Page 1 of 3 123 LastLast
Results 1 to 10 of 27

Thread: help with this backdoor trojan

  1. 2007-06-10, 10:35 #1
    alshay
    alshay is offline
    Member
    Join Date
    Apr 2007
    Posts
    34

    Default help with this backdoor trojan

    my antivirus has detected this backdoor trojan with this filename dnscon70.dll and it can't be cleaned or quarantined...also i cant open my local disc (C) everytime i click it a mgs po up cannot find script file "C:\FS6519.dll.vbs". plz help me

    here's my HJT log

    Logfile of HijackThis v1.99.1
    Scan saved at 5:19:02 PM, on 6/10/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\RUNDLL32.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\WINDOWS\system32\NSP.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Documents and Settings\_stn_11\Desktop\cleaner\hijackthis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = TAGA LIPA ARE!
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
    O4 - HKLM\..\Run: [VirtualDrive] "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [NSP] C:\WINDOWS\system32\NSP.exe
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    end of report
  2. 2007-06-10, 20:29 #2
    Mr_JAk3
    Mr_JAk3 is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    Hello alshay

    I must warn that one or more of the identified infections is a backdoor trojan

    This allows hackers to remotely control your computer, steal critical system information and Download and Execute files

    I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

    Though the infection has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

    How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
    When Should I Format, How Should I Reinstall

    I can help you in the cleaning if you don't want to reformat but there is a possibility that we can't get you 100% clean.

    Please let us know what you have decided to do in your next post
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006
  3. 2007-06-13, 04:45 #3
    alshay
    alshay is offline
    Member
    Join Date
    Apr 2007
    Posts
    34

    Default

    hi mr_jak3! plx help me to clean my pc formatting will be my last option...i dnt use this pc in online banking that's why am not worrie cuase it doesnt contain any of my personal info....i would gladly apprciate ur help..tnx in advance!!!!!!!
  4. 2007-06-13, 21:01 #4
    Mr_JAk3
    Mr_JAk3 is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    Ok, I'll be happy to help you

    Let's begin the cleaning

    Please download and run Flash_Disinfector by sUBs

    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Restart the computer and post a fresh HijackThis log along with the ComboFix log
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006
  5. 2007-06-14, 07:36 #5
    alshay
    alshay is offline
    Member
    Join Date
    Apr 2007
    Posts
    34

    Default

    Hi!

    here's new HJT log

    Logfile of HijackThis v1.99.1
    Scan saved at 2:38:35 PM, on 6/14/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Documents and Settings\_stn_11\Desktop\cleaner\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
    O4 - HKLM\..\Run: [VirtualDrive] "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    the combofix log..

    ComboFix 07-06-13.3 - C:\Documents and Settings\_stn_11\Desktop\cleaner\ComboFix.exe
    "_stn_11" - 2007-06-14 14:31:46 - Service Pack 2 NTFS


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\DOCUME~1\_stn_11\Desktop\internet.lnk


    ((((((((((((((((((((((((( Files Created from 2007-05-14 to 2007-06-14 )))))))))))))))))))))))))))))))


    2007-06-14 14:29 49,152 --a------ C:\WINDOWS\nircmd.exe
    2007-06-14 14:28 26,112 --a------ C:\WINDOWS\system32\nircmd.exe
    2007-06-14 14:28 <DIR> drahs---- C:\autorun.inf
    2007-06-10 17:09 <DIR> d-------- C:\VundoFix Backups
    2007-06-10 15:25 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    2007-06-04 19:37 <DIR> d-------- C:\DOCUME~1\_stn_11\APPLIC~1\U3
    2007-05-18 13:39 <DIR> d-------- C:\Program Files\Digital Image Recovery


