Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

malware/spybot won't run, IEXPLORE.exe opening at random and undeletable files.


  • This topic is locked This topic is locked
3 replies to this topic

#1 omgitswill

omgitswill

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:57 PM

Posted 19 February 2009 - 08:52 PM

Can't run any malware bytes or spybot. Most programs won't open or crash upon opening. IEXPLORE.exe is opening at random, and often when I open a new my computer window. Worth mentioning is that we have removed some spyware recently and don't appear to have gotten it all.

Here is the dds.txt:


DDS (Ver_09-02-01.01) - NTFSx86
Run by Administrator at 17:42:23.70 on 2009-02-19
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1058 [GMT -8:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\MySQL\MySQL Server 5.1\bin\mysqld.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Keys Server\sntlkeyssrvr.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
svchost.exe C:\WINDOWS\TEMP\VRT10.tmp
C:\WINDOWS\system32\userinit.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TortoiseSVN\bin\TSVNCache.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe
C:\Program Files\Apache Software Foundation\Apache2.2\bin\ApacheMonitor.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\regedit.exe
C:\Documents and Settings\Will Corwin\Desktop\blargh\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com/
uInternet Connection Wizard,ShellNext = hxxp://localhost/Will/spellbookmaker.htm
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe"
mRun: [NVMixerTray] "c:\program files\nvidia corporation\nvmixer\NVMixerTray.exe"
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\monito~1.lnk - c:\program files\apache software foundation\apache2.2\bin\ApacheMonitor.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ralink~1.lnk - c:\program files\ralink\common\RaUI.exe
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll
LSP: c:\docume~1\willco~1\locals~1\temp\ntdll64.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
Notify: AtiExtEvent - Ati2evxx.dll
Notify: __c00F3D91 - c:\windows\system32\__c00F3D91.dat
LSA: Authentication Packages = msv1_0 c:\windows\system32\wvUnMcCt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\lz8a6k8l.default\
FF - prefs.js: browser.startup.homepage - hxxp://google.com

============= SERVICES / DRIVERS ===============

R2 Apache2.2;Apache2.2;c:\program files\apache software foundation\apache2.2\bin\httpd.exe [2008-6-13 45115]
R2 SentinelKeysServer;Sentinel Keys Server;c:\program files\common files\safenet sentinel\sentinel keys server\sntlkeyssrvr.exe [2007-4-27 316992]
S1 ethuzipm;ethuzipm;c:\windows\system32\drivers\ethuzipm.sys [2009-2-19 138432]
S2 mkeswukaudch;mkeswukaudch;c:\windows\system32\drivers\ubdgh.sys [2009-2-15 30976]
S4 ccevtsvc;CcEvtSvc;c:\windows\system32\ccevtsvc.exe -k netsvcs --> c:\windows\system32\CcEvtSvc.exe -k netsvcs [?]

=============== Created Last 30 ================

2009-02-19 16:47 47,104 a------- c:\documents and settings\administrator\reader_s.exe
2009-02-19 16:47 41,473 a------- c:\windows\services.exe
2009-02-19 15:16 439 a------- c:\windows\system32\win32hlp.cnf
2009-02-19 14:58 138,432 a------- c:\windows\system32\drivers\ethuzipm.sys
2009-02-19 14:31 <DIR> --d-h--- c:\windows\system32\GroupPolicy
2009-02-19 13:45 <DIR> --d----- c:\windows\system32\inf
2009-02-19 13:44 100,590 a------- c:\windows\system32\drivers\2f911258.sys
2009-02-19 13:43 24,576 a------- c:\windows\system32\__c00F3D91.dat
2009-02-18 19:21 213,024 a------- c:\windows\system32\drivers\str.sys
2009-02-18 19:15 <DIR> --d----- C:\ComboFix
2009-02-16 19:07 2,184 a------- c:\windows\system32\wpa.dbl
2009-02-16 17:02 <DIR> --d----- C:\cmdcons
2009-02-16 17:00 179,200 a------- c:\windows\SWREG.exe
2009-02-16 17:00 115,712 a------- c:\windows\sed.exe
2009-02-16 16:54 <DIR> --d----- c:\program files\CCleaner
2009-02-16 14:18 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-02-16 14:18 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-02-15 11:34 <DIR> --d----- c:\docume~1\admini~1\applic~1\Subversion
2009-02-15 11:31 221,184 a------- c:\windows\system32\wmpns.dll
2009-02-15 11:30 30,976 a------- c:\windows\system32\drivers\ubdgh.sys
2009-02-14 11:25 <DIR> --d----- c:\program files\Gravity
2009-02-12 19:59 <DIR> --d----- c:\program files\Trend Micro
2009-01-30 14:30 <DIR> --d----- c:\program files\ProFantasy
2009-01-21 00:38 <DIR> --d----- C:\Temp

==================== Find3M ====================

2009-02-19 13:48 137,760 a------- c:\windows\system32\drivers\aec.sys
2009-02-19 13:46 182,912 a------- c:\windows\system32\drivers\ndis.sys
2009-02-19 13:44 121,856 a------- c:\windows\system32\userinit.exe
2009-02-19 00:35 410,984 a------- c:\windows\system32\deploytk.dll

============= FINISH: 17:43:08.85 ===============

Attached Files



BC AdBot (Login to Remove)

 


#2 omgitswill

omgitswill
  • Topic Starter

  • Members
  • 4 posts
  • OFFLINE
  •  
  • Local time:01:57 PM

Posted 20 February 2009 - 05:39 AM

I've weighed my pros and cons here and decided I'm simply going to reformat and reinstall. Thanks for the help

#3 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:57 PM

Posted 20 February 2009 - 06:12 AM

Hi,

I have bad news for you :thumbup2:

I see you're dealing with Virut (or variant). In that case, it's unfortunately a lost case - Game over situation and a format and reinstall is the fastest and especially the safest solution.

You may want to read this why:
Virut and other File infectors - Throwing in the Towel?

So, I suggest you to start backup all of your valuable data/documents/pictures/movies/songs/etc.. Do NOT backup any applications/installers and Do NOT backup any .exe/.scr/.htm/.html/.xml/.zip/.rar files...
This because these files may be infected as well. If you back them up and replace them afterwards, it will infect your computer again.


Read here for instructions how to format and reinstall Windows: http://web.mit.edu/ist/products/winxp/adva...all-format.html
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#4 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:08:57 PM

Posted 01 March 2009 - 12:38 PM

Since there is no feedback anymore, I assume this issue is resolved ... so, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users