-
Virtumonde help please!
A few problems:
-Windows Security Center says automatic updates are off, but won't turn them on. When I go into the system properties, it says they are on.
-Firefox won't open or load websites, IE does but with many popups.
-Spybot repeatedly fnds Virtumonde and Virtumonde.dll even after removing. I scanned several times in safe mode as well but it still never disappeared.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:58:46 PM, on 6/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\zHotkey.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {3CA60057-9277-49C0-8D64-280DBAD9C3E1} - C:\WINDOWS\system32\iifFuvur.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
O2 - BHO: {2e1573e6-0430-4059-9a64-d62b899d0f8b} - {b8f0d998-b26d-46a9-9504-03406e3751e2} - C:\WINDOWS\system32\mrhiidjo.dll
O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [BM3fcc04a5] Rundll32.exe "C:\WINDOWS\system32\brnpegbm.dll",s
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA6330] command /c del "C:\WINDOWS\system32\ddcbbyXq.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5] cmd /c del "C:\WINDOWS\system32\ddcbbyXq.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: run_startmenu.cmd
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - Winlogon Notify: iifFuvur - C:\WINDOWS\SYSTEM32\iifFuvur.dll
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 8048 bytes
-
Hi alliegintha703
1. Download combofix from any of these links and save it to Desktop:
Link 1
Link 2
Link 3
**Note: It is important that it is saved directly to your desktop**
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
If you have problems with Combofix usage, see here
Post:
- a fresh HijackThis log
- combofix report
-
ComboFix 08-06-12.2 - Owner 2008-06-14 12:08:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.431 [GMT -4:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM3fcc04a5.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\awtsQHWq.dll
C:\WINDOWS\system32\brnpegbm.dll
C:\WINDOWS\system32\cbXRHApN.dll
C:\WINDOWS\system32\iifFuvur.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mrhiidjo.dll
C:\WINDOWS\system32\NpAHRXbc.ini
C:\WINDOWS\system32\NpAHRXbc.ini2
C:\WINDOWS\system32\qufgvues.dll
C:\WINDOWS\system32\qXybbcdd.ini
C:\WINDOWS\system32\qXybbcdd.ini2
C:\WINDOWS\system32\seuvgfuq.ini
C:\WINDOWS\system32\ssnackdt.dll
C:\WINDOWS\system32\UvDLknmp.ini
C:\WINDOWS\system32\UvDLknmp.ini2
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 )))))))))))))))))))))))))))))))
.
2008-06-12 21:58 . 2008-06-12 21:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-12 18:16 . 2004-08-27 05:54 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
2008-06-12 18:16 . 2008-06-03 01:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
2008-06-12 18:16 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\McAfee
2008-06-12 18:16 . 2008-06-12 18:16 <DIR> d-------- C:\Documents and Settings\Administrator
2008-06-12 18:12 . 2008-06-12 21:49 382 --a------ C:\WINDOWS\wininit.ini
2008-06-11 22:09 . 2008-06-12 17:47 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-11 22:09 . 2008-06-12 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-11 22:03 . 2008-06-11 22:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-06-11 22:03 . 2008-06-12 15:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-11 12:40 . 2008-06-12 15:55 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-06-11 00:29 . 2008-06-11 00:29 <DIR> d-------- C:\Program Files\MSBuild
2008-06-11 00:17 . 2008-06-12 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-11 00:15 . 2008-06-11 00:15 <DIR> d-------- C:\MSOCache
2008-06-10 23:40 . 2008-06-12 17:36 <DIR> d-------- C:\Program Files\MagicISO
2008-06-10 18:05 . 2008-06-10 18:05 <DIR> d-------- C:\Program Files\Common Files\Control Panels
2008-06-10 18:02 . 2008-06-10 18:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ALM
2008-06-10 12:43 . 2008-06-10 12:43 <DIR> d-------- C:\Program Files\Snes9x
2008-06-10 12:43 . 2008-06-10 12:43 216,064 --a------ C:\WINDOWS\iun3405.exe
2008-06-10 09:19 . 2008-06-10 09:19 0 --a------ C:\WINDOWS\VPC32.INI
2008-06-09 17:53 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Symantec_Client_Security
2008-06-09 17:53 . 2008-06-09 17:52 124,167 --a------ C:\WINDOWS\system32\SYMEVNT.386
2008-06-09 17:53 . 2008-06-09 17:52 83,208 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-06-09 17:53 . 2008-06-09 17:52 73,496 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-06-09 17:12 . 2008-06-09 17:12 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
2008-06-09 17:12 . 2008-06-09 17:12 <DIR> d-------- C:\Program Files\MSECACHE
2008-06-09 16:53 . 2008-06-09 16:53 <DIR> d-------- C:\Program Files\Bonjour
2008-06-09 16:48 . 2008-06-09 16:48 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-06-07 23:23 . 2008-06-09 17:39 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-06-07 23:15 . 2008-06-07 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-06-07 17:48 . 2008-06-07 17:48 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-06-07 13:52 . 2008-06-07 13:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ahead
2008-06-06 22:12 . 2007-02-20 16:04 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2008-06-06 22:12 . 2007-02-20 16:04 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2008-06-05 14:48 . 2008-06-05 14:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Media Player Classic
2008-06-05 14:45 . 2008-06-05 14:48 49 --a------ C:\WINDOWS\NeroDigital.ini
2008-06-05 14:40 . 2008-06-10 18:08 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-04 21:49 . 2008-06-04 21:49 <DIR> d-------- C:\WINDOWS\Sun
2008-06-04 21:46 . 2008-06-12 15:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\uTorrent
2008-06-04 21:09 . 2008-06-04 21:09 376 --a------ C:\WINDOWS\ODBC.INI
2008-06-04 21:07 . 2008-06-11 00:55 <DIR> d-------- C:\WINDOWS\ShellNew
2008-06-04 21:06 . 2008-06-04 21:06 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Microsoft Web Folders
2008-06-04 06:27 . 2008-03-01 09:06 6,066,176 --a--c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-06-04 06:27 . 2007-04-17 05:32 2,455,488 --a--c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-06-04 06:27 . 2007-03-08 01:10 991,232 --a--c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-06-04 06:27 . 2008-03-01 09:06 459,264 --a--c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-06-04 06:27 . 2008-03-01 09:06 383,488 --a--c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-06-04 06:27 . 2008-03-01 09:06 267,776 --a--c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-06-04 06:27 . 2008-03-01 09:06 63,488 --a--c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-06-04 06:27 . 2008-03-01 09:06 52,224 --a--c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-06-04 06:27 . 2008-02-22 06:00 13,824 --a--c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-04 03:00 . 2008-06-04 17:48 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-06-04 03:00 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-03 23:07 . 2008-06-03 23:07 <DIR> d-------- C:\Program Files\XBCD
2008-06-03 23:06 . 2008-06-03 23:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2008-06-03 23:05 . 2008-06-03 23:05 <DIR> d-------- C:\Program Files\BitPim
2008-06-03 23:04 . 2008-06-03 23:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
2008-06-03 02:11 . 2008-06-03 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-06-03 02:10 . 2008-06-03 23:04 <DIR> d-------- C:\Program Files\AIM6
2008-06-03 01:47 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\iTunes
2008-06-03 01:47 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\iPod
2008-06-03 01:47 . 2008-06-10 18:47 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Apple Computer
2008-06-03 01:47 . 2008-06-14 12:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-03 01:47 . 2008-06-03 01:47 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-06-03 01:46 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\QuickTime
2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Program Files\Apple Software Update
2008-06-03 01:46 . 2008-06-03 01:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-06-03 01:20 . 2008-06-03 01:20 2 --a------ C:\WINDOWS\msoffice.ini
2008-06-03 01:11 . 2004-08-27 05:54 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
2008-06-03 01:11 . 2004-08-27 05:54 <DIR> d-------- C:\Documents and Settings\Default User\WINDOWS
2008-06-03 01:06 . 2008-06-03 01:06 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-06-03 01:04 . 2008-06-03 01:04 333 --a------ C:\WINDOWS\system32\$ncsp$.inf
2008-06-03 01:04 . 2008-06-03 01:04 0 --a------ C:\WINDOWS\system32\emachines_T6212__.MRK
2008-06-03 01:03 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
2008-06-03 01:03 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-03 01:03 . 2004-08-04 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2008-06-03 01:02 . 2006-06-14 04:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-06-03 01:02 . 2006-06-14 04:47 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys
2008-06-03 01:01 . 2008-06-03 01:01 <DIR> d-------- C:\Program Files\ATI Technologies
2008-06-03 01:01 . 2008-06-03 01:01 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SampleView
2008-06-03 01:00 . 2004-07-15 17:08 471,300 --a------ C:\WINDOWS\wallpe.exe
2008-06-03 01:00 . 2003-03-25 08:00 67,072 --a------ C:\WINDOWS\POWERCFG.EXE
2008-06-03 01:00 . 2004-04-22 20:48 30,056 --a------ C:\WINDOWS\system32\oemlogo.bmp
2008-06-03 01:00 . 2004-09-03 19:07 20,480 --a------ C:\WINDOWS\system32\Marker32.exe
2008-06-03 00:59 . 2008-06-03 00:59 <DIR> d-------- C:\Program Files\CyberLink
2008-06-03 00:59 . 2008-06-03 00:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-03 00:58 . 2008-06-03 00:58 <DIR> d-------- C:\Program Files\Google
2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\WINDOWS\occache
2008-06-03 00:57 . 2008-06-03 23:03 <DIR> d-------- C:\Program Files\Viewpoint
2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Pure Networks
2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Learn2.com
2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-06-03 00:57 . 2008-06-03 00:58 <DIR> d-------- C:\Program Files\Ahead
2008-06-03 00:57 . 2008-06-03 02:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
2008-06-03 00:55 . 2008-06-03 00:55 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
2008-06-03 00:55 . 2008-06-03 00:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\Program Files\Real
2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\Program Files\Common Files\Real
2008-06-03 00:54 . 2008-06-03 01:26 <DIR> d-------- C:\Program Files\Common Files\aolshare
2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\My Music
2008-06-03 00:54 . 2008-06-03 02:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
2008-06-03 00:52 . 2008-06-03 02:11 <DIR> d-------- C:\Program Files\Common Files\AOL
2008-06-03 00:52 . 2008-06-03 00:52 335 --a------ C:\WINDOWS\nsreg.dat
2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Java
2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Digital Media Reader
2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Common Files\Java
2008-06-03 00:51 . 2008-06-03 00:51 53,352 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Symantec
2008-06-03 00:45 . 2008-06-03 01:02 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-03 00:45 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-03 00:45 . 2004-05-17 21:30 543,232 --a------ C:\WINDOWS\zHotkey.exe
2008-06-03 00:45 . 2003-05-26 22:19 532,544 --a------ C:\WINDOWS\PIC.dll
2008-06-03 00:45 . 2003-09-19 12:09 36,864 --a------ C:\WINDOWS\ShowWnd.exe
2008-06-03 00:45 . 2001-07-02 23:36 24,576 --a------ C:\WINDOWS\HKNTDLL.dll
2008-06-03 00:45 . 2000-08-07 14:57 5,280 --a------ C:\WINDOWS\hotbtnv.vxd
2008-06-03 00:45 . 2003-05-29 21:56 3,927 --a------ C:\WINDOWS\mHotkey.reg
2008-06-03 00:41 . 2008-06-03 00:41 <DIR> d-------- C:\Program Files\Common Files\New Boundary
2008-06-03 00:41 . 2008-06-03 00:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prism Deploy
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-05 01:06 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-03 04:54 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{764A95ED-CBF9-45B4-870C-D51795263392}]
C:\WINDOWS\system32\ddcbbyXq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC}]
C:\WINDOWS\system32\pmnkLDvU.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 16:42 212992]
"CHotkey"="zHotkey.exe" [2004-05-17 21:30 543232 C:\WINDOWS\zHotkey.exe]
"ShowWnd"="ShowWnd.exe" [2003-09-19 12:09 36864 C:\WINDOWS\ShowWnd.exe]
"SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 18:04 135168]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 14:50 155648]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 15:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 22:42 32768]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-12 00:10 344064]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21 90112]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-03-29 22:14 624248]
"Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 23:05:56 65588]
run_startmenu.cmd [2004-10-11 16:20:38 45]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
"3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
"50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
"50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server
R1 vcdrom;Virtual CD-ROM Device Driver;C:\WINDOWS\system32\drivers\VCdRom.sys [2001-12-19 11:45]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
.
Contents of the 'Scheduled Tasks' folder
"2008-06-03 05:46:47 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-03 05:11:12 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-14 12:16:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\NavLogon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
.
**************************************************************************
.
Completion time: 2008-06-14 12:29:09 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-14 16:28:12
Pre-Run: 14,027,948,032 bytes free
Post-Run: 14,467,481,600 bytes free
246 --- E O F --- 2008-06-05 00:27:13
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:25 PM, on 6/14/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\zHotkey.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: run_startmenu.cmd
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 7412 bytes
-
Hi
Open HijackThis, click do a system scan only and checkmark these:
O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)
Close all windows including browser and press fix checked.
Reboot.
Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.- The program will launch and then start to download the latest definition files.
- Once the scanner is installed and the definitions downloaded, click Next.
- Now click on Scan Settings
- In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database:
+ Extended (If available otherwise Standard)
o Scan Options:
+ Scan Archives
+ Scan Mail Bases
- Click OK
- Now under select a target to scan select My Computer
- The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
- Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
- Click the Save Report As... button (see red arrow below)
http://img.photobucket.com/albums/v6...veReport-1.gif - In the Save as... prompt, select Desktop
- In the File name box, name the file KasScan-ddmmyy (or similar)
- In the Save as type prompt, select Text file (see below)
http://img.photobucket.com/albums/v6...as-Savetxt.gif - Now click on the Save as Text button
- Savethe file to your desktop.
- Copy and paste that information in your next post.
Note: This scanner will work with Internet Explorer Only! Keep ALL other programs closed during the scan
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.
Post:
- a fresh HijackThis log
- kaspersky report
-
The first time I ran Kaspersky my computer decided to automatically restart when i wasnt home because of a "serious error" that occured after the scan had finished, so I had to do it all over again. 10 hours and 42 minutes later, I finally have a log. By the way, thanks for all the help!
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, June 15, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, June 15, 2008 13:14:31
Records in database: 867103
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan statistics:
Files scanned: 141992
Threat name: 6
Infected objects: 17
Suspicious objects: 0
Duration of the scan: 10:41:50
File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0000.VBN Infected: Trojan.Win32.Monder.oa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0001.VBN Infected: Trojan.Win32.Monder.na 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0004.VBN Infected: Trojan.Win32.Monder.na 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0005.VBN Infected: Trojan.Win32.Monder.oa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0006.VBN Infected: Trojan.Win32.Monder.nb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0007.VBN Infected: Trojan.Win32.Monder.oa 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300000.VBN Infected: Trojan.Win32.Monder.nb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300001.VBN Infected: Trojan-PSW.Win32.OnLineGames.apjl 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300002.VBN Infected: Trojan.Win32.Monder.nb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300003.VBN Infected: Trojan.Win32.Monder.na 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C9C0000.VBN Infected: Trojan.Win32.Monder.na 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CA40000.VBN Infected: Trojan.Win32.Monder.nb 1
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CA40001.VBN Infected: Trojan.Win32.Monder.oa 1
C:\Program Files\MagicISO\magic.iso.maker.v5.5.261-nope.exe Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\awtsQHWq.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\iifFuvur.dll.vir Infected: Trojan.Win32.Monder.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\ssnackdt.dll.vir Infected: Trojan.Win32.Monder.qg 1
The selected area was scanned.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:33:10 PM, on 6/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\zHotkey.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: run_startmenu.cmd
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL/...ws-i586-jc.cab
O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 8069 bytes
-
Hi
And we found out where it all started:
C:\Program Files\MagicISO\magic.iso.maker.v5.5.261-nope.exe Infected: Trojan.Win32.Monder.gen 1
Using pirated software is not only illegal but also very stupid as you can see.
Uninstall via add/remove programs:
MagicISO
Delete this:
C:\Program Files\MagicISO\
Empty these folders:
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\
C:\QooBox\Quarantine\
Empty Recycle Bin.
Still problems?
-
Yeah I never actually used the program, I tried to uninstall it a few weeks ago from add/remove programs, but it always said that it couldn't because of a missing INSTALL.log file so I just left it. I deleted everything in the 2 folders but misosh.dll because it says "access is denied." It's not write-protected ad not in use as far as I can tell so I don't know what to do about that.
-
Hi
You can try to delete that folder in safe mode.
-
That didn't work; I tried both the owner account and the administrator account and it still says the same thing.
-
Hi
Please download the OTMoveIt2 by OldTimer.
- Save it to your desktop.
- Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
- Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
Code:
C:\Program Files\MagicISO
- Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
- Click the red Moveit! button.
- Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
- Close OTMoveIt2
Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.