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-06-14 18:06:54 -------- d-----w C:\Program Files\Common Files\Symantec Shared
    2007-05-19 18:40:30 -------- d-----w C:\Program Files\Norton AntiVirus
    2007-05-13 00:00:03 -------- d-----w C:\Program Files\LimeWire
    2007-04-23 03:30:17 14 ----a-w C:\WINDOWS\popcinfo.dat
    2007-04-23 01:53:26 -------- d-----w C:\DOCUME~1\_stn_11\APPLIC~1\Magic Academy
    2007-04-23 01:47:36 -------- d-----w C:\Program Files\Yahoo!
    2007-04-23 01:46:06 -------- d-----w C:\Program Files\Yahoo! Games
    2007-04-23 01:23:30 -------- d-----w C:\Program Files\TryMedia
    2007-04-23 01:23:22 -------- d-----w C:\Program Files\PopCap Games
    2007-04-19 00:54:40 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-04-18 23:52:03 -------- d-----w C:\Program Files\Master Recovery Card
    2007-04-18 04:03:33 -------- d-----w C:\Program Files\Common Files\LightScribe
    2007-04-18 04:02:36 -------- d-----w C:\Program Files\Ahead
    2007-04-18 03:59:42 -------- d-----w C:\Program Files\Common Files\Nero
    2007-04-18 03:55:47 -------- d-----w C:\Program Files\Common Files\Ahead
    2007-04-18 01:57:07 -------- d-----w C:\Program Files\FarStone
    2007-04-18 01:53:13 86,016 ----a-w C:\WINDOWS\system32\Dversion.dll
    2007-04-18 01:53:13 126,976 ----a-w C:\WINDOWS\system32\DVC.dll
    2007-04-18 00:12:56 -------- d-----w C:\Program Files\Symantec
    2007-04-02 00:02:14 39,836,051 ----a-w C:\VirtualDrive11.1.exe
    2007-03-29 01:41:32 517,848 ----a-w C:\WINDOWS\system32\SymNeti.dll
    2007-03-29 01:41:28 132,824 ----a-w C:\WINDOWS\system32\SymRedir.dll
    2004-08-05 03:00:00 89,600 --sha-r C:\WINDOWS\Temp\_ISTMPI.DIR\mmc32.exe


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 11:28]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]
    {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
    {BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 13:54]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 18:32]
    "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-04-17 17:12]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-09 01:54 C:\WINDOWS\SOUNDMAN.EXE]
    "nwiz"="nwiz.exe" [2004-04-22 21:24 C:\WINDOWS\system32\nwiz.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 04:48]
    "PowerDVD"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" [2005-09-28 23:40]
    "@"="" []
    "VirtualDrive"="C:\Program Files\FarStone\VirtualDrive\VDTask.exe" [2007-02-07 07:43]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 02:06]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    netm NetManager
    LocalServices dnscon


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1691bcfe-cd15-11db-af48-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d1b5e22-e20f-11db-af6e-00115b0c5055}]
    Auto\command- F:\infrom.exe
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d3c1ebe-1162-11dc-862a-00115b0c5055}]
    Auto\command- F:\RavMonE.exe e
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d78de8e-d004-11db-af4c-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d78de95-d004-11db-af4c-00115b0c5055}]
    Auto\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    Browser\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2abc12b3-f1df-11db-a858-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4c25747e-ca8f-11db-af41-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e747238-e158-11db-af6d-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{50727b63-1217-11dc-862b-00115b0c5055}]
    Auto\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    Browser\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55168fa9-eb85-11db-af7d-00115b0c5055}]
    Auto\command- G:\infrom.exe
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63506e0e-ce6f-11db-af4a-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NETSVCS.EXE
    é_†™\command- NETSVCS.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63506e11-ce6f-11db-af4a-00115b0c5055}]
    Auto\command- I:\RavMonE.exe e
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{79368516-fcee-11db-8609-00115b0c5055}]
    Auto\command- infrom.exe
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8c49bd98-06fe-11dc-861b-00115b0c5055}]
    AutoRun\command- G:\.\Recycled\Driveinfo.exe
    Open\Command- G:\.\Recycled\Driveinfo.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8f10e905-d7ee-11db-af59-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{94e08fb6-e707-11db-af72-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e2706c3-de2e-11db-af63-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a84b33a6-0356-11dc-8612-00115b0c5055}]
    AutoRun\command- G:\EXPLORER.EXE
    explore\Command- G:\EXPLORER.EXE
    open\Command- G:\EXPLORER.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab5f72d7-f38f-11db-a85a-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ab5f72d8-f38f-11db-a85a-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af7eabbc-c913-11db-af3f-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0b8bf97-0fa7-11dc-8626-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bde300e6-fb3f-11db-8606-00115b0c5055}]
    AutoRun\command- RavMon.exe
    explore\Command- RavMon.exe -e
    open\Command- RavMon.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bfe4d0bf-130d-11dc-862c-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e65bce4e-e88a-11db-af79-00115b0c5055}]
    Auto\command- G:\RavMonE.exe e
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RavMonE.exe e

