PDA

View Full Version : Virtumonde - HELP!! (With Log File)


lordfede
2008-08-19, 12:00
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:55, on 19/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Archivos de programa\RocketDock\RocketDock.exe
C:\Archivos de programa\Ares\Ares.exe
C:\Archivos de programa\DynDNS Updater\DynUpPs.exe
C:\Archivos de programa\DynDNS Updater\DynTray.exe
C:\Archivos de programa\BitLord\BitLord.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\msiexec.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.daemonsearch.com/ar/ư
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O1 - Hosts: 87.229.102.30 l2authd.lineage2.com
O1 - Hosts: 87.229.102.30 l2testauthd.lineage2.com
O1 - Hosts: 216.107.250.194 nprotect.lineage2.com
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\archivos de programa\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {2ba521ac-b9b9-4433-ba45-dba2f02cba5a} - (no file)
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\ARCHIV~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\ARCHIV~1\TEXTAL~1\TAForIE.dll
O4 - HKLM\..\Run: [\Win4A.exe] C:\Windows\system32\Win4A.exe
O4 - HKLM\..\Run: [\Win4B.exe] C:\Windows\system32\Win4B.exe
O4 - HKLM\..\Run: [\Win4C.exe] C:\Windows\system32\Win4C.exe
O4 - HKLM\..\Run: [\Win4D.exe] C:\Windows\system32\Win4D.exe
O4 - HKLM\..\Run: [\Win4E.exe] C:\Windows\system32\Win4E.exe
O4 - HKLM\..\Run: [Antivirus] "C:\Archivos de programa\VAV\vav.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Archivos de programa\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKLM\..\Run: [Anti-keylogger] C:\Archivos de programa\Anti-keylogger\Anti-keylogger.exe /autorun
O4 - HKLM\..\Run: [SpybotSnD] "C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKLM\..\Run: [c4408146] rundll32.exe "C:\WINDOWS\system32\reualhwu.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Archivos de programa\Spybot - Search & Destroy\SpybotSD.exe" /autocheck /autofix
O4 - HKCU\..\Run: [RocketDock] "C:\Archivos de programa\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ares] "C:\Archivos de programa\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [\Win4A.exe] C:\Windows\system32\Win4A.exe
O4 - HKCU\..\Run: [\Win4B.exe] C:\Windows\system32\Win4B.exe
O4 - HKCU\..\Run: [\Win4C.exe] C:\Windows\system32\Win4C.exe
O4 - HKCU\..\Run: [\Win4D.exe] C:\Windows\system32\Win4D.exe
O4 - HKCU\..\Run: [\Win4E.exe] C:\Windows\system32\Win4E.exe
O4 - HKCU\..\Run: [Antivirus] "C:\Archivos de programa\VAV\vav.exe"
O4 - HKUS\S-1-5-18\..\Run: [Nokia.PCSync] C:\Archivos de programa\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] C:\Archivos de programa\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - Global Startup: DynDNS Updater.lnk = C:\Archivos de programa\DynDNS Updater\DynUpPs.exe
O8 - Extra context menu item: &Clean Traces - C:\Archivos de programa\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - C:\Archivos de programa\DAP\dapextie.htm
O8 - Extra context menu item: Add to AMV Converter... - C:\Archivos de programa\MP3 Player Utilities 4.13\AMVConverter\grab.html
O8 - Extra context menu item: Download &all with DAP - C:\Archivos de programa\DAP\dapextie2.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Archivos de programa\MP3 Player Utilities 4.13\MediaManager\grab.html
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Archivos de programa\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Archivos de programa\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O20 - AppInit_DLLs: mhzybu.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe

--
End of file - 5717 bytes

Thanks
pskelley
2008-08-21, 02:10
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

I would like to help you but we must start with this:
C:\Archivos de programa\Ares\Ares.exe
File Sharing, otherwise known as Peer To Peer. (P2P)
http://forums.spybot.info/showthread.php?t=282 <<< read this, especially post #4
Uninstall that program in Add Remove programs before you post the next HJT log.

You have a pretty bad infection, follow the directions carefully and keep the computer offline except when troubleshooting until we get it cleaned.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.

Remove any old copies of combofix before you proceed.

Thanks to sUBs and anyone else who helped with this fix.

It is important that it is saved directly to your Desktop.

Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop

Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Post the combofix log and a new HJT log.

Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Thanks