Infected with some virus - cannot run any exe files

Hi ,

My PC is likely to be infected with SmitFraud Virus and is throwing some errors on the start up of the machine.

Also I am not able to run any exes like games exe, chrome.exe,

I already reinstalled couple of application so that their exe are functioning now normally but i believe there are few more exe's infected with some virus causing the functionality issue.

Please find teh DDS log.


DDS (Ver_10-03-17.01) - NTFSx86
Run by sunil at 17:32:00.45 on Sun 03/21/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_16
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.447.40 [GMT 8:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\S3trayp.exe
C:\Program Files\VIA\VIAudioi\HDADeck\HDeck.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\WINDOWS\explorer.exe
svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\sunil\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com.sg/
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = local;localhost
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.5.4723.1820\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe"
uRun: [LogitechSoftwareUpdate] "c:\program files\logitech\video\ManifestEngine.exe" boot
uRun: [LDM] c:\program files\logitech\desktop messenger\8876480\program\BackWeb-8876480.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Messenger (Yahoo!)] "c:\progra~1\yahoo!\messen~1\YahooMessenger.exe" -quiet
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [Google Update] "c:\documents and settings\sunil\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [HKCU] c:\windows\system32\shellmgmt\shell.exe
mRun: [VTTimer] VTTimer.exe
mRun: [S3Trayp] S3trayp.exe
mRun: [HDAudDeck] c:\program files\via\viaudioi\hdadeck\HDeck.exe 1
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [LVCOMSX] c:\windows\system32\LVCOMSX.EXE
mRun: [LogitechVideoRepair] c:\program files\logitech\video\ISStart.exe
mRun: [LogitechVideoTray] c:\program files\logitech\video\LogiTray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [HKLM] c:\windows\system32\shellmgmt\shell.exe
uExplorerRun: [Policies] c:\windows\system32\shellmgmt\shell.exe
mExplorerRun: [Policies] c:\windows\system32\shellmgmt\shell.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\desktop messenger\8876480\program\LDMConf.exe
IE: &Clean Traces - c:\program files\dap\privacy package\dapcleanerie.htm
IE: &Download with &DAP - c:\program files\dap\dapextie.htm
IE: Download &all with DAP - c:\program files\dap\dapextie2.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: barcap.com\sgpconnect
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} - hxxps://sgpconnect.barcap.com/workplace/webifiers/wficat.cab
DPF: {3BA494B1-D507-4C11-9BDA-D47E1A65DFCF} - hxxps://sgpra.barcap.com/Citrix/MetaFrame/default/WholeSecurity/CATScan/winxp/AXXPEE.dll
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1238324842734
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
mASetup: {1YOPCGXK-103Q-4NHO-1E37-SG06BQWQ40QY} - c:\windows\system32\shellmgmt\shell.exe

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\sunil\applic~1\mozilla\firefox\profiles\0sdi0l4n.default\
FF - component: c:\program files\dap\dapfirefox\components\DAPFireFox.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.ytff.general.dontshowhpoffer - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2009-3-29 11264]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2009-3-23 12872]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-3-23 66632]
R3 S3GIGP;S3GIGP;c:\windows\system32\drivers\S3gIGPm.sys [2009-3-29 654848]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-3-23 12872]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-2-21 135664]
S2 tbfif;Monitor Boot;c:\windows\system32\svchost.exe -k netsvcs [2004-8-4 14336]

=============== Created Last 30 ================

2010-03-21 06:58:09 0 d-----w- c:\program files\AVG
2010-03-21 06:57:58 0 d-----w- c:\docume~1\alluse~1\applic~1\avg9
2010-03-21 06:43:29 0 d--h--w- c:\windows\system32\GroupPolicy
2010-03-21 03:52:26 0 d-----w- C:\!KillBox
2010-03-21 03:21:35 0 d-----w- c:\windows\svchost.exe
2010-03-21 01:34:43 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
2010-03-21 01:34:21 3595264 -c----w- c:\windows\system32\dllcache\moviemk.exe
2010-03-20 02:50:48 34325 ----a-w- c:\docume~1\sunil\applic~1\SQLite3.dll
2010-03-20 02:40:18 98816 ----a-w- c:\windows\sed.exe
2010-03-20 02:40:18 77312 ----a-w- c:\windows\MBR.exe
2010-03-20 02:40:18 261632 ----a-w- c:\windows\PEV.exe
2010-03-20 02:40:18 161792 ----a-w- c:\windows\SWREG.exe

==================== Find3M ====================

2010-03-21 09:26:07 19380 ---ha-w- c:\docume~1\sunil\applic~1\logs.dat
2009-12-21 19:14:05 916480 ----a-w- c:\windows\system32\wininet.dll
2005-09-29 23:03:29 682061 --sh--r- c:\windows\system32\shellmgmt\shell.exe

============= FINISH: 17:32:34.26 ===============

EDIT: Since you quoted only your previous post, I am editting this out.

===========

Hello

While we understand your frustration at having to wait, please note that Bleeping Computer deals with several hundred requests for assistance such as yours on a daily basis. As a result, our backlog is quite large as are other comparable sites that help others with malware issues. Although our HJT Team members work on hundreds of requests each day, they are all volunteers who work logs when they can and are able to do so. No one is paid by Bleeping Computer for their assistance to our members.

Further, our malware removal staff is comprised of team members with various levels of skill and expertise to deal with thousands of malware variants, some more complex than others. Although we try to take DDS/HJT logs in order (starting with the oldest), it is often the skill level of the particular helper and sometimes the operating system that dictates which logs get selected first. Some infections are more complicated than others and require a higher skill level to remove. Without that skill level attempted removal could result in disastrous results. In other instances, the helper may not be familiar with the operating system that you are using, since they use another. In either case, neither of us want someone to assist you who is not familiar with your issue and attempt to fix it.

We ask that once you have posted your log and are waiting, please DO NOT "bump" your thread or make further replies until it has been responded to by a member of the Malware Response Team. The reason we ask this or do not respond to your requests is because that would remove you from the active queue that Techs and Staff have access to. The malware staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response, there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

That is why I have made an edit to your last post, instead of a reply. Please do not multiple post here, as that only pushes you further down the queue and causes confusion to the staff.

Please be patient. It may take several days, up to more than a week, perhaps less, to get a response but your log will be reviewed and answered as soon as possible. I advise checking your topic once a day for responses as the e-mail notification system is unreliable.

Thank you for understanding.

Elise - forum moderator

Edited by elise025, 23 March 2010 - 07:45 AM.

Hi carryoutsphere!!..

Are you getting help elsewhere or ran ComboFix on your own??..

Please note: ComboFix is an extremely powerful tool which should only be used when instructed to do so by someone who has been properly trained. ComboFix is intended by its creator to be "used under the guidance and supervision of an expert." It is NOT for private use. Please read Combofix's Disclaimer.

Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


Since you have already run ComboFix, please post contents of c:\ComboFix.txt ...
Then delete your current copy of ComboFix (delete a file from a Desktop) and download a new one from one of the links below:

Link 1
Link 2

Run the tool as instructed in the guide, post the logfile: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Hi

Thanks for your help and looking forward to work with you to resolve this issue.

You are right, i did run combofix on my own after reading it somewhere. Attached is the log file.

Hi

I have rerun the combofix after your advice and pls find the new attached log for same.

Thanks.

Hi again carryoutsphere!!.. .

Do you update your Windows regularly??.. I ask because one of the infections residing on your computer is Conficker - it exploits one old vulnerability in Windows...

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open Notepad and copy/paste the text in the codebox below into it:



Save this as CFScript.txt





Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

• Ensure you are connected to the internet and click OK on the message box.

Then,
Please go to http://www.virustotal.com/ , click on Browse, and upload the following file for analysis:

c:\windows\svchost.exe

Then click Send File. Allow the file to be uploaded and scanned. Then, please post a link to the results page for me to see.


Finally,
Please scan your computer with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the icon on your desktop.
4. Check
5. Click the button.
6. Accept any security warnings from your browser.
7. Check
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
11. Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the button.
13. Push

Hi

Attach is the Combofix log file.

Please note that c:\windows\svchost.exe is a folder created by me. Its not a file. so i am unable to scan that file and hence the report is not available.

Thanks

Hi

Please find the ESET Scan Log file attached.

Hi again carryoutsphere and thanks for a logfile!!.. .

Your logfile looks clean... Does any problem persist??..

I've scripted some malware files for an upload (this is to help us make our programs better)... As far as I can see, one of the files has been zipped, however, a zipped file has not been uploaded yet...
Could you double-click this file: C:\CF-Submit.htm and follow the instructions there to upload that zipped file??.. Thanks in advance...


You're right... My mistake here... ;)..

Edit: please see my post #10 before performing the steps below...

You may delete this folder, it should be empty: c:\windows\system32\ShellMgmt

I've asked for an ESET OnlineScan... Post the logfile please once it finishes...

After running an online scan, please do the following:
- it seems you have no antivirus software installed at this moment... Please install an antivirus program of your choice, you may choose one of the programs I recommend on my site: link
Let me know if you have any problem installing an AV...

Please note that you run Spybot's TeaTimer and SuperAntiSpyware on startup... I recommend disabling them if your new antivirus program provides an antispyware protection... Link: disable protection programs

- your logfile shows that you do not use any firewall... I highly recommend you either enable Windows Firewall or install a firewall software of your choice (see my page: link)...

- We need to update outdated programs, so that you do not get reinfected:

Go to Start > Control Panel double-click on Add or Remove Programs and uninstall the following:
Java™ 6 Update 16
Adobe Reader 8.1.4


Get the newest version of Adobe Acrobat Reader here: http://www.adobe.com/products/acrobat/readstep2.html

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6.
• Scroll down to where it says "JDK 6 Update 18 (JDK or JRE)".
• Click the "Download JRE" button to the right.
• In the Window that opens, select Windows, your Language, check the "agree" box and click Continue.
• Click on the link to download Windows Offline Installation and save to your Desktop.
• Close any programs you may have running - especially your web browser.
• Then from your desktop double-click on jre-6u18-windows-i586.exe that you downloaded to install the newest version.

From Firefox' window --> Help --> Check for updates... Update it to the latest version: 3.6.2

To make sure you have the latest version of Adobe Flash Player installed:
1. To uninstall an older version, download this file to your Desktop: uninstall_flash_player.exe
2. Quit ALL running applications, including all Internet Explorer or other browser windows, and messenger applications (like AOL Instant Messenger, Yahoo Messenger, MSN Messenger.
3. Double-click on the file you've downloaded to uninstall Flash.
4. If uninstalled successfully, go to this site: Install Adobe Flash Player, and choose Agree and install now. This will install the newest version of Flash for your browser (note: Flash plugins for IE and Firefox must be installed separately).
Note: I recommend you uncheck an optional install (Free McAfee Security Scan or Free Google Toolbar).

- go to Microsoft Update service and install all critical updates for your system...

Let me know if you performed all the steps above (it's important) and if any problem persists...

Edited by snemelk, 26 March 2010 - 10:28 AM.

aahh, haven't seen Eset's online scan results before posting the above post...

Ok... Jeefo.A virus is a file infector... I'm not sure if Eset cleaned it by deleting or repairing files... Probably the latter, however, if it deleted those files, most of your applications will have to be reinstalled...

I think that before performing my instructions from a post above, you can install an antivirus program of your choice and perform a full system scan with it... Post the scan logfile, if possible... If it keeps finding those files infected, we'll perform a system scan from outside of the system...

Let me know how it goes...

Hi

Thanks for your help. I have installed AVAST Antivirus and have completed the full scan on my PC. It was having 21 files infected which i have moved to Chest protection.
Was not able to copy the log file so could not post it.

As per your advice i have uninstall few old programs and going to reinstall. So far no issues seen on my PC. I will keep my system under watch state for next couple of days and let you know if there are any issues.

Thank you very much for your help so far. Appreciate it!. .

Regards

Hi again carryoutsphere !!.. .


Did you perform that step?.. I do not see this file being uploaded...
If you haven't already done this, double-click c:\CF-Submit.htm and follow the instructions to upload a file... Alternatively, if there is a problem with it, please manually upload a file of this type (with a similar name): C:\Qoobox\Quarantine\[4]-Submit_2010-03-26_23.44.45.zip to this site: Submit Malware Sample

Afterwards,
The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /Uninstall


Please check my site - snemelk.hekko.pl. There, you'll find a few steps to make your web browsing safer. :thumbup:

Also, I recommend you to read Tony Klein's excellent article: How did I get infected?, With steps so it does not happen again!



As far as I know, that Jeefo.A virus is quite an old infection... Moreover, I did not see it really being active... That's a good information... If you only keep your programs updated (and your system patched) everything should be fine...


You're welcome!.. .

Glad we could help.

If you need this topic reopened, just send me a PM (Send message from my profile) with the address of the thread. This applies only to the original topic starter. Everyone else please begin a New Topic.