PDA

View Full Version : Win32.TDSS.rtk TROJAN Problem



cellularfix
2009-08-09, 00:53
Running Windows XP Professional
Originally I had the System Security 2009 Malware. I ran MalwareBytes, SmitFraudFix, & SpyBot Search & Destroy. SpyBot Search & Destroy continues to show the Win32.TDSS.rtk TROJAN after each scan and cleaning operation. The TROJAN FILES are hidden and can't be deleted. Additionally, I cannot get into Safe Mode at all and the desktop background keeps going away. Thanks in advance for any help you may offer!

The following scans are attached: 1)HiJackThis Log; 2). SmitFraud Fix Logs; 3). SpyBot Search & Destroy Log showing the Win32.TDSS.rtk TROJAN files.
================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:05:56, on 8/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\\NeroCheck.exe
O4 - HKLM\..\Run: [ WinStart] C:\WINDOWS\Connection Wizard\Status\services.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\RunOnce: [SpybotDeletingA1832] command.com /c del "C:\WINDOWS\system32\drivers\hjgruioodvaaan.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingC550] cmd.exe /c del "C:\WINDOWS\system32\drivers\hjgruioodvaaan.sys"
O4 - HKLM\..\RunOnce: [SpybotDeletingA9410] command.com /c del "C:\WINDOWS\system32\hjgruidlavdumf.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5577] cmd.exe /c del "C:\WINDOWS\system32\hjgruidlavdumf.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6225] command.com /c del "C:\WINDOWS\system32\hjgruixkvaruac.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingC1376] cmd.exe /c del "C:\WINDOWS\system32\hjgruixkvaruac.dll"
O4 - HKLM\..\RunOnce: [SpybotDeletingA775] command.com /c del "C:\WINDOWS\system32\hjgruidxxoaadh.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5903] cmd.exe /c del "C:\WINDOWS\system32\hjgruidxxoaadh.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2549] command.com /c del "C:\WINDOWS\system32\hjgruimfxoqiax.dat"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5463] cmd.exe /c del "C:\WINDOWS\system32\hjgruimfxoqiax.dat"
O4 - HKCU\..\Run: [_WinStart] C:\WINDOWS\Connection Wizard\Status\services.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB9725] command.com /c del "C:\WINDOWS\system32\drivers\hjgruioodvaaan.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1785] cmd.exe /c del "C:\WINDOWS\system32\drivers\hjgruioodvaaan.sys"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4092] command.com /c del "C:\WINDOWS\system32\hjgruidlavdumf.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4366] cmd.exe /c del "C:\WINDOWS\system32\hjgruidlavdumf.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6705] command.com /c del "C:\WINDOWS\system32\hjgruixkvaruac.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4758] cmd.exe /c del "C:\WINDOWS\system32\hjgruixkvaruac.dll"
O4 - HKCU\..\RunOnce: [SpybotDeletingB4412] command.com /c del "C:\WINDOWS\system32\hjgruidxxoaadh.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3523] cmd.exe /c del "C:\WINDOWS\system32\hjgruidxxoaadh.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5665] command.com /c del "C:\WINDOWS\system32\hjgruimfxoqiax.dat"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7095] cmd.exe /c del "C:\WINDOWS\system32\hjgruimfxoqiax.dat"
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: &Add animation to IncrediMail Style Box - C:\PROGRA~1\INCRED~1\bin\resources\WebMenuImg.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://*.server2k
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1238281499734
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = DDI01.com
O17 - HKLM\Software\..\Telephony: DomainName = DDI01.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = DDI01.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = DDI01.com
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = DDI01.com
O22 - SharedTaskScheduler: Apartment - ThreadingModel - (no file)
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: iPod Service (ipod service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
--
End of file - 6581 bytes
========
SmitFraudFix v2.423
Scan done at 13:16:33.46, Sat 08/08/2009
Run from C:\Documents and Settings\Jimb\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
Process
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Jimb\Desktop\SmitfraudFix\Policies.exe
C:\WINDOWS\system32\cmd.exe
hosts
C:\
C:\WINDOWS
C:\WINDOWS\system
C:\WINDOWS\Web
C:\WINDOWS\system32
C:\WINDOWS\system32\LogFiles
C:\Documents and Settings\Jimb
C:\DOCUME~1\Jimb\LOCALS~1\Temp
C:\Documents and Settings\Jimb\Application Data
Start Menu
C:\DOCUME~1\Jimb\FAVORI~1
Desktop
C:\Program Files
Corrupted keys
Desktop Components
o4Patch
!!!Attention, following keys are not inevitably infected!!!
o4Patch
Credits: Malware Analysis & Diagnostic
Code: S!Ri
IEDFix
!!!Attention, following keys are not inevitably infected!!!
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Agent.OMZ.Fix
!!!Attention, following keys are not inevitably infected!!!
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
404Fix
!!!Attention, following keys are not inevitably infected!!!
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Share dTaskScheduler]
"ThreadingModel"="Apartment"
AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
Winlogon
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
RK
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS2\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS3\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.25
Scanning for wininet.dll infection
End
SmitFraudFix v2.423
Scan done at 13:24:55.28, Sat 08/08/2009
Run from C:\Documents and Settings\Jimb\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode
SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Share dTaskScheduler]
"ThreadingModel"="Apartment"
Killing process
hosts
VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
Generic Renos Fix
GenericRenosFix by S!Ri
Deleting infected files
IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
Agent.OMZ.Fix
Agent.OMZ.Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
RK
DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS2\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS3\Services\Tcpip\..\{e1b4e5f3-6913-4b8a-8010-215467d0c4f0}: DhcpNameServer=192.168.0.1 205.171.3.25
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1 205.171.3.25
Deleting Temp Files
Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
RK.2
Registry Cleaning
Registry Cleaning done.
SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Share dTaskScheduler]
"ThreadingModel"="Apartment"
End
================
SpyBot S&D

Win32.TDSS.rtk

(SBI $F5851ADB) File
C:\WNDOWS\System32\drivers\hjgruioodvaaan.sys

(SBI $6ED9DA84) File
C:\WNDOWS\System32\hjgruidlavdumf.dll

(SBI $6ED9DA84) File
C:\WNDOWS\System32\hjgruixkvaruac.dll

(SBI $6361226C) File
C:\WNDOWS\System32\hjgruidxxoaadh.dat

(SBI $6361226C) File
C:\WNDOWS\System32\hjgruimfxoqiax.dat
==========
THANKS!!

Shaba
2009-08-10, 07:31
Hi cellularfix

You are not supposed to fixes like SmitFraudFix unsupervised.

We will continue with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here. (http://www.bleepingcomputer.com/forums/topic114351.html)

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

cellularfix
2009-08-10, 16:40
Shaba - Thank you for your reply! I have been helped on another forum. I apologize for any confusion or extra effort on your part - Regards :oops: