Page 1 of 2 12 LastLast
Results 1 to 10 of 19

Thread: Virtumonde

  1. 2007-09-01, 07:58 #1
    Aphazael
    Aphazael is offline
    Junior Member
    Join Date
    Sep 2007
    Posts
    9

    Default Virtumonde

    spybot cant remove for me so here are my logs, plus there might be some other problems if u guys can find um for me.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:29:18 PM, on 8/31/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [wnctybef] rundll32.exe "C:\Program Files\wnctybef\ifsdqfyf.dll",Init
    O4 - HKLM\..\Run: [gvghmjqf] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\gvghmjqf.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\hnyxilcx.dll",forkonce
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7854] command /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC5326] cmd /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8040] command /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC3093] cmd /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKCU\..\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\ProxyCap.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 4598 bytes


    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Friday, August 31, 2007 10:57:18 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.93.0
    Kaspersky Anti-Virus database last update: 1/09/2007
    Kaspersky Anti-Virus database records: 401726
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\
    E:\

    Scan Statistics:
    Total number of scanned objects: 57023
    Number of viruses found: 19
    Number of infected objects: 65
    Number of suspicious objects: 0
    Duration of the scan process: 00:49:46

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\Sean\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Sean\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Sean\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Sean\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Sean\Local Settings\Temp\gos12C.tmp Infected: Trojan.Win32.Dialer.qn skipped
    C:\Documents and Settings\Sean\Local Settings\Temp\win127.tmp.exe Infected: Trojan.Win32.Dialer.qn skipped
    C:\Documents and Settings\Sean\Local Settings\Temp\wnd11F.tmp Infected: Trojan.Win32.Dialer.qn skipped
    C:\Documents and Settings\Sean\Local Settings\Temporary Internet Files\Content.IE5\65GU956A\gepj[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
    C:\Documents and Settings\Sean\Local Settings\Temporary Internet Files\Content.IE5\IF2VI16Z\gepj[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.lq skipped
    C:\Documents and Settings\Sean\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Sean\Local Settings\Temporary Internet Files\Content.IE5\ZEGVRLW9\valera[1] Infected: Trojan.Win32.Agent.bck skipped
    C:\Documents and Settings\Sean\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Sean\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
    C:\Program Files\Steam\Steam.log Object is locked skipped
    C:\Program Files\Steam\steamapps\winui.gcf Object is locked skipped
    C:\Program Files\Steam\SteamLogs\SteamStats.log Object is locked skipped
    C:\Program Files\ucleaner_setup.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped
    C:\Program Files\Warcraft III\bncache.dat Object is locked skipped
    C:\Program Files\wnctybef\ifsdqfyf.dll Infected: Trojan-Downloader.Win32.Zlob.cci skipped
    C:\SDFix\backups\backups.zip/backups/milis.dll Infected: Backdoor.Win32.Agent.asa skipped
    C:\SDFix\backups\backups.zip/backups/setup.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\SDFix\backups\backups.zip/backups/setup.exe/stream Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\SDFix\backups\backups.zip/backups/setup.exe Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\SDFix\backups\backups.zip ZIP: infected - 4 skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP29\A0001579.exe/stream/data0008 Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP29\A0001579.exe/stream Infected: not-a-virus:Client-IRC.Win32.mIRC.621 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP29\A0001579.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP6\A0000771.exe Infected: not-a-virus:RiskTool.Win32.Reboot.e skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP82\A0010693.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010705.exe Infected: Trojan-Downloader.Win32.PurityScan.ej skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010706.exe Infected: Trojan-Clicker.Win32.Small.mv skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010710.exe Infected: Trojan.Win32.Agent.qt skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010711.exe Infected: Trojan-Downloader.Win32.Alphabet.p skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010715.exe Infected: Trojan-Downloader.Win32.Agent.bls skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010716.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010718.exe Infected: Trojan-Downloader.Win32.Alphabet.p skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP84\A0010720.exe Infected: Trojan-Downloader.Win32.PurityScan.eg skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011636.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011694.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011694.exe/stream Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011694.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011698.dll Infected: Backdoor.Win32.Agent.asa skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011699.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011700.dll Infected: Trojan-Downloader.Win32.Zlob.cci skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011701.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP85\A0011704.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012199.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.b skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012257.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012257.exe/stream Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012257.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012261.dll Infected: Backdoor.Win32.Agent.asa skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012262.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012263.dll Infected: Trojan-Downloader.Win32.Zlob.cci skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012264.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP86\A0012267.exe Infected: Trojan-Downloader.Win32.Small.eqn skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP92\A0015145.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.hb skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015160.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015160.exe/stream Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015160.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015162.dll Infected: Backdoor.Win32.Agent.asa skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015168.dll Infected: Backdoor.Win32.Agent.asa skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015169.exe/stream/data0006 Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015169.exe/stream Infected: Trojan-Downloader.Win32.Zlob.cbp skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\A0015169.exe NSIS: infected - 2 skipped
    C:\System Volume Information\_restore{6B1456E2-255B-4369-A330-10628F533B26}\RP93\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\aopkkgjj.exe Infected: Trojan.Win32.Agent.bck skipped
    C:\WINDOWS\system32\byxxwuu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
    C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\drvwok.dll Infected: Trojan.Win32.Dialer.qn skipped
    C:\WINDOWS\system32\hnyxilcx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lq skipped
    C:\WINDOWS\system32\jfkaoxmm.exe Infected: Trojan.Win32.Agent.bck skipped
    C:\WINDOWS\system32\ladqtipo.exe Infected: Trojan.Win32.Agent.bck skipped
    C:\WINDOWS\system32\nsaxnmeq.exe Infected: Trojan.Win32.Agent.bck skipped
    C:\WINDOWS\system32\urqommn.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\system32\wdqpokti\wdqpokti1.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
    C:\WINDOWS\system32\wdqpokti\wdqpokti2.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
    C:\WINDOWS\system32\wdqpokti\wdqpokti3.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.c skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.
  2. 2007-09-01, 14:06 #2
    random/random
    random/random is offline
    Security Expert: Visiting Fellow
    Join Date
    Jul 2007
    Posts
    703

    Default

    You do not appear to be running a realtime antivirus, this is leaving you open to infection
    Please install one of the following free antivirus programs:


    Rename HijackThis.exe to random.exe

    Download SmitfraudFix (by S!Ri) to your Desktop.
    http://siri.urz.free.fr/Fix/SmitfraudFix.exe

    Double-click SmitfraudFix.exe
    Select option #1 - Search by typing 1 and press Enter
    This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.

    IMPORTANT: Do NOT run any other options until you are asked to do so!

    **If the tool fails to launch from the Desktop, please move SmitfraudFix.exe directly to the root of the system drive (usually C:), and launch from there.

    Post back with the smitfraudfix log and a new HijackThis log
  3. 2007-09-01, 22:56 #3
    Aphazael
    Aphazael is offline
    Junior Member
    Join Date
    Sep 2007
    Posts
    9

    Default

    SmitFraudFix v2.219

    Scan done at 13:54:18.57, Sat 09/01/2007
    Run from C:\Documents and Settings\Sean\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sean


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sean\Application Data

    C:\Documents and Settings\Sean\Application Data\Install.dat FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sean\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
    DNS Server Search Order: 192.168.1.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:29:18 PM, on 8/31/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\random.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [wnctybef] rundll32.exe "C:\Program Files\wnctybef\ifsdqfyf.dll",Init
    O4 - HKLM\..\Run: [gvghmjqf] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\gvghmjqf.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\hnyxilcx.dll",forkonce
    O4 - HKLM\..\RunOnce: [SpybotDeletingA7854] command /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC5326] cmd /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingA8040] command /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC3093] cmd /c del "C:\WINDOWS\system32\ssqpq.dll_tobedeleted"
    O4 - HKCU\..\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\ProxyCap.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 4598 bytes
  4. 2007-09-01, 23:26 #4
    random/random
    random/random is offline
    Security Expert: Visiting Fellow
    Join Date
    Jul 2007
    Posts
    703

    Default

    Why haven't you installed an antivirus?
  5. 2007-09-02, 01:49 #5
    Aphazael
    Aphazael is offline
    Junior Member
    Join Date
    Sep 2007
    Posts
    9

    Default

    SmitFraudFix v2.219

    Scan done at 16:49:10.46, Sat 09/01/2007
    Run from C:\Documents and Settings\Sean\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in normal mode

    »»»»»»»»»»»»»»»»»»»»»»»» Process

    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\RTHDCPL.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\WINDOWS\system32\cldfjwsk.exe
    C:\Program Files\Ventrilo\Ventrilo.exe
    C:\Program Files\mIRC\mirc.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\cmd.exe

    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    »»»»»»»»»»»»»»»»»»»»»»»» C:\


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32


    »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sean


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sean\Application Data

    C:\Documents and Settings\Sean\Application Data\Install.dat FOUND !

    »»»»»»»»»»»»»»»»»»»»»»»» Start Menu


    »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sean\FAVORI~1


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop


    »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files


    »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys


    »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"


    »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
    "AppInit_DLLs"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Rustock



    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
    DNS Server Search Order: 192.168.1.1

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


    »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection


    »»»»»»»»»»»»»»»»»»»»»»»» End

    sry heres the updated log
  6. 2007-09-02, 10:45 #6
    random/random
    random/random is offline
    Security Expert: Visiting Fellow
    Join Date
    Jul 2007
    Posts
    703

    Default

    Reboot your computer in Safe Mode.
    • If the computer is running, shut down Windows, and then turn off the power.
    • Wait 30 seconds, and then turn the computer on.
    • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
    • Ensure that the Safe Mode option is selected.
    • Press Enter. The computer then begins to start in Safe mode.
    • Login on your usual account.
    ______________________________

    Double-click on SmitfraudFix.exe
    Select option #2 - Clean by typing 2 and press Enter.
    Wait for the tool to complete and disk cleanup to finish.
    You will be prompted : "Registry cleaning - Do you want to clean the registry ?" answer Yes by typing Y and hit Enter.
    The tool will also check if wininet.dll is infected. If a clean version is found, you will be prompted to replace wininet.dll. Answer Yes to the question "Replace infected file ?" by typing Y and hit Enter.

    A reboot may be needed to finish the cleaning process, if you computer does not restart automatically please do it yourself manually.

    Post the contents of C:\rapport.txt and a new HijackThis log
  7. 2007-09-02, 20:58 #7
    Aphazael
    Aphazael is offline
    Junior Member
    Join Date
    Sep 2007
    Posts
    9

    Default

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:55:44 AM, on 9/2/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\RTHDCPL.EXE
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Steam\Steam.exe
    C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\system32\cldfjwsk.exe
    C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
    O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [wnctybef] rundll32.exe "C:\Program Files\wnctybef\ifsdqfyf.dll",Init
    O4 - HKLM\..\Run: [gvghmjqf] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\gvghmjqf.dll"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
    O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\hnyxilcx.dll",forkonce
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ProxyCap] C:\PROGRA~1\PROXYL~1\ProxyCap\ProxyCap.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175...at-no-eula.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: DomainService - - C:\WINDOWS\system32\cldfjwsk.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 5245 bytes


    SmitFraudFix v2.219

    Scan done at 11:49:55.26, Sun 09/02/2007
    Run from C:\Documents and Settings\Sean\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts

    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\Documents and Settings\Sean\Application Data\Install.dat Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{C5E5D2EA-1C23-41A1-AFA3-DFDDB45A3D46}: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.1


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System"=""


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End
  8. 2007-09-02, 21:27 #8
    random/random
    random/random is offline
    Security Expert: Visiting Fellow
    Join Date
    Jul 2007
    Posts
    703

    Default

    Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.
    1. Close all applications and windows.
    2. Double-click on dss.exe to run it, and follow the prompts.
    3. When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
    4. Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply
  9. 2007-09-02, 21:54 #9
    Aphazael
    Aphazael is offline
    Junior Member
    Join Date
    Sep 2007
    Posts
    9

    Default

    the program crashes when its about to finish every time
  10. 2007-09-02, 22:02 #10
    random/random
    random/random is offline
    Security Expert: Visiting Fellow
    Join Date
    Jul 2007
    Posts
    703

    Default

    • Download WinPFind by OldTimer here
    • Double click on winpfind.exe to extract it
    • Click extract
    • Wait for the message "All files have been extracted" and then click OK
    • This will create the folder winPFind on your desktop
    • Inside that folder is a file called WinPFind.exe
    • Double click on that file to launch WinPFind
    • This will launch a configuration screen
      • Under Driver Services change the selection to Non-Microsoft
      • Under File Created Within change the selection to 60 days
      • Leave the other settings as they are
    • Click Run Scan
    • During the scan WinPFind may appear to be not responding, this is normal
    • Wait for the scan to finish, this may take several minutes
    • A notepad window will open with WinPFind's log.
    • Copy and paste the contents of that window here.
    • Note: You may need several posts to post the entire log, or it might get cut off
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules