PM

Most recent HJT log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:46, on 10/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [music] C:\music.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O20 - Winlogon Notify: hbgpm - hbgpm.dll (file missing)
O20 - Winlogon Notify: msvmon - msvmon.dll (file missing)
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3277 bytes

#9 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 06 October 2007 - 06:20 PM

Hi

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below,"if still present":

O4 - HKCU\..\Run: [music] C:\music.exe
O20 - Winlogon Notify: hbgpm - hbgpm.dll (file missing)
O20 - Winlogon Notify: msvmon - msvmon.dll (file missing)

Click on Posted Image button. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



2. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
Now copy/paste the entire content of the codebox below into the Notepad window:

http://www.bleepingcomputer.com/forums/t/110502/win32adwarevirtumonde/


Collect:[4]
C:\music.exe
C:\Windows\killVBS.vbs
C:\Windows\IISDLL.dll.vbs


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"music"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hbgpm]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msvmon]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05bf3735-176e-11dc-a72d-000ea6731433}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4071faec-0493-11dc-a6f4-000ea6731433}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

  • Save the above as CFScript.txt
  • Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
  • Posted Image
  • This will start ComboFix again. Upon reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
  • When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed, and read it carefully.
  • With the above script, ComboFix will capture a file to submit for analysis.
  • Ensure you are connected to the internet and click OK.
  • A browser will open. Simply follow the instructions to copy/paste/send the requested file.

Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#10 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 07 October 2007 - 10:57 PM

ComboFix 07-10-02.2 - Administrator 2007-10-08 10:42:28.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.874.66.1033.18.292 [GMT 7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript_used_2007-10-05@2.35.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\winmds.exe
C:\WINDOWS\system32\2Q72Ybxs.exe
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At100.job
C:\WINDOWS\Tasks\At101.job
C:\WINDOWS\Tasks\At102.job
C:\WINDOWS\Tasks\At103.job
C:\WINDOWS\Tasks\At104.job
C:\WINDOWS\Tasks\At105.job
C:\WINDOWS\Tasks\At106.job
C:\WINDOWS\Tasks\At107.job
C:\WINDOWS\Tasks\At108.job
C:\WINDOWS\Tasks\At109.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At110.job
C:\WINDOWS\Tasks\At111.job
C:\WINDOWS\Tasks\At112.job
C:\WINDOWS\Tasks\At113.job
C:\WINDOWS\Tasks\At114.job
C:\WINDOWS\Tasks\At115.job
C:\WINDOWS\Tasks\At116.job
C:\WINDOWS\Tasks\At117.job
C:\WINDOWS\Tasks\At118.job
C:\WINDOWS\Tasks\At119.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At120.job
C:\WINDOWS\Tasks\At121.job
C:\WINDOWS\Tasks\At122.job
C:\WINDOWS\Tasks\At123.job
C:\WINDOWS\Tasks\At124.job
C:\WINDOWS\Tasks\At125.job
C:\WINDOWS\Tasks\At126.job
C:\WINDOWS\Tasks\At127.job
C:\WINDOWS\Tasks\At128.job
C:\WINDOWS\Tasks\At129.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At130.job
C:\WINDOWS\Tasks\At131.job
C:\WINDOWS\Tasks\At132.job
C:\WINDOWS\Tasks\At133.job
C:\WINDOWS\Tasks\At134.job
C:\WINDOWS\Tasks\At135.job
C:\WINDOWS\Tasks\At136.job
C:\WINDOWS\Tasks\At137.job
C:\WINDOWS\Tasks\At138.job
C:\WINDOWS\Tasks\At139.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At140.job
C:\WINDOWS\Tasks\At141.job
C:\WINDOWS\Tasks\At142.job
C:\WINDOWS\Tasks\At143.job
C:\WINDOWS\Tasks\At144.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At49.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At50.job
C:\WINDOWS\Tasks\At51.job
C:\WINDOWS\Tasks\At52.job
C:\WINDOWS\Tasks\At53.job
C:\WINDOWS\Tasks\At54.job
C:\WINDOWS\Tasks\At55.job
C:\WINDOWS\Tasks\At56.job
C:\WINDOWS\Tasks\At57.job
C:\WINDOWS\Tasks\At58.job
C:\WINDOWS\Tasks\At59.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At60.job
C:\WINDOWS\Tasks\At61.job
C:\WINDOWS\Tasks\At62.job
C:\WINDOWS\Tasks\At63.job
C:\WINDOWS\Tasks\At64.job
C:\WINDOWS\Tasks\At65.job
C:\WINDOWS\Tasks\At66.job
C:\WINDOWS\Tasks\At67.job
C:\WINDOWS\Tasks\At68.job
C:\WINDOWS\Tasks\At69.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At70.job
C:\WINDOWS\Tasks\At71.job
C:\WINDOWS\Tasks\At72.job
C:\WINDOWS\Tasks\At73.job
C:\WINDOWS\Tasks\At74.job
C:\WINDOWS\Tasks\At75.job
C:\WINDOWS\Tasks\At76.job
C:\WINDOWS\Tasks\At77.job
C:\WINDOWS\Tasks\At78.job
C:\WINDOWS\Tasks\At79.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At80.job
C:\WINDOWS\Tasks\At81.job
C:\WINDOWS\Tasks\At82.job
C:\WINDOWS\Tasks\At83.job
C:\WINDOWS\Tasks\At84.job
C:\WINDOWS\Tasks\At85.job
C:\WINDOWS\Tasks\At86.job
C:\WINDOWS\Tasks\At87.job
C:\WINDOWS\Tasks\At88.job
C:\WINDOWS\Tasks\At89.job
C:\WINDOWS\Tasks\At9.job
C:\WINDOWS\Tasks\At90.job
C:\WINDOWS\Tasks\At91.job
C:\WINDOWS\Tasks\At92.job
C:\WINDOWS\Tasks\At93.job
C:\WINDOWS\Tasks\At94.job
C:\WINDOWS\Tasks\At95.job
C:\WINDOWS\Tasks\At96.job
C:\WINDOWS\Tasks\At97.job
C:\WINDOWS\Tasks\At98.job
C:\WINDOWS\Tasks\At99.job
C:\WINDOWS\system32\rt25.exe
C:\WINDOWS\system32\msvmon.dll
c:\windows\system32\hjkahjk.dll
C:\WINDOWS\system32\eonlwlku.dll
c:\windows\system32\qsrtjtfn.dll
C:\WINDOWS\system\bimtcs32.dll
C:\WINDOWS\system32\hbgpm.dll
C:\WINDOWS\system32\ayvxxtbz.dll
C:\WINDOWS\system32\ysermlgb.dll
C:\WINDOWS\system32\zdjrglkb.dll
C:\WINDOWS\system32\vlgwsnxa.dll
C:\WINDOWS\system32\jxbochnp.dll
C:\WINDOWS\system32\hjkahjk.dll
.

((((((((((((((((((((((((( Files Created from 2007-09-08 to 2007-10-08 )))))))))))))))))))))))))))))))
.

2007-10-07 21:27 <DIR> d-------- C:\Program Files\Guitar Pro 4 Demo
2007-10-02 23:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-01 13:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-30 14:32 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-09-15 08:12 <DIR> d-------- C:\Program Files\AC3Filter
2007-09-09 13:57 <DIR> d-------- C:\Program Files\GameHouse

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-30 14:18 --------- d-------- C:\Program Files\TrojanHunter 4.7
2007-09-07 13:40 --------- d-------- C:\Program Files\Advanced Spyware Remover Pro
2007-09-05 13:00 --------- d-------- C:\Documents and Settings\Administrator\Application Data\TrojanHunter
2007-08-30 10:13 --------- d-------- C:\Program Files\Trojan Remover
2007-08-30 10:07 --------- d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-30 00:01 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-08-30 00:01 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-08-30 00:01 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-08-29 23:57 --------- d-------- C:\Program Files\Panda Security
2007-08-27 20:34 10048 --a------ C:\WINDOWS\system32\mspriv32.dll
2007-08-13 19:42 81984 --a------ C:\WINDOWS\system32\bdod.bin
2007-08-12 04:46 --------- d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2007-08-12 04:34 --------- d-------- C:\Documents and Settings\Administrator\Application Data\Bitdefender
2007-08-04 17:24 73216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-08-04 17:24 286720 --------- C:\WINDOWS\Setup1.exe
.

((((((((((((((((((((((((((((( snapshot@2007-10-02_23.57.41.21 )))))))))))))))))))))))))))))))))))))))))
.
----a-w 250,288 2007-10-08 03:38:02 C:\WINDOWS\system32\FNTCACHE.DAT
----a-w 32,768 2007-10-04 19:16:21 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-10-04 19:16:21 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
----a-w 249,496 2007-08-13 12:47:45 C:\WINDOWS\system32\FNTCACHE.DAT
----a-w 32,768 2007-10-02 16:56:01 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
----a-w 32,768 2007-10-02 16:56:01 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 16:50]
"CnxDslTaskBar"="C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe" [2004-01-27 16:56]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-20 10:14]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" []
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 18:26]
"Anti Trojan Elite"="C:\Program Files\Anti Trojan Elite\TJEnder.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:56]

R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgN.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 ATE_PROCMON;ATE_PROCMON;\??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
1\Command- music.exe
2\Command- music.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- E:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05bf3735-176e-11dc-a72d-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe IISDLL.dll.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4071faec-0493-11dc-a6f4-000ea6731433}]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe killVBS.vbs

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-08 10:45:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-08 10:45:45 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-10-08 10:45
C:\ComboFix2.txt ... 2007-10-05 02:43
C:\ComboFix3.txt ... 2007-10-02 23:58
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57, on 10/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Ahead\Nero StartSmart\NeroStartSmart.exe
C:\Program Files\Ahead\nero\nero.exe
C:\WINDOWS\system32\imapi.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3172 bytes

#11 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 12 October 2007 - 02:13 PM

Hi rasmalai,

I think you make some kind of confusion with my instrucions. Please be carefull, and follow precisaly all my instrucions below.

If you have any kind of doubts, please fell free to ask.

Thanks, lets go to work:


1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below,"if still present":

O4 - HKCU\..\Run: [music] C:\music.exe
O20 - Winlogon Notify: hbgpm - hbgpm.dll (file missing)
O20 - Winlogon Notify: msvmon - msvmon.dll (file missing)

Click on Posted Image button. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.



2. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
Now copy/paste the entire content of the codebox below into the Notepad window:

http://www.bleepingcomputer.com/forums/t/110502/win32adwarevirtumonde/

Collect:[4]
C:\music.exe
C:\Windows\killVBS.vbs
C:\Windows\IISDLL.dll.vbs


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"music"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hbgpm]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\msvmon]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{05bf3735-176e-11dc-a72d-000ea6731433}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4071faec-0493-11dc-a6f4-000ea6731433}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

  • Save the above as CFScript.txt
  • Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.
  • Posted Image
  • This will start ComboFix again. Upon reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
  • When ComboFix finishes running, the ComboFix log will open along with a message box--do not be alarmed, and read it carefully.
  • With the above script, ComboFix will capture a file to submit for analysis.
  • Ensure you are connected to the internet and click OK.
  • A browser will open. Simply follow the instructions to copy/paste/send the requested file.

Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#12 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 13 October 2007 - 04:55 AM

ComboFix 07-10-12.4 - Administrator 2007-10-13 16:50:18.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.874.66.1033.18.215 [GMT 7:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 )))))))))))))))))))))))))))))))
.

2007-10-07 21:27 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-10-07 21:27 <DIR> d-------- C:\Program Files\Guitar Pro 4 Demo
2007-10-02 23:47 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-01 13:39 <DIR> d-------- C:\Program Files\Trend Micro
2007-09-30 14:32 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-09-15 08:12 <DIR> d-------- C:\Program Files\AC3Filter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-30 07:18 --------- d-----w C:\Program Files\TrojanHunter 4.7
2007-09-09 06:57 --------- d-----w C:\Program Files\GameHouse
2007-09-07 06:40 --------- d-----w C:\Program Files\Advanced Spyware Remover Pro
2007-09-05 06:00 --------- d-----w C:\Documents and Settings\Administrator\Application Data\TrojanHunter
2007-08-30 03:13 --------- d-----w C:\Program Files\Trojan Remover
2007-08-30 03:07 --------- d-----w C:\Documents and Settings\All Users\Application Data\TEMP
2007-08-29 17:01 512,096 ----a-w C:\WINDOWS\system32\drivers\amon.sys
2007-08-29 17:01 298,104 ----a-w C:\WINDOWS\system32\imon.dll
2007-08-29 17:01 15,424 ----a-w C:\WINDOWS\system32\drivers\nod32drv.sys
2007-08-29 16:57 --------- d-----w C:\Program Files\Panda Security
2007-08-27 13:34 10,048 ----a-w C:\WINDOWS\system32\mspriv32.dll
2007-08-13 12:42 81,984 ----a-w C:\WINDOWS\system32\bdod.bin
2007-08-04 10:24 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-08-04 10:24 286,720 ------w C:\WINDOWS\Setup1.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 16:50]
"CnxDslTaskBar"="C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe" [2004-01-27 16:56]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-05-20 10:14]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" []
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 04:56 C:\WINDOWS\system32\rundll32.exe]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2002-10-11 18:26]
"Anti Trojan Elite"="C:\Program Files\Anti Trojan Elite\TJEnder.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:56]

R3 CnxEtP;Conexant AccessRunner USB ADSL WAN Adapter Filter Driver;C:\WINDOWS\system32\DRIVERS\CnxEtP.sys
R3 CnxEtU;Conexant AccessRunner USB ADSL Interface Device Driver;C:\WINDOWS\system32\DRIVERS\CnxEtU.sys
R3 CnxTgN;Conexant AccessRunner USB ADSL WAN Adapter Driver;C:\WINDOWS\system32\DRIVERS\CnxTgN.sys
R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys
S3 ATE_PROCMON;ATE_PROCMON;\??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
1\Command - music.exe
2\Command - music.exe
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
1\Command - music.exe
2\Command - music.exe
AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Music.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command - E:\setup.exe

.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-13 16:51:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-13 16:52:24
C:\ComboFix-quarantined-files.txt ... 2007-10-08 10:45
C:\ComboFix2.txt ... 2007-10-08 10:45
C:\ComboFix3.txt ... 2007-10-05 02:43
.
--- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 04:55, on 10/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3209 bytes

#13 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 18 October 2007 - 04:10 AM

Hi,

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
Copy (Ctrl+C) and paste (Ctrl+V) the following text inside the code box below (starting with REGEDIT4) to Notepad. (Be sure to use Notepad, not Wordpad, otherwise it won't work).

REGEDIT4

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

  • Make sure there are no blank spaces before REGEDIT4 and there should be one blank line at the end.
  • Click File at the top and then choose Save As.
  • Change Save As Type to All Files.
  • Name it FixMusic.reg and save it on your desktop.
  • Double click FixMusic.reg. It will ask you if you want to merge it to the registry, click Yes.
2. Reboot normaly your PC.


3. Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.


4. Please go HERE to run Panda's ActiveScan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report, along with a new HijackThis log

Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!

#14 rasmalai

rasmalai
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:02:57 AM

Posted 21 October 2007 - 02:10 PM

Incident Status Location

Spyware:spyware/searchcentrix Not disinfected Windows Registry
Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Administrator\Cookies\administrator@go[1].txt
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Administrator\Desktop\ComboFix.exe[nircmd.exe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\Administrator\Desktop\ComboFix.exe[nircmd.cfexe]
Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe
Virus:W32/ZlFake.A Disinfected C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
Virus:Trj/Downloader.MDW Disinfected C:\WINDOWS\system32\vdrtcaaa.exe
Virus:Generic Trojan Not disinfected D:\หลบลี้หนีภัย\All\Download\Internet Download Manager5[1].03(Full-Crack).rar[IDM_PATCH\Patch.exe]


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 02:10, on 10/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CnxDslTaskBar] "C:\Program Files\BIPAC-7000 ADSL USB Modem\CnxDslTb.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [Anti Trojan Elite] C:\Program Files\Anti Trojan Elite\TJEnder.exe :NO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O17 - HKLM\System\CS1\Services\Tcpip\..\{0F58F124-E5E0-4E51-986D-A34A320482E6}: NameServer = 203.144.207.29 203.144.207.49
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 3353 bytes

#15 lusitano

lusitano

    Portuguese Malware Fighter


  • Members
  • 1,443 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Portugal
  • Local time:06:57 AM

Posted 22 October 2007 - 06:59 AM

Hi rasmalai,

Virus:Generic Trojan Not disinfected D:\หลบลี้หนีภัย\All\Download\Internet Download Manager5[1].03(Full-Crack).rar[IDM_PATCH\Patch.exe]


:thumbsup: Watch what you download :blink:

Delete this crack file and your PC will be clean.



Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and reenable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Reenable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety
  • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
  • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
  • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
    Using Winpatrol to protect your computer from malicious software

Posted Image
Please do not PM me asking for support.
Please be courteous, polite, and say thank you.
Please post the final results, good or bad. We like to know!




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users