Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected With Virtumonde


  • This topic is locked This topic is locked
1 reply to this topic

#1 carlotb

carlotb

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:12:01 PM

Posted 01 August 2008 - 01:34 AM

Closed. After more problems surfaced I gave up and reinstalled the computer. Thanks anyway.


Microsofts onecare online scanner reports 5 problems, but cannot repair them. below is my report

Deckard's System Scanner v20071014.68
Run by cterburg on 2008-08-01 08:24:49
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
6: 2008-08-01 05:46:25 UTC - RP89 - Windows Update
5: 2008-07-31 19:56:51 UTC - RP88 - Installed AVG 8.0
4: 2008-07-31 19:56:20 UTC - RP87 - Removed AVG 8.0
3: 2008-07-31 19:54:26 UTC - RP86 - Removed AVG 8.0
2: 2008-07-31 16:06:06 UTC - RP85 - Cleaned registry with Windows Live OneCare safety scanner


-- First Restore Point --
1: 2008-07-31 14:41:49 UTC - RP84 - Last known good configuration


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-08-01 08:26:45
Platform: Windows Vista Service Pack 1 (6.00.6001)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\System32\taskeng.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Windows\System32\dwm.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\ApntEx.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\explorer.exe
C:\Users\cterburg\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CHNL81IA\dss[1].exe
C:\Windows\System32\taskmgr.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...o&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...o&pf=laptop
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 8\SnagItBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {CC6589C5-5E61-4FEA-8EFA-8B7F7D1CA926} - C:\Windows\System32\yATLCtrQ.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 8\SnagItIEAddin.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [BM40504ebc] Rundll32.exe "C:\Windows\system32\maqwduuy.dll",s
O4 - HKLM\..\Run: [43637d20] rundll32.exe "C:\Windows\system32\ggaijbwk.dll",b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) - http://cdn.scan.onecare.live.com/resource/...s/wlscctrl2.cab
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\microsoft shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\microsoft shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\System32\drivers\XAudio.exe


--
End of file - 5805 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 HP Health Check Service - "c:\program files\hewlett-packard\hp health check\hphc_service.exe" <Not Verified; Hewlett-Packard; HP Health Check Service>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-07-31 16:43:21 424 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{B4FB9A67-2270-4915-88EE-534B0FD8F381}.job


-- Files created between 2008-07-01 and 2008-08-01 -----------------------------

2008-08-01 08:19:02 83456 --a------ C:\Windows\system32\ggaijbwk.dll
2008-08-01 07:47:32 0 d-------- C:\Windows\SQLTools9_KB934458_ENU
2008-07-31 22:04:24 0 d-------- C:\VundoFix Backups
2008-07-31 21:56:59 0 d-------- C:\Users\All Users\Avg8
2008-07-31 21:55:07 91648 --a------ C:\Windows\system32\maqwduuy.dll
2008-07-31 21:52:56 0 d-------- C:\Program Files\Common Files\PX Storage Engine
2008-07-31 21:52:49 0 d------c- C:\Windows\system32\DRVSTORE
2008-07-31 21:52:30 83456 -----n--- C:\Windows\system32\qoadfjlb.dll
2008-07-31 21:52:18 91648 --a------ C:\Windows\system32\krxoscct.dll
2008-07-31 21:44:36 0 d-------- C:\Program Files\Microsoft Windows OneCare Live
2008-07-31 21:37:02 0 d-------- C:\Program Files\Enigma Software Group
2008-07-31 16:40:20 26112 --a------ C:\Windows\system32\iifddbcB.dll
2008-07-31 14:24:44 0 d-------- C:\Program Files\Windows Live Safety Center
2008-07-31 13:05:49 0 d-a------ C:\Users\All Users\TEMP
2008-07-31 13:04:49 0 d-------- C:\Users\All Users\Spybot - Search & Destroy
2008-07-31 13:02:18 0 d-------- C:\Users\All Users\Prevx
2008-07-31 09:45:14 0 d-------- C:\Users\All Users\vsosdk
2008-07-30 11:57:23 0 d-------- C:\Program Files\ahead
2008-07-30 10:18:55 247178 --ahs---- C:\Windows\system32\QrtCLTAy.ini2
2008-07-30 10:18:49 314880 --a------ C:\Windows\system32\yATLCtrQ.dll
2008-07-30 10:13:46 26112 --a------ C:\Windows\system32\mljhihhf.dll
2008-07-28 14:16:03 0 d-------- C:\Carlo
2008-07-24 14:59:25 0 d-------- C:\Users\cterburg\Desktop
2008-07-14 13:45:09 0 d-------- C:\Program Files\Microsoft Silverlight
2008-07-02 14:14:03 0 d-------- C:\Program Files\Winamp


-- Find3M Report ---------------------------------------------------------------

2008-08-01 07:49:17 0 d-------- C:\Program Files\Microsoft SQL Server
2008-07-31 21:52:56 0 d-------- C:\Program Files\Common Files
2008-07-31 16:38:44 0 d-------- C:\Users\cterburg\AppData\Roaming\Winamp
2008-07-31 16:38:44 0 d-------- C:\Users\cterburg\AppData\Roaming\uTorrent
2008-07-31 14:44:13 0 d-------- C:\Users\cterburg\AppData\Roaming\Lavasoft
2008-07-31 11:43:57 0 d-------- C:\Program Files\CyberLink
2008-07-31 11:43:52 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-31 11:28:49 0 d-------- C:\Users\cterburg\AppData\Roaming\Vso
2008-07-31 11:28:48 668 --a------ C:\Users\cterburg\AppData\Roaming\vso_ts_preview.xml
2008-07-31 08:56:27 74 --a------ C:\Users\cterburg\AppData\Roaming\pcouffin.log
2008-07-30 12:52:10 0 d-------- C:\Program Files\HP
2008-07-24 15:17:43 0 d-------- C:\Users\cterburg\AppData\Roaming\Map Maker
2008-07-11 11:54:03 0 d-------- C:\Program Files\Windows Mail
2008-07-11 10:29:42 0 d-------- C:\Program Files\FindAndReplace
2008-06-13 15:31:49 0 d-------- C:\Program Files\Microsoft Visual Studio 8
2008-06-13 14:53:35 0 d-------- C:\Program Files\Microsoft.NET
2008-06-13 14:50:56 0 d-------- C:\Program Files\SQLXML 4.0
2008-06-13 14:50:32 0 d-------- C:\Program Files\Microsoft Analysis Services
2008-06-13 14:05:04 0 d-------- C:\Users\cterburg\AppData\Roaming\Media Player Classic
2008-06-13 14:04:02 0 d-------- C:\Program Files\K-Lite Codec Pack
2008-06-06 15:42:23 0 d-------- C:\Program Files\uTorrent
2008-06-06 11:32:06 0 d-------- C:\Users\cterburg\AppData\Roaming\CDBurnerXP_Soft
2008-06-06 10:56:38 0 d-------- C:\Program Files\Hewlett-Packard
2008-05-28 09:17:44 174 --ahs---- C:\Program Files\desktop.ini
2008-05-27 14:16:27 0 -rahs---- C:\MSDOS.SYS
2008-05-27 14:16:27 0 -rahs---- C:\IO.SYS
2008-05-24 15:56:32 81 --a------ C:\Windows\system32\LOG


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC6589C5-5E61-4FEA-8EFA-8B7F7D1CA926}]
07/30/2008 10:18 AM 314880 --a------ C:\Windows\system32\yATLCtrQ.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [10/25/2007 04:44 AM]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [10/03/2007 04:44 PM]
"UCam_Menu"="C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [09/13/2007 05:32 PM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 09:38 AM]
"hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [10/03/2007 04:15 PM]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [06/25/2008 06:48 AM]
"BM40504ebc"="C:\Windows\system32\maqwduuy.dll" [07/31/2008 09:55 PM]
"43637d20"="C:\Windows\system32\ggaijbwk.dll" [08/01/2008 08:19 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"EnableLUA"=0 (0x0)
"EnableUIADesktopToggle"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{97F614AE-3B91-4A21-B0FD-CC459DD4237F}"= C:\Windows\system32\iifddbcB.dll [07/30/2008 10:13 AM 26112]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\Windows\system32\yATLCtrQ

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
C:\Windows\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]

[ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
C:\Windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSServer]
rundll32.exe C:\Windows\system32\iifddbcB.dll,#1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
C:\Windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
"C:\Program Files\HP\QuickPlay\QPService.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
"C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-08-01 08:28:26 ------------

Edited by carlotb, 01 August 2008 - 04:47 AM.


BC AdBot (Login to Remove)

 


#2 SifuMike

SifuMike

    malware expert


  • Members
  • 15,385 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Vancouver (not BC) WA (Not DC) USA
  • Local time:03:01 AM

Posted 01 August 2008 - 09:22 PM

Closed. After more problems surfaced I gave up and reinstalled the computer. Thanks anyway.



Since you have fixed this yourself I am closing this thread.

Edited by SifuMike, 01 August 2008 - 09:24 PM.

If I've saved you time & money,
please make a donation so I can keep helping people just like you! You can donate using a credit card and PayPal. Thank you!



Posted Image

Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users