Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

virtumonde.prx


  • This topic is locked This topic is locked
2 replies to this topic

#1 mart42

mart42

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:03:13 PM

Posted 20 December 2008 - 09:59 PM

Hi all.

Im writing this on behalf of a friend of mine whos computer has been very badly infected for quite a few month with the vundo virus. I've helped him as much as I could by getting him to use spybot, and various other apps including malwarebytes. I've done everything I could possibly think based on my own experiences and managed to lower his trojans (using malwarebytes) from around 54 to only 2. The 2 remaing trojans in the spybot results are vitumonde and virtumonde.prx. which my research lead me to believe is part of the vundo virus? (we tried vundofix which didn't pick these trojans up so Im now unsure) Anyway..these 2 files seem stubborn and almost impossible to get rid so if anyone could possibly help, it would be very much appreciated.


I hope my posting is within forum rules...time is very much against me at the moment and so I've been unable to read forum rules so apologies in advance.

Below is the hijackThis log. I;ve also included in a quote box, my own interpretation of the log file and what I think are causing him problems.



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:57:10 PM, on 12/20/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\Skype.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Image-Line\FL Studio 8\FL.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jordan\My Documents\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {16B8C0D4-5DCC-4039-970B-4C8EF1004B05} - (no file)
O2 - BHO: (no name) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {624E1F29-16A0-4541-88DF-EF49161C1A3E} - (no file)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7D6AD8B6-D3DD-482B-AE93-79A6F2009BD5} - (no file)
O2 - BHO: (no name) - {85C27F9C-CD08-4994-B5A3-597B918AE433} - (no file)
O2 - BHO: (no name) - {8F453D11-4A11-457F-B503-372714026D43} - (no file)
O2 - BHO: (no name) - {9df4456a-a1a7-4c0e-b60e-b03cd4284868} - C:\WINDOWS\system32\hasilibo.dll
O2 - BHO: {866e0a7d-653f-981b-4614-a378c3f480bb} - {bb084f3c-873a-4164-b189-f356d7a0e668} - C:\WINDOWS\system32\mlbvxk.dll
O2 - BHO: (no name) - {D525AB62-B03A-4941-A82D-6B567317B280} - (no file)
O2 - BHO: (no name) - {e0bb9e39-f51e-4a7e-a102-88c662fb1015} - (no file)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O2 - BHO: (no name) - {ED4ABEBD-3F8B-41E4-9C24-11D4CBB43E99} - (no file)
O2 - BHO: (no name) - {F0AE4806-3D7E-4FB4-9EE6-F2848CA7EFAD} - (no file)
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [begobevome] Rundll32.exe "C:\WINDOWS\system32\sawigewe.dll",s
O4 - HKLM\..\Run: [CPMcb03fcb4] Rundll32.exe "c:\windows\system32\zadasola.dll",a
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [begobevome] Rundll32.exe "C:\WINDOWS\system32\sawigewe.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [begobevome] Rundll32.exe "C:\WINDOWS\system32\sawigewe.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O16 - DPF: {F8C5C0F1-D884-43EB-A5A0-9E1C4A102FA8} (GoPetsWeb Control) - https://secure.gopetslive.com/dev/GoPetsWeb.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\System32\infosoft32.dll C:\WINDOWS\System32\infosoft32.dll C:\WINDOWS\system32\guard32.dll C:\WINDOWS\system32\cssdll32.dll vncdrh.dll mxjunj.dll auefwk.dll jzxxwt.dll ufqqsi.dll mlbvxk.dll C:\WINDOWS\system32\togitata.dll C:\WINDOWS\System32\infosoft32.dll C:\WINDOWS\System32\infosoft32.dll C:\WINDOWS\System32\infosoft32.dll C:\WINDOWS\System32\infosoft32.dll c:\windows\system32\zadasola.dll,C:\WINDOWS\System32\infosoft32.dll
O20 - Winlogon Notify: c830cf87509 - C:\WINDOWS\System32\infosoft32.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zadasola.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\zadasola.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End

EDIT: I had a check through the log myself after posting this. Im no expert but most of the stuff in a log is farily familiar to me o I've checked through myself to see if I can pick out the baddies on my own.

