Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan Horse Generic9.aqno/virus Lop


  • Please log in to reply
6 replies to this topic

#1 j_bues05

j_bues05

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 19 February 2008 - 01:22 PM

Hi!

I am new to this forum, so please correct me if I somehow "misbehave"

I usually don't surf with the IE, but recently I had to because my Opera wouldn't play some nba.com video footage.

Afterwards my IE displayed two warnings about downloading either PerformanceOptimizer or NeuerSchild (German, NewShield in English) to fix a virus that infected my PC. I didn't download anything, but soon my AVG 7.5 kept popping up reporting a virus called Generic9.AQNO or Virus Lop which are supposed to be trojan horses. I selected "Move to Vault" everytime. But now IE windows keep popping up out of thin air telling me to join a browser-game called "Gladiatus", or to download NeuerSchild.

As of now, there are hardly any deficits in performance, though I am still worried about the security of my PC. It is possibly of interest that I run Windows Vista Home Premium.

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:08:01, on 19.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVG Antivirus\avgcc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Razer\Diamondback\razertra.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGANT~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [Dimondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\tuspn.dll,#1
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4486] command /c del "C:\Windows\System32\khhgg.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2856] cmd /c del "C:\Windows\System32\khhgg.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB8706] command /c del "C:\Windows\System32\khhgg.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7064] cmd /c del "C:\Windows\System32\khhgg.dll"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Autostart.txt
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgemc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 5418 bytes

My question is whether to ignore the warnings because nothing is really happening to my PC, or whether I should try to fix the problem. Can anyone help me?

The Virus is in my IE5 Temporary InternetFiles.


Thanks, Jonathan


p.s. I am also using an external HDD. Is there any possibility for the virus to move onto it if there are only some .mp3-files and documents on it? And if there
could be a possible threat, how do I manage to fix that?

BC AdBot (Login to Remove)

 


m

#2 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:05:00 PM

Posted 25 February 2008 - 03:29 PM

Hi,

let us first take care of your internal HD.

Download ComboFix from Here or Here to your Desktop.
  • Double click combofix.exe and follow the prompts.
  • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Regards,

Rosty.
Posted Image
Proud member of ASAP since 2007

#3 j_bues05

j_bues05
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 25 February 2008 - 04:59 PM

Hi Rosty!

Thanks for replying so quickly.

ComboFix log:

ComboFix 08-02-19.2 - Jonathan 2008-02-25 22:18:20.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1390 [GMT 1:00]
ausgeführt von:: C:\Users\Jonathan\Desktop\ComboFix.exe
* Neuer Wiederherstellungspunkt wurde erstellt
.

(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\System32\ddefe.ini
C:\Windows\System32\ddefe.ini2
C:\Windows\System32\hijlm.ini
C:\Windows\System32\hijlm.ini2
C:\Windows\System32\jmlnn.ini
C:\Windows\System32\jmlnn.ini2
C:\Windows\system32\ljhfc.dll
C:\Windows\system32\nnlmj.dll
C:\Windows\System32\npsru.ini
C:\Windows\System32\npsru.ini2
C:\Windows\System32\stuvw.ini
C:\Windows\System32\stuvw.ini2
C:\Windows\System32\tsutv.ini
C:\Windows\System32\tsutv.ini2
C:\Windows\system32\urspn.dll
C:\Windows\system32\wvurqqn.dll

.
((((((((((((((((((((((( Dateien erstellt von 2008-01-25 bis 2008-02-25 ))))))))))))))))))))))))))))))
.

2008-02-23 22:39 . 2008-02-23 22:39 619 --a------ C:\Windows\eReg.dat
2008-02-19 17:24 . 2008-02-19 17:24 88 --a------ C:\Windows\wininit.ini
2008-02-19 15:43 . 2008-02-19 17:24 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-02-19 15:43 . 2008-02-19 17:24 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-02-19 15:43 . 2008-02-19 15:43 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 08:18 . 2008-02-19 09:00 <DIR> d-------- C:\Users\Jonathan\.housecall6.6
2008-02-19 08:18 . 2008-02-19 08:18 102,664 --a------ C:\Windows\System32\drivers\tmcomm.sys
2008-02-19 07:26 . 2008-02-19 07:29 <DIR> d-------- C:\Program Files\Java
2008-02-19 07:26 . 2008-02-19 07:26 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-19 07:10 . 2008-02-19 07:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-17 19:48 . 2008-02-17 19:50 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-02-17 19:48 . 2008-02-17 19:50 <DIR> d-------- C:\ProgramData\Lavasoft
2008-02-17 19:48 . 2008-02-17 19:48 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 19:47 . 2008-02-17 19:47 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 17:19 . 2008-02-17 17:19 94,208 --a------ C:\Windows\DIIUnin.exe
2008-02-17 17:19 . 2008-02-17 17:28 32,284 --a------ C:\Windows\DIIUnin.dat
2008-02-17 17:19 . 2008-02-17 17:19 2,829 --a------ C:\Windows\DIIUnin.pif
2008-02-17 16:55 . 2008-02-17 16:55 43,520 --a------ C:\Windows\System32\CmdLineExt03.dll
2008-02-17 04:17 . 2008-02-17 04:18 242,638,079 --a------ C:\Windows\MEMORY.DMP
2008-02-17 01:53 . 2008-02-17 01:53 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-02-17 01:52 . 2008-02-17 01:53 <DIR> d-------- C:\Program Files\DivX
2008-02-15 16:36 . 2008-02-15 16:36 <DIR> d-------- C:\Users\Jonathan\AppData\Roaming\Microsoft Games
2008-02-15 14:16 . 2008-02-15 14:16 <DIR> d-------- C:\Program Files\Razer
2008-02-15 14:16 . 2007-01-18 10:33 73,728 --a------ C:\Windows\System32\diamondback.cpl
2008-02-15 14:16 . 2005-04-24 22:43 13,225 --a------ C:\Windows\System32\drivers\Razerlow.sys
2008-02-13 19:03 . 2007-04-09 13:23 28,040 --a------ C:\Windows\System32\mdimon.dll
2008-02-13 19:03 . 2008-02-13 19:03 400 --a------ C:\Windows\ODBC.INI
2008-02-13 19:00 . 2008-02-13 19:00 <DIR> d-------- C:\Windows\PCHEALTH
2008-02-13 19:00 . 2008-02-13 19:00 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-13 18:58 . 2008-02-13 18:58 <DIR> dr-h----- C:\MSOCache
2008-02-13 10:42 . 2008-02-13 10:42 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-13 10:42 . 2008-02-13 10:42 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-13 10:38 . 2008-02-13 10:38 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-13 10:37 . 2008-02-13 10:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-13 10:37 . 2008-02-13 10:37 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-13 10:30 . 2008-02-13 10:30 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-10 02:07 . 2008-02-10 02:07 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-08 02:14 . 2008-02-17 12:16 69 --a------ C:\Windows\NeroDigital.ini
2008-02-03 18:19 . 2008-02-03 18:19 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-02-03 18:19 . 2008-02-03 18:19 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-02-03 18:18 . 2008-02-03 18:18 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-02-02 21:28 . 2008-02-02 21:28 530 --a------ C:\WirelessDiagLog.csv

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-25 20:41 --------- d-----w C:\Program Files\AVG Antivirus
2008-02-24 21:29 --------- d-----w C:\Users\Jonathan\AppData\Roaming\Winamp
2008-02-24 20:35 27,620 ----a-w C:\Users\Jonathan\AppData\Roaming\nvModes.dat
2008-02-23 21:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-20 14:37 --------- d-----w C:\Users\Jonathan\AppData\Roaming\AVG7
2008-02-20 14:31 --------- d-----w C:\ProgramData\avg7
2008-02-16 13:56 --------- d-----w C:\Program Files\BitComet
2008-02-13 09:38 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 09:38 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 09:38 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-13 09:38 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-13 09:38 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-13 09:38 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 09:38 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 09:38 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 09:38 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-13 09:38 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 09:38 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 09:37 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 09:37 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 09:37 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 09:37 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 09:32 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-13 09:32 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-13 09:32 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 09:32 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-04 00:30 --------- d-----w C:\Program Files\Windows Mail
2008-02-03 17:18 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-04 21:59 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-01-04 21:58 129,784 ------w C:\Windows\System32\pxafs.dll
2008-01-04 21:58 118,520 ------w C:\Windows\System32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\Windows\System32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-29 04:55 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-28 14:35 --------- d-----w C:\Users\Jonathan\AppData\Roaming\Nero
2007-12-28 14:25 --------- d-----w C:\Program Files\Common Files\Nero
2007-12-28 14:23 --------- d-----w C:\ProgramData\Nero
2007-12-28 14:23 --------- d-----w C:\Program Files\Nero
2007-12-28 12:41 --------- d-----w C:\Program Files\PowerISO
2007-12-21 10:19 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-21 10:19 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-21 10:19 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-14 10:32 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2007-12-03 17:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll
2007-09-24 10:55 174 --sha-w C:\Program Files\desktop.ini
2007-09-24 09:38 76 --sh--r C:\Windows\CT4CET.bin
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13CECED7-0FFA-4A21-B3C5-152CF4360106}]
C:\Windows\system32\mljih.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E0EA90C-0A29-489C-B399-BABA638D51D7}]
C:\Windows\system32\efedd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C6CF7C-DBB5-460D-9280-12EBD11677F7}]
C:\Windows\system32\mljih.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4AAD8075-DC1C-4D14-9562-BBD940DE160F}]
C:\Windows\system32\wvuts.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4EB46111-E917-4B5C-9877-E622059469B8}]
C:\Windows\system32\vtust.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64BEC5ED-AD45-485B-871F-83C8D8C4CF4E}]
C:\Windows\system32\wvuts.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A82A7C5A-F3E2-49A0-9CC8-9908F7CC6F34}]
C:\Windows\system32\vtust.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\AVGANT~1\avgcc.exe" [2007-12-21 11:10 579072]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 15:35 857648]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 21:24 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 21:24 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 21:24 81920]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 21:24 86016]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-05-09 16:01 36864]
"Dimondback"="C:\Program Files\Razer\Diamondback\razerhid.exe" [2007-01-18 09:48 147456]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\AVGANT~1\avgw.exe" [2007-10-26 10:40 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-09-24 01:52 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\Windows\system32\urspn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 15:39]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2007-12-21 11:10]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 17:03]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 17:45]
S3 NETw4v32;Intel® Wireless WiFi Link Adaptertreiber für Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-25 05:14]
S3 Razerlow;Razerlow USB Filter Driver;C:\Windows\system32\Drivers\Razerlow.sys [2005-04-24 22:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

.
Inhalt des "geplante Tasks" Ordners
"2008-02-25 21:24:00 C:\Windows\Tasks\At1.job"
- C:\Windows\system32\kmd.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-25 22:40:12
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
Zeit der Fertigstellung: 2008-02-25 22:43:46
ComboFix-quarantined-files.txt 2008-02-25 21:43:37
.
2008-02-22 13:43:19 --- E O F ---





New HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:45:55, on 25.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG Antivirus\avgcc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Windows\Explorer.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13CECED7-0FFA-4A21-B3C5-152CF4360106} - C:\Windows\system32\mljih.dll (file missing)
O2 - BHO: (no name) - {2E0EA90C-0A29-489C-B399-BABA638D51D7} - C:\Windows\system32\efedd.dll (file missing)
O2 - BHO: (no name) - {45C6CF7C-DBB5-460D-9280-12EBD11677F7} - C:\Windows\system32\mljih.dll (file missing)
O2 - BHO: (no name) - {4AAD8075-DC1C-4D14-9562-BBD940DE160F} - C:\Windows\system32\wvuts.dll (file missing)
O2 - BHO: (no name) - {4EB46111-E917-4B5C-9877-E622059469B8} - C:\Windows\system32\vtust.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {64BEC5ED-AD45-485B-871F-83C8D8C4CF4E} - C:\Windows\system32\wvuts.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {A82A7C5A-F3E2-49A0-9CC8-9908F7CC6F34} - C:\Windows\system32\vtust.dll (file missing)
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGANT~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [Dimondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Autostart.txt
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgemc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 5929 bytes

Thanks for your help!

BTW: Who programmed ComboFix? Seems like a very useful but also unfortunately dangerous tool to me...

#4 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:05:00 PM

Posted 26 February 2008 - 02:28 PM

Hi,
thanks for the logs.

Open HijackThis, click do a scan only and place a check next to the following entries:

O2 - BHO: (no name) - {13CECED7-0FFA-4A21-B3C5-152CF4360106} - C:\Windows\system32\mljih.dll (file missing)
O2 - BHO: (no name) - {2E0EA90C-0A29-489C-B399-BABA638D51D7} - C:\Windows\system32\efedd.dll (file missing)
O2 - BHO: (no name) - {45C6CF7C-DBB5-460D-9280-12EBD11677F7} - C:\Windows\system32\mljih.dll (file missing)
O2 - BHO: (no name) - {4AAD8075-DC1C-4D14-9562-BBD940DE160F} - C:\Windows\system32\wvuts.dll (file missing)
O2 - BHO: (no name) - {4EB46111-E917-4B5C-9877-E622059469B8} - C:\Windows\system32\vtust.dll (file missing)
O2 - BHO: (no name) - {64BEC5ED-AD45-485B-871F-83C8D8C4CF4E} - C:\Windows\system32\wvuts.dll (file missing)
O2 - BHO: (no name) - {A82A7C5A-F3E2-49A0-9CC8-9908F7CC6F34} - C:\Windows\system32\vtust.dll (file missing)

Close all other windows and browsers, except HijackThis, and clcick Fix Checked. Close HijackThis.

1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13CECED7-0FFA-4A21-B3C5-152CF4360106}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E0EA90C-0A29-489C-B399-BABA638D51D7]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{45C6CF7C-DBB5-460D-9280-12EBD11677F7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4AAD8075-DC1C-4D14-9562-BBD940DE160F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4EB46111-E917-4B5C-9877-E622059469B8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{64BEC5ED-AD45-485B-871F-83C8D8C4CF4E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A82A7C5A-F3E2-49A0-9CC8-9908F7CC6F34}]



3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

Posted Image


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

Posted Image
Proud member of ASAP since 2007

#5 j_bues05

j_bues05
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 26 February 2008 - 03:51 PM

Done.

CF log:

ComboFix 08-02-19.2 - Jonathan 2008-02-26 21:39:39.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1031.18.1409 [GMT 1:00]
ausgeführt von:: C:\Users\Jonathan\Desktop\ComboFix.exe
Command switches used :: C:\Users\Jonathan\Desktop\CFScript.txt
* Neuer Wiederherstellungspunkt wurde erstellt
.

((((((((((((((((((((((( Dateien erstellt von 2008-01-26 bis 2008-02-26 ))))))))))))))))))))))))))))))
.

2008-02-23 22:39 . 2008-02-23 22:39 619 --a------ C:\Windows\eReg.dat
2008-02-19 17:24 . 2008-02-19 17:24 88 --a------ C:\Windows\wininit.ini
2008-02-19 15:43 . 2008-02-19 17:24 <DIR> d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-02-19 15:43 . 2008-02-19 17:24 <DIR> d-------- C:\ProgramData\Spybot - Search & Destroy
2008-02-19 15:43 . 2008-02-19 15:43 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-19 08:18 . 2008-02-19 09:00 <DIR> d-------- C:\Users\Jonathan\.housecall6.6
2008-02-19 08:18 . 2008-02-19 08:18 102,664 --a------ C:\Windows\System32\drivers\tmcomm.sys
2008-02-19 07:26 . 2008-02-19 07:29 <DIR> d-------- C:\Program Files\Java
2008-02-19 07:26 . 2008-02-19 07:26 <DIR> d-------- C:\Program Files\Common Files\Java
2008-02-19 07:10 . 2008-02-19 07:10 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-17 19:48 . 2008-02-17 19:50 <DIR> d-------- C:\Users\All Users\Lavasoft
2008-02-17 19:48 . 2008-02-17 19:50 <DIR> d-------- C:\ProgramData\Lavasoft
2008-02-17 19:48 . 2008-02-17 19:48 <DIR> d-------- C:\Program Files\Lavasoft
2008-02-17 19:47 . 2008-02-17 19:47 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-17 17:19 . 2008-02-17 17:19 94,208 --a------ C:\Windows\DIIUnin.exe
2008-02-17 17:19 . 2008-02-17 17:28 32,284 --a------ C:\Windows\DIIUnin.dat
2008-02-17 17:19 . 2008-02-17 17:19 2,829 --a------ C:\Windows\DIIUnin.pif
2008-02-17 16:55 . 2008-02-17 16:55 43,520 --a------ C:\Windows\System32\CmdLineExt03.dll
2008-02-17 04:17 . 2008-02-17 04:18 242,638,079 --a------ C:\Windows\MEMORY.DMP
2008-02-17 01:53 . 2008-02-17 01:53 <DIR> d-------- C:\Program Files\Common Files\PX Storage Engine
2008-02-17 01:52 . 2008-02-17 01:53 <DIR> d-------- C:\Program Files\DivX
2008-02-15 16:36 . 2008-02-15 16:36 <DIR> d-------- C:\Users\Jonathan\AppData\Roaming\Microsoft Games
2008-02-15 14:16 . 2008-02-15 14:16 <DIR> d-------- C:\Program Files\Razer
2008-02-15 14:16 . 2007-01-18 10:33 73,728 --a------ C:\Windows\System32\diamondback.cpl
2008-02-15 14:16 . 2005-04-24 22:43 13,225 --a------ C:\Windows\System32\drivers\Razerlow.sys
2008-02-13 19:03 . 2007-04-09 13:23 28,040 --a------ C:\Windows\System32\mdimon.dll
2008-02-13 19:03 . 2008-02-13 19:03 400 --a------ C:\Windows\ODBC.INI
2008-02-13 19:00 . 2008-02-13 19:00 <DIR> d-------- C:\Windows\PCHEALTH
2008-02-13 19:00 . 2008-02-13 19:00 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-02-13 18:58 . 2008-02-13 18:58 <DIR> dr-h----- C:\MSOCache
2008-02-13 10:42 . 2008-02-13 10:42 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-02-13 10:42 . 2008-02-13 10:42 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-02-13 10:38 . 2008-02-13 10:38 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-02-13 10:37 . 2008-02-13 10:37 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll
2008-02-13 10:37 . 2008-02-13 10:37 1,686,528 --a------ C:\Windows\System32\gameux.dll
2008-02-13 10:30 . 2008-02-13 10:30 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-02-10 02:07 . 2008-02-10 02:07 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-02-08 02:14 . 2008-02-17 12:16 69 --a------ C:\Windows\NeroDigital.ini
2008-02-03 18:19 . 2008-02-03 18:19 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-02-03 18:19 . 2008-02-03 18:19 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-02-03 18:18 . 2008-02-03 18:18 11,776 --a------ C:\Windows\System32\sbunattend.exe
2008-02-02 21:28 . 2008-02-02 21:28 530 --a------ C:\WirelessDiagLog.csv

.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 18:18 --------- d-----w C:\Program Files\AVG Antivirus
2008-02-24 21:29 --------- d-----w C:\Users\Jonathan\AppData\Roaming\Winamp
2008-02-24 20:35 27,620 ----a-w C:\Users\Jonathan\AppData\Roaming\nvModes.dat
2008-02-23 21:39 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-02-20 14:37 --------- d-----w C:\Users\Jonathan\AppData\Roaming\AVG7
2008-02-20 14:31 --------- d-----w C:\ProgramData\avg7
2008-02-16 13:56 --------- d-----w C:\Program Files\BitComet
2008-02-13 09:38 803,328 ----a-w C:\Windows\system32\drivers\tcpip.sys
2008-02-13 09:38 45,112 ----a-w C:\Windows\system32\drivers\pciidex.sys
2008-02-13 09:38 3,470,392 ----a-w C:\Windows\System32\ntoskrnl.exe
2008-02-13 09:38 24,064 ----a-w C:\Windows\System32\netcfg.exe
2008-02-13 09:38 22,016 ----a-w C:\Windows\System32\netiougc.exe
2008-02-13 09:38 216,632 ----a-w C:\Windows\system32\drivers\netio.sys
2008-02-13 09:38 21,560 ----a-w C:\Windows\system32\drivers\atapi.sys
2008-02-13 09:38 17,464 ----a-w C:\Windows\system32\drivers\intelide.sys
2008-02-13 09:38 167,424 ----a-w C:\Windows\System32\tcpipcfg.dll
2008-02-13 09:38 154,624 ----a-w C:\Windows\system32\drivers\nwifi.sys
2008-02-13 09:38 109,624 ----a-w C:\Windows\system32\drivers\ataport.sys
2008-02-13 09:37 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-02-13 09:37 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-02-13 09:37 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-02-13 09:37 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-02-13 09:32 824,832 ----a-w C:\Windows\System32\wininet.dll
2008-02-13 09:32 56,320 ----a-w C:\Windows\System32\iesetup.dll
2008-02-13 09:32 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-02-13 09:32 26,624 ----a-w C:\Windows\System32\ieUnatt.exe
2008-02-04 00:30 --------- d-----w C:\Program Files\Windows Mail
2008-02-03 17:18 --------- d-----w C:\Program Files\Windows Sidebar
2008-01-04 21:59 524,288 ----a-w C:\Windows\System32\DivXsm.exe
2008-01-04 21:58 3,596,288 ----a-w C:\Windows\System32\qt-dx331.dll
2008-01-04 21:58 200,704 ----a-w C:\Windows\System32\ssldivx.dll
2008-01-04 21:58 129,784 ------w C:\Windows\System32\pxafs.dll
2008-01-04 21:58 118,520 ------w C:\Windows\System32\pxinsi64.exe
2008-01-04 21:58 1,044,480 ----a-w C:\Windows\System32\libdivx.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx0c.dll
2008-01-04 21:57 823,296 ----a-w C:\Windows\System32\divx_xx07.dll
2008-01-04 21:57 81,920 ----a-w C:\Windows\System32\dpl100.dll
2008-01-04 21:57 802,816 ----a-w C:\Windows\System32\divx_xx11.dll
2008-01-04 21:57 682,496 ----a-w C:\Windows\System32\DivX.dll
2008-01-04 21:57 593,920 ----a-w C:\Windows\System32\dpuGUI11.dll
2008-01-04 21:57 57,344 ----a-w C:\Windows\System32\dpv11.dll
2008-01-04 21:57 53,248 ----a-w C:\Windows\System32\dpuGUI10.dll
2008-01-04 21:57 344,064 ----a-w C:\Windows\System32\dpus11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu11.dll
2008-01-04 21:57 294,912 ----a-w C:\Windows\System32\dpu10.dll
2008-01-04 21:57 196,608 ----a-w C:\Windows\System32\dtu100.dll
2008-01-04 21:56 156,992 ----a-w C:\Windows\System32\DivXCodecVersionChecker.exe
2008-01-04 21:56 12,288 ----a-w C:\Windows\System32\DivXWMPExtType.dll
2007-12-29 04:55 --------- d-----w C:\Program Files\MSXML 4.0
2007-12-28 14:35 --------- d-----w C:\Users\Jonathan\AppData\Roaming\Nero
2007-12-28 14:25 --------- d-----w C:\Program Files\Common Files\Nero
2007-12-28 14:23 --------- d-----w C:\ProgramData\Nero
2007-12-28 14:23 --------- d-----w C:\Program Files\Nero
2007-12-28 12:41 --------- d-----w C:\Program Files\PowerISO
2007-12-21 10:19 9,728 ----a-w C:\Windows\System32\LAPRXY.DLL
2007-12-21 10:19 223,232 ----a-w C:\Windows\System32\WMASF.DLL
2007-12-21 10:19 1,327,104 ----a-w C:\Windows\System32\quartz.dll
2007-12-14 10:32 12,632 ----a-w C:\Windows\System32\lsdelete.exe
2007-12-03 17:04 95,600 ----a-w C:\Windows\System32\NeroCo.dll
2007-09-24 10:55 174 --sha-w C:\Program Files\desktop.ini
2007-09-24 09:38 76 --sh--r C:\Windows\CT4CET.bin
.

(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\AVGANT~1\avgcc.exe" [2007-12-21 11:10 579072]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-04-27 15:35 857648]
"NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-10-04 21:24 86016]
"NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-10-04 21:24 8497696]
"NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-10-04 21:24 81920]
"NVHotkey"="C:\Windows\system32\nvHotkey.dll" [2007-10-04 21:24 86016]
"OEM02Mon.exe"="C:\Windows\OEM02Mon.exe" [2007-05-09 16:01 36864]
"Dimondback"="C:\Program Files\Razer\Diamondback\razerhid.exe" [2007-01-18 09:48 147456]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\AVGANT~1\avgw.exe" [2007-10-26 10:40 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
avgwlntf.dll 2007-09-24 01:52 9216 C:\Windows\System32\avgwlntf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
C:\Program Files\BitComet\BitComet.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

R2 SBSDWSCService;SBSD Security Center Service;C:\Program Files\Spybot []
R2 XAudio;XAudio;C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 15:39]
R3 AvgWFP;AVG7 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfp.sys [2007-12-21 11:10]
R3 OEM02Dev;Creative Camera OEM002 Driver;C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-10 17:03]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 17:45]
S3 NETw4v32;Intel® Wireless WiFi Link Adaptertreiber für Windows Vista 32 Bit;C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-02-25 05:14]
S3 Razerlow;Razerlow USB Filter Driver;C:\Windows\system32\Drivers\Razerlow.sys [2005-04-24 22:43]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

.
Inhalt des "geplante Tasks" Ordners
"2008-02-25 21:24:00 C:\Windows\Tasks\At1.job"
- C:\Windows\system32\kmd.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-26 21:44:00
Windows 6.0.6000 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostart Einträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\AVGANT~1\avgamsvr.exe
C:\PROGRA~1\AVGANT~1\avgupsvc.exe
C:\PROGRA~1\AVGANT~1\avgrssvc.exe
C:\PROGRA~1\AVGANT~1\avgemc.exe
C:\PROGRA~1\AVGANT~1\avgrssvc.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
C:\Program Files\AVG Antivirus\avgcc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2008-02-26 21:47:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-26 20:47:22
ComboFix2.txt 2008-02-25 21:43:48
.
2008-02-22 13:43:19 --- E O F ---




HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:48:58, on 26.02.2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16609)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AVG Antivirus\avgcc.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Windows\OEM02Mon.exe
C:\Program Files\Razer\Diamondback\razerhid.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Windows\Explorer.exe
C:\Program Files\Razer\Diamondback\razerofa.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\AVGANT~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [Dimondback] C:\Program Files\Razer\Diamondback\razerhid.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\AVGANT~1\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Autostart.txt
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O20 - Winlogon Notify: avgwlntf - C:\Windows\SYSTEM32\avgwlntf.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\AVGANT~1\avgemc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 5165 bytes


Looks kinda clean to me now. But that's just a guess :thumbsup:

#6 Rosty

Rosty

    Skydive junkie


  • Malware Response Team
  • 1,220 posts
  • OFFLINE
  •  
  • Local time:05:00 PM

Posted 26 February 2008 - 04:00 PM

Hi,

those logs looks clean.
How are things running?

Please remove Combofix in this way:

Click Start >> Run, and then type ComboFix /u and hit enter.

Now you have a clean system retore point, your clock settings are back to normal and evrything related wth ComboFix is gone.

Note: Forgot to answer on this:

BTW: Who programmed ComboFix? Seems like a very useful but also unfortunately dangerous tool to me...

sUBs is the programmer and yes its adangerous tool!! So never use it with supervision of someone who knows how to work with it.

Let me know how things are running.
Posted Image
Proud member of ASAP since 2007

#7 j_bues05

j_bues05
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:10:00 AM

Posted 26 February 2008 - 05:56 PM

Okay, I see.

Things are running as they ought to, but then again they always were. With the little exception that AVG has stopped popping up from time to time reporting that either my cookies or some .dll were infected :thumbsup: I'm very glad that it's gone, because the pc kinda had the habit to reboot after every .dll-report.

Thanks a bunch Rosty, you've helped me a lot. And don't worry about the external HDD. I don't think anything got onto it.

Good job!

Cya




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users