Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

What Was This? Got Rid Of It, But...


  • This topic is locked This topic is locked
2 replies to this topic

#1 wyrd_chao

wyrd_chao

  • Members
  • 3 posts
  • OFFLINE
  •  
  • Local time:08:09 AM

Posted 19 June 2007 - 09:19 PM

Not sure I need help now, but.. Anyone with similar symptoms? This may help...


A customer's computer came into the shop, said it had a virus, or something; oh boy.

Note: This PC XP Home SP2, NAV 2006, fully updated. This is a PC heavily used for on-line games; LimeWire and Steam also seem to have been installed at one time..

----

Booted to safe mode. Ran 'msconfig' and removed a bunch of suspicious and/or unnecessary stuff. Ran CleanUp!, deleted about 500MB of crap. Loaded and ran RogueRemover, which found a program called 'Ultimate Fixer 2007' (but nothing else). Hmmm.

Loaded Spybot S&D, plugged into the internet for a bit and updated it, and then ran the scan. It found:

Virtumonde
Freeze
FakeMSN8Beta (ah hah!)
MovieLand

One of these (according to the info) is infamous for subverting the WindowsUpdate system, and another specialized in turning off and/or disabling anti-virus/anti-spyware programs. Hmmm.

SS&D also indicated that the 'hosts' file (c:\windows\system32\drivers\etc\hosts) had been modified. Ah ha hah.

I let SS&D do its fixes. Went to the 'hosts' file, changed it from 'read-only', and removed a whole list of bogus entries such as follows:

1.1.1.1 www.avast.com
1.1.1.1 hijackthis.com
1.1.1.1 javacoolsoftware.com
1.1.1.1 safer-networking.org


and etc. Obviously meant to keep you from going anywhere to download security software.

Installed avast! Home, updated it, scheduled a boot-time scan, restarted.

Avast! found the following:

c:\bmgenkji1.exe
c:\windows\system32\bmgenkji1.exe
c:\bmgenkji2.exe
c:\bmgenkji3.exe
c:\windows\system32\8dyBxB6M.dll
c:\windows\system32\aqdzcgivb\csrss.exe~

These were infected with trojans:

Win32:Delf-DOM
Win32:VB-KP
Win32:Adware-gen (a generic result from avast! concerning adware bots)

So it looked like the work might be finished?

NOW it gets interesting..

Booted back to safe mode again.

Tried installing SpywareBlaster; If I was REALLY fast on the mouse I could get as far as answering 'I have read...' on the EULA before the install program shut down. At this point I was getting a little pissed.

Turned System Restore off. Booted to safe mode again. Still couldn't install SpywareBlaster.

Tried installing HijackThis. Same exact problem. Rrghhh. Bleep.
Downloaded a new version of HJT. Renamed it, very sneakily installed it. No dice, still wouldn't run. Arrghgh!

Came here, poked around in the Forums, found someone with a similar problem, which I recommend:

Start up Task Manager, Go to the Process tab, highlight explorer.exe and hit 'End Process'. Boom, the desktop disappears. Go to 'File/New Task' and browse for HijackThis.exe (wherever you installed it) and let 'er rip.

My full HijackThis log is attached at the end, but here are the relavant lines, I think.
----

O2 - BHO: (no name) - {53B5F2B1-94DD-43E5-8187-EB4E31F00701} - C:\WINDOWS\system32\8dvByB6M.dll (file missing)

O20 - Winlogon Notify: iffnxalcqqag - C:\WINDOWS\system32\iffnxalcqqag.dll
O20 - Winlogon Notify: ilgsbhklsasr - C:\WINDOWS\system32\ilgsbhklsasr.dll (has hidden and system attributes on)

---

Hah hah! Still in Task Manager, back to File/New Task. Installed SpywareBlaster no problem w/o 'explorer' running. Went to command line, changed directories to c:\windows\system32, poked around a little.

Couldn't remove the two above *.dll's; were still being 'used by the system'. Found and removed the following:

../bmgenkji/(lots of stuff)
../aqdzcgivb/csrss.ini
../tmp421af.exe
../nqdoxyve.exe

I tried doing a 'regsvr32 /u' on the above .dll's, but no dice, and about 5 seconds after I tried, the PC would spontaneously shut down. This happened three times under identical conditions so, whatever service was using it was still somewhat active.

Booted to the XP Home Edition install disk, choose System Recover, logged back to c:\windows\system32. After deleting both the .dll's (NOTE: ilgsbhklsasr.dll has hidden and system attributes on), restarted and ran all the scans again. Avast! needed to be repaired, since whatever was running damaged it so that the various 'shields' couldn't start. Spybot S&D's immunization list also needed to be redone for some reason.

Everything seems clean, but...

Any ideas about what this (these?) was/were? Am I done yet?

-- Wyrdchao

-------------------- HijackThis log for (customer) ----------
Logfile of HijackThis v1.99.1
Scan saved at 3:23:06 PM, on 6/19/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53B5F2B1-94DD-43E5-8187-EB4E31F00701} - C:\WINDOWS\system32\8dvByB6M.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SMSTray] C:\Program Files\Samsung\Samsung Media Studio 5\SMSTray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab55579.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: iffnxalcqqag - C:\WINDOWS\system32\iffnxalcqqag.dll
O20 - Winlogon Notify: ilgsbhklsasr - C:\WINDOWS\system32\ilgsbhklsasr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: XEXUKRU - Sysinternals - www.sysinternals.com - C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\XEXUKRU.exe
-----

"Men talk of killing time, while time slowly kills them."
- Dion Boucicault

Pat Struthers
patstr@uci.net
Heppner, OR

BC AdBot (Login to Remove)

 


m

#2 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:09 PM

Posted 20 June 2007 - 07:31 AM

Hi,

Not sure if you need help or not...

By the way, as I read from your post, you work in a computer repair shop, so why didn't you just hook up the infected drive as a slave? Then you can delete the files without any problem.

In anyway, when you return this computer back to the costumer, tell him/her that all passwords need to get changed, because they are currently known.

Not sure either why you installed Avast while Norton/Symantec was already present. You should know that having more than one Antivirus installed may cause a LOT of problems - also, it causes a huge system slowdown.
So in case Norton has expired on that machine, it's better to uninstall it.
In case the costumer purchased Norton, then it's better to contact him/her and ask if they want to keep Norton or not.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.

#3 miekiemoes

miekiemoes

    Malware Killer Dog


  • Malware Response Team
  • 19,420 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:Belgium
  • Local time:02:09 PM

Posted 29 June 2007 - 08:54 AM

Since there is no feedback anymore, I assume this issue is resolved ... so, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
AntispywareScanners---Antivirus Scanners---Firewalls---Online Scanners---Prevention---Help! My computer is slow---My Blog---Follow me on Twitter.
My help is ALWAYS FREE, but if you want to donate to help me continue my fight against malware -- click here!
Asking for help via Private Message or Mail will be ignored - So If you need help, post your problem in the forum.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users