Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infected W/ Virtumonde And Others....help!


  • Please log in to reply
7 replies to this topic

#1 lokaii

lokaii

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:09:56 PM

Posted 26 May 2007 - 12:53 PM

I am getting constant browser hijackings w/ popups to install antivirus software and other like popups. I need help removing. I do not know how to w/ my tools at hand. I have spybot 1.4 and ZoneAlarm Security Suite.


#########################################################
Logfile of HijackThis v1.99.1
Scan saved at 10:43, on 07-05-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Microsoft32] win32sys.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft32] win32sys.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

#############################################################

Edited by lokaii, 26 May 2007 - 12:55 PM.


BC AdBot (Login to Remove)

 


#2 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 26 May 2007 - 03:30 PM

Welcome to the BleepingComputer HijackThis Logs and Analysis forum lokaii :thumbsup:

Please download VundoFix.exe to your desktop.
Double-click VundoFix.exe to run it.
When VundoFix re-opens,click the "Scan for Vundo" button.
Once it's done scanning,click the "Remove Vundo" button.
You will receive a prompt asking if you want to remove the files, click "YES".
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed,it will prompt that it will reboot your computer,click "OK".
Please post the contents of C:\vundofix.txt into your next reply.

Note:
It is possible that VundoFix encountered a file it could not remove.
In this case,VundoFix will run on reboot,simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

******************

Please download Combofix and save to your desktop:
http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
Note:
It is important that it is saved directly to your desktop

Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the C:\ComboFix.txt into your next reply.
Note:
Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.


******************

Now go to:
C:\Program Files\HijackThis\HijackThis.exe
Right click on Hijackthis.exe and select 'Rename', rename it to abc.bat
Double click on abc.bat(which is still Hijackthis.exe),post that log into your next reply please.
Posted Image
Posted Image

#3 lokaii

lokaii
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:09:56 PM

Posted 26 May 2007 - 05:03 PM

Ok....performed Vundofix, Combofix and HijackThis as abc.bat:

Vundofix.txt:

VundoFix V6.3.18

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 10:03:15 PM 5/23/2007

Listing files found while scanning....

C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\pmnli.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ilnmp.bak1
C:\WINDOWS\system32\ilnmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ilnmp.bak2
C:\WINDOWS\system32\ilnmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ilnmp.ini
C:\WINDOWS\system32\ilnmp.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\pmnli.dll
C:\WINDOWS\system32\pmnli.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.18

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 9:25:52 PM 5/24/2007

Listing files found while scanning....


VundoFix V6.3.18

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 9:33:02 PM 5/24/2007

Listing files found while scanning....

C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\mljgg.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mljgg.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\mljgg.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.3.18

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 14:23:20 07-05-26

Listing files found while scanning....

C:\WINDOWS\system32\ilkkj.bak1
C:\WINDOWS\system32\ilkkj.bak2
C:\WINDOWS\system32\ilkkj.ini
C:\WINDOWS\system32\jkkli.dll

Beginning removal...

Attempting to delete C:\WINDOWS\system32\ilkkj.bak1
C:\WINDOWS\system32\ilkkj.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ilkkj.bak2
C:\WINDOWS\system32\ilkkj.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ilkkj.ini
C:\WINDOWS\system32\ilkkj.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\jkkli.dll
C:\WINDOWS\system32\jkkli.dll Has been deleted!