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec19a18a-cde1-11db-af49-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FS6519.dll.vbs

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f094b3c0-e9f8-11db-af7b-00115b0c5055}]
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL NETSVCS.EXE
    é_†™\command- NETSVCS.EXE

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f43bbb7c-fe9d-11db-860c-00115b0c5055}]
    Auto\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE
    Browser\command- F:\RECYCLER\S-1-5-21-1078073611-1993962763-839522115-1003\mmc32.EXE


    Contents of the 'Scheduled Tasks' folder
    2007-06-09 03:14:13 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - _stn_11.job

    **************************************************************************

    catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-06-14 14:34:07
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    cmd.exe [3544]


    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-06-14 14:34:41
    C:\ComboFix-quarantined-files.txt ... 2007-06-14 14:34

    --- E O F ---
  6. 2007-06-14, 21:10 #6
    Mr_JAk3
    Mr_JAk3 is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    Hi again, we'll continue

    You should print these instructions or save these to a text file. Follow these instructions carefully.

    Backup your registry:
    • Start
    • Run
    • Type the following to the box and hit Ok: regedit
    • A window opens, click on File
    • Choose Export form the menu
    • Change the save location to C:\
    • Give the filename, RegBackUp
    • Make sure that the filetype is set to Registryfiles (*.reg)
    • Click on Save and Close the window

    Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
    http://www.ewido.net/en/download/
    • Install AVG Anti-Spyware by double clicking the installer.
    • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
    • On the main screen under Your Computer's security.
      • Click on Change state next to Resident shield. It should now change to inactive.
      • Click on Change state next to Automatic updates. It should now change to inactive.
      • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
      • Wait until you see the Update succesfull message.
    • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    If you are having problems with the updater, you can use this link to manually update ewido.
    AVG Anti-Spyware manual updates.
    Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

    Download ATF Cleaner by Atribune to your desktop.
    Do NOT run yet.

    Download fix_flashinf.reg to your desktop.
    Do NOT run yet.

    Make your hidden files visible:
    • Go to My Computer
    • Select the Tools menu and click Folder Options
    • Click the View tab.
    • Checkmark the "Display the contents of system folders"
    • Under the Hidden files and folders select "Show hidden files and folders"
    • Uncheck "Hide protected operating system files"
    • Click Apply and then the OK and close My Computer.


    ==================

    Restart your computer to the safe mode:
    • Restart your computer
    • Start tapping the F8 key when the computer restarts.
    • When the start menu opens, choose Safe mode
    • Press Enter. The computer then begins to start in Safe mode.


    Go to the My Computer and delete the following files (if present) (be careful with the names and locations!!):
    F:\infrom.exe
    F:\RavMonE.exe
    G:\infrom.exe
    G:\EXPLORER.EXE

    Use the Windows search
    • Start
    • Search
    • All files and folders
    • More advanced options
    Checkmark these options:
    • "Search system folders"
    • "Search hidden files and folders"
    • "Search subfolders"
    • Search for this and delete if found: FS6519.dll.vbs
    • Search for this and delete if found: mmc32.EXE
    • Search for this and delete if found: NETSVCS.EXE
    • Search for this and delete if found: RavMonE.exe
    • Search for this and delete if found: Driveinfo.exe
    • Search for this and delete if found: copy.exe


    Doubleclick on the fix_flashinf.reg and allow it to merge with the registry.

    Run Flash_Disinfector by sUBs again.

    Run ATF Cleaner
    • Under Main choose: Select All
      Click the Empty Selected button.
    If you use Firefox browser
    • Click Firefox at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    If you use Opera browser
    • Click Opera at the top and choose: Select All
      Click the Empty Selected button.
      NOTE: If you would like to keep your saved passwords, please click No at the prompt.
    Click Exit on the Main menu to close the program.

    Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
    • Click on Scanner on the toolbar.
    • Click on the Settings tab.
      • Under How to act?
        • Click on Recommended Action and choose Quarantine from the popup menu.
      • Under How to scan?
        • All checkboxes should be ticked.
      • Under Possibly unwanted software:
        • All checkboxes should be ticked.
      • Under Reports:
        • Select Automatically generate report after every scan and uncheck Only if threats were found.
      • Under What to scan?
        • Select Scan every file.
    • Click on the Scan tab.
    • Click on Complete System Scan to start the scan process.
    • Let the program scan the machine.
    • When the scan has finished, follow the instructions below.
      IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
      • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
      • At the bottom of the window click on the Apply all Actions button. (3)
    • When done, click the Save Scan Report button. (4)
      • Click the Save Report as button.
      • Save the report to your Desktop.
    • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
    Reboot in Normal Mode.

    Run ComboFix again

    ================

    When you're ready, please post the following logs to here:
    - AVG's report
    - a fresh HijackThis log
    - fresh ComboFix log
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006
  7. 2007-06-16, 11:41 #7
    alshay
    alshay is offline
    Member
    Join Date
    Apr 2007
    Posts
    34

    Default

    hi here's the fresh logs...

    AVG Result
    ---------------------------------------------------------
    AVG Anti-Spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 4:28:38 PM 6/16/2007

    + Scan result:



    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP31\A0021201.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP31\A0021202.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP31\A0022201.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP31\A0022202.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022204.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022205.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022224.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022225.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022231.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP32\A0022232.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP33\A0022243.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP33\A0022244.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP33\A0022251.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP33\A0022252.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0022267.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0022268.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0023250.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0023252.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0023279.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP34\A0023280.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP35\A0023282.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP35\A0023283.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP35\A0023292.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP35\A0023293.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP36\A0023298.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP36\A0023299.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP36\A0023307.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP36\A0023308.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP37\A0023312.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP37\A0023313.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP37\A0024307.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP37\A0024308.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP38\A0024315.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP38\A0024316.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP38\A0024331.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP38\A0024332.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP39\A0024343.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP39\A0024344.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP39\A0024351.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP39\A0024352.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP40\A0024363.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP40\A0024364.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP40\A0024383.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP40\A0024384.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024386.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024387.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024398.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024399.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024421.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024422.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).
    C:\System Volume Information\_restore{0E7AA2AB-0FBE-4515-9029-1F10DA63919E}\RP41\A0024464.vbs -> Worm.Solow.a : Cleaned with backup (quarantined).


    ::Report end


    HJT log

    Logfile of HijackThis v1.99.1
    Scan saved at 6:40:57 PM, on 6/16/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\SYSTEM32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\_stn_11\Desktop\cleaner\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
    O4 - HKLM\..\Run: [PowerDVD] C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe /autostart
    O4 - HKLM\..\Run: [VirtualDrive] "C:\Program Files\FarStone\VirtualDrive\VDTask.exe" /AutoRestore
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


    and lastly the combofix log

    ComboFix 07-06-13.3 - C:\Documents and Settings\_stn_11\Desktop\cleaner\ComboFix.exe
    "_stn_11" - 2007-06-16 18:28:10 - Service Pack 2 NTFS


    ((((((((((((((((((((((((( Files Created from 2007-05-17 to 2007-06-17 )))))))))))))))))))))))))))))))


    2007-06-16 15:20 26,112 --a------ C:\WINDOWS\system32\nircmd.exe
    2007-06-16 12:21 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-06-16 11:44 60,381,528 --a------ C:\RegBackUp.reg
    2007-06-14 14:29 49,152 --a------ C:\WINDOWS\nircmd.exe
    2007-06-14 14:28 <DIR> drahs---- C:\autorun.inf
    2007-06-10 17:09 <DIR> d-------- C:\VundoFix Backups
    2007-06-10 15:25 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
    2007-06-04 19:37 <DIR> d-------- C:\DOCUME~1\_stn_11\APPLIC~1\U3
    2007-05-18 13:39 <DIR> d-------- C:\Program Files\Digital Image Recovery