Ok, THESE BELOW ARE ONES I BELIEVE TO BE NASTY. There are a few I may have missed, or wasn't totally sure about
Running processes:
LIMEWIRE-(I've told him a few times to get rid of this program, and the bearshare thing.

O2 - BHO: (no name) - {16B8C0D4-5DCC-4039-970B-4C8EF1004B05} - (no file)
O2 - BHO: (no name) - {1827766B-9F49-4854-8034-F6EE26FCB1EC} - (no file)
O2 - BHO: (no name) - {624E1F29-16A0-4541-88DF-EF49161C1A3E} - (no file)
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare
O2 - BHO: {866e0a7d-653f-981b-4614-a378c3f480bb} - {bb084f3c-873a-4164-b189-f356d7a0e668} - C:\WINDOWS\system32\mlbvxk.dll
O2 - BHO: (no name) - {7D6AD8B6-D3DD-482B-AE93-79A6F2009BD5} - (no file)
O2 - BHO: (no name) - {85C27F9C-CD08-4994-B5A3-597B918AE433} - (no file)
O2 - BHO: (no name) - {8F453D11-4A11-457F-B503-372714026D43} - (no file)
O2 - BHO: (no name) - {9df4456a-a1a7-4c0e-b60e-b03cd4284868} - C:\WINDOWS\system32\hasilibo.dll
O2 - BHO: {866e0a7d-653f-981b-4614-a378c3f480bb} - {bb084f3c-873a-4164-b189-f356d7a0e668} - C:\WINDOWS\system32\mlbvxk.dll
O2 - BHO: (no name) - {D525AB62-B03A-4941-A82D-6B567317B280} - (no file)
O2 - BHO: (no name) - {e0bb9e39-f51e-4a7e-a102-88c662fb1015} - (no file)
O2 - BHO: (no name) - {E3215F20-3212-11D6-9F8B-00D0B743919D} - (no file)
O2 - BHO: (no name) - {ED4ABEBD-3F8B-41E4-9C24-11D4CBB43E99} - (no file)
O2 - BHO: (no name) - {F0AE4806-3D7E-4FB4-9EE6-F2848CA7EFAD} - (no file)
O4 - HKUS\S-1-5-19\..\Run: [begobevome] Rundll32.exe "C:\WINDOWS\system32\sawigewe.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [begobevome] Rundll32.exe "C:\WINDOWS\system32\sawigewe.dll",s (User 'NETWORK SERVICE')
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll (this one looks suspicious but worries me because removing this will lose his internet connection..I had this experience myself with spybot years ago, then one of their updates included replacement of the winsock file if my memory serves me
O20 - AppInit_DLLs:
c:\windows\system32\zadasola.dll
C:\WINDOWS\system32\togitata.dll





thanks in advance for any help offered.

Martin

Edited by mart42, 21 December 2008 - 12:37 AM.


BC AdBot (Login to Remove)

 


#2 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:13 AM

Posted 27 December 2008 - 08:46 PM

Hello Martin,

Posted Image

Sorry about the delay.:thumbsup: If you still need help, please post a new HijackThis log to make sure nothing has changed, and I'll be happy to look at it for you.

Thanks,
tea
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?

#3 teacup61

teacup61

    Bleepin' Texan!


  • Malware Response Team
  • 17,075 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Wills Point, Texas
  • Local time:10:13 AM

Posted 06 January 2009 - 07:56 PM

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic
Please make a donation so I can keep helping people just like you.
Every little bit helps! :)
You can even use your credit card! Thank you!

Posted Image


Error reading poptart in Drive A: Delete kids y/n?




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users