Virtumonde in S&D but not in VundoFix or Malwarebytes

[dougal813]

This is the first time I have actually had something show up on Spybot in at least a year on this laptop. I scanned my computer and had virtumonde.sdn show up. I ran vundofix and malwarebytes and both came up clean. At this point I am not sure if I have something on my computer or not. Any help would be appreciated. Below is the HJT log. I went through and removed the old javas from my programs list because I read that I needed to do this.

Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:00 AM, on 6/20/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Karina\AppData\Roaming\Research In Motion\BlackBerry\Updates\E7518ED5-A2B2-44ad-8500-05BAD276FF8F\BBDesktopInstaller.exe
C:\Windows\system32\MsiExec.exe
C:\Windows\system32\Macromed\Flash\FlashUtil10b.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Internet Explorer\iexplore.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://technology.msb.edu/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AGSearchHook Class - {0BC6E3FA-78EF-4886-842C-5A1258C4455A} - C:\Program Files\AGI\common\agcutils.dll
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [BlackBerryAutoUpdate] C:\Program Files\Common Files\Research In Motion\Auto Update\RIMAutoUpdate.exe /background
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www.clarkcolor.com/ClarkActivia.cab
O16 - DPF: {49312E18-AA92-4CC2-BB97-55DEA7BCADD6} (WMI Class) - http://support.dell.com/systemprofiler/SysProExe.CAB
O16 - DPF: {700EF03F-A472-4D26-8ACB-300F4D04FD96} (Recovery ActiveX Control Module) - http://www.lojackforlaptops.com/ctmweb/testoc.cab
O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/controls/DigWebX2.cab?10,0,910,0
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AG Windows Service (AGWinService) - Unknown owner - C:\Program Files\AGI\common\win32\PythonService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\Windows\system32\CTsvcCDA.exe
O23 - Service: Folding@home-CPU-[1] - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Folding@home-CPU-[2] - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Google Update Service (gupdate1c9b796173b4f85) (gupdate1c9b796173b4f85) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Remote Procedure Call (RPC) Net (Rpcnet) - Absolute Software Corp. - C:\Windows\SYSTEM32\Rpcnet.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11168 bytes

[Blade81]

Hi dougal813,

Where did Spybot detect the infection in? Please post contents of the results.

[dougal813]

The file that was infected was rpcnet.dll and it was in the system32 directory. Sorry for the slow response.

Mike

[Blade81]

No problem :)

Please upload the file to Virustotal (http://www.virustotal.com) and post back the results or a link to the results.

[dougal813]

File rpcnet.dll received on 2009.06.29 13:57:10 (UTC)
Current status: finished

Result: 1/40 (2.50%)
Compact Print results Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.29 -
AhnLab-V3 5.0.0.2 2009.06.29 -
AntiVir 7.9.0.199 2009.06.29 -
Antiy-AVL 2.0.3.1 2009.06.29 -
Authentium 5.1.2.4 2009.06.29 -
Avast 4.8.1335.0 2009.06.28 -
AVG 8.5.0.339 2009.06.29 -
BitDefender 7.2 2009.06.29 -
CAT-QuickHeal 10.00 2009.06.29 -
ClamAV 0.94.1 2009.06.29 -
Comodo 1487 2009.06.29 -
DrWeb 5.0.0.12182 2009.06.29 -
eSafe 7.0.17.0 2009.06.28 -
eTrust-Vet 31.6.6588 2009.06.29 -
F-Prot 4.4.4.56 2009.06.29 -
F-Secure 8.0.14470.0 2009.06.29 -
Fortinet 3.117.0.0 2009.06.29 PossibleThreat
GData 19 2009.06.29 -
Ikarus T3.1.1.64.0 2009.06.29 -
Jiangmin 11.0.706 2009.06.29 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.29 -
McAfee 5660 2009.06.28 -
McAfee+Artemis 5660 2009.06.28 -
McAfee-GW-Edition 6.7.6 2009.06.29 -
Microsoft 1.4803 2009.06.29 -
NOD32 4196 2009.06.29 -
Norman 6.01.09 2009.06.26 -
nProtect 2009.1.8.0 2009.06.29 -
Panda 10.0.0.14 2009.06.29 -
PCTools 4.4.2.0 2009.06.28 -
Rising 21.36.04.00 2009.06.29 -
Sophos 4.43.0 2009.06.29 -
Sunbelt 3.2.1858.2 2009.06.28 -
Symantec 1.4.4.12 2009.06.29 -
TheHacker 6.3.4.3.356 2009.06.27 -
TrendMicro 8.950.0.1094 2009.06.29 -
VBA32 3.12.10.7 2009.06.29 -
ViRobot 2009.6.29.1810 2009.06.29 -
VirusBuster 4.6.5.0 2009.06.29 -
Additional information
File size: 56680 bytes
MD5 : 2f4158cfe7801a73beaa7e8a9dfcad26
SHA1 : 54f8866720054252de75a2f05643ce98b5a9d253
SHA256: c959993db45d484da3a811f2dd6a8bf522fcd15afa05b46053e061db500d66f3
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1C10
timedatestamp.....: 0x49AD6B29 (Tue Mar 3 18:38:49 2009)
machinetype.......: 0x14C (Intel I386)

( 5 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x9129 0x9200 6.51 9becfb7d2513d33591ab673115bba95f
.data 0xB000 0x1D74 0x1E00 3.36 62bbc527cc88a05d5c449d6103467740
.cdata 0xD000 0x298 0x400 2.66 c93e206aac1e4e4b1506d414a18738eb
.rsrc 0xE000 0x448 0x600 2.54 66c04b9abc0c570bb3b2612f0ccfd50b
.reloc 0xF000 0x9EE 0xA00 6.24 3a404a244b8c32be9260e308210f9344

( 7 imports )

> advapi32.dll: ControlService, DeleteService, CreateServiceA, QueryServiceConfigA, ChangeServiceConfigA, OpenSCManagerA, OpenServiceA, QueryServiceStatus, StartServiceA, CloseServiceHandle, EqualSid, RegisterServiceCtrlHandlerA, SetServiceStatus, StartServiceCtrlDispatcherA, DuplicateTokenEx, SetTokenInformation, CreateProcessAsUserA, RegOpenKeyA, RegCreateKeyExA, RegSetValueExA, SetKernelObjectSecurity, RegDeleteKeyA, RegDeleteValueA, RegOpenKeyExA, RegQueryValueExA, RegCloseKey, OpenProcessToken, GetTokenInformation, AdjustTokenPrivileges, GetKernelObjectSecurity, AllocateAndInitializeSid, SetSecurityDescriptorDacl, InitializeSecurityDescriptor, SetEntriesInAclA, FreeSid
> kernel32.dll: lstrcatA, lstrcpyA, MapViewOfFile, CreateFileMappingA, SetEvent, ResetEvent, WaitForSingleObject, LocalAlloc, CreateThread, GetLastError, BackupRead, BackupWrite, OpenProcess, GetCurrentProcessId, GetCurrentProcess, FreeLibrary, GetProcAddress, LoadLibraryA, DeleteFileA, lstrlenA, CreateFileA, BackupSeek, GetFileAttributesExA, SetFileTime, SetFileAttributesA, CreateEventA, GetVersionExA, GetSystemDirectoryA, FindClose, FindFirstFileA, lstrcmpiA, lstrcmpA, LoadLibraryExA, GetModuleHandleA, WriteFile, GetWindowsDirectoryA, GetEnvironmentVariableA, GetExitCodeThread, WaitForMultipleObjects, CreateRemoteThread, VirtualFreeEx, WriteProcessMemory, VirtualAllocEx, SetFilePointer, CopyFileA, GetModuleFileNameA, SetStdHandle, TerminateProcess, CreateProcessA, ReadProcessMemory, GetStdHandle, HeapAlloc, HeapFree, GetProcessHeap, RaiseException, GetVersion, RtlUnwind, ClearCommError, PurgeComm, GetOverlappedResult, EnterCriticalSection, LeaveCriticalSection, WaitCommEvent, SetCommMask, ReadFile, Sleep, DeleteCriticalSection, SetThreadPriority, InitializeCriticalSection, SetCommTimeouts, SetCommState, GetCommState, SetupComm, GetCommProperties, GetCurrentThreadId, GetLocalTime, GetCommandLineA, FlushFileBuffers, ExitProcess, ResumeThread, GetComputerNameA, TerminateThread, LocalFree, CloseHandle, UnmapViewOfFile, ExitThread
> netapi32.dll: Netbios
> tapi32.dll: lineDeallocateCall, lineMakeCall, lineSetDevConfig, lineGetID, lineSetStatusMessages, lineGetDevCaps, lineInitialize, lineGetDevConfig, lineOpen, lineShutdown, lineGetCallStatus, lineDrop, lineClose
> user32.dll: PeekMessageA, KillTimer, PostMessageA, GetMessageA, TranslateMessage, PostQuitMessage, DefWindowProcA, wsprintfA, RegisterClassA, CreateWindowExA, DispatchMessageA, MsgWaitForMultipleObjects, SendMessageA, PostThreadMessageA, SetTimer
> userenv.dll: CreateEnvironmentBlock, DestroyEnvironmentBlock
> wsock32.dll: -, -, -, -, -, -, -, -, -, -, -, -, -

( 1 exports )

> ServiceMain
TrID : File type identification
Generic Win/DOS Executable (50.0%)
DOS Executable Generic (49.9%)
ThreatExpert: http://www.threatexpert.com/report.aspx?md5=2f4158cfe7801a73beaa7e8a9dfcad26
ssdeep: 768:kJTMRW36uadqY3bIxaiXssKrXbdURa1MRAn/v2mN90ebqAMt2IHjPz3Ot0qPG4Pb:LW3/aEwsK7iCMun/eAeydt0Yw4G4
PEiD : -
RDS : NSRL Reference Data Set
-

[Blade81]

Hi,

That finding is most likely a false positive (please see this (http://forums.spybot.info/showthread.php?t=49473) topic). Have you updated Spybot definitions now? Please make sure that the definitions are up-to-date and then run a scan again.

[Blade81]

Due to inactivity, this thread will now be closed.

Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.