SMithfraud and Virtumonde Infection Help? [Archive]

Herboshorshe

2008-10-03, 00:25

Hello

I think I got this virus from a torrent or something. Heres the logs to "Highjack This" and "Combo Fix." Any help would be much appreciated. Thanks!!!!!!

Steven

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:06:26 PM, on 10/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://oklahomacity.craigslist.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: ktguvw.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 3046 bytes

ComboFix 08-10-02.04 - Owner 2008-10-02 16:53:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1214 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner\Cookies\owner@hb.pcworld[1].txt
C:\Documents and Settings\Owner\Cookies\owner@insightexpressai[2].txt
C:\WINDOWS\BMdff39af4.txt
C:\WINDOWS\BMdff39af4.xml
C:\WINDOWS\system32\btpnidii.dll
C:\WINDOWS\system32\celvsk.dll
C:\WINDOWS\system32\cqbwpyxf.dll
C:\WINDOWS\system32\jkklkIXQ.dll
C:\WINDOWS\system32\jqijvimc.dll
C:\WINDOWS\system32\ktguvw.dll
C:\WINDOWS\system32\rkdcom.dll
C:\WINDOWS\system32\wmemlbvk.dll
C:\WINDOWS\system32\ykrbgwnr.dll

.
((((((((((((((((((((((((( Files Created from 2008-09-02 to 2008-10-02 )))))))))))))))))))))))))))))))
.

2008-10-02 12:18 . 2008-10-02 12:18 121 --ahs---- C:\WINDOWS\system32\iwrmwlro.ini
2008-10-02 11:33 . 2008-10-02 13:49 881,264 --ahs---- C:\WINDOWS\system32\VybHRXbc.ini2
2008-10-02 11:33 . 2008-10-02 13:49 881,264 --ahs---- C:\WINDOWS\system32\VybHRXbc.ini
2008-10-02 04:44 . 2008-10-02 04:44 <DIR> d-------- C:\Program Files\Windows Defender
2008-10-02 04:30 . 2008-10-02 04:31 961,675 --ahs---- C:\WINDOWS\system32\qafxcgqc.ini
2008-09-29 15:12 . 2008-09-29 15:12 <DIR> d-------- C:\Program Files\Sony
2008-09-29 14:17 . 2005-09-29 16:35 972,292 --ahs---- C:\WINDOWS\system32\hfaxvocx.ini
2008-09-29 14:10 . 2008-10-02 05:02 893,080 --ahs---- C:\WINDOWS\system32\FffMUvut.ini2
2008-09-29 14:10 . 2008-10-02 05:03 893,080 --ahs---- C:\WINDOWS\system32\FffMUvut.ini
2008-09-28 14:00 . 2008-09-28 14:01 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\vlc
2008-09-28 13:59 . 2008-09-28 13:59 <DIR> d-------- C:\Program Files\VideoLAN
2008-09-19 18:49 . 2008-09-19 18:49 <DIR> d-------- C:\Program Files\Acoustica MP3 Audio Mixer
2008-09-19 18:49 . 2004-02-12 14:44 352,256 --a------ C:\WINDOWS\system32\eSellerateEngine.dll
2008-09-19 10:47 . 2008-09-19 10:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Minnetonka Audio Software
2008-09-19 08:59 . 2008-09-19 08:59 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-19 08:57 . 2008-09-19 08:57 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-19 08:57 . 2008-09-19 08:58 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-19 02:30 . 2008-09-19 02:30 <DIR> d-------- C:\Program Files\Sony Setup
2008-09-15 23:01 . 2008-09-15 23:01 <DIR> d-------- C:\MPS
2008-09-11 10:48 . 2008-04-14 00:17 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-11 10:48 . 2008-04-14 00:17 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-10 02:40 . 2008-09-10 02:40 <DIR> d-------- C:\Program Files\uTorrent
2008-09-10 02:40 . 2003-10-01 10:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\uTorrent
2008-09-08 18:32 . 2008-09-08 18:32 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-09-08 18:32 . 2008-09-20 03:00 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-09-04 05:54 . 2003-08-11 10:13 344,064 -ra------ C:\WINDOWS\system32\msvcr70.dll
2008-09-04 05:54 . 2003-08-11 10:07 14,604 --a------ C:\WINDOWS\system32\drivers\pfc.sys
2008-09-03 19:09 . 2003-09-30 01:30 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-09-03 18:15 . 2008-04-14 00:10 43,904 --a------ C:\WINDOWS\system32\drivers\sbp2port.sys
2008-09-03 18:15 . 2008-04-14 00:10 43,904 --a--c--- C:\WINDOWS\system32\dllcache\sbp2port.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-04 10:52 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-23 15:36 --------- d-----w C:\Documents and Settings\Owner\Application Data\Ahead
2008-08-23 15:23 --------- d-----w C:\Documents and Settings\Owner\Application Data\CyberLink
2008-08-23 15:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\CyberLink
2008-08-23 14:57 --------- d-----w C:\Program Files\Common Files\Ahead
2008-08-23 14:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ahead
2008-08-23 14:56 --------- d-----w C:\Program Files\Nero
2008-08-23 14:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2008-08-23 14:50 --------- d-----w C:\Program Files\CyberLink
2008-08-22 23:47 --------- d-----w C:\Program Files\CCleaner
2008-08-22 23:25 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-19 03:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut"="C:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"SoundMan"="SOUNDMAN.EXE" [2006-04-01 C:\WINDOWS\SOUNDMAN.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-09-29 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ktguvw.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= ctwdm32.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

BHO-{0B549309-31C4-4F81-9EFB-5134EC9FCEEB} - C:\WINDOWS\system32\tuvUMffF.dll
BHO-{20c9c8a1-3464-45fd-8e36-0b8c0eed4a94} - C:\WINDOWS\system32\ktguvw.dll
BHO-{25F5A921-4B7F-4BF4-BA9A-C52E022F63F9} - C:\WINDOWS\system32\jkklkIXQ.dll
BHO-{96D6C80D-0236-4EE5-BABE-1B605795C0C8} - C:\WINDOWS\system32\cbXRHbyV.dll
HKLM-Run-BMdff39af4 - C:\WINDOWS\system32\cjdgwuhd.dll
ShellExecuteHooks-{25F5A921-4B7F-4BF4-BA9A-C52E022F63F9} - C:\WINDOWS\system32\jkklkIXQ.dll

.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://oklahomacity.craigslist.org/
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-02 16:57:25
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\DOCUME~1\Owner\LOCALS~1\Temp\RGI1.tmp

scan completed successfully
hidden files: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\devldr32.exe
.
**************************************************************************
.
Completion time: 2008-10-02 16:58:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-10-02 21:58:54

Pre-Run: 195,052,417,024 bytes free
Post-Run: 195,058,286,592 bytes free

138 --- E O F --- 2008-09-20 08:01:07

pskelley

2008-10-04, 12:38

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
The junk can be tough to remove, so do not expect fast or easy.

If you still need help, proceed like this.

1) Read the directions, appears you have not done so yet.

2) File Sharing, otherwise known as Peer To Peer. (P2P)
http://forums.spybot.info/showthread.php?t=282

3) Do NOT run 'FIXES' before helpers have analyzed the HJT log
http://forums.spybot.info/showthread.php?t=16806

4) A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.

5) Once the above is complete, post a new HJT log and describe any problems you are having. If you receive error messages, post those word for word.

Thanks

pskelley

2008-10-11, 12:11

Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.