PDA

View Full Version : Guess what.....Virtumonde again ! I cant remove it



Christfire
2008-04-15, 08:05
I thought there was a simple way to remove it but as I read threads I see that this is a little bit more complicate and it seems to be different for everybody(CFScript file..). So, I hope somebody will help me, here is my ComboFix log.

Thank you
David


ComboFix 08-04-14.2 - David 2008-04-15 0:40:58.1 - NTFSx86
Microsoft Windows XP Professionnel 5.1.2600.2.1252.1.1036.18.462 [GMT -4:00]
Endroit: C:\Documents and Settings\David\Bureau\ComboFix.exe
* Création d'un nouveau point de restauration

AVERTISSEMENT - LA CONSOLE DE RÉCUPÉRATION N'EST PAS INSTALLÉE SUR CETTE MACHINE !!
.
The following files were disabled during the run:
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll


(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\David\Application Data\macromedia\Flash Player\#SharedObjects\N6T3QEZS\www.broadcaster.com
C:\Documents and Settings\David\Application Data\macromedia\Flash Player\#SharedObjects\N6T3QEZS\www.broadcaster.com\BCLUserPrefs.sol
C:\Documents and Settings\David\Application Data\macromedia\Flash Player\#SharedObjects\N6T3QEZS\www.broadcaster.com\played_list.sol
C:\Documents and Settings\David\Application Data\macromedia\Flash Player\#SharedObjects\N6T3QEZS\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\David\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\David\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\OUvwyccf.ini
C:\WINDOWS\system32\OUvwyccf.ini2
C:\WINDOWS\system32\QAKmmUvw.ini
C:\WINDOWS\system32\QAKmmUvw.ini2
C:\WINDOWS\system32\vttjswkf.ini
C:\WINDOWS\system32\yavbvhvr.ini

.
((((((((((((((((((((((((((((( Fichiers cr‚‚s 2008-03-15 to 2008-04-15 ))))))))))))))))))))))))))))))))))))
.

2008-04-14 11:19 . 2008-04-14 11:19 <REP> d-------- C:\Program Files\Enigma Software Group
2008-04-13 22:51 . 2008-04-13 22:51 <REP> d-------- C:\Program Files\Spybot - Search & Destroy
2008-04-13 22:51 . 2008-04-13 23:14 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-04-13 22:41 . 2008-04-13 22:43 <REP> d-------- C:\Program Files\SpywareBlaster
2008-04-13 22:41 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-04-13 15:15 . 2008-04-13 15:15 <REP> d-------- C:\WINDOWS\McAfee.com
2008-04-13 14:05 . 2008-04-13 14:05 129,536 --a----t- C:\WINDOWS\system32\DarkSpyKernel.sys
2008-04-13 13:04 . 2008-04-13 13:04 <REP> d-------- C:\kav
2008-04-12 10:13 . 2008-04-13 13:17 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-12 03:07 . 2008-04-14 11:46 101,119 --a------ C:\WINDOWS\BM5f8d95fe.xml
2008-04-11 18:04 . 2008-04-11 18:04 <REP> d-------- C:\Program Files\GameSpy Arcade
2008-04-11 17:58 . 2008-04-11 17:58 <REP> d-------- C:\Program Files\Eidos
2008-04-11 17:49 . 2008-04-11 17:49 <REP> d-------- C:\Program Files\Smart Projects
2008-04-11 15:08 . 2008-03-29 14:23 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2008-04-11 15:08 . 2008-03-29 14:35 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2008-04-11 15:08 . 2008-01-17 11:34 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2008-04-11 15:08 . 2008-03-29 14:31 75,856 --a------ C:\WINDOWS\system32\drivers\aswSP.sys
2008-04-11 15:08 . 2008-03-29 14:27 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2008-04-11 15:08 . 2008-03-29 14:26 26,944 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2008-04-11 15:08 . 2008-03-29 14:29 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2008-04-11 15:08 . 2008-03-29 14:35 20,560 --a------ C:\WINDOWS\system32\drivers\aswFsBlk.sys
2008-04-11 15:07 . 2008-04-11 15:07 <REP> d-------- C:\Program Files\Alwil Software
2008-04-11 15:07 . 2008-03-29 14:45 1,146,232 --a------ C:\WINDOWS\system32\aswBoot.exe
2008-04-11 15:07 . 2004-01-09 04:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2008-04-11 14:59 . 2008-04-11 14:59 38,400 --a------ C:\WINDOWS\system32\opnopOHB.dll.bak
2008-03-28 23:08 . 2008-03-28 23:08 <REP> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-03-20 12:46 . 2008-03-20 12:46 <REP> d-------- C:\Documents and Settings\NetworkService\Mes documents

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-15 04:44 17,408 ----a-w C:\WINDOWS\system32\drivers\USBCRFT.SYS
2008-04-14 03:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-13 17:17 --------- d-----w C:\Program Files\Lavasoft
2008-04-13 16:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-13 16:16 --------- d-----w C:\Program Files\LimeWire
2008-04-13 16:15 --------- d-----w C:\Program Files\America's Army Server Manager
2008-04-13 16:15 --------- d-----w C:\Program Files\America's Army
2008-04-11 19:23 --------- d-----w C:\Documents and Settings\David\Application Data\Azureus
2008-04-09 16:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-07 04:37 --------- d-----w C:\Program Files\mIRC
2008-03-30 22:38 --------- d-----w C:\Program Files\MSN Messenger
2008-03-30 22:38 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-03-12 05:41 --------- d-----w C:\Program Files\Fichiers communs\InstallShield
2008-03-08 06:04 --------- d-----w C:\Program Files\Azureus
2008-03-01 05:01 --------- dcsh--w C:\Program Files\Fichiers communs\WindowsLiveInstaller
2008-03-01 04:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-25 03:51 --------- d-----w C:\Documents and Settings\David\Application Data\Canon
2008-02-23 03:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\PassMark
2008-02-01 16:17 587,264 ----a-w C:\WINDOWS\WLXPGSS.SCR
2007-05-19 06:20 774,144 ----a-w C:\Program Files\RngInterstitial.dll
2006-08-21 01:58 0 ----a-w C:\Documents and Settings\David\Application Data\wklnhst.dat
2005-09-12 16:57 56 --sh--r C:\WINDOWS\system32\3154A52CE7.sys
2005-09-12 19:51 56 --sh--r C:\WINDOWS\system32\7CE60FCB2F.sys
2005-09-12 19:51 5,018 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((( Point de chargement Reg )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Note* les ‚l‚ments vides & les ‚l‚ments initiaux l‚gitimes ne sont pas list‚s

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C4058CF-D464-4506-8E5A-E1CEF6B8DDFD}]
C:\WINDOWS\system32\wvUmmKAQ.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66C9237B-3B0D-41F7-98FD-DADCC3F31C8F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D7BF7385-3A28-46F9-99D8-353AD5DF6481}]
C:\WINDOWS\system32\fccywvUO.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F997E142-F579-4F8E-B1D3-35D4B6472444}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 08:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-03 09:59 204288]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"V0220Mon.exe"="C:\WINDOWS\V0220Mon.exe" [2006-06-29 01:01 32768]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-16 18:54 155648]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 10:00 49152]
"nwiz"="nwiz.exe" [2005-10-10 22:49 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-10-10 22:49 7286784]
"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2006-04-11 22:57 1042000]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 13:50 155648]
"mmtask"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 14:12 53248]
"ledpointer"="CNYHKey.exe" [2004-02-03 11:15 5794816 C:\WINDOWS\CNYHKey.exe]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 15:34 64512]
"Dit"="Dit.exe" [2004-07-20 12:18 90112 C:\WINDOWS\Dit.exe]
"Cmaudio"="cmicnfg.cpl" []
"CHotkey"="mHotkey.exe" [2004-02-24 08:05 508416 C:\WINDOWS\mHotkey.exe]
"AVFX Engine"="C:\Program Files\Creative\Creative Live! Cam\VideoFX\StartFX.exe" [2006-10-19 19:44 20480]
"AOLDialer"="C:\Program Files\Fichiers communs\AOLSHARE\AOLDialReg.exe" [ ]
"amd_dc_opt"="C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2006-11-17 17:49 77824]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"5cbea662"="C:\WINDOWS\system32\rvhvbvay.dll" [ ]
"SpyHunter Security Suite"="C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe" [2008-01-23 15:47 847872]
"BM5f8d95fe"="C:\WINDOWS\system32\oosbdcty.dll" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 08:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnopOHB]
opnopOHB.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Messenger\\Msmsgs.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Sierra\\Empire Earth II\\EE2.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\THQ\\Company of Heroes\\Archive.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\game.dat"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Eidos\\Pyro Studios\\Commandos 3 - Destination Berlin\\commandos3.exe"=
"C:\\kav\\kav7\\setup.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 14:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 14:35]
R3 UKBFLT;UKBFLT;C:\WINDOWS\system32\DRIVERS\UKBFLT.sys [2003-12-19 16:13]
S3 CardReaderFilter;Card Reader Filter;C:\WINDOWS\system32\Drivers\USBCRFT.SYS [2008-04-15 00:44]
S3 DarkSpy;DarkSpy;C:\WINDOWS\system32\DarkSpyKernel.sys [2008-04-13 14:05]
S3 V0220Dev;Live! Cam Video IM;C:\WINDOWS\system32\DRIVERS\V0220Dev.sys [2006-06-29 13:58]
S3 V0220Vfx;V0220VFX;C:\WINDOWS\system32\DRIVERS\V0220Vfx.sys [2006-06-08 16:00]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-15 00:46:23
Windows 5.1.2600 Service Pack 2 NTFS

Balayage processus cach‚s ...

Balayage cach‚ autostart entries ...

Balayage des fichiers cach‚s ...

Scan termin‚ avec succŠs
Les fichiers cach‚s: 3

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Fichiers communs\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Fichiers communs\LightScribe\LSSrvc.exe
C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
.
**************************************************************************
.
Temps d'accomplissement: 2008-04-15 0:51:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-15 04:51:14

Pre-Run: 299,416,805,376 octets libres
Post-Run: 302,796,677,120 octets libres
.
2008-04-13 20:39:42 --- E O F ---

Shaba
2008-04-16, 11:40
Hi Christfire

First of all, you are not supposed to run tools like ComboFix unsupervised.

Secondly, please do this next:

Click here (http://www.trendsecure.com/portal/en-US/threat_analytics/HJTInstall.exe) to download HJTInstall.exe
Save HJTInstall.exe to your desktop.
Doubleclick on the HJTInstall.exe icon on your desktop.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
Come back here to this thread and Paste the log in your next reply.
DO NOT use the AnalyseThis button, its findings are dangerous if misinterpreted.
DO NOT have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.