Virtumonde plus virtumonde.generic and others

loger.ock · Jan 27, 2008

Hi,

I am new to this forum and I would like to know if anyone could help me out cleaning my system from Virtumonde, Virtumonde.generic and win32.inject.bw

I have run a HJT log before and after running combofix which I post below plus a combofix report also added.

Many thanks in advance!

HJT before combofix
========================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:36:20 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Utils\Antivirus\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://createpdf.adobe.com/?Language=ENU
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: Shell=
O3 - Toolbar: PDF de Adobe - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ShowIcon_Chander_CRW Series Driver v1.17r019] "C:\Archivos de programa\CRW\shwicon.exe" -t"Chander\CRW Series Driver v1.17r019"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LManager] C:\ARCHIV~1\LAUNCH~1\CPLFL32.EXE
O4 - HKLM\..\Run: [CloneCDTray] "D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Archivos de programa\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Archivos de programa\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Archivos de programa\Archivos comunes\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Utils\Visors\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [7c4639e8] rundll32.exe "C:\WINDOWS\system32\onpxlxfu.dll",b
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: toDO.lnk = C:\Documents and Settings\Salitre\Escritorio\toDO.txt
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\Utils\Edicio\MSOffice\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Utils\Edicio\MSOffice\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {08FD87EF-2A15-11D1-AF00-00A0C91F4B89} (WebPlotCtl Class) - http://www.icv.gva.es/pags/webplot.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVR Control) - http://www.devalvr.com/instalacion/plugin/devalocx.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://mapg.fmd.emory.edu/mgvinstall/mgaxctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9971703-8C00-4272-BB13-6555140CB2AF}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 7263 bytes

HJT after combofix
======================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:29:41 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
D:\Utils\Antivirus\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://createpdf.adobe.com/?Language=ENU
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Utils\Visors\AcrobatPro\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: PDF de Adobe - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ShowIcon_Chander_CRW Series Driver v1.17r019] "C:\Archivos de programa\CRW\shwicon.exe" -t"Chander\CRW Series Driver v1.17r019"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LManager] C:\ARCHIV~1\LAUNCH~1\CPLFL32.EXE
O4 - HKLM\..\Run: [CloneCDTray] "D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Archivos de programa\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Archivos de programa\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Archivos de programa\Archivos comunes\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Utils\Visors\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: toDO.lnk = C:\Documents and Settings\Salitre\Escritorio\toDO.txt
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\Utils\Edicio\MSOffice\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Utils\Edicio\MSOffice\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {08FD87EF-2A15-11D1-AF00-00A0C91F4B89} (WebPlotCtl Class) - http://www.icv.gva.es/pags/webplot.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVR Control) - http://www.devalvr.com/instalacion/plugin/devalocx.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://mapg.fmd.emory.edu/mgvinstall/mgaxctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9971703-8C00-4272-BB13-6555140CB2AF}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 7389 bytes

-- to long, continue in a reply

loger.ock · Jan 29, 2008

Infection (Virtumonde) and messy "removal",help please

Hi, I have undertaken a series of viruses removals attempts. Alas, I haven't proceed with caution since I ComboFixed before posting in the forum

. Results of kaspersky still shows 6 virus and the system still has problems. However SSD doesn't show any more virus. Here is the kaspersky report sand the HJT one. Would be grateful if any experienced person could throw light into this situation. I am afraid it might be irreversible

Thanks!

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 29, 2008 2:28:12 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/01/2008
Kaspersky Anti-Virus database records: 534986
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\

Scan Statistics:
Total number of scanned objects: 190469
Number of viruses found: 6
Number of infected objects: 26
Number of suspicious objects: 0
Duration of the scan process: 03:56:26

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\BOPDATA\_Date-20080128_Time-161459921_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\BOPDATA\_Date-20080128_Time-161459921_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\Common Framework\Db\Agent_ALGAR.log Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\Common Framework\Db\PrdMgr_ALGAR.log Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\VirusScan\AccessProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\VirusScan\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Network Associates\VirusScan\OnAccessScanLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde5.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde5.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde6.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde6.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde7.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde7.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde8.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde8.zip ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\WinInjectbw.zip/windows Infected: Trojan.Win32.Zapchast.dt skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\WinInjectbw.zip ZIP: infected - 1 skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Historial\History.IE5\MSHist012008012820080129\index.dat Object is locked skipped
C:\Documents and Settings\Salitre\Configuración local\Temp\JETCC10.tmp Object is locked skipped
C:\Documents and Settings\Salitre\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Salitre\Datos de programa\Opera\Opera\mail\indexer\indexer.dat Object is locked skipped
C:\Documents and Settings\Salitre\Datos de programa\Opera\Opera\mail\lexicon\lexicon.dat Object is locked skipped
C:\Documents and Settings\Salitre\Datos de programa\Opera\Opera\mail\mailbase.dat Object is locked skipped
C:\Documents and Settings\Salitre\ntuser.dat Object is locked skipped
C:\Documents and Settings\Salitre\ntuser.dat.LOG Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\ldywrhme.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnn skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\nuwmihae.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.dnn skipped
C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip/mljhfgf.dll Infected: Trojan-Downloader.Win32.Small.htw skipped
C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip/nuwmihae.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dnn skipped
C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip ZIP: infected - 3 skipped
C:\QooBox\Quarantine\catchme2008-01-28_160552.37.zip/gebcd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\QooBox\Quarantine\catchme2008-01-28_160552.37.zip/SHSTAT.EXE Infected: Trojan-Dropper.Win32.Agent.dgo skipped
C:\QooBox\Quarantine\catchme2008-01-28_160552.37.zip ZIP: infected - 2 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\A0115418.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.dyx skipped
C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\change.log Object is locked skipped
D:\Utils\Internet\O2\Broadband\vWTP.mdb Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\Toni_Jan\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar/Ner....2004.www.eMuleSoft.com.By.Ribera/NeroKey.exe Infected: Trojan.Win32.StartPage.afh skipped
E:\Toni_Jan\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar RAR: infected - 1 skipped
E:\Toni_Kim\0712\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar/Ner....2004.www.eMuleSoft.com.By.Ribera/NeroKey.exe Infected: Trojan.Win32.StartPage.afh skipped
E:\Toni_Kim\0712\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar RAR: infected - 1 skipped

Scan process completed.

======
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34:07 AM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Utils\Antivirus\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://createpdf.adobe.com/?Language=ENU
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Utils\Visors\AcrobatPro\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: PDF de Adobe - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ShowIcon_Chander_CRW Series Driver v1.17r019] "C:\Archivos de programa\CRW\shwicon.exe" -t"Chander\CRW Series Driver v1.17r019"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [LManager] C:\ARCHIV~1\LAUNCH~1\CPLFL32.EXE
O4 - HKLM\..\Run: [CloneCDTray] "D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Archivos de programa\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Archivos de programa\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Archivos de programa\Archivos comunes\Network Associates\TalkBack\tbmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Utils\Visors\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\RunOnce: [WIAWizardMenu] RUNDLL32.EXE C:\WINDOWS\system32\sti_ci.dll,WiaCreateWizardMenu
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\MSMSGS.EXE" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: toDO.lnk = C:\Documents and Settings\Salitre\Escritorio\toDO.txt
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = ?
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\Utils\Edicio\MSOffice\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Utils\Sistema\J2SE\bin\npjpi150_04.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Utils\Edicio\MSOffice\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe (file missing)
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {08FD87EF-2A15-11D1-AF00-00A0C91F4B89} (WebPlotCtl Class) - http://www.icv.gva.es/pags/webplot.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVR Control) - http://www.devalvr.com/instalacion/plugin/devalocx.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) - http://mapg.fmd.emory.edu/mgvinstall/mgaxctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9971703-8C00-4272-BB13-6555140CB2AF}: NameServer = 80.58.61.250,80.58.61.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 7524 bytes

katana · Jan 30, 2008

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:
1. If you don't know, stop and ask! Don't keep going on.
2. Please reply to this thread. Do not start a new topic.
3. Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those three things, everything should go smoothly

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.

Do you have the latest ComboFix Log ?
C:\combofix.txt

loger.ock · Jan 30, 2008

Latest comobofix log

Hi katana,

Thanks your interest, however I got a bit desperate and I took some actions (as you can see from my other thread) which I am not sure if have been catastrophic. I would very much appreciate if you could help me to sort out some of the questions I have. I definitely agree with you, since I believe there is still something wrong in the computer.

Here is my latest combofix log:
===========
ComboFix 08-01-21.7 - Salitre 2008-01-28 15:46:39.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.3082.18.230 [GMT -5:00]
Se ejecuta desde: C:\Documents and Settings\Salitre\Escritorio\ComboFix.exe

ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Archivos de programa\Network Associates\VirusScan\SHSTAT .EXE
C:\Archivos de programa\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\system32\ctfmon .exe
C:\WINDOWS\system32\dcbeg.ini
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\gebcd.dll
C:\WINDOWS\system32\gebcd.exe

Code:

 <pre>
C:\Archivos de programa\Network Associates\VirusScan\SHSTAT .EXE ---> QooBox
C:\WINDOWS\system32\ctfmon .exe ---> QooBox
</pre>

.
.
(((((((((((((((((( Archivos creados desde 2007-12-28 - 2008-01-28 )))))))))))))))))))))))))))))))))
.

2008-01-28 14:41 . 2004-08-03 23:00 261,904 --a------ C:\cmldr
2008-01-27 12:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-21 18:24 . 2008-01-27 11:11 352 --a------ C:\WINDOWS\wininit.ini
2008-01-20 15:39 . 2008-01-20 15:46 221 --a------ C:\WINDOWS\ao97pr.ini
2008-01-20 15:28 . 2008-01-20 15:46 1,537 --a------ C:\WINDOWS\aoxppr.ini
2008-01-20 14:56 . 2008-01-20 14:56 <DIR> d-------- C:\Archivos de programa\ElcomSoft
2008-01-20 14:56 . 2008-01-20 15:22 1,892 --a------ C:\WINDOWS\aopr.ini

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-20 20:03 --------- d-----w C:\Archivos de programa\Launch Manager
2008-01-20 20:03 --------- d-----w C:\Archivos de programa\CRW
2005-09-18 01:20 1,890 --sh--w C:\WINDOWS\system32\KGyGaAvL.sys
.

Code:

<pre>
----a-w         1,694,208 2008-01-21 19:29:09  C:\Archivos de programa\Messenger\MSMSGS .EXE
</pre>

((((((((((((((((((((((((((((( snapshot@2008-01-27_14.13.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-27 17:40:23 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
+ 2008-01-28 20:44:48 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
- 2008-01-27 17:40:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-28 20:44:48 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-27 17:40:25 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-28 20:44:48 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-27 17:40:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-28 20:44:48 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-27 17:40:26 9,752,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-28 20:44:49 9,752,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-27 17:40:27 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-28 20:44:50 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-21 17:25 15360]
"MSMSGS"="C:\Archivos de programa\Messenger\MSMSGS.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 08:41 88363 C:\WINDOWS\AGRSMMSG.exe]
"SynTPLpr"="C:\Archivos de programa\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Archivos de programa\Synaptics\SynTP\SynTPEnh.exe" [ ]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"ShowIcon_Chander_CRW Series Driver v1.17r019"="C:\Archivos de programa\CRW\shwicon.exe" [ ]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"LManager"="C:\ARCHIV~1\LAUNCH~1\CPLFL32.EXE" [ ]
"CloneCDTray"="D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" [2004-06-27 21:33 57344]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [ ]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [ ]
"ShStatEXE"="C:\Archivos de programa\Network Associates\VirusScan\SHSTAT.exe" [ ]
"McAfeeUpdaterUI"="C:\Archivos de programa\Network Associates\Common Framework\UpdaterUI.exe" [ ]
"Network Associates Error Reporting Service"="C:\Archivos de programa\Archivos comunes\Network Associates\TalkBack\tbmon.exe" [ ]
"QuickTime Task"="D:\Utils\Visors\QuickTime\qttask.exe" [2006-03-21 20:16 155648]
"HP Software Update"="D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"="C:\WINDOWS\system32\sti_ci.dll" [2004-08-19 17:42 137728]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-01-21 17:25 15360]

C:\Documents and Settings\Salitre\Men£ Inicio\Programas\Inicio\
toDO.lnk - C:\Documents and Settings\Salitre\Escritorio\toDO.txt [2006-07-22 23:35:42 2948]

R0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 05:39]
R2 portD;CMS PortIO Service;C:\WINDOWS\system32\DRIVERS\portd2k.sys [2004-02-23 08:40]
R3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 04:43]
S3 C-Dilla;C-Dilla;C:\WINDOWS\System32\drivers\CDANT.SYS [2001-09-10 18:09]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []
S3 usbscan;Controlador de escáner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 00:58]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 01:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{606c57c1-5d67-11dc-80d6-000e353a08d7}]
\Shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{606c57c3-5d67-11dc-80d6-000e353a08d7}]
\Shell\AutoRun\command - H:\AutoRun.exe

*Newly Created Service* - ENTDRV51
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 16:06:16
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2008-01-28 16:09:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-28 21:09:40
ComboFix2.txt 2008-01-27 19:15:07
.
2008-01-14 21:20:46 --- E O F ---

katana · Jan 31, 2008

You had a file infector virus, and it looks like a lot of files got deleted somwhere along they way.
Any programs that don't work properly will need to be reinstalled.

Submit a File For Analysis
We need to have the files below Scanned by Uploading them/it to Virus Total

Please visit Virustotal
Copy/paste the the following file path into the window
C:\WINDOWS\ao97pr.ini
Click Submit/Send File
Please post back, to let me know the results.

Please do the same for the following file
C:\WINDOWS\aoxppr.ini
C:\WINDOWS\aopr.ini

If Virustotal is too busy please try Jotti

Custom CFScript

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code:

RenV::
C:\Archivos de programa\Messenger\MSMSGS .EXE

File::
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde5.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde6.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde7.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde8.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\WinInjectbw.zip
Folder::
Driver::
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"=-
"SynTPLpr"=-
"SynTPEnh"=-
"ShowIcon_Chander_CRW Series Driver v1.17r019"=-
"IgfxTray"=-
"HotKeysCmds"=-
"LManager"=-
"NeroFilterCheck"=-
"snpstd"=-
"ShStatEXE"=-
"McAfeeUpdaterUI"=-
"Network Associates Error Reporting Service"=-
"HPDJ Taskbar Utility"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"WIAWizardMenu"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{606c57c1-5d67-11dc-80d6-000e353a08d7}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{606c57c3-5d67-11dc-80d6-000e353a08d7}]

Save this as CFScript.txt and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Installed Programs
Please could you give me a list of the programs that are installed.

Start HijackThis
Click on the Config button
Click on the Misc Tools button
Click on the Open Uninstall Manager button.

You will see a list with the programs installed in your computer.
Click on save list button and specify where you would like to save this file.
When you press Save button a notepad will open with the contents of that file.
Simply copy and paste the contents of that notepad into your next post.

TotalScan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
Please go to this site Link >> TotalScan << LINK

Under Scan Now click the Full Scan button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV
When the scan is finished, a report will be generated
Next to Scan Details click the small Save button and save the report to your desktop.
Please post the report in your reply.

Please post all the logs in reply

loger.ock · Jan 31, 2008

Virtumondo and others

Hi katana,

Here are the results from VirusTotal:
C:\WINDOWS\ao97pr.ini
============================
Análisis del archivo ao97pr.ini recibido el 31.01.2008 20:00:09 (CET)
Estado actual: análisis terminado
Resultado: 0/31 (0%)

Motor antivirus Versión Última actualización Resultado
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Información adicional
Tamano archivo: 221 bytes
MD5: edb811d40fc7c5a04a523f9768c94759
SHA1: 72bbccbee8e9c19debb1b0143e6ccf041ac79a12
PEiD: -

C:\WINDOWS\aoxppr.ini
============================
File aoxppr.ini received on 01.31.2008 20:25:03 (CET)
Current status: finished
Result: 0/32 (0%)

Antivirus Version Last Update Result
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Prevx1 V2 2008.01.31 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Additional information
File size: 1537 bytes
MD5: dd9855f72e3978c946291a41ab6b4e0e
SHA1: 4c8f309431feed1b1699fa2bf32c41d742b32c1c
PEiD: -

C:\WINDOWS\aopr.ini
============================
File aopr.ini received on 01.31.2008 20:32:39 (CET)
Current status: finished
Result: 0/32 (0%)

Antivirus Version Last Update Result
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Prevx1 V2 2008.01.31 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Additional information
File size: 1892 bytes
MD5: 09c2b3174b5a942dc2719ebd8d7ae708
SHA1: a3080edc61170d4c7a725e483ee73518590d9725
PEiD: -

CFScript.txt log
==================================
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-25 16:56 8,496,640 ------w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 15:01 2,109,440 ------w C:\WINDOWS\system32\dllcache\wmvcore.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\wmasf.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-11 06:12 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 06:12 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-10-11 06:12 662,016 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 06:12 616,448 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 06:12 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 06:12 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 06:12 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 06:12 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 06:12 1,056,256 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2005-09-18 01:20 1,890 --sh--w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_14.13.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-27 17:40:23 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
- 2008-01-27 17:40:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-31 19:52:54 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-27 17:40:25 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-27 17:40:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-31 19:52:55 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-27 17:40:26 9,752,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-31 19:52:55 9,760,768 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-27 17:40:27 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-31 19:52:55 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-21 17:25 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 08:41 88363 C:\WINDOWS\AGRSMMSG.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"CloneCDTray"="D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" [2004-06-27 21:33 57344]
"QuickTime Task"="D:\Utils\Visors\QuickTime\qttask.exe" [2006-03-21 20:16 155648]
"HP Software Update"="D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-01-21 17:25 15360]

C:\Documents and Settings\Salitre\Men£ Inicio\Programas\Inicio\
toDO.lnk - C:\Documents and Settings\Salitre\Escritorio\toDO.txt [2006-07-22 23:35:42 2916]

R0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 05:39]
R2 portD;CMS PortIO Service;C:\WINDOWS\system32\DRIVERS\portd2k.sys [2004-02-23 08:40]
R3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 04:43]
S3 C-Dilla;C-Dilla;C:\WINDOWS\System32\drivers\CDANT.SYS [2001-09-10 18:09]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []
S3 usbscan;Controlador de escáner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 00:58]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 01:08]

*Newly Created Service* - ENTDRV51
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 14:55:55
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2008-01-31 14:57:57
ComboFix-quarantined-files.txt 2008-01-31 19:57:42
ComboFix2.txt 2008-01-28 21:09:44
ComboFix3.txt 2008-01-27 19:15:07
.
2008-01-14 21:20:46 --- E O F ---

