Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Still infected with Windows Police Pro?


  • This topic is locked This topic is locked
3 replies to this topic

#1 phoeneous

phoeneous

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:06 AM

Posted 20 October 2009 - 12:05 PM

One of our users here at work has become infected with Windows Police Pro. I followed the removal guide found here but Im afraid the pc is still infected. It has several registry entries in HKLM\Software\Microsoft\Windows\CurrentVersion\Run that keep recreating themselves. Her hosts file keeps remodifying herself and her browser results are hijacked and redirected. I have followed the instructions from the prep thread, please see below for the DDS.txt file. The Attach.txt and Ark.txt files are attached. Thank you, all help is appreciated.



DDS (Ver_09-10-13.01) - NTFSx86
Run by Administrator at 9:36:21.90 on Tue 10/20/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2022.1549 [GMT -7:00]

AV: Trend Micro Client-Server Security Agent AntiVirus *On-access scanning enabled* (Updated) {D543A068-362F-4712-8B13-6E9EF1666209}
FW: Trend Micro Client-Server Security Agent Firewall *disabled* {D543A068-362F-4712-8B13-6E9EF1666209}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\Program Files\Trend Micro\Client Server Security Agent\OfcPfwSvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Spyware Tools\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://maxsun.biz/in.cgi?9&key=zucchini+calories
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: c:\windows\system32\pfhjpgum.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\pfhjpgum.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [OfficeScanNT Monitor] "c:\program files\trend micro\client server security agent\pccntmon.exe" -HideWindow
mRun: [Ryaresiqa] rundll32.exe "c:\windows\omazoheceweweciq.dll",Startup
mRun: [dimumuhoj] Rundll32.exe "c:\windows\system32\wuwobamu.dll",a
mPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
dPolicies-explorer: NoSetActiveDesktop = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\windows\system32\lsp.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1231190402703
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} - hxxp://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
TCP: {A9534ADA-B745-4165-93E8-05202A163458} = 172.18.80.1
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: c:\windows\system32\zebeduwi.dll c:\windows\system32\hupabubi.dll c:\windows\system32\wuwobamu.dll,bupayeta.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: gujuvelit - {4f466a33-aae3-4e2b-a8e1-c94667fd7b6e} - c:\windows\system32\zebeduwi.dll
SSODL: nupovimoz - {6989fc38-241b-4b6f-9af0-9cd20ca600f1} - c:\windows\system32\hupabubi.dll
SSODL: fojesuvud - {43827b1a-f712-48f8-81c3-eeffdb903bf4} - c:\windows\system32\wuwobamu.dll
STS: c:\windows\system32\pfhjpgum.dll: {a2234b15-23f2-42ad-f4e4-00aac39c0004} - c:\windows\system32\pfhjpgum.dll
STS: kupuhivus: {4f466a33-aae3-4e2b-a8e1-c94667fd7b6e} - c:\windows\system32\zebeduwi.dll
STS: kupuhivus: {6989fc38-241b-4b6f-9af0-9cd20ca600f1} - c:\windows\system32\hupabubi.dll
STS: jugezatag: {43827b1a-f712-48f8-81c3-eeffdb903bf4} - c:\windows\system32\wuwobamu.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
LSA: Notification Packages = scecli tcoift.dll wewirase.dll

============= SERVICES / DRIVERS ===============

R2 BtwSrv;BtwSrv;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]
R2 TmFilter;Trend Micro Filter;c:\program files\trend micro\client server security agent\tmxpflt.sys [2007-11-15 225296]
R2 TmPreFilter;Trend Micro PreFilter;c:\program files\trend micro\client server security agent\tmpreflt.sys [2007-11-15 36368]
S2 fastnetsrv;fastnetsrv Service;c:\windows\system32\FastNetSrv.exe [2004-8-4 94720]
S2 WDefend;WDefend;c:\windows\svohost.exe --> c:\windows\svohost.exe [?]
S3 isapeep;isapeep;c:\windows\system32\isapeep.sys [2004-8-4 2304]

=============== Created Last 30 ================

2009-10-20 08:58 1,614 a------- c:\windows\system32\tmp.reg
2009-10-20 08:57 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-20 08:57 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-10-20 08:57 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-10-20 08:56 26,368 ac------ c:\windows\system32\dllcache\usbstor.sys
2009-10-19 16:14 222 a------- c:\windows\wininit.ini
2009-10-19 15:00 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2009-10-19 15:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-10-19 14:57 <DIR> --d----- c:\docume~1\admini~1.gjl\applic~1\Malwarebytes
2009-10-19 14:57 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-10-19 14:43 0 a------- c:\windows\system32\41.exe
2009-10-19 14:40 <DIR> --d----- c:\documents and settings\Administrator.GJL-LILY
2009-10-19 14:35 120 a------- c:\windows\Rzamacaxozabo.dat
2009-10-19 14:35 0 a------- c:\windows\Bnexasulebo.bin
2009-10-19 14:35 <DIR> --d----- c:\windows\system32\schtml
2009-10-19 14:34 178,432 a------- c:\windows\system32\lsp.dll
2009-10-19 14:32 58 a------- c:\windows\wp4.dat
2009-10-19 14:32 2 a------- c:\windows\wp3.dat
2009-10-19 14:32 <DIR> --d----- c:\program files\efimud
2009-10-19 14:32 34 a------- c:\windows\system32\wwp.htm
2009-10-19 14:31 25,600 a--sh--- c:\windows\system32\calc.dll
2009-10-19 14:31 52,736 a------- C:\ldvx.exe
2009-10-19 14:31 248,320 a------- C:\dtacmawh.exe
2009-10-19 14:31 7,680 a------- C:\jyacth.exe
2009-10-19 14:31 50,688 a------- C:\buxuhto.exe
2009-10-19 14:31 27,648 a------- C:\vyiy.exe
2009-10-15 15:39 10,059 a------- C:\pwrtool.old
2009-09-24 09:44 4,408 a------- c:\windows\cfgrt.ini
2009-09-24 09:44 3,582 a------- c:\windows\cfgspyrt.ini

==================== Find3M ====================

2009-08-06 19:23 274,288 a------- c:\windows\system32\mucltui.dll
2009-08-06 19:23 215,920 a------- c:\windows\system32\muweb.dll
2009-08-05 02:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-20 02:42 53,760 a--sh--- c:\windows\system32\bupayeta.dll
2009-07-20 02:41 1,011,210 a--sh--- c:\windows\system32\fayawidu.exe
2009-07-20 02:41 53,760 a--sh--- c:\windows\system32\jivitezo.dll
2009-07-19 16:40 1,011,359 a--sh--- c:\windows\system32\lewadiye.exe
2009-07-19 14:41 1,011,607 a--sh--- c:\windows\system32\lomugiti.exe
2009-07-20 02:42 53,760 a--sh--- c:\windows\system32\lopegefa.dll
2009-07-20 02:41 39,424 a--sh--- c:\windows\system32\niyiweho.dll
2009-07-19 16:40 39,424 a--sh--- c:\windows\system32\pepimude.dll
2009-07-19 14:41 27,648 a--sh--- c:\windows\system32\wawunego.exe
2009-07-20 02:42 53,760 a--sh--- c:\windows\system32\wewirase.dll
2009-07-20 02:41 91,136 a--sh--- c:\windows\system32\wuwobamu.dll
2009-07-19 14:41 39,424 a--sh--- c:\windows\system32\yupabeda.dll
2009-01-05 14:18 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009010520090106\index.dat

============= FINISH: 9:37:01.36 ===============

Attached Files


Edited by phoeneous, 20 October 2009 - 12:09 PM.


BC AdBot (Login to Remove)

 


#2 phoeneous

phoeneous
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:06 AM

Posted 21 October 2009 - 01:04 PM

Bump?

Hello phoeneous,

While we understand your frustration at having to wait, please note that Bleeping Computer deals with several hundred requests for assistance such as yours on a daily basis. As a result, our backlog is quite large, as are other comparable sites that help others with malware issues. Athough our HJT Team members work on hundreds of requests each day, they are all volunteers who work logs when they can and are able to do so. No one is paid by Bleeping Computer for their assistance to our members.

Further, our malware removal staff is comprised of team members with various levels of skill and expertise to deal with thousands of malware variants, some more complex than others. Although we try to take DDS/HJT logs in order (starting with the oldest), it is often the skill level of the particular helper and sometimes the operating system that dictates which logs get selected first. Some infections are more complicated than others and require a higher skill level to remove. Without that skill level attempted removal could result in disastrous results. In other instances, the helper may not be familiar with the operating system that you are using, since they use another. In either case, you wouldn't want someone to assist you who is not familiar with your issue and attempt to fix it, would you?

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the HJT Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible.

Thank you for understanding.

Regards,

The weatherman
(Moderator)

Edited by The weatherman, 21 October 2009 - 05:17 PM.


#3 phoeneous

phoeneous
  • Topic Starter

  • Members
  • 7 posts
  • OFFLINE
  •  
  • Local time:01:06 AM

Posted 29 October 2009 - 11:49 AM

Please close this thread. I was able to fix the issue on my own. Thank you.

#4 schrauber

schrauber

    Mr.Mechanic


  • Malware Response Team
  • 24,794 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Munich,Germany
  • Local time:09:06 AM

Posted 30 October 2009 - 04:35 PM

Since this issue appears to be resolved ... this Topic has been closed.
If your the topic starter, and need this topic reopened, please contact me via pm with the address of the thread.

Everyone else please begin a New Topic.
regards,
schrauber

Posted Image
Posted Image

If I've not posted back within 48 hrs., feel free to send a PM with your topic link. Thank you!

If I have helped you then please consider donating to continue the fight against malware Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users