Performing Repairs to the registry.
Done!
#########################################

Combofix.txt:

"Larry Edwards" - 07-05-26 14:38:58 Service Pack 2
ComboFix 07-03-29 - Running from: "C:\Documents and Settings\Larry Edwards\Desktop"


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\jkkjg.dll
C:\WINDOWS\system32\jkkji.dll
C:\WINDOWS\system32\ssqrr.dll


((((((((((((((((((((((((((((((( Files Created from 2007-04-26 to 2007-05-26 ))))))))))))))))))))))))))))))))))


2007-05-26 10:32 0 --a------ C:\WINDOWS\nsreg.dat
2007-05-26 10:21 <DIR> d-------- C:\WINDOWS\SYSTEM32\appmgmt
2007-05-26 09:42 512 --a------ C:\ScanSectorLog.dat
2007-05-26 09:39 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\MailFrontier
2007-05-26 08:16 38,432 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox2.dat
2007-05-26 08:16 1,680,928 --ahs---- C:\WINDOWS\SYSTEM32\DRIVERS\fidbox.dat
2007-05-26 08:02 75,512 --a------ C:\WINDOWS\zllsputility.exe
2007-05-26 08:02 4,212 ---h----- C:\WINDOWS\SYSTEM32\zllictbl.dat
2007-05-26 08:02 11,264 --a------ C:\WINDOWS\SYSTEM32\SpOrder.dll
2007-05-26 08:01 1,087,216 --a------ C:\WINDOWS\SYSTEM32\zpeng24.dll
2007-05-26 08:01 <DIR> d-------- C:\WINDOWS\SYSTEM32\ZoneLabs
2007-05-26 08:00 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-05-25 21:55 50,745 --a------ C:\WINDOWS\SYSTEM32\oxxtvkmm.dll
2007-05-25 18:13 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-05-24 05:39 725,044 --ahs---- C:\WINDOWS\SYSTEM32\ssqrp.dll
2007-05-23 22:39 725,044 --ahs---- C:\WINDOWS\SYSTEM32\mljge.dll
2007-05-23 22:39 725,044 --ahs---- C:\WINDOWS\SYSTEM32\awtsq.dll
2007-05-23 22:03 <DIR> d-------- C:\VundoFix Backups
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\TQ0
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\T8
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\T6
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\T4
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\T3
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\T1QaSQ
2007-05-21 21:50 <DIR> d-------- C:\WINDOWS\SYSTEM32\pog
2007-05-21 21:50 <DIR> d-------- C:\Temp
2007-05-21 21:42 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\Microsoft Games
2007-05-21 20:44 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\My Battle for Middle-earth Files
2007-05-12 14:50 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-05-10 22:05 21,504 --a------ C:\WINDOWS\SYSTEM32\hidserv.dll
2007-05-08 23:17 <DIR> d-------- C:\Program Files\Maxtor
2007-05-08 22:41 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-06 23:40 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-05-06 23:16 <DIR> d-------- C:\Program Files\MSECache
2007-05-06 13:43 <DIR> d-------- C:\Sysprep
2007-05-06 12:28 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\Symantec
2007-05-06 12:18 499,712 --a------ C:\WINDOWS\SYSTEM32\MSVCP71.DLL
2007-05-06 12:18 348,160 --a------ C:\WINDOWS\SYSTEM32\MSVCR71.DLL
2007-05-06 12:18 1,060,864 --a------ C:\WINDOWS\SYSTEM32\MFC71.DLL
2007-05-06 12:18 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2007-05-06 12:18 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Symantec
2007-05-06 12:15 <DIR> d-------- C:\Program Files\Symantec
2007-05-06 12:04 <DIR> d-------- C:\Program Files\MagicISO
2007-05-06 12:00 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\WinRAR
2007-05-06 08:22 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\uTorrent
2007-05-06 08:21 <DIR> d-------- C:\Program Files\uTorrent
2007-05-05 09:50 <DIR> d--h----- C:\WINDOWS\SYSTEM32\GroupPolicy
2007-05-05 09:22 <DIR> d--hs---- C:\WINDOWS\CSC
2007-05-05 08:14 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\Google
2007-05-05 08:12 <DIR> d-------- C:\Program Files\Google
