Trying to remove Vundo / Stop Sign [Archive]

tigger23505

2008-03-03, 01:56

hjt log, will post KAV when it finishes

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:38:36 PM, on 3/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Network Associates\Common Framework\UdaterUI.exe
C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
C:\Program Files\Network Associates\Common Framework\McTray.exe
C:\Program Files\DISC\DISCover.exe
C:\Program Files\Verizon\VSP\VerizonServicepoint.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\DISC\DiscStreamHub.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.best-price.com/startseite.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q106&bd=pavilion&pf=desktop
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: (no name) - {BF2CEDEF-939A-4AD2-8CAC-C68857F60946} - C:\WINDOWS\system32\geeba.dll (file missing)
O2 - BHO: {f4d960ac-0e7b-9d58-48b4-e1ec8d2e6b1f} - {f1b6e2d8-ce1e-4b84-85d9-b7e0ca069d4f} - C:\WINDOWS\system32\wpiussyu.dll (file missing)
O3 - Toolbar: Verizon Broadband Toolbar - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - C:\WINDOWS\DOWNLO~1\vzbb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\Verizon\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [DISCover] C:\Program Files\DISC\DISCover.exe nogui
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon0.dll",VerifyStatus
O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus
O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [VerizonServicepoint.exe] "C:\Program Files\Verizon\VSP\VerizonServicepoint.exe" /AUTORUN
O4 - HKLM\..\Run: [19bce822] rundll32.exe "C:\WINDOWS\system32\anrelmgc.dll",b
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [A00F17F6039.exe] C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\_A00F17F6039.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - .DEFAULT User Startup: Pin.lnk = C:\hp\bin\CLOAKER.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170436349860
O20 - Winlogon Notify: khfcbya - khfcbya.dll (file missing)
O20 - Winlogon Notify: __c000 - C:\WINDOWS\system32\__c000.dat (file missing)
O20 - Winlogon Notify: __c0017385 - C:\WINDOWS\system32\__c0017385.dat (file missing)
O20 - Winlogon Notify: __c001B22C - C:\WINDOWS\system32\__c001B22C.dat (file missing)
O20 - Winlogon Notify: __c001E42D - C:\WINDOWS\system32\__c001E42D.dat (file missing)
O20 - Winlogon Notify: __c0021C11 - C:\WINDOWS\system32\__c0021C11.dat (file missing)
O20 - Winlogon Notify: __c00221E0 - C:\WINDOWS\system32\__c00221E0.dat (file missing)
O20 - Winlogon Notify: __c0023421 - C:\WINDOWS\system32\__c0023421.dat (file missing)
O20 - Winlogon Notify: __c0026442 - C:\WINDOWS\system32\__c0026442.dat (file missing)
O20 - Winlogon Notify: __c002AB2C - C:\WINDOWS\system32\__c002AB2C.dat (file missing)
O20 - Winlogon Notify: __c002E7D5 - C:\WINDOWS\system32\__c002E7D5.dat (file missing)
O20 - Winlogon Notify: __c0030451 - C:\WINDOWS\system32\__c0030451.dat (file missing)
O20 - Winlogon Notify: __c0032407 - C:\WINDOWS\system32\__c0032407.dat (file missing)
O20 - Winlogon Notify: __c0034BC9 - C:\WINDOWS\system32\__c0034BC9.dat (file missing)
O20 - Winlogon Notify: __c003542E - C:\WINDOWS\system32\__c003542E.dat (file missing)
O20 - Winlogon Notify: __c0035D9C - C:\WINDOWS\system32\__c0035D9C.dat (file missing)
O20 - Winlogon Notify: __c00369A4 - C:\WINDOWS\system32\__c00369A4.dat (file missing)
O20 - Winlogon Notify: __c003C9F3 - C:\WINDOWS\system32\__c003C9F3.dat (file missing)
O20 - Winlogon Notify: __c003F90 - C:\WINDOWS\system32\__c003F90.dat (file missing)
O20 - Winlogon Notify: __c0040210 - C:\WINDOWS\system32\__c0040210.dat (file missing)
O20 - Winlogon Notify: __c0045C4 - C:\WINDOWS\system32\__c0045C4.dat (file missing)
O20 - Winlogon Notify: __c004B3BA - C:\WINDOWS\system32\__c004B3BA.dat (file missing)
O20 - Winlogon Notify: __c0051CE8 - C:\WINDOWS\system32\__c0051CE8.dat (file missing)
O20 - Winlogon Notify: __c0052537 - C:\WINDOWS\system32\__c0052537.dat (file missing)
O20 - Winlogon Notify: __c0053780 - C:\WINDOWS\system32\__c0053780.dat (file missing)
O20 - Winlogon Notify: __c0055DC3 - C:\WINDOWS\system32\__c0055DC3.dat (file missing)
O20 - Winlogon Notify: __c0058674 - C:\WINDOWS\system32\__c0058674.dat (file missing)
O20 - Winlogon Notify: __c0070F97 - C:\WINDOWS\system32\__c0070F97.dat (file missing)
O20 - Winlogon Notify: __c007761D - C:\WINDOWS\system32\__c007761D.dat (file missing)
O20 - Winlogon Notify: __c007C018 - C:\WINDOWS\system32\__c007C018.dat (file missing)
O20 - Winlogon Notify: __c007EC46 - C:\WINDOWS\system32\__c007EC46.dat (file missing)
O20 - Winlogon Notify: __c0081459 - C:\WINDOWS\system32\__c0081459.dat (file missing)
O20 - Winlogon Notify: __c0081677 - C:\WINDOWS\system32\__c0081677.dat (file missing)
O20 - Winlogon Notify: __c008CD69 - C:\WINDOWS\system32\__c008CD69.dat (file missing)
O20 - Winlogon Notify: __c008D79A - C:\WINDOWS\system32\__c008D79A.dat (file missing)
O20 - Winlogon Notify: __c008F904 - C:\WINDOWS\system32\__c008F904.dat (file missing)
O20 - Winlogon Notify: __c0091188 - C:\WINDOWS\system32\__c0091188.dat (file missing)
O20 - Winlogon Notify: __c00A473 - C:\WINDOWS\system32\__c00A473.dat (file missing)
O20 - Winlogon Notify: __c00A59C6 - C:\WINDOWS\system32\__c00A59C6.dat (file missing)
O20 - Winlogon Notify: __c00B171F - C:\WINDOWS\system32\__c00B171F.dat (file missing)
O20 - Winlogon Notify: __c00B4206 - C:\WINDOWS\system32\__c00B4206.dat (file missing)
O20 - Winlogon Notify: __c00C319B - C:\WINDOWS\system32\__c00C319B.dat (file missing)
O20 - Winlogon Notify: __c00C392C - C:\WINDOWS\system32\__c00C392C.dat (file missing)
O20 - Winlogon Notify: __c00CDD95 - C:\WINDOWS\system32\__c00CDD95.dat (file missing)
O20 - Winlogon Notify: __c00D87AE - C:\WINDOWS\system32\__c00D87AE.dat (file missing)
O20 - Winlogon Notify: __c00DC909 - C:\WINDOWS\system32\__c00DC909.dat (file missing)
O20 - Winlogon Notify: __c00DD1F9 - C:\WINDOWS\system32\__c00DD1F9.dat (file missing)
O20 - Winlogon Notify: __c00DE0F9 - C:\WINDOWS\system32\__c00DE0F9.dat (file missing)
O20 - Winlogon Notify: __c00DEB21 - C:\WINDOWS\system32\__c00DEB21.dat (file missing)
O20 - Winlogon Notify: __c00E9110 - C:\WINDOWS\system32\__c00E9110.dat (file missing)
O20 - Winlogon Notify: __c00EA248 - C:\WINDOWS\system32\__c00EA248.dat (file missing)
O20 - Winlogon Notify: __c00EBEB8 - C:\WINDOWS\system32\__c00EBEB8.dat (file missing)
O20 - Winlogon Notify: __c00EC551 - C:\WINDOWS\system32\__c00EC551.dat (file missing)
O20 - Winlogon Notify: __c00EE2B1 - C:\WINDOWS\system32\__c00EE2B1.dat (file missing)
O20 - Winlogon Notify: __c00EEB0C - C:\WINDOWS\system32\__c00EEB0C.dat (file missing)
O20 - Winlogon Notify: __c00FC522 - C:\WINDOWS\system32\__c00FC522.dat (file missing)
O20 - Winlogon Notify: __c00FCEAD - C:\WINDOWS\system32\__c00FCEAD.dat (file missing)
O20 - Winlogon Notify: __c00FDD4E - C:\WINDOWS\system32\__c00FDD4E.dat (file missing)
O20 - Winlogon Notify: __c00FF810 - C:\WINDOWS\system32\__c00FF810.dat (file missing)
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe

--
End of file - 14400 bytes

Shaba

2008-03-04, 15:14

Hi tigger23505

1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)

Post:

- a fresh HijackThis log
- combofix report

Shaba

2008-03-09, 11:12

Due to the lack of feedback this Topic is closed.

If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.