Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


infected by troyan.win32.genome.hew

  • Please log in to reply
2 replies to this topic

#1 takatam


  • Members
  • 2 posts
  • Local time:03:46 PM

Posted 02 February 2009 - 06:02 PM

Hi all,

sorry that I have to post but i was not able to find enough information in other posts to remove the above mentioned troyan. here's what happened so far.

whenever my screensaver turned off because i started using my machine, i got a virus warning saying that some file was infected with a troyan. i quarantined the file every time, but i never got to the end of it. so i decided to take action. btw, i'm using avira antivirus.

after reading a few posts in this forum i tried to find the source by myself, and fix it if possible. this is how far i got.

1) i ran HJT and had a look at the log but couldn't find anything exotic. i've attached it for you reference.

2) then i ran ATF-cleaner to remove all the unneeded files from my computer. this worked, it freed up around 350MB.

3) afterwards i ran OTScanIt2.exe, downloaded using a link from another post. this produced a logfile with 650 lines. i have to admit, i did not read through all of them. so i continued. i've attached the log though.

4) next, i ran the kaspersky online virus scanner. this one found the Trojan.Win32.Genome.hew in the file C:\Program Files\Ipswitch\WS_FTP Professional\fwsced.exe

so do you have any ideas on how i could get rid of this troyan? which logs should i post? or is it just a warning based on a heuristic analysis of the program code? i doubt the later cause i've had WS_FTP installed for quite a while now and i've used it a couple of times.

any help or suggestion is much appreciated


Attached Files

BC AdBot (Login to Remove)


#2 takatam

  • Topic Starter

  • Members
  • 2 posts
  • Local time:03:46 PM

Posted 03 February 2009 - 05:16 PM

Hi all,

sorry guys, it was a bit late last night. i completely forgot to post the logs for anyone to look at. here's my dds.txt log

thanks for any help.


DDS (Ver_09-02-01.01) - NTFSx86
Run by Thomas at 23:10:47.17 on 03.02.2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1024.147 [GMT 1:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\FreePDF_XP\fpassist.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

============== Pseudo HJT Report ===============

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LogitechQuickCamRibbon] "Cc:\program files\logitech\quickcam\Quickcam.exe" /hide
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"
mRun: [C-Media Mixer] Mixer.exe /startup
mRun: [VirtualCloneDrive] "c:\program files\elaborate bytes\virtualclonedrive\VCDDaemon.exe" /s
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [FreePDF Assistant] c:\program files\freepdf_xp\fpassist.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
dRunOnce: [nltide_2] regsvr32 /s /n /i:U shell32
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueso~1.lnk - c:\program files\ivt corporation\bluesoleil\BlueSoleil.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\wpdshserviceobj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\thomas\applic~1\mozilla\firefox\profiles\gysusjci.default\
FF - component: c:\documents and settings\thomas\application data\mozilla\firefox\profiles\gysusjci.default\extensions\{463f6ca5-ee3c-4be1-b7e6-7fee11953374}\platform\winnt\components\FoxyTunes.dll
FF - component: c:\program files\real\realplayer\browserrecord\components\nprpbrowserrecordplugin.dll

============= SERVICES / DRIVERS ===============

R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2008-10-2 11840]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Planer;c:\program files\avira\antivir personaledition classic\sched.exe [2008-10-2 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2008-10-2 151297]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-10-2 52032]

=============== Created Last 30 ================

2009-02-03 20:12 0 a------- c:\windows\iPlayer.INI
2009-02-03 19:56 <DIR> --d----- c:\program files\InterActual
2009-01-31 23:57 <DIR> --d----- c:\program files\Trend Micro
2009-01-21 00:16 <DIR> --d----- c:\program files\DiskInternals
2009-01-20 22:32 <DIR> --d----- c:\documents and settings\thomas\.amokexifsorter
2009-01-20 22:32 <DIR> --d----- c:\program files\AmoK Exif Sorter
2009-01-14 21:09 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-11 16:14 <DIR> --d----- c:\windows\system32\appmgmt
2009-01-08 19:35 413,696 a------- c:\windows\system32\PICSDK.dll
2009-01-08 19:35 114,688 a------- c:\windows\system32\EpPicPrt.dll
2009-01-08 19:35 91,923 a------- c:\windows\system32\EPPICPrinterDB.dat
2009-01-08 19:35 76,956 a------- c:\windows\system32\EPPICPattern2.dat
2009-01-08 19:35 65,536 a------- c:\windows\system32\EPPicMgr.dll
2009-01-08 19:35 39,121 a------- c:\windows\system32\EPPICPattern1.dat
2009-01-08 19:35 27,965 a------- c:\windows\system32\EPPICPresetData_JP.dat
2009-01-08 19:35 15,822 a------- c:\windows\system32\EPPICLocal_JP.cfg
2009-01-08 19:35 14,482 a------- c:\windows\system32\EPPICLocal_EN.cfg
2009-01-08 19:34 <DIR> --d----- c:\program files\HOTALBUMMyBOX
2009-01-05 16:18 90,112 a------- c:\windows\system32\QuickTimeVR.qtx
2009-01-05 16:18 57,344 a------- c:\windows\system32\QuickTime.qts

==================== Find3M ====================

2009-02-03 22:33 98,294 a------- c:\windows\excal32.dat
2008-12-11 11:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-10-02 21:05 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008100220081003\index.dat

============= FINISH: 23:11:35.50 ===============

Attached Files

#3 kahdah


  • Security Colleague
  • 11,138 posts
  • Gender:Male
  • Location:Florida
  • Local time:10:46 AM

Posted 15 February 2009 - 10:21 AM

Hello takatam

Welcome to BleepingComputer :thumbup2:
If you are still in need of assistance please post a new dds log.
Please do not pm for help, post it in the forums instead.

If I am helping you and have not responded for 48 hours please send me a pm as I don't always get notifications.

My help is always free, however, if you would like to make a donation to me for the help I have provided please click here Posted Image

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users