2007-05-05 08:12 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-05-05 03:36 <DIR> d-------- C:\WINDOWS\SYSTEM32\bits
2007-05-05 03:35 23,856 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-05-05 03:35 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-05-05 03:35 <DIR> d-------- C:\WINDOWS\SYSTEM32\PreInstall
2007-05-05 03:28 <DIR> d-------- C:\WINDOWS\SYSTEM32\vmm32
2007-05-05 03:21 8,192 --a------ C:\WINDOWS\SYSTEM32\bitsprx2.dll
2007-05-05 03:21 7,168 --a------ C:\WINDOWS\SYSTEM32\bitsprx3.dll
2007-05-05 03:21 438,784 --a------ C:\WINDOWS\SYSTEM32\xpob2res.dll
2007-05-05 03:21 351,232 --a------ C:\WINDOWS\SYSTEM32\winhttp.dll
2007-05-05 03:21 18,944 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-05-05 03:18 <DIR> d-------- C:\WINDOWS\SYSTEM32\SoftwareDistribution
2007-05-05 03:17 465,176 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-05-05 03:17 41,240 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-05-05 03:17 194,328 --a------ C:\WINDOWS\SYSTEM32\wuaueng1.dll
2007-05-05 03:17 173,536 --a------ C:\WINDOWS\SYSTEM32\wuweb.dll
2007-05-05 03:17 172,312 --a------ C:\WINDOWS\SYSTEM32\wuauclt1.exe
2007-05-05 03:17 127,256 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-05-05 03:17 <DIR> d-------- C:\WINDOWS\SoftwareDistribution
2007-05-05 03:14 198,424 --a------ C:\WINDOWS\SYSTEM32\iuengine.dll
2007-05-05 03:14 1,572,864 --ah----- C:\DOCUME~1\LARRYE~1\NTUSER.DAT
2007-05-05 03:14 <DIR> d-------- C:\WUTemp
2007-05-05 03:14 <DIR> d-------- C:\DOCUME~1\LARRYE~1\APPLIC~1\Sun
2007-05-05 03:13 262,144 --a------ C:\DOCUME~1\ALLUSE~1\NTUSER.DAT
2007-05-05 03:13 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\APPLIC~1\Sun
2007-05-05 03:09 9,600 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\hidusb.sys
2007-05-05 03:09 14,848 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kbdhid.sys
2007-05-05 03:09 12,160 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mouhid.sys
2007-05-05 01:06 178,408 --a------ C:\WINDOWS\SYSTEM32\muweb.dll
2007-05-05 01:06 127,208 --a------ C:\WINDOWS\SYSTEM32\mucltui.dll
2007-05-05 00:46 <DIR> d-------- C:\WINDOWS\network diagnostic
2007-05-04 17:09 <DIR> d-------- C:\WINDOWS\SYSTEM32\XPSViewer
2007-05-04 17:09 <DIR> d-------- C:\Program Files\Reference Assemblies
2007-05-04 17:08 14,048 --a------ C:\WINDOWS\SYSTEM32\spmsg2.dll
2007-05-04 17:08 <DIR> d-------- C:\d822a542f51de476a0
2007-05-04 17:07 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-05-04 17:06 <DIR> d-------- C:\WINDOWS\SYSTEM32\LogFiles
2007-05-04 17:06 <DIR> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\UMDF
2007-05-04 17:01 <DIR> d-------- C:\WINDOWS\SYSTEM32\URTTemp
2007-05-04 16:59 36,352 --a------ C:\WINDOWS\SYSTEM32\tsgqec.dll
2007-05-04 16:59 288,768 --a------ C:\WINDOWS\SYSTEM32\rhttpaa.dll
2007-05-04 16:59 116,736 --a------ C:\WINDOWS\SYSTEM32\aaclient.dll
2007-05-04 16:29 <DIR> d-------- C:\Program Files\MSBuild
2007-05-04 16:29 <DIR> d-------- C:\Program Files\Microsoft Works
2007-05-04 16:27 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-05-04 16:26 <DIR> dr-h----- C:\MSOCache
2007-05-04 16:26 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft Help
2007-05-04 15:51 <DIR> d-------- C:\WINDOWS\Sun
2007-05-04 15:43 <DIR> d-------- C:\WINDOWS\Prefetch
2007-05-04 15:13 221,184 --a------ C:\WINDOWS\SYSTEM32\wmpns.dll
2007-05-04 15:12 <DIR> d-------- C:\WINDOWS\provisioning
2007-05-04 15:12 <DIR> d-------- C:\WINDOWS\peernet
2007-05-04 15:10 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-05-04 15:06 <DIR> d-------- C:\WINDOWS\EHome
2007-05-04 15:04 4,569 --a------ C:\WINDOWS\SYSTEM32\secupd.dat
2007-05-04 15:04 11,776 --a------ C:\WINDOWS\SYSTEM32\spnpinst.exe
2007-05-04 14:56 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-05-04 14:55 <DIR> d--hs---- C:\DOCUME~1\LARRYE~1\UserData


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-05-26 08:32 -------- d-------- C:\Program Files\messenger
2007-05-24 21:29 -------- d-------- C:\Program Files\java
2007-05-05 03:17 -------- d--h----- C:\Program Files\windowsupdate
2007-05-04 15:12 -------- d-------- C:\Program Files\movie maker
2007-05-04 15:10 -------- d-------- C:\Program Files\windows nt
2007-04-18 09:12 2854400 --a------ C:\WINDOWS\SYSTEM32\msi.dll
2007-03-23 07:07 583504 --a------ C:\WINDOWS\SYSTEM32\xpsshhdr.dll
2007-03-23 07:07 1683280 --a------ C:\WINDOWS\SYSTEM32\xpssvcs.dll
2007-03-22 21:25 124928 --a------ C:\WINDOWS\SYSTEM32\prntvpt.dll
2007-03-17 06:43 292864 --a------ C:\WINDOWS\SYSTEM32\winsrv.dll
2007-03-08 08:36 577536 --a------ C:\WINDOWS\SYSTEM32\user32.dll
2007-03-08 08:36 40960 --a------ C:\WINDOWS\SYSTEM32\mf3216.dll
2007-03-08 08:36 281600 --a------ C:\WINDOWS\SYSTEM32\gdi32.dll
2007-03-08 06:47 1843584 --a------ C:\WINDOWS\SYSTEM32\win32k.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"Microsoft32"="win32sys.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Microsoft32"="win32sys.exe"


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5}"=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yabaxvv

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



********************************************************************

catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006
http://www.gmer.net

scanning hidden processes ...

scanning hidden services ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************

Completion time: 07-05-26 14:53:32
C:\ComboFix2.txt ... 07-05-23 22:19
####################################################

HiJackThis.log(abc.bat):


Logfile of HijackThis v1.99.1
Scan saved at 2:55:25 PM, on 5/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Larry Edwards\Desktop\abc.bat

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {0B75D1C4-ACEA-457B-8F39-750C0137FD22} - C:\WINDOWS\system32\yklsyeml.dll (file missing)
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\yabaxvv.dll (file missing)
O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\oxxtvkmm.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7CAF9D7C-FD2B-4EAE-84B5-E58D76AA70E6} - C:\WINDOWS\system32\mljgg.dll (file missing)
O2 - BHO: 0 - {9A9A8629-EC7F-4AC5-FC80-EC0C488AC36F} - C:\Program Files\Messenger\qukad.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O2 - BHO: (no name) - {C1A1A875-A8EF-4D10-8DAE-D99FED3F4D72} - C:\WINDOWS\system32\pmnli.dll (file missing)
O2 - BHO: (no name) - {E5E1AEA8-34BD-45A6-BF1B-684A11FBD264} - C:\WINDOWS\system32\jkkli.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Microsoft32] win32sys.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft32] win32sys.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: yabaxvv - yabaxvv.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

##########################################

There they are.....all three logs. What's next?

#4 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 26 May 2007 - 05:17 PM

Download Avenger from the link below:
http://swandog46.geekstogo.com/avenger.zip
Unzip/extract it to your desktop.

Start up Avenger.
Check the 'Input script manually' option.
Click the Magnifying Glass icon.
In the box that opens,copy and paste ALL the following bold blue text in the Quote box below:

Files to delete:
C:\WINDOWS\SYSTEM32\oxxtvkmm.dll
C:\WINDOWS\SYSTEM32\ssqrp.dll
C:\WINDOWS\SYSTEM32\mljge.dll
C:\WINDOWS\SYSTEM32\awtsq.dll
C:\WINDOWS\SYSTEM32\rhttpaa.dll

Then click on 'Done'.
Click the Traffic Light icon to start the program.
Then press OK at the prompts to reboot your PC.

Post the Avenger output.txt, which you can find at C:\Avenger\.txt into your next reply.
Also post a new Hijackthis log please.
Posted Image
Posted Image

#5 lokaii

lokaii
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:09:56 PM

Posted 27 May 2007 - 12:06 PM

Ok....here are the avenger and new hijackthis txt's:

#######################################
avenger.txt

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nryehaie

*******************

Script file located at: \??\C:\Program Files\uhncwfan.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\SYSTEM32\oxxtvkmm.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\ssqrp.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\mljge.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\awtsq.dll deleted successfully.
File C:\WINDOWS\SYSTEM32\rhttpaa.dll deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

##########################################

HiJackThis.log:


Logfile of HijackThis v1.99.1
Scan saved at 9:59:41 AM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Larry Edwards\Desktop\abc.bat

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {0B75D1C4-ACEA-457B-8F39-750C0137FD22} - C:\WINDOWS\system32\yklsyeml.dll (file missing)
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\yabaxvv.dll (file missing)
O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\oxxtvkmm.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7CAF9D7C-FD2B-4EAE-84B5-E58D76AA70E6} - C:\WINDOWS\system32\mljgg.dll (file missing)
O2 - BHO: 0 - {9A9A8629-EC7F-4AC5-FC80-EC0C488AC36F} - C:\Program Files\Messenger\qukad.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O2 - BHO: (no name) - {C1A1A875-A8EF-4D10-8DAE-D99FED3F4D72} - C:\WINDOWS\system32\pmnli.dll (file missing)
O2 - BHO: (no name) - {E5E1AEA8-34BD-45A6-BF1B-684A11FBD264} - C:\WINDOWS\system32\jkkli.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [Microsoft32] win32sys.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\RunServices: [Microsoft32] win32sys.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: yabaxvv - yabaxvv.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Are there any more steps? So far this seems to be working wonderfully.

#6 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 27 May 2007 - 12:20 PM

Download/install AVG Anti-Spyware 7.5.

Please follow these instructions very carefully.

Launch/start up AVG Anti-Spyware.
On the main page click the 'Update' tab,and then 'Start Update'.
Note:
If you have any problems running the update process prior to running the scan,download/install the 'Full Database' from here:
http://download.ewido.net/avgas-signatures-full-current.exe

Once the updates have been installed,do the following:
Select the 'Scanner' icon at the top of the screen, then select the 'Settings' tab.
Once in the 'Settings' screen,under 'How to act?',then under 'Set default action for detected malware to:', click on 'Recommended actions',then click on 'Quarantine'.
Under 'Reports' select 'Automatically generate report after every scan' and unselect 'Only if threats were found'.
Exit AVG Anti-Spyware,don't run the scan just yet.

You might want to print/copy the following as you need to be in Safe Mode from here on.

Reboot your computer into SAFE MODE using the F8 method.
To do this,restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options.
Use the arrow keys on your keyboard to navigate and select the option to run Windows in "Safe Mode".

Have Hijack This fix the following [If still present], by placing a check in the appropriate boxes and selecting 'Fix checked'.
Make sure all browser and all Windows Explorer windows are closed before fixing:

O2 - BHO: (no name) - {0B75D1C4-ACEA-457B-8F39-750C0137FD22} - C:\WINDOWS\system32\yklsyeml.dll (file missing)
O2 - BHO: (no name) - {3E8EC2D9-806B-4C7F-AE7F-F44AD4ABE8B5} - C:\WINDOWS\system32\yabaxvv.dll (file missing)
O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\oxxtvkmm.dll (file missing)
O2 - BHO: (no name) - {7CAF9D7C-FD2B-4EAE-84B5-E58D76AA70E6} - C:\WINDOWS\system32\mljgg.dll (file missing)
O2 - BHO: 0 - {9A9A8629-EC7F-4AC5-FC80-EC0C488AC36F} - C:\Program Files\Messenger\qukad.dll (file missing)
O2 - BHO: (no name) - {C1A1A875-A8EF-4D10-8DAE-D99FED3F4D72} - C:\WINDOWS\system32\pmnli.dll (file missing)
O2 - BHO: (no name) - {E5E1AEA8-34BD-45A6-BF1B-684A11FBD264} - C:\WINDOWS\system32\jkkli.dll (file missing)
O4 - HKLM\..\Run: [Microsoft32] win32sys.exe
O4 - HKLM\..\RunServices: [Microsoft32] win32sys.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O20 - Winlogon Notify: yabaxvv - yabaxvv.dll (file missing)


Still in Safe Mode launch AVG Anti-Spyware.
Click the 'Scanner' icon at the top.
To start the scan click on 'Complete System Scan'.
Please be patient,it takes a while for the scan to finish.

Once the scan is complete,do the following.
If AVG Anti-Spyware detected any infected objects:,click on 'Apply All Actions'.

Next click on 'Save Report'.
Copy and paste that report into your next reply.
The report can be found under the 'Reports' tab at the top.
Close AVG Anti-Spyware when you've done.
Reboot normally.

Post the AVG Anti Spyware report and a new Hijackthis log into your next reply.
Let me know how your pc is running now please.

Posted Image
Posted Image

#7 lokaii

lokaii
  • Topic Starter

  • Members
  • 12 posts
  • OFFLINE
  •  
  • Local time:09:56 PM

Posted 28 May 2007 - 12:41 AM

Ok....Ran AVGAS and HiJackThis again....

AVG report:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 10:27:14 PM 5/27/2007

+ Scan result:



C:\QooBox\Quarantine\07-05-23\Program Files\Web Buying\v1.6.8\webbuying.exe.vir -> Adware.Agent : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP38\A0009753.exe -> Adware.Agent : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP41\A0010156.dll -> Adware.BHO : Cleaned.
C:\QooBox\Quarantine\07-05-23\Program Files\Web Buying\v1.6.8\webbuying.dll.vir -> Adware.WebBuying : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP38\A0009693.exe -> Adware.WebBuying : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP38\A0009752.dll -> Adware.WebBuying : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP42\A0011128.exe -> Adware.ZQuest : Cleaned.
C:\Documents and Settings\Larry Edwards\My Documents\Downloads\Winrar 2007 Crystal Edition + Crack\Winrar3.70_Crack.exe -> Backdoor.Sdbot : Cleaned.
C:\Program Files\WinRAR\Winrar3.70_Crack.exe -> Backdoor.Sdbot : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP41\A0010155.exe -> Backdoor.Sdbot : Cleaned.
D:\Program Files\EA Games\Battle for Middle-earth\LotR BfME 1.03 NoDVD.exe -> Downloader.Harnig.bq : Cleaned.
C:\System Volume Information\_restore{CCA15F78-7193-4CA6-8115-2B570DD6546C}\RP41\A0010157.dll -> Hijacker.StartPage : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@www.abcsearch[1].txt -> TrackingCookie.Abcsearch : Cleaned.
:mozilla.36:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.37:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.38:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@3.adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@4.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@adbrite[2].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@ads.adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.18:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@ehg-maniatv.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@ehg-meevee.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.64:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.43:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@www.paypal[1].txt -> TrackingCookie.Paypal : Cleaned.
:mozilla.10:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.11:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.12:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.13:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.14:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.9:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.59:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.60:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.61:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.62:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.63:C:\Documents and Settings\Larry Edwards\Application Data\Mozilla\Firefox\Profiles\hv84e4bq.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@www.smartadserver[1].txt -> TrackingCookie.Smartadserver : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@adopt.specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@specificclick[1].txt -> TrackingCookie.Specificclick : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@anad.tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@anat.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@tacoda[2].txt -> TrackingCookie.Tacoda : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned.
C:\Documents and Settings\Larry Edwards\Cookies\larry_edwards@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned.


::Report end

####################################

New HiJackThis.log:

Logfile of HijackThis v1.99.1
Scan saved at 10:36:37 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\avsys\ScanningProcess.exe
C:\Program Files\Intel\ASF Agent\ASFAgent.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ZONELA~1\ZONEAL~1\MAILFR~1\mantispm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Larry Edwards\Desktop\abc.bat

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.5672\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ASF Agent (ASFAgent) - Intel Corporation - C:\Program Files\Intel\ASF Agent\ASFAgent.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe

Everything seems to be running fine now...Thanks.

#8 RichieUK

RichieUK

    Malware Assassin


  • Malware Response Team
  • 13,614 posts
  • OFFLINE
  •  
  • Local time:06:56 AM

Posted 28 May 2007 - 03:11 AM

AVG Anti Spyware removed Backdoor.Sdbot from your C:\System Volume Information folder which is System Restore.
I don't know how long you've had this particular trojan on your pc but you should read the following.

Backdoor.Sdbot
A Backdoor is a software program that gives an attacker unauthorized access to a machine and the means for remotely controlling the machine without the user's knowledge. A Backdoor compromises system integrity by making changes to the system that allow it to by used by the attacker for malicious purposes unknown to the user.

They are typically installed without user interaction through security exploits, and may allow an attacker to remotely control the infected machine. Such risks may allow the attacker to install additional malware and use the compromised machine to participate in denial of service attacks, spamming, and bot nets, or to transmit sensitive data to a remote server. The malware may be cloaked and not visible to the user. These risks severely compromise the system by lowering security settings, installing 'backdoors,' infecting system files, or spreading to other networked machines.

If your computer was used for online banking or has credit card information on it, all passwords should be changed immediately to include those used for email, eBay and forums.
You should consider them to be compromised.
They should be changed by using a different computer and not the infected one,if not an attacker may get the new passwords and transaction information.
Banking and credit card institutions should be notified of the possible security breech.

Since your computer was compromised read:
‘How to report ID theft, fraud, drive-by installs, hijacking and malware’:
http://www.dslreports.com/faq/10451


***************************

Your log is clean :thumbsup:
If all's ok,please do the following:

Find and delete:
VundoFix.exe
Combofix
Avenger

C:\VundoFix Backups
C:\QooBox
C:\Avenger

Click on Start/All Programs/Accessories/System Tools/System Restore.
In the 'System Restore' window,click on the 'Create a Restore Point' button,then click 'Next'.
In the window that appears,enter a description\name for the Restore Point,then click on 'Create',wait,then click 'Close'.
The date and time will be created automatically.

Next click on Start/All Programs/Accessories/System Tools/Disk Cleanup.
The 'Select Drive' box will appear,click on Ok.
The 'Disk Cleanup for [C:]' box will appear,click on the 'More Options' tab.
At the bottom in the 'System Restore' window,click on the 'Clean up...' button.
A box will pop up 'Are you sure you want to delete all but the most recent restore point?',click on 'Yes'.
Click on 'Yes' at 'Are you sure you want to perform these actions?'.
Now wait until 'Disk Cleanup' finishes and the box disappears.

Read through the information found here,to help you prevent any possible future infections.
'How to prevent Malware' by miekiemoes:
http://users.telenet.be/bluepatchy/miekiem...prevention.html
Posted Image
Posted Image




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users