Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.win32.monderc.gen / Backdoor.win32.hupigon.cdpb


  • This topic is locked This topic is locked
1 reply to this topic

#1 mK.

mK.

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:38 AM

Posted 06 July 2008 - 05:04 PM

I am not sure but i think the monderc came from a PS CS 4 download. That my friend executed in my laptop...

So heres the logs

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, July 6, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, July 06, 2008 17:57:34
Records in database: 918909
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
H:\

Scan statistics:
Files scanned: 59919
Threat name: 2
Infected objects: 18
Suspicious objects: 0
Duration of the scan: 01:10:36


File name / Threat name / Threats count
C:\WINDOWS\system32\vtUmJCvs.dll/C:\WINDOWS\system32\vtUmJCvs.dll Infected: Trojan.Win32.Monderc.gen 3
C:\Arquivos de programas\Common Files\Microsoft Shared\Speech\svchost.exe//Armadillo/C:\Arquivos de programas\Common Files\Microsoft Shared\Speech\svchost.exe//Armadillo Infected: Backdoor.Win32.Hupigon.cdpb 1
C:\WINDOWS\system32\moqnxwyo.dll/C:\WINDOWS\system32\moqnxwyo.dll Infected: Trojan.Win32.Monderc.gen 6
C:\Arquivos de programas\Common Files\Microsoft Shared\Speech\svchost.exe Infected: Backdoor.Win32.Hupigon.cdpb 1
C:\Arquivos de programas\Trend Micro\HijackThis\backups\backup-20080706-162648-857.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Arquivos de programas\Trend Micro\HijackThis\backups\backup-20080706-162727-376.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Arquivos de programas\Trend Micro\HijackThis\backups\backup-20080706-162813-433.dll Infected: Trojan.Win32.Monderc.gen 1
C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5\0HM7CTMJ\kb456456[1] Infected: Trojan.Win32.Monderc.gen 1
C:\Documents and Settings\Administrador\Configurações locais\Temporary Internet Files\Content.IE5\89YVKHUR\CA6NIZQT Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\moqnxwyo.dll Infected: Trojan.Win32.Monderc.gen 1
C:\WINDOWS\system32\vtUmJCvs.dll Infected: Trojan.Win32.Monderc.gen 1

The scan was stopped by the user.


**I only scanned C:
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


Hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:31:25, on 6/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Arquivos de programas\Apoint2K\Apoint.exe
C:\Arquivos de programas\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Arquivos de programas\Java\jre1.6.0_03\bin\jusched.exe
C:\Arquivos de programas\Apoint2K\Apntex.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Arquivos de programas\FirefoxPortable\App\firefox\firefox.exe
C:\Arquivos de programas\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =

&http://home.microsoft.com/intl/br/access/allinone.asp
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [Apoint] C:\Arquivos de programas\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Arquivos de programas\ATI Technologies\ATI Control

Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de

programas\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [a4e30a55] rundll32.exe "C:\WINDOWS\system32\moqnxwyo.dll",b
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\ARQUIV~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL

SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Download All with FlashGet - C:\Arquivos de

programas\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Arquivos de

programas\FlashGet\jc_link.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de

programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

C:\Arquivos de programas\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de

programas\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Arquivos de

programas\FlashGet\FlashGet.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O17 - HKLM\System\CCS\Services\Tcpip\..\{054C7CE1-60FE-4D1E-A0CA-4D0AD27875EA}: NameServer =

10.1.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{0E42A40D-81C9-4D1D-ABE0-685C078DD453}: NameServer =

10.1.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{054C7CE1-60FE-4D1E-A0CA-4D0AD27875EA}: NameServer =

10.1.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{054C7CE1-60FE-4D1E-A0CA-4D0AD27875EA}: NameServer =

10.1.1.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: DVD-RAM_Service - Matsubleepa Electric Industrial Co., Ltd. -

C:\WINDOWS\system32\DVDRAMSV.exe

--
End of file - 3891 bytes
----------------------------------------------------------------------------------------------------------------------------------------------------------


And here some SS's


Processes: http://img59.imageshack.us/img59/558/imagemyu5.jpg

Register: 01 - http://img92.imageshack.us/img92/8378/reg01cy8.jpg
02 - http://img410.imageshack.us/img410/2258/reg0ko8.jpg
03 - http://img368.imageshack.us/img368/6325/reg1gh8.jpg
04 - http://img133.imageshack.us/img133/2205/reg2gt3.jpg

(Thats whats happening in the register in 1 second)


By the way, which AV should i use?

Thanks.

Edited by mK., 06 July 2008 - 05:07 PM.


BC AdBot (Login to Remove)

 


m

#2 mK.

mK.
  • Topic Starter

  • Members
  • 2 posts
  • OFFLINE
  •  
  • Local time:09:38 AM

Posted 08 July 2008 - 11:33 PM

Nevermid, format :c rulez

I wanted to format my pc long time ago, took me 1 hour only to install windows and all the programs i need.

Ty anyway.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users