View Full Version : Virtumonde Removal
dirtywater31
2009-01-14, 18:59
Have tried on many occasion to remove but always seems to come back after computer restart if internet is connected.
Here is my HJT Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:41 PM, on 1/14/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ACAD2000\acad.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.royaliron.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: {1eaac1d4-38d9-12e9-c604-50745d000858} - {858000d5-4705-406c-9e21-9d834d1caae1} - C:\WINDOWS\system32\tmiate.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - C:\WINDOWS\system32\kojofaba.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [F-Secure Gatekeeper] umwyaw.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [TaskMon] C:\WINDOWS\system32\taskmon.exe
O4 - HKLM\..\Run: [CPM7f8c2ca6] Rundll32.exe "C:\WINDOWS\system32\vojedayu.dll",a
O4 - HKLM\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s
O4 - HKLM\..\RunServices: [F-Secure Gatekeeper] umwyaw.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA428] command /c del "c:\windows\system32\vojedayu.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC7209] cmd /c del "c:\windows\system32\vojedayu.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA2003] command /c del "C:\WINDOWS\system32\fibikavi.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4371] cmd /c del "C:\WINDOWS\system32\fibikavi.dll_old"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunServices: [F-Secure Gatekeeper] umwyaw.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB490] command /c del "c:\windows\system32\vojedayu.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3800] cmd /c del "c:\windows\system32\vojedayu.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9074] command /c del "C:\WINDOWS\system32\fibikavi.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9315] cmd /c del "C:\WINDOWS\system32\fibikavi.dll_old"
O4 - HKUS\S-1-5-19\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O20 - AppInit_DLLs: tmiate.dll C:\WINDOWS\system32\dimidiva.dll c:\windows\system32\vojedayu.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\vojedayu.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\vojedayu.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 9289 bytes
shelf life
2009-01-18, 20:37
hi dirtywater31,
we will get a download to use. Link and directions:
Please download Malwarebytes' Anti-Malware (MBAM) to your desktop:
http://www.malwarebytes.org/mbam.php
* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
*** Be sure that everything is checked, and click Remove Selected.***
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
please post the MBAM log in reply. Also after you use MBAM, rescan and post a new hjt log in your reply.
dirtywater31
2009-01-20, 15:33
Malwarebytes' Anti-Malware 1.33
Database version: 1668
Windows 5.1.2600 Service Pack 3
1/20/2009 9:21:38 AM
mbam-log-2009-01-20 (09-21-21).txt
Scan type: Full Scan (C:\|T:\|)
Objects scanned: 79000
Time elapsed: 24 minute(s), 58 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 3
Registry Keys Infected: 10
Registry Values Infected: 10
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 46
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> No action taken.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b8daa2b3-1adb-4c8d-9204-362bbe1eb1d5} (Trojan.Vundo) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bigajuhiki (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb1036 (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd6337 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga3359 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1348 (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskmon (Trojan.Downloader) -> No action taken.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vehuyafa.dll -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\SYSTEM32\bufezeza.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\azezefub.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\fajutuse.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\esutujaf.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\tituzeki.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\ikezutit.ini (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\SYSTEM32\jawepuwa.dll_old (Trojan.Vundo.H) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068632.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068633.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068634.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068639.exe (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068643.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068645.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068676.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068678.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068686.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068688.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068702.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068703.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068713.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068714.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068716.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068717.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP625\A0068957.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069035.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069036.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP630\A0069169.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069324.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069322.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069323.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069325.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069326.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069327.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069328.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069329.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069331.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069334.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069335.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069345.dll (Trojan.Vundo) -> No action taken.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069361.dll (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Scott\Local Settings\Temp\Temporary Internet Files\Content.IE5\7PE1LQRL\InstallAVg_770522170802[1].exe (Rogue.Installer) -> No action taken.
C:\WINDOWS\SYSTEM32\sosafuji.dll (Trojan.Vundo) -> No action taken.
C:\WINDOWS\SYSTEM32\hepozili.dll (Trojan.Vundo) -> No action taken.
shelf life
2009-01-20, 23:22
hi,
check MBAM for updates then do a full scan again, and this time after the scan:
* When the scan is complete, click OK, then Show Results to view the results.
*** Be sure that everything is checked, and click Remove Selected.***
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
after you are done with MBAM, rescan and post a new hjt log.
dirtywater31
2009-01-21, 15:52
Malwarebytes' Anti-Malware 1.33
Database version: 1674
Windows 5.1.2600 Service Pack 3
1/21/2009 8:43:48 AM
mbam-log-2009-01-21 (08-43-48).txt
Scan type: Full Scan (C:\|T:\|)
Objects scanned: 79142
Time elapsed: 25 minute(s), 44 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 10
Registry Values Infected: 6
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 46
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> Delete on reboot.
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{b8daa2b3-1adb-4c8d-9204-362bbe1eb1d5} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bigajuhiki (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskmon (Trojan.Downloader) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vehuyafa.dll -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\SYSTEM32\bufezeza.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\azezefub.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\fajutuse.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\esutujaf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\pidezabi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ibazedip.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\tituzeki.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\ikezutit.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> Delete on reboot.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068632.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068633.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068634.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068639.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068643.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068645.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068676.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068678.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068686.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068688.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068702.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068703.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068713.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068714.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068716.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068717.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP625\A0068957.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069035.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069036.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP630\A0069169.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069324.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069322.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069323.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069325.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069326.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069327.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069328.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069329.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069331.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069334.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069335.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069345.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069361.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\sosafuji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\hepozili.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
shelf life
2009-01-21, 23:24
hi,
ok good. lets get one more tool for another look. Its called combofix. There is a guide you should read. One thing you should do is install the ms recovery console. You can do it manually as posted in the guide or combofix will do it for before it scans. Disabled any AV/anti-malware before using combofix.
the guide is here:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Post the combofix log in your reply.
dirtywater31
2009-01-22, 17:28
ComboFix 09-01-21.02 - Scott 2009-01-22 10:49:32.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.631 [GMT -5:00]
Running from: c:\documents and settings\Scott\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\start.exe
c:\windows\system32\aravawaw.ini
c:\windows\system32\asepuwid.ini
c:\windows\system32\awadeyuw.ini
c:\windows\system32\ayisalup.ini
c:\windows\system32\azowoyuh.ini
c:\windows\system32\ehetazep.ini
c:\windows\system32\ejtmpt.dll
c:\windows\system32\hupetetu.dll
c:\windows\system32\ihikabiw.ini
c:\windows\system32\imagijuv.ini
c:\windows\system32\isiwosom.ini
c:\windows\system32\ivakibif.ini
c:\windows\system32\jskjwq.dll
c:\windows\system32\lelimafu.dll
c:\windows\system32\luruwono.dll
c:\windows\system32\mawuwaha.dll
c:\windows\system32\nizefipu.dll
c:\windows\system32\oreroraz.ini
c:\windows\system32\yeneriho.dll
c:\windows\Web\default.htt
T:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
.
2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\documents and settings\Scott\Application Data\Malwarebytes
2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-20 08:54 . 2009-01-14 16:11 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-01-20 08:54 . 2009-01-14 16:11 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-01-14 12:53 . 2009-01-14 12:53 <DIR> d-------- c:\program files\Trend Micro
2009-01-09 08:00 . 2009-01-09 08:07 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-01-06 11:51 . 2009-01-06 11:51 <DIR> d-------- c:\program files\Autodesk
2008-12-29 08:47 . 2008-12-29 08:47 0 --a------ c:\windows\SYSTEM32\efulizul.tmp
2008-12-24 11:35 . 2008-12-24 11:35 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
2008-12-24 11:35 . 2008-12-24 11:35 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2008-12-24 08:24 . 2008-12-24 08:24 <DIR> d-------- c:\program files\Lavasoft
2008-12-24 08:24 . 2008-12-24 08:24 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-24 08:24 . 2008-12-24 08:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-16 13:06 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-01-16 13:06 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-06 16:51 --------- d-----w c:\program files\Common Files\Autodesk Shared
2009-01-02 15:54 --------- d-----w c:\program files\FriendBlasterPro
2009-01-02 14:33 --------- d-----w c:\program files\ACAD2000
2008-12-15 13:22 --------- d-----w c:\program files\Java
2006-07-02 21:21 266 --sha-w c:\program files\desktop.ini
2006-07-02 21:21 11,079 ---ha-w c:\program files\folder.htt
2008-08-30 16:55 32,768 --sha-w c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083020080831\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
@="{7D688A77-C613-11D0-999B-00C04FD655E1}"
[HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
2008-04-13 19:12 8461312 --a------ c:\windows\SYSTEM32\SHELL32.DLL
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ASUS Probe"="c:\program files\ASUS\Probe\AsusProb.exe" [2002-12-06 617984]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-09 71328]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-07-03 100056]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]
"TCASUTIEXE"="TCAUDIAG.exe" [2003-02-12 c:\windows\SYSTEM32\TCAUDIAG.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2003-06-18 54472]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.VDOM"= vdowave.drv
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
--a------ 2003-05-30 08:42 585728 c:\program files\Analog Devices\SoundMAX\SMax4.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
--a------ 2003-05-29 15:28 790528 c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\MSMSGS.EXE"=
"c:\\Program Files\\Norton AntiVirus\\NAVAPSVC.EXE"=
"c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=
"c:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\SymWSC.exe"=
"c:\\Program Files\\Analog Devices\\SoundMAX\\SMAgent.exe"=
"c:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe"=
R4 tcaicchg;tcaicchg;c:\windows\SYSTEM32\TCAICCHG.SYS [2000-06-06 21233]
R4 TCAITDI;TCAITDI Protocol;c:\windows\SYSTEM32\DRIVERS\TCAITDI.SYS [2001-09-04 19534]
S0 viaraid;viaraid;c:\windows\system32\DRIVERS\viaraid.sys --> c:\windows\system32\DRIVERS\viaraid.sys [?]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b6bfa3d-c675-11db-ad22-000ea60690dd}]
\Shell\AutoRun\command - e:\jdsecure\Windows\JDSecure31.exe
.
Contents of the 'Scheduled Tasks' folder
2009-01-05 c:\windows\Tasks\Drawings A-H.job
- c:\windows\system32\ntbackup.exe [2008-04-13 19:12]
2009-01-06 c:\windows\Tasks\Drawings I-P.job
- c:\windows\system32\ntbackup.exe [2008-04-13 19:12]
2009-01-07 c:\windows\Tasks\Drawings R-Z.job
- c:\windows\system32\ntbackup.exe [2008-04-13 19:12]
2006-11-30 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Scott.job
- c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 17:22]
2008-09-13 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
- c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 17:22]
2009-01-22 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-06-18 16:17]
.
- - - - ORPHANS REMOVED - - - -
BHO-{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)
HKCU-Run-F-Secure Gatekeeper - umwyaw.exe
HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
Notify-WgaLogon - (no file)
MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
MSConfigStartUp-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.royaliron.com/
DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Scott\Application Data\Mozilla\Firefox\Profiles\bbwfdja8.default\
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 10:56:16
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Norton AntiVirus\NAVAPSVC.EXE
c:\program files\Norton AntiVirus\SAVScan.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\SYSTEM32\wdfmgr.exe
c:\program files\Common Files\Symantec Shared\Security Center\SymWSC.exe
.
**************************************************************************
.
Completion time: 2009-01-22 10:58:53 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-22 15:58:47
Pre-Run: 103,198,036,480 bytes free
Post-Run: 104,271,409,664 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout = 30
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Professional" /noexecute=optin /fastdetect
186 --- E O F --- 2008-12-18 21:50:54
shelf life
2009-01-22, 23:23
hi,
ok good. Must be looking better on your end.
Rescan and post one more hjt log.
dirtywater31
2009-01-26, 15:53
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:24 AM, on 1/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ASUS\Probe\AsusProb.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\SAVScan.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\ACAD2000\acad.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.royaliron.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
--
End of file - 7177 bytes
shelf life
2009-01-26, 23:34
hi dirtywater31,
ok. Thanks for the info. we will use hjt. First disable spybots tea timer so it wont go nuts:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
start HJT, click the "Scan" button. check the items below, close any open windows, then click "Fixed checked"
O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)
O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
----------------------------------------
reboot computer and check MBAM for updates and run it once more.Post the MBAM log. Last: post a new hjt log also