Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Trojan.downloader ? Adware.vundo Variant?


  • Please log in to reply
7 replies to this topic

#1 RAZOREUS

RAZOREUS

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:28 AM

Posted 03 May 2007 - 11:36 PM

I'm late posting. I was learning how to use this web. Thanks for help.
I don't know how i got this infection, just suddenly my free version of AVG antivirus started showing up messages finding trojans (or something similar). I run my free SUPERAntiSpyware and...it found a lot of ... what? Adware.Vundo Variant , Trojan.Downloader-UniBBB, Trojan.WinFixer, and other bad stuff. The program deleted and quarentined those items, but when i connect to internet appears a message RUN.DLL error and the bad stuff comes back to my system. AVG detects the trojans downloaded and heal them, but it doesn't stop the process. I have tried to clean my system in safe mode but it is useless, the matter repeats again and again. I count with:
Avg free edition
avg antispyware free
Superantispyware
hi jack this
ad-aware free
ccleaner
and others. I have used all of them without success.
Now, i don't know what to do. My knowledge on this issue is really nothing, You are my last and real resource. If you can help me I will thank you for sharing your knowledge with me. This is my hijackthis last log:

Logfile of HijackThis v1.99.1
Scan saved at 11:26:35 p.m., on 03/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\msngr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
C:\Archivos de programa\Folder Lockbox\flockbox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Webshots\WebshotsTray.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Archivos de programa\Registry Mechanic\RegMech.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Siber Systems\AI RoboForm\robotaskbaricon.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrador\Mis documentos\Programas\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O3 - Toolbar: Asistente para Internet de Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SiteAdvisor] C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [flockbox] C:\Archivos de programa\Folder Lockbox\flockbox.exe /a
O4 - HKLM\..\Run: [SDTray] C:\Archivos de programa\Spyware Doctor\SDTrayApp.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgpnfaub.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Archivos de programa\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: Webshots.lnk = C:\Archivos de programa\Webshots\WebshotsTray.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Guardar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personalizar Menú - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Rellenar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RF Barra de Herramientas - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Guardar - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Guardar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra de Herramientas - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O15 - Trusted Zone: *.correo.telecom.com.co
O15 - Trusted Zone: *.thor.movistar.com.co
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2E64EAE-294C-48EA-BCFE-198E3070FFDF}: NameServer = 200.21.200.2,200.21.200.79
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Archivos de programa\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\msngr.exe
java script:emoticon(':clapping:', 'smid_8')
:thumbsup:

BC AdBot (Login to Remove)

 


#2 jurgenv

jurgenv

  • Members
  • 1,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:09:28 AM

Posted 04 May 2007 - 05:20 PM

Please download VundoFix.exe
to your desktop.
  • Double-click VundoFix.exe to run it.
  • Click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will reboot your computer, click OK.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above
instructions starting from "Click the Scan for Vundo button." when
VundoFix appears at reboot.
Greets Jürgenv

Donation: Click me.

#3 RAZOREUS

RAZOREUS
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:28 AM

Posted 04 May 2007 - 08:24 PM

Hi, Jurgenv. Thanks for help. These are the results you asked for:

VundoFix:
VundoFix V6.3.21

Checking Java version...

Sun Java not detected
Scan started at 08:00:03 p.m. 04/05/2007

Listing files found while scanning....

C:\WINDOWS\system32\bccdd.bak1
C:\WINDOWS\system32\bccdd.bak2
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\byxxyvs.dll
C:\WINDOWS\system32\cbxwuts.dll
C:\WINDOWS\system32\ddccb.dll
C:\WINDOWS\system32\hgghheb.dll
C:\WINDOWS\system32\hyhbqxup.dll
C:\WINDOWS\system32\iifgddd.dll
C:\WINDOWS\system32\jkklkih.dll
C:\WINDOWS\system32\kuevqvui.dll
C:\WINDOWS\system32\nnnnoon.dll
C:\WINDOWS\system32\opnnnmn.dll
C:\WINDOWS\system32\puxqbhyh.ini
C:\WINDOWS\system32\qomjijg.dll
C:\WINDOWS\system32\tkotpyuw.ini
C:\WINDOWS\system32\tuvtron.dll
C:\WINDOWS\system32\wuyptokt.dll
C:\WINDOWS\system32\wvussqr.dll
C:\WINDOWS\system32\wvuvwtt.dll
C:\WINDOWS\system32\yayvwtu.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\bccdd.bak1
C:\WINDOWS\system32\bccdd.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bccdd.bak2
C:\WINDOWS\system32\bccdd.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\bccdd.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\byxxyvs.dll
C:\WINDOWS\system32\byxxyvs.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\cbxwuts.dll
C:\WINDOWS\system32\cbxwuts.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghheb.dll
C:\WINDOWS\system32\hgghheb.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hyhbqxup.dll
C:\WINDOWS\system32\hyhbqxup.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\iifgddd.dll
C:\WINDOWS\system32\iifgddd.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\jkklkih.dll
C:\WINDOWS\system32\jkklkih.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\kuevqvui.dll
C:\WINDOWS\system32\kuevqvui.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\nnnnoon.dll
C:\WINDOWS\system32\nnnnoon.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\opnnnmn.dll
C:\WINDOWS\system32\opnnnmn.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\puxqbhyh.ini
C:\WINDOWS\system32\puxqbhyh.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\tkotpyuw.ini
C:\WINDOWS\system32\tkotpyuw.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\tuvtron.dll
C:\WINDOWS\system32\tuvtron.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wuyptokt.dll
C:\WINDOWS\system32\wuyptokt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvussqr.dll
C:\WINDOWS\system32\wvussqr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wvuvwtt.dll
C:\WINDOWS\system32\wvuvwtt.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\yayvwtu.dll
C:\WINDOWS\system32\yayvwtu.dll Has been deleted!

Performing Repairs to the registry.
Done!


Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 08:08:39 p.m., on 04/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\msngr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
C:\Archivos de programa\Folder Lockbox\flockbox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Archivos de programa\Webshots\WebshotsTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrador\Mis documentos\Programas\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: (no name) - {28056A1D-DD31-4A0F-9741-C3AC6E140ABE} - C:\WINDOWS\system32\ddccb.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Archivos de programa\BitComet\tools\BitCometBHO_1.1.3.28.dll
O2 - BHO: (no name) - {8C676465-8E2E-449C-B945-044DF22D5A0C} - (no file)
O2 - BHO: (no name) - {DD6E9456-A4EF-4784-AAEE-06782272ADEF} - (no file)
O3 - Toolbar: Asistente para Internet de Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SiteAdvisor] C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [flockbox] C:\Archivos de programa\Folder Lockbox\flockbox.exe /a
O4 - HKLM\..\Run: [SDTray] C:\Archivos de programa\Spyware Doctor\SDTrayApp.exe
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgpnfaub.dll",realset
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Archivos de programa\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: Webshots.lnk = C:\Archivos de programa\Webshots\WebshotsTray.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Guardar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personalizar Menú - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Rellenar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RF Barra de Herramientas - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Guardar - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Guardar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra de Herramientas - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O15 - Trusted Zone: *.correo.telecom.com.co
O15 - Trusted Zone: *.thor.movistar.com.co
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2E64EAE-294C-48EA-BCFE-198E3070FFDF}: NameServer = 200.21.200.2,200.21.200.79
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O20 - Winlogon Notify: ddccb - C:\WINDOWS\system32\ddccb.dll (file missing)
O20 - Winlogon Notify: iifgeee - C:\WINDOWS\
O20 - Winlogon Notify: pmkji - C:\WINDOWS\
O20 - Winlogon Notify: qomjijg - qomjijg.dll (file missing)
O20 - Winlogon Notify: ssttq - C:\WINDOWS\system32\ssttq.dll (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Archivos de programa\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
O23 - Service: Windows Server Management Services (WSMSPSVC) - Unknown owner - C:\WINDOWS\msngr.exe

#4 jurgenv

jurgenv

  • Members
  • 1,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:09:28 AM

Posted 05 May 2007 - 06:01 AM

* Please open hijackthis and put a check next to the following:

O2 - BHO: (no name) - {28056A1D-DD31-4A0F-9741-C3AC6E140ABE} - C:\WINDOWS\system32\ddccb.dll (file missing)
O2 - BHO: (no name) - {8C676465-8E2E-449C-B945-044DF22D5A0C} - (no file)
O2 - BHO: (no name) - {DD6E9456-A4EF-4784-AAEE-06782272ADEF} - (no file)
O4 - HKLM\..\Run: [WindowsService] rundll32.exe "C:\WINDOWS\system32\dgpnfaub.dll",realset
O15 - Trusted Zone: *.correo.telecom.com.co
O15 - Trusted Zone: *.thor.movistar.com.co
O20 - Winlogon Notify: ddccb - C:\WINDOWS\system32\ddccb.dll (file missing)
O20 - Winlogon Notify: iifgeee - C:\WINDOWS\
O20 - Winlogon Notify: pmkji - C:\WINDOWS\
O20 - Winlogon Notify: qomjijg - qomjijg.dll (file missing)
O20 - Winlogon Notify: ssttq - C:\WINDOWS\system32\ssttq.dll (file missing)


* After you check the items you want to fix, close all browsers and windows, except for HijackThis, then click on the Fix Checked button on HijackThis.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
  • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

Greets Jürgenv

Donation: Click me.

#5 RAZOREUS

RAZOREUS
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:28 AM

Posted 05 May 2007 - 07:40 PM

java script:emoticon(':woot:', 'smid_24')
:thumbsup: Fantastic ! ... Here are the results:

SDFix:


SDFix: Version 1.83

Run by Administrador - 05/05/2007 - 19:16:29,31

Microsoft Windows XP [Versi¢n 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
WSMSPSVC

ImagePath:
"C:\WINDOWS\msngr.exe"

WSMSPSVC - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service
Restoring Missing SharedAccess Service

Rebooting...

Normal Mode:
Checking Files:

Below files will be copied to Backups folder then removed:

C:\WINDOWS\msngr.exe - Deleted
C:\WINDOWS\Temp\removalfile.bat - Deleted



Removing Temp Files

ADS Check:

Checking if ADS is attached to system32 Folder
C:\WINDOWS\system32
No streams found.

Checking if ADS is attached to svchost.exe
C:\WINDOWS\system32\svchost.exe
No streams found.



Final Check:

Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Archivos de programa\\Grisoft\\AVG7\\avginet.exe"="C:\\Archivos de programa\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Archivos de programa\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Archivos de programa\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Archivos de programa\\Grisoft\\AVG7\\avgcc.exe"="C:\\Archivos de programa\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Archivos de programa\\Grisoft\\AVG7\\avgemc.exe"="C:\\Archivos de programa\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\WINDOWS\\system32\\sessmgr.exe"="C:\\WINDOWS\\system32\\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\\Archivos de programa\\BitComet\\BitComet.exe"="C:\\Archivos de programa\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


Remaining Files:
---------------

Backups Folder: - C:\SDFix\backups\backups.zip

Checking For Files with Hidden Attributes:

C:\Archivos de programa\Picasa2\setup.exe
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp
C:\WINDOWS\system32\gjkmp.tmp
C:\WINDOWS\system32\ijkmp.tmp
C:\WINDOWS\system32\lmllm.tmp
C:\WINDOWS\system32\qttss.tmp

Finished


HiJackThis:

Logfile of HijackThis v1.99.1
Scan saved at 07:25:24 p.m., on 05/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\SiteAdvisor\6066\SAService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe
C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
C:\Archivos de programa\Folder Lockbox\flockbox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Archivos de programa\Webshots\WebshotsTray.exe
C:\Documents and Settings\Administrador\Mis documentos\Programas\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Archivos de programa\BitComet\tools\BitCometBHO_1.1.3.28.dll
O3 - Toolbar: Asistente para Internet de Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\2007\ENCWCBAR.DLL
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Archivos de programa\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARCHIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SiteAdvisor] C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.exe
O4 - HKLM\..\Run: [flockbox] C:\Archivos de programa\Folder Lockbox\flockbox.exe /a
O4 - HKLM\..\Run: [SDTray] C:\Archivos de programa\Spyware Doctor\SDTrayApp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Archivos de programa\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - Startup: Webshots.lnk = C:\Archivos de programa\Webshots\WebshotsTray.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Archivos de programa\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Guardar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O8 - Extra context menu item: Personalizar Menú - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: Rellenar Formularios - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RF Barra de Herramientas - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Rellenar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Guardar - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Guardar Formularios - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RF Barra de Herramientas - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Archivos de programa\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Barra de búsqueda de Encarta - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2E64EAE-294C-48EA-BCFE-198E3070FFDF}: NameServer = 200.21.200.2,200.21.200.79
O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Archivos de programa\SiteAdvisor\6066\SiteAdv.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Archivos de programa\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARCHIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: LEC TranslateDotNet Server - Language Engineering Corporation, LLC - C:\Archivos de programa\Power Translator\LogoMedia TranslateDotNet Server.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Archivos de programa\SiteAdvisor\6066\SAService.exe

#6 jurgenv

jurgenv

  • Members
  • 1,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:09:28 AM

Posted 06 May 2007 - 06:53 AM

* Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 onlyDouble-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

* After that, tell me how everything is working.
Greets Jürgenv

Donation: Click me.

#7 RAZOREUS

RAZOREUS
  • Topic Starter

  • Members
  • 5 posts
  • OFFLINE
  •  
  • Local time:03:28 AM

Posted 09 May 2007 - 08:11 PM

Hello. I've got a familiar problem: A child in hospital. Excuse me, I'm back.

jurgenv, My pc seems to be o.k again. No more "RUN.DLL error messages" . No more AVG trojans findings. Superantyspyware shows all clean. The good speed and performance are back to my system.
In few worlds: YOU HAVE RESTORED THE HEALTH TO MY P.C. :thumbsup:

So, thank you very much. You are my hero.

I'll be there around learning more. :flowers:

thanks.

#8 jurgenv

jurgenv

  • Members
  • 1,093 posts
  • OFFLINE
  •  
  • Gender:Male
  • Location:Belgium
  • Local time:09:28 AM

Posted 10 May 2007 - 10:21 AM

Hello. I've got a familiar problem: A child in hospital. Excuse me, I'm back.

No problem, such things are more priority. :flowers: Take care.


Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we at Bleepingcomputer are to help you, for your sake we would rather not have repeat customers. :thumbsup:

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are ZoneAlarm, Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck. :D
Greets Jürgenv

Donation: Click me.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users