Uninstall list from HJT
=============================
Actualización de seguridad para el Reproductor de Windows Media (KB911564)
Actualización de seguridad para el Reproductor de Windows Media 6.4 (KB925398)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB911565)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB917734)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB936782)
Actualización de seguridad para Windows XP (KB890046)
Actualización de seguridad para Windows XP (KB893066)
Actualización de seguridad para Windows XP (KB893756)
Actualización de seguridad para Windows XP (KB896358)
Actualización de seguridad para Windows XP (KB896422)
Actualización de seguridad para Windows XP (KB896423)
Actualización de seguridad para Windows XP (KB896424)
Actualización de seguridad para Windows XP (KB896428)
Actualización de seguridad para Windows XP (KB896688)
Actualización de seguridad para Windows XP (KB899587)
Actualización de seguridad para Windows XP (KB899588)
Actualización de seguridad para Windows XP (KB899591)
Actualización de seguridad para Windows XP (KB900725)
Actualización de seguridad para Windows XP (KB901017)
Actualización de seguridad para Windows XP (KB901214)
Actualización de seguridad para Windows XP (KB902400)
Actualización de seguridad para Windows XP (KB905414)
Actualización de seguridad para Windows XP (KB905749)
Actualización de seguridad para Windows XP (KB905915)
Actualización de seguridad para Windows XP (KB908519)
Actualización de seguridad para Windows XP (KB908531)
Actualización de seguridad para Windows XP (KB911280)
Actualización de seguridad para Windows XP (KB911562)
Actualización de seguridad para Windows XP (KB911567)
Actualización de seguridad para Windows XP (KB911927)
Actualización de seguridad para Windows XP (KB912812)
Actualización de seguridad para Windows XP (KB912919)
Actualización de seguridad para Windows XP (KB913446)
Actualización de seguridad para Windows XP (KB913580)
Actualización de seguridad para Windows XP (KB914388)
Actualización de seguridad para Windows XP (KB914389)
Actualización de seguridad para Windows XP (KB916281)
Actualización de seguridad para Windows XP (KB917159)
Actualización de seguridad para Windows XP (KB917344)
Actualización de seguridad para Windows XP (KB917422)
Actualización de seguridad para Windows XP (KB917953)
Actualización de seguridad para Windows XP (KB918118)
Actualización de seguridad para Windows XP (KB918439)
Actualización de seguridad para Windows XP (KB918899)
Actualización de seguridad para Windows XP (KB919007)
Actualización de seguridad para Windows XP (KB920213)
Actualización de seguridad para Windows XP (KB920214)
Actualización de seguridad para Windows XP (KB920670)
Actualización de seguridad para Windows XP (KB920683)
Actualización de seguridad para Windows XP (KB920685)
Actualización de seguridad para Windows XP (KB921398)
Actualización de seguridad para Windows XP (KB921503)
Actualización de seguridad para Windows XP (KB921883)
Actualización de seguridad para Windows XP (KB922616)
Actualización de seguridad para Windows XP (KB922760)
Actualización de seguridad para Windows XP (KB922819)
Actualización de seguridad para Windows XP (KB923191)
Actualización de seguridad para Windows XP (KB923414)
Actualización de seguridad para Windows XP (KB923689)
Actualización de seguridad para Windows XP (KB923694)
Actualización de seguridad para Windows XP (KB923980)
Actualización de seguridad para Windows XP (KB924191)
Actualización de seguridad para Windows XP (KB924270)
Actualización de seguridad para Windows XP (KB924496)
Actualización de seguridad para Windows XP (KB924667)
Actualización de seguridad para Windows XP (KB925454)
Actualización de seguridad para Windows XP (KB925486)
Actualización de seguridad para Windows XP (KB925902)
Actualización de seguridad para Windows XP (KB926255)
Actualización de seguridad para Windows XP (KB926436)
Actualización de seguridad para Windows XP (KB927779)
Actualización de seguridad para Windows XP (KB927802)
Actualización de seguridad para Windows XP (KB928090)
Actualización de seguridad para Windows XP (KB928255)
Actualización de seguridad para Windows XP (KB928843)
Actualización de seguridad para Windows XP (KB929123)
Actualización de seguridad para Windows XP (KB929969)
Actualización de seguridad para Windows XP (KB930178)
Actualización de seguridad para Windows XP (KB931261)
Actualización de seguridad para Windows XP (KB931768)
Actualización de seguridad para Windows XP (KB931784)
Actualización de seguridad para Windows XP (KB932168)
Actualización de seguridad para Windows XP (KB933566)
Actualización de seguridad para Windows XP (KB933729)
Actualización de seguridad para Windows XP (KB935839)
Actualización de seguridad para Windows XP (KB935840)
Actualización de seguridad para Windows XP (KB936021)
Actualización de seguridad para Windows XP (KB937143)
Actualización de seguridad para Windows XP (KB938127)
Actualización de seguridad para Windows XP (KB938829)
Actualización de seguridad para Windows XP (KB939653)
Actualización de seguridad para Windows XP (KB941202)
Actualización de seguridad para Windows XP (KB941568)
Actualización de seguridad para Windows XP (KB941569)
Actualización de seguridad para Windows XP (KB941644)
Actualización de seguridad para Windows XP (KB942615)
Actualización de seguridad para Windows XP (KB943460)
Actualización de seguridad para Windows XP (KB943485)
Actualización de seguridad para Windows XP (KB944653)
Actualización para Windows XP (KB898461)
Actualización para Windows XP (KB900485)
Actualización para Windows XP (KB904942)
Actualización para Windows XP (KB910437)
Actualización para Windows XP (KB916595)
Actualización para Windows XP (KB920872)
Actualización para Windows XP (KB922582)
Actualización para Windows XP (KB927891)
Actualización para Windows XP (KB929338)
Actualización para Windows XP (KB930916)
Actualización para Windows XP (KB931836)
Actualización para Windows XP (KB933360)
Actualización para Windows XP (KB936357)
Actualización para Windows XP (KB938828)
Actualización para Windows XP (KB942763)
Actualización para Windows XP (KB942840)
Actualización para Windows XP (KB946627)
Adobe Acrobat 6.0 Professional - Español, Italiano, Português
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0
Agere Systems AC'97 Modem
Aspire Series
ATI - Utilidad de desinstalación de software
ATI Control Panel
ATI Display Driver
AutoCAD 2006 - Español
BounceBack Express
CDex extraction audio
C-Dilla Licence Management System
CloneCD
CloneDVD2
Creative DVD Audio Plugin for Audigy Series
CRW Series Driver v1.17r019
DAEMON Tools
DevalVR para Internet Explorer (eliminar)
DivX Web Player
Ejecutable GTK+ 2.6.9 rev a (sólo para eliminar)
EPSON Scan
ER Mapper Imagery Plug-in v2.1 for AutoCAD
ER Viewer 2.0e
Gaim (sólo eliminar)
HijackThis 2.0.2
HP Deskjet 3900 series
HP Software Update
HP Solution Center & Imaging Support Tools 5.0
Indeo® Software
InterVideo WinDVD 6
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_01
Kaspersky Online Scanner
Launch Manager
MATLAB Family of Products Release 14
McAfee VirusScan Enterprise
MicroSim EVAL 8
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Spanish Language Pack
Microsoft Data Access Components KB870669
Microsoft Office Professional Edition 2003
Mpeg Layer3 Codec FHG-Radium v1.263
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Nero OEM
O2 Broadband USB Modem
Opera 9.10
Oxford English Dictionary
PowerQuest PartitionMagic 8.0
QuickTime
RealPlayer
Realtek AC'97 Audio
Remove DivX Pro Codec
Revisión de Windows XP - KB873333
Revisión de Windows XP - KB873339
Revisión de Windows XP - KB885250
Revisión de Windows XP - KB885835
Revisión de Windows XP - KB885836
Revisión de Windows XP - KB886185
Revisión de Windows XP - KB887472
Revisión de Windows XP - KB887742
Revisión de Windows XP - KB888113
Revisión de Windows XP - KB888302
Revisión de Windows XP - KB890859
Revisión de Windows XP - KB891781
Revisión de Windows XP - KB893086
Revisión del Reproductor de Windows Media 9 [Para más información, consulte KB885492]
Skype™ 3.5
SMSC IrCC Driver V5.1.2462.0 (WinXP)
Spybot - Search & Destroy 1.4
Synaptics Pointing Device Driver
The Cleaner
TRUST 120 SPACEC@M
TVUPlayer 1.5.12
VanDyke Software SecureCRT 5.0
VoipBuster 2.08 build 277
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows XP Service Pack 2
WinRAR archiver
WinZip

part 1 of 2

loger.ock · Jan 31, 2008

Virtumondo and others

Hi katana,

Here are the results from VirusTotal:
C:\WINDOWS\ao97pr.ini
============================
Análisis del archivo ao97pr.ini recibido el 31.01.2008 20:00:09 (CET)
Estado actual: análisis terminado
Resultado: 0/31 (0%)

Motor antivirus Versión Última actualización Resultado
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Información adicional
Tamano archivo: 221 bytes
MD5: edb811d40fc7c5a04a523f9768c94759
SHA1: 72bbccbee8e9c19debb1b0143e6ccf041ac79a12
PEiD: -

C:\WINDOWS\aoxppr.ini
============================
File aoxppr.ini received on 01.31.2008 20:25:03 (CET)
Current status: finished
Result: 0/32 (0%)

Antivirus Version Last Update Result
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Prevx1 V2 2008.01.31 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Additional information
File size: 1537 bytes
MD5: dd9855f72e3978c946291a41ab6b4e0e
SHA1: 4c8f309431feed1b1699fa2bf32c41d742b32c1c
PEiD: -

C:\WINDOWS\aopr.ini
============================
File aopr.ini received on 01.31.2008 20:32:39 (CET)
Current status: finished
Result: 0/32 (0%)

Antivirus Version Last Update Result
AhnLab-V3 2008.2.1.10 2008.01.31 -
AntiVir 7.6.0.59 2008.01.31 -
Authentium 4.93.8 2008.01.31 -
Avast 4.7.1098.0 2008.01.31 -
AVG 7.5.0.516 2008.01.31 -
BitDefender 7.2 2008.01.31 -
CAT-QuickHeal 9.00 2008.01.30 -
ClamAV 0.92 2008.01.31 -
DrWeb 4.44.0.09170 2008.01.31 -
eSafe 7.0.15.0 2008.01.28 -
eTrust-Vet 31.3.5500 2008.01.31 -
Ewido 4.0 2008.01.31 -
FileAdvisor 1 2008.01.31 -
Fortinet 3.14.0.0 2008.01.31 -
F-Prot 4.4.2.54 2008.01.30 -
F-Secure 6.70.13260.0 2008.01.31 -
Ikarus T3.1.1.20 2008.01.31 -
Kaspersky 7.0.0.125 2008.01.31 -
McAfee 5220 2008.01.31 -
Microsoft 1.3109 2008.01.31 -
NOD32v2 2840 2008.01.31 -
Norman 5.80.02 2008.01.31 -
Panda 9.0.0.4 2008.01.30 -
Prevx1 V2 2008.01.31 -
Rising 20.29.22.00 2008.01.30 -
Sophos 4.25.0 2008.01.31 -
Sunbelt 2.2.907.0 2008.01.31 -
Symantec 10 2008.01.31 -
TheHacker 6.2.9.203 2008.01.30 -
VBA32 3.12.2.6 2008.01.31 -
VirusBuster 4.3.26:9 2008.01.31 -
Webwasher-Gateway 6.6.2 2008.01.31 -

Additional information
File size: 1892 bytes
MD5: 09c2b3174b5a942dc2719ebd8d7ae708
SHA1: a3080edc61170d4c7a725e483ee73518590d9725
PEiD: -

CFScript.txt log
==================================
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-25 16:56 8,496,640 ------w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 15:01 2,109,440 ------w C:\WINDOWS\system32\dllcache\wmvcore.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\wmasf.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-11 06:12 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 06:12 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-10-11 06:12 662,016 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 06:12 616,448 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 06:12 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 06:12 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 06:12 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 06:12 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 06:12 1,056,256 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2005-09-18 01:20 1,890 --sh--w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_14.13.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-27 17:40:23 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
- 2008-01-27 17:40:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-31 19:52:54 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-27 17:40:25 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-27 17:40:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-31 19:52:55 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-27 17:40:26 9,752,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-31 19:52:55 9,760,768 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-27 17:40:27 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-31 19:52:55 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-21 17:25 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 08:41 88363 C:\WINDOWS\AGRSMMSG.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"CloneCDTray"="D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" [2004-06-27 21:33 57344]
"QuickTime Task"="D:\Utils\Visors\QuickTime\qttask.exe" [2006-03-21 20:16 155648]
"HP Software Update"="D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-01-21 17:25 15360]

C:\Documents and Settings\Salitre\Men£ Inicio\Programas\Inicio\
toDO.lnk - C:\Documents and Settings\Salitre\Escritorio\toDO.txt [2006-07-22 23:35:42 2916]

R0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 05:39]
R2 portD;CMS PortIO Service;C:\WINDOWS\system32\DRIVERS\portd2k.sys [2004-02-23 08:40]
R3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 04:43]
S3 C-Dilla;C-Dilla;C:\WINDOWS\System32\drivers\CDANT.SYS [2001-09-10 18:09]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []
S3 usbscan;Controlador de escáner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 00:58]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 01:08]

*Newly Created Service* - ENTDRV51
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 14:55:55
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2008-01-31 14:57:57
ComboFix-quarantined-files.txt 2008-01-31 19:57:42
ComboFix2.txt 2008-01-28 21:09:44
ComboFix3.txt 2008-01-27 19:15:07
.
2008-01-14 21:20:46 --- E O F ---

Uninstall list from HJT
=============================
Actualización de seguridad para el Reproductor de Windows Media (KB911564)
Actualización de seguridad para el Reproductor de Windows Media 6.4 (KB925398)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB911565)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB917734)
Actualización de seguridad para el Reproductor de Windows Media 9 (KB936782)
Actualización de seguridad para Windows XP (KB890046)
Actualización de seguridad para Windows XP (KB893066)
Actualización de seguridad para Windows XP (KB893756)
Actualización de seguridad para Windows XP (KB896358)
Actualización de seguridad para Windows XP (KB896422)
Actualización de seguridad para Windows XP (KB896423)
Actualización de seguridad para Windows XP (KB896424)
Actualización de seguridad para Windows XP (KB896428)
Actualización de seguridad para Windows XP (KB896688)
Actualización de seguridad para Windows XP (KB899587)
Actualización de seguridad para Windows XP (KB899588)
Actualización de seguridad para Windows XP (KB899591)
Actualización de seguridad para Windows XP (KB900725)
Actualización de seguridad para Windows XP (KB901017)
Actualización de seguridad para Windows XP (KB901214)
Actualización de seguridad para Windows XP (KB902400)
Actualización de seguridad para Windows XP (KB905414)
Actualización de seguridad para Windows XP (KB905749)
Actualización de seguridad para Windows XP (KB905915)
Actualización de seguridad para Windows XP (KB908519)
Actualización de seguridad para Windows XP (KB908531)
Actualización de seguridad para Windows XP (KB911280)
Actualización de seguridad para Windows XP (KB911562)
Actualización de seguridad para Windows XP (KB911567)
Actualización de seguridad para Windows XP (KB911927)
Actualización de seguridad para Windows XP (KB912812)
Actualización de seguridad para Windows XP (KB912919)
Actualización de seguridad para Windows XP (KB913446)
Actualización de seguridad para Windows XP (KB913580)
Actualización de seguridad para Windows XP (KB914388)
Actualización de seguridad para Windows XP (KB914389)
Actualización de seguridad para Windows XP (KB916281)
Actualización de seguridad para Windows XP (KB917159)
Actualización de seguridad para Windows XP (KB917344)
Actualización de seguridad para Windows XP (KB917422)
Actualización de seguridad para Windows XP (KB917953)
Actualización de seguridad para Windows XP (KB918118)
Actualización de seguridad para Windows XP (KB918439)
Actualización de seguridad para Windows XP (KB918899)
Actualización de seguridad para Windows XP (KB919007)
Actualización de seguridad para Windows XP (KB920213)
Actualización de seguridad para Windows XP (KB920214)
Actualización de seguridad para Windows XP (KB920670)
Actualización de seguridad para Windows XP (KB920683)
Actualización de seguridad para Windows XP (KB920685)
Actualización de seguridad para Windows XP (KB921398)
Actualización de seguridad para Windows XP (KB921503)
Actualización de seguridad para Windows XP (KB921883)
Actualización de seguridad para Windows XP (KB922616)
Actualización de seguridad para Windows XP (KB922760)
Actualización de seguridad para Windows XP (KB922819)
Actualización de seguridad para Windows XP (KB923191)
Actualización de seguridad para Windows XP (KB923414)
Actualización de seguridad para Windows XP (KB923689)
Actualización de seguridad para Windows XP (KB923694)
Actualización de seguridad para Windows XP (KB923980)
Actualización de seguridad para Windows XP (KB924191)
Actualización de seguridad para Windows XP (KB924270)
Actualización de seguridad para Windows XP (KB924496)
Actualización de seguridad para Windows XP (KB924667)
Actualización de seguridad para Windows XP (KB925454)
Actualización de seguridad para Windows XP (KB925486)
Actualización de seguridad para Windows XP (KB925902)
Actualización de seguridad para Windows XP (KB926255)
Actualización de seguridad para Windows XP (KB926436)
Actualización de seguridad para Windows XP (KB927779)
Actualización de seguridad para Windows XP (KB927802)
Actualización de seguridad para Windows XP (KB928090)
Actualización de seguridad para Windows XP (KB928255)
Actualización de seguridad para Windows XP (KB928843)
Actualización de seguridad para Windows XP (KB929123)
Actualización de seguridad para Windows XP (KB929969)
Actualización de seguridad para Windows XP (KB930178)
Actualización de seguridad para Windows XP (KB931261)
Actualización de seguridad para Windows XP (KB931768)
Actualización de seguridad para Windows XP (KB931784)
Actualización de seguridad para Windows XP (KB932168)
Actualización de seguridad para Windows XP (KB933566)
Actualización de seguridad para Windows XP (KB933729)
Actualización de seguridad para Windows XP (KB935839)
Actualización de seguridad para Windows XP (KB935840)
Actualización de seguridad para Windows XP (KB936021)
Actualización de seguridad para Windows XP (KB937143)
Actualización de seguridad para Windows XP (KB938127)
Actualización de seguridad para Windows XP (KB938829)
Actualización de seguridad para Windows XP (KB939653)
Actualización de seguridad para Windows XP (KB941202)
Actualización de seguridad para Windows XP (KB941568)
Actualización de seguridad para Windows XP (KB941569)
Actualización de seguridad para Windows XP (KB941644)
Actualización de seguridad para Windows XP (KB942615)
Actualización de seguridad para Windows XP (KB943460)
Actualización de seguridad para Windows XP (KB943485)
Actualización de seguridad para Windows XP (KB944653)
Actualización para Windows XP (KB898461)
Actualización para Windows XP (KB900485)
Actualización para Windows XP (KB904942)
Actualización para Windows XP (KB910437)
Actualización para Windows XP (KB916595)
Actualización para Windows XP (KB920872)
Actualización para Windows XP (KB922582)
Actualización para Windows XP (KB927891)
Actualización para Windows XP (KB929338)
Actualización para Windows XP (KB930916)
Actualización para Windows XP (KB931836)
Actualización para Windows XP (KB933360)
Actualización para Windows XP (KB936357)
Actualización para Windows XP (KB938828)
Actualización para Windows XP (KB942763)
Actualización para Windows XP (KB942840)
Actualización para Windows XP (KB946627)
Adobe Acrobat 6.0 Professional - Español, Italiano, Português
Adobe Flash Player 9 ActiveX
Adobe Reader 7.0
Agere Systems AC'97 Modem
Aspire Series
ATI - Utilidad de desinstalación de software
ATI Control Panel
ATI Display Driver
AutoCAD 2006 - Español
BounceBack Express
CDex extraction audio
C-Dilla Licence Management System
CloneCD
CloneDVD2
Creative DVD Audio Plugin for Audigy Series
CRW Series Driver v1.17r019
DAEMON Tools
DevalVR para Internet Explorer (eliminar)
DivX Web Player
Ejecutable GTK+ 2.6.9 rev a (sólo para eliminar)
EPSON Scan
ER Mapper Imagery Plug-in v2.1 for AutoCAD
ER Viewer 2.0e
Gaim (sólo eliminar)
HijackThis 2.0.2
HP Deskjet 3900 series
HP Software Update
HP Solution Center & Imaging Support Tools 5.0
Indeo® Software
InterVideo WinDVD 6
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_01
Kaspersky Online Scanner
Launch Manager
MATLAB Family of Products Release 14
McAfee VirusScan Enterprise
MicroSim EVAL 8
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Spanish Language Pack
Microsoft Data Access Components KB870669
Microsoft Office Professional Edition 2003
Mpeg Layer3 Codec FHG-Radium v1.263
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Nero OEM
O2 Broadband USB Modem
Opera 9.10
Oxford English Dictionary
PowerQuest PartitionMagic 8.0
QuickTime
RealPlayer
Realtek AC'97 Audio
Remove DivX Pro Codec
Revisión de Windows XP - KB873333
Revisión de Windows XP - KB873339
Revisión de Windows XP - KB885250
Revisión de Windows XP - KB885835
Revisión de Windows XP - KB885836
Revisión de Windows XP - KB886185
Revisión de Windows XP - KB887472
Revisión de Windows XP - KB887742
Revisión de Windows XP - KB888113
Revisión de Windows XP - KB888302
Revisión de Windows XP - KB890859
Revisión de Windows XP - KB891781
Revisión de Windows XP - KB893086
Revisión del Reproductor de Windows Media 9 [Para más información, consulte KB885492]
Skype™ 3.5
SMSC IrCC Driver V5.1.2462.0 (WinXP)
Spybot - Search & Destroy 1.4
Synaptics Pointing Device Driver
The Cleaner
TRUST 120 SPACEC@M
TVUPlayer 1.5.12
VanDyke Software SecureCRT 5.0
VoipBuster 2.08 build 277
Winamp (remove only)
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Live Messenger
Windows XP Service Pack 2
WinRAR archiver
WinZip

part 1 of 2

loger.ock · Jan 31, 2008

Virtumondo and others - part 2

TotalScan report
========================
;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-01-31 17:51:27
PROTECTIONS: 1
MALWARE: 8
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
McAfee VirusScan Enterprise 8.0.0.912 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00193523 Adware/Startpage.ADT Adware No 0 No No E:\Toni_Jan\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar[Nero.Burning.Rom.6.3.1.6.Españo.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera\NeroKey.exe]
00193523 Adware/Startpage.ADT Adware No 0 No No E:\Toni_Kim\0712\Nero.Burning.Rom.6.3.1.6.Español.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera.rar[Nero.Burning.Rom.6.3.1.6.Españo.Serial.Plugins.2004.www.eMuleSoft.com.By.Ribera\NeroKey.exe]
00279006 Adware/StartPage.ATU Adware No 1 Yes No E:\DivX\XviD.MPEG-4.video.codec.v.2.1 (XVID DIVX DX50)(3)(2).exe
01262593 Application/NirCmd.A HackTools No 0 No No E:\Tenp2\Virusfix\ComboFix.exe[nircmd.com]
01262593 Application/NirCmd.A HackTools No 0 No No E:\Tenp2\Virusfix\ComboFix.exe[nircmd.cfexe]
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Salitre\Escritorio\ComboFix.exe[nircmd.cfexe]
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\WINDOWS\Nircmd.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP760\A0115878.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\A0115852.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP755\A0115269.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP756\A0115331.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP757\A0115354.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP757\A0115368.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP758\A0115391.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP758\A0115405.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\A0115460.com
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\Salitre\Escritorio\ComboFix.exe[nircmd.com]
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\A0115433.sys
02892536 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\ldywrhme.dll.vir
02892536 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\nuwmihae.dll.vir
02892536 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip[nuwmihae.dll]
02893506 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\rkvigksr.dll.vir
02893586 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\catchme2008-01-28_160552.37.zip[gebcd.dll]
02893586 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\catchme2008-01-27_134029.03.zip[gebcd.dll]
02893586 Spyware/Virtumonde Spyware No 1 Yes No C:\System Volume Information\_restore{EF28BDC4-6FE9-4D25-9AE0-D6129AD748F9}\RP759\A0115418.dll
02895042 Spyware/Virtumonde Spyware No 1 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\onpxlxfu.dll.vir
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

katana · Jan 31, 2008

Please can you post the ComboFix log again, it looks like some got cut off

C:\Combofix.txt

loger.ock · Feb 1, 2008

Combofix log

ComboFix 08-01-21.7 - Salitre 2008-01-31 14:53:23.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.3082.18.213 [GMT -5:00]
Se ejecuta desde: C:\Documents and Settings\Salitre\Escritorio\ComboFix.exe
Command switches used :: C:\Documents and Settings\Salitre\Escritorio\CFScript.txt
* Creado un nuevo punto de restauración

ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!

FILE
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde5.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde6.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde7.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde8.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\WinInjectbw.zip
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde5.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde6.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde7.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\Virtumonde8.zip
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\WinInjectbw.zip

.
(((((((((((((((((( Archivos creados desde 2007-12-28 - 2008-01-31 )))))))))))))))))))))))))))))))))
.

2008-01-28 16:45 . 2008-01-28 16:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-28 14:41 . 2004-08-03 23:00 261,904 --a------ C:\cmldr
2008-01-27 12:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-21 18:24 . 2008-01-27 11:11 352 --a------ C:\WINDOWS\wininit.ini
2008-01-20 15:39 . 2008-01-20 15:46 221 --a------ C:\WINDOWS\ao97pr.ini
2008-01-20 15:28 . 2008-01-20 15:46 1,537 --a------ C:\WINDOWS\aoxppr.ini
2008-01-20 14:56 . 2008-01-20 14:56 <DIR> d-------- C:\Archivos de programa\ElcomSoft
2008-01-20 14:56 . 2008-01-20 15:22 1,892 --a------ C:\WINDOWS\aopr.ini

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 22:25 15,360 ----a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
2008-01-21 22:25 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-01-20 20:03 --------- d-----w C:\Archivos de programa\Launch Manager
2008-01-20 20:03 --------- d-----w C:\Archivos de programa\CRW
2007-11-14 07:28 450,560 ------w C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-07 09:28 726,528 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:28 726,528 ------w C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 17:20 360,064 ------w C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-30 10:17 3,079,680 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,293,824 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-25 16:56 8,496,640 ------w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 15:01 2,109,440 ------w C:\WINDOWS\system32\dllcache\wmvcore.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\wmasf.dll
2007-10-25 15:00 230,912 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-11 06:12 96,768 ------w C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 06:12 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2007-10-11 06:12 662,016 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 06:12 616,448 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 06:12 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 06:12 532,480 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 06:12 474,624 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 06:12 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 06:12 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 06:12 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 06:12 251,392 ------w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 06:12 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 06:12 16,384 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 06:12 151,552 ------w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 06:12 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 06:12 1,495,040 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 06:12 1,056,256 ------w C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 06:12 1,023,488 ------w C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe
2005-09-18 01:20 1,890 --sh--w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_14.13.14.00 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-27 17:40:23 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
- 2008-01-27 17:40:24 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-31 19:52:54 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-27 17:40:25 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-31 19:52:54 1,421,312 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-27 17:40:25 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-31 19:52:55 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-27 17:40:26 9,752,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-31 19:52:55 9,760,768 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-27 17:40:27 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-31 19:52:55 110,592 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-01-21 17:25 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-02-09 09:54 65024 C:\WINDOWS\SOUNDMAN.EXE]
"AGRSMMSG"="AGRSMMSG.exe" [2003-11-19 08:41 88363 C:\WINDOWS\AGRSMMSG.exe]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 09:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"CloneCDTray"="D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" [2004-06-27 21:33 57344]
"QuickTime Task"="D:\Utils\Visors\QuickTime\qttask.exe" [2006-03-21 20:16 155648]
"HP Software Update"="D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-01-21 17:25 15360]

C:\Documents and Settings\Salitre\Men£ Inicio\Programas\Inicio\
toDO.lnk - C:\Documents and Settings\Salitre\Escritorio\toDO.txt [2006-07-22 23:35:42 2916]

R0 stwlfbus;stwlfbus;C:\WINDOWS\system32\DRIVERS\stwlfbus.sys [2003-04-27 05:39]
R2 portD;CMS PortIO Service;C:\WINDOWS\system32\DRIVERS\portd2k.sys [2004-02-23 08:40]
R3 st3wolf;st3wolf;C:\WINDOWS\system32\DRIVERS\st3wolf.sys [2003-04-27 04:43]
S3 C-Dilla;C-Dilla;C:\WINDOWS\System32\drivers\CDANT.SYS [2001-09-10 18:09]
S3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\System32\DRIVERS\COMFiltr.sys []
S3 usbscan;Controlador de escáner USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-04 00:58]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 01:08]

*Newly Created Service* - ENTDRV51
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-31 14:55:55
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2008-01-31 14:57:57
ComboFix-quarantined-files.txt 2008-01-31 19:57:42
ComboFix2.txt 2008-01-28 21:09:44
ComboFix3.txt 2008-01-27 19:15:07
.
2008-01-14 21:20:46 --- E O F ---

katana · Feb 1, 2008

Your Java and Adobe is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java and Adobe components and update.

Updating Java:

Download the latest version of Java Runtime Environment (JRE) 6u4 from http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.

Update Adobe Acrobat Reader

Please go to this link Adobe Acrobat Reader Download Link
Cllick Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

Now close all windows, including your browser.
Double click on the Java installation that you downloaded and follow the prompts.

Remove Programs
Now click Start---Control Panel. Double click Add or Remove Programs. If any of the following programs are listed there,
click on the program to highlight it, and click on remove.

Adobe Reader 7.0
J2SE Runtime Environment 5.0 Update 4
Java 2 Runtime Environment, SE v1.4.2_01

Now close the Control Panel.

Reboot your machine.

Please post a fresh HJT log in your reply
How are things running now ?

loger.ock · Feb 2, 2008

More HJT reports

Hi katana,

First of all, thanks again for your support and help. I am following all your steps and everything is clear. However, I still fear that (according to virustotal) there are still a couple of problems in my system.

Thanks and here it goes the latest HJT report:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:04:41 PM, on 2/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
C:\Archivos de programa\Network Associates\VirusScan\mcshield.exe
C:\Archivos de programa\Network Associates\VirusScan\vstskmgr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\AGRSMMSG.exe
D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
D:\Utils\Sistema\JRE\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
D:\Utils\Internet\O2\Broadband\O2 Broadband.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Utils\Antivirus\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://createpdf.adobe.com/?Language=ENU
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de

programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Utils\Sistema\JRE\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} -

D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: PDF de Adobe - {47833539-D0C5-4125-9FA8-0819E2EAAC93} -

D:\Utils\Visors\AcrobatPro\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [CloneCDTray] "D:\Utils\Grabacio\CloneCD\CloneCDTray.exe" /s
O4 - HKLM\..\Run: [QuickTime Task] "D:\Utils\Visors\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [HP Software Update] D:\Utils\Sistema\Drivers\HP3930\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Utils\Visors\AcrobatReader-80\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] D:\Utils\Sistema\JRE\bin\jusched.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: toDO.lnk = C:\Documents and Settings\Salitre\Escritorio\toDO.txt
O4 - Global Startup: Acelerador de inicio de AutoCAD.lnk = C:\Archivos de programa\Archivos comunes\Autodesk

Shared\acstart16.exe
O4 - Global Startup: Acrobat Assistant.lnk = D:\Utils\Visors\AcrobatPro\Distillr\acrotray.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://D:\Utils\Edicio\MSOffice\OFFICE11

\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

D:\Utils\Sistema\JRE\bin\npjpi160_04.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -

D:\Utils\Sistema\JRE\bin\npjpi160_04.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Utils\Edicio\MSOffice\OFFICE11

\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de

programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de

programa\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) -

http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {08FD87EF-2A15-11D1-AF00-00A0C91F4B89} (WebPlotCtl Class) - http://www.icv.gva.es/pags/webplot.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -

http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) -

http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {512FC5A1-7DE1-43F1-BC0C-371622FCB409} (TotalScan Installer Class) -

http://www.nanoscan.com/as/cabs/ascstubie.cab
O16 - DPF: {5D2CF9D0-113A-476B-986F-288B54571614} (DevalVR Control) -

http://www.devalvr.com/instalacion/plugin/devalocx.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

http://a1540.g.akamai.net/7/1540/52...apple.com/snape/us/win/QuickTimeInstaller.exe
O16 - DPF: {62789780-B744-11D0-986B-00609731A21D} (Autodesk MapGuide ActiveX Control) -

http://mapg.fmd.emory.edu/mgvinstall/mgaxctrl.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) -

https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CCS\Services\Tcpip\..\{72E208FC-8C10-44F2-82B7-37D39DA33688}: NameServer = 62.40.32.33

62.40.32.34
O17 - HKLM\System\CCS\Services\Tcpip\..\{B9971703-8C00-4272-BB13-6555140CB2AF}: NameServer =

80.58.61.250,80.58.61.254
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk

Shared\Service\AdskScSrv.exe
O23 - Service: C-DillaSrv - C-Dilla Ltd - C:\WINDOWS\system32\DRIVERS\CDANTSRV.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de

programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Archivos de

programa\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Archivos de

programa\Network Associates\VirusScan\mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Archivos de

programa\Network Associates\VirusScan\vstskmgr.exe

--
End of file - 6742 bytes

katana · Feb 2, 2008

loger.ock said:
However, I still fear that (according to virustotal) there are still a couple of problems in my system.

If you mean the items in the Total Scan log, then they are nothing to worry about.
It was just a few false positives on the cleaning tools we have used, and files that had already been quarantined.

Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

You can also delete any logs we have produced, and empty your Recycle bin.

The following is some info to help you stay safe and clean.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.nanoscan.com
http://www.pandasoftware.com/activescan/com/activescan_principal.htm
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

AntiSpyware

AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
All the programs in this list have a free version.
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy <<< A must have program
- It includes host protection and registry protection
- A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
a-squared Free <<< A good "realtime" or "on demand" scanner
AVG Anti-Spyware 7.5 <<< A good "realtime" or "on demand" scanner
superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 3.5.1
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
    - Change the Download signed ActiveX controls to Prompt
    - Change the Download unsigned ActiveX controls to Disable
    - Change the Initialise and script ActiveX controls not marked as safe to Disable
    - Change the Installation of desktop items to Prompt
    - Change the Launching programs and files in an IFRAME to Prompt
    - Change the Navigate sub-frames across different domains to Prompt
    - When all these settings have been made, click on the OK button.
    - If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
- FireFox
  - With many addons available that make customization easy this is a very popular choice
  - NoScript and AdBlockPlus addons are essential
- Opera
  - Another popular alternative
- Netscape
  - Another popular alternative
  - Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.......So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

loger.ock · Feb 3, 2008

Reply

:Hi katana,

I would like to thank you once more for the time you spend with my case. I definately appreciatte it! So far it looks that all the threads after a last scan are false positives. Anyway, how can I remove the files stored at the quarantine bin, manually??

Other than that, after installing extra security I still have some problems such as the the hotkeys for my computer are not working or the icon for C drive changed by a cross (I know it sounds a bit stupid, but is that usually a consequence from one of this attacks?) and my McAfee permament protection is gone and there is no chance of finding how to re-activate it.

Thanks

katana · Feb 3, 2008

The files in quarantine were removed when you used Combofix /u

As for the programs that don't work

katana said:
You had a file infector virus, and it looks like a lot of files got deleted somwhere along the way.
Any programs that don't work properly will need to be reinstalled.

There is not a lot I can do for you there, the files were removed before I started helping you.
You will need to reinstall the programs.

Virtumonde plus virtumonde.generic and others

loger.ock

New member

loger.ock

New member

katana

Security Expert-Emeritus

loger.ock

New member

katana

Security Expert-Emeritus

loger.ock

New member

loger.ock

New member

loger.ock

New member

katana

Security Expert-Emeritus

loger.ock

New member

katana

Security Expert-Emeritus

loger.ock

New member

katana

Security Expert-Emeritus

loger.ock

New member

katana

Security Expert-Emeritus