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-06-14 18:06:54 -------- d-----w C:\Program Files\Common Files\Symantec Shared
    2007-05-19 18:40:30 -------- d-----w C:\Program Files\Norton AntiVirus
    2007-05-13 00:00:03 -------- d-----w C:\Program Files\LimeWire
    2007-04-23 03:30:17 14 ----a-w C:\WINDOWS\popcinfo.dat
    2007-04-23 01:53:26 -------- d-----w C:\DOCUME~1\_stn_11\APPLIC~1\Magic Academy
    2007-04-23 01:47:36 -------- d-----w C:\Program Files\Yahoo!
    2007-04-23 01:46:06 -------- d-----w C:\Program Files\Yahoo! Games
    2007-04-23 01:23:30 -------- d-----w C:\Program Files\TryMedia
    2007-04-23 01:23:22 -------- d-----w C:\Program Files\PopCap Games
    2007-04-19 00:54:40 -------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-04-18 23:52:03 -------- d-----w C:\Program Files\Master Recovery Card
    2007-04-18 04:03:33 -------- d-----w C:\Program Files\Common Files\LightScribe
    2007-04-18 04:02:36 -------- d-----w C:\Program Files\Ahead
    2007-04-18 03:59:42 -------- d-----w C:\Program Files\Common Files\Nero
    2007-04-18 03:55:47 -------- d-----w C:\Program Files\Common Files\Ahead
    2007-04-18 01:57:07 -------- d-----w C:\Program Files\FarStone
    2007-04-18 01:53:13 86,016 ----a-w C:\WINDOWS\system32\Dversion.dll
    2007-04-18 01:53:13 126,976 ----a-w C:\WINDOWS\system32\DVC.dll
    2007-04-18 00:12:56 -------- d-----w C:\Program Files\Symantec
    2007-04-02 00:02:14 39,836,051 ----a-w C:\VirtualDrive11.1.exe
    2007-03-29 01:41:32 517,848 ----a-w C:\WINDOWS\system32\SymNeti.dll
    2007-03-29 01:41:28 132,824 ----a-w C:\WINDOWS\system32\SymRedir.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
    {02478D38-C3F9-4EFB-9B51-7695ECA05670}=C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll [2006-10-26 11:28]
    {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 02:56]
    {53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
    {BDF3E430-B101-42AD-A544-FADC6B084872}=C:\Program Files\Norton AntiVirus\NavShExt.dll [2005-10-19 13:54]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 18:32]
    "Symantec NetDriver Monitor"="C:\PROGRA~1\SYMNET~1\SNDMon.exe" [2007-04-17 17:12]
    "SoundMan"="SOUNDMAN.EXE" [2004-02-09 01:54 C:\WINDOWS\SOUNDMAN.EXE]
    "nwiz"="nwiz.exe" [2004-04-22 21:24 C:\WINDOWS\system32\nwiz.exe]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 04:01]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 04:48]
    "PowerDVD"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" [2005-09-28 23:40]
    "@"="" []
    "VirtualDrive"="C:\Program Files\FarStone\VirtualDrive\VDTask.exe" [2007-02-07 07:43]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 02:06]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 05:29]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    netm NetManager
    LocalServices dnscon


    Contents of the 'Scheduled Tasks' folder
    2007-06-09 03:14:13 C:\WINDOWS\tasks\Norton AntiVirus - Scan my computer - _stn_11.job

    **************************************************************************

    catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-06-16 18:31:27
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    **************************************************************************

    Completion time: 2007-06-16 18:32:25
    C:\ComboFix-quarantined-files.txt ... 2007-06-16 18:31
    C:\ComboFix2.txt ... 2007-06-14 14:34

    --- E O F ---
  8. 2007-06-16, 13:58 #8
    Mr_JAk3
    Mr_JAk3 is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    Ok good, looks better.

    How is the computer running?

    Please go to My Computer and navigate to this file:
    C:\autorun.inf

    Rightclick the file with you mouse and Choose; Edit.

    Copy the contents to here
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006
  9. 2007-06-17, 05:15 #9
    alshay
    alshay is offline
    Member
    Join Date
    Apr 2007
    Posts
    34

    Default

    hi! here's my post when i edit the autorun.inf :

    This folder was created by Flash_Disinfector
  10. 2007-06-17, 18:11 #10
    Mr_JAk3
    Mr_JAk3 is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    3,934

    Default

    OK good. How is the computer running?

    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.
    MalWare Removal University - You too could train to help others
    UNITE & ASAP member since 2006
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules