Page 2 of 4 FirstFirst 1234 LastLast
Results 11 to 20 of 32

Thread: Another Virtumonde Removal

  1. #11
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    Quote Originally Posted by Shaba View Post
    Hi

    Glad that it finally ran, anyway

    Please make sure that you can view all hidden files. Instructions on how to do this can be found here:

    How to see hidden files in Windows

    Please click this link-->Jotti

    When the jotti page has finished loading, click the Browse button and navigate to the following file and click Submit.

    C:\WINDOWS\system32\drivers\bwoncqcb.sys

    Repeat step for these:

    C:\WINDOWS\system32\drivers\bwoncqcb.dat
    C:\WINDOWS\system32\drivers\ylitivvl.dat
    C:\WINDOWS\system32\drivers\ylitivvl.sys
    C:\WINDOWS\system32\cscu.dll

    Please post back the results of the scan in your next post.

    If Jotti is busy, try the same at Virustotal: http://www.virustotal.com/

    Here are the results:

    bwoncqcb.sys

    A-Squared Found Trojan.Win32.BHO.gy
    AntiVir Found TR/Rootkit.Gen
    ArcaVir Found Trojan.Bho.Gy
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found Trojan.Spy.Bzub.NFQ
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found Trojan.Sentinel
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found Trojan.Win32.BHO.gy
    Fortinet Found nothing
    Kaspersky Anti-Virus Found Trojan.Win32.BHO.gy
    NOD32 Found a variant of Win32/Rootkit.Agent.NDA
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Rising Antivirus Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing


    bwoncqcb.dat


    will not scan file.


    ylitivvl.sys


    A-Squared Found Trojan.Win32.BHO.gy
    AntiVir Found nothing
    ArcaVir Found Trojan.Bho.Gy
    Avast Found nothing
    AVG Antivirus Found nothing
    BitDefender Found Trojan.Spy.Bzub.NFQ
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found Trojan.Sentinel
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found Trojan.Win32.BHO.gy
    Fortinet Found nothing
    Kaspersky Anti-Virus Found Trojan.Win32.BHO.gy
    NOD32 Found nothing
    Norman Virus Control Found nothing
    Panda Antivirus Found nothing
    Rising Antivirus Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found Trojan.Win32.BHO.gy



    ylitivvl.dat

    will not run


    cscu.dll

    A-Squared Found nothing
    AntiVir Found nothing
    ArcaVir Found nothing
    Avast Found nothing
    AVG Antivirus Found BHO.BLR
    BitDefender Found nothing
    ClamAV Found nothing
    CPsecure Found nothing
    Dr.Web Found Trojan.Click.4671
    F-Prot Antivirus Found nothing
    F-Secure Anti-Virus Found nothing
    Fortinet Found nothing
    Kaspersky Anti-Virus Found nothing
    NOD32 Found nothing
    Norman Virus Control Found W32/BHO.QG
    Panda Antivirus Found nothing
    Rising Antivirus Found nothing
    Sophos Antivirus Found nothing
    VirusBuster Found nothing
    VBA32 Found nothing





    I have tried all day to scan the DAT files with no luck.
    When i hit SUBMIT its says uploading and then gos to a blank white page.

    I ahve left the white page up for hours before with no luck.

  2. #12
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Download suspicious file packer from here

    Unzip it to desktop, open it & paste in the list of files below, press next & it will create an archive (zip/cab file) on desktop

    C:\WINDOWS\system32\drivers\bwoncqcb.sys
    C:\WINDOWS\system32\drivers\bwoncqcb.dat
    C:\WINDOWS\system32\drivers\ylitivvl.dat
    C:\WINDOWS\system32\drivers\ylitivvl.sys
    C:\WINDOWS\system32\cscu.dll

    Go to spykiller

    Press new topic, make threads title "Files for Shaba"
    Include to your message a link to here, then attach the cab/zip file to your message and post the topic
    If you cant locate it through the browse button just copy/paste the filename and path.

    Post back after you've done that, please
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  3. #13
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    I have posted the files for you on spykiller.

    thanks for the help with this nasty little bugger

  4. #14
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Thanks for the files

    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    File::
    C:\WINDOWS\system32\drivers\bwoncqcb.sys
    C:\WINDOWS\system32\drivers\bwoncqcb.dat
    C:\WINDOWS\system32\drivers\ylitivvl.dat
    C:\WINDOWS\system32\drivers\ylitivvl.sys
    C:\WINDOWS\system32\cscu.dll
    
    Driver::
    qufoglgi
    
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnmmkj]
    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  5. #15
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    ComboFix 07-10-06.5 - Scot 2007-10-09 20:08:46.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.473 [GMT -7:00]
    Running from: C:\Documents and Settings\Scot\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Scot\Desktop\CFscript.txt
    * Created a new restore point

    FILE::
    C:\WINDOWS\system32\cscu.dll
    C:\WINDOWS\system32\drivers\bwoncqcb.dat
    C:\WINDOWS\system32\drivers\bwoncqcb.sys
    C:\WINDOWS\system32\drivers\ylitivvl.dat
    C:\WINDOWS\system32\drivers\ylitivvl.sys
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\cscu.dll . . . . failed to delete
    C:\WINDOWS\system32\drivers\bwoncqcb.dat . . . . failed to delete
    C:\WINDOWS\system32\drivers\ylitivvl.dat . . . . failed to delete

    .
    ((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))
    .

    2007-10-09 13:17 <DIR> d-------- C:\WINDOWS\LastGood
    2007-10-06 23:35 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-06 13:48 5,120 C:\WINDOWS\system32\drivers\bwoncqcb.dat
    2007-10-06 13:48 17,664 C:\WINDOWS\system32\drivers\ylitivvl.dat
    2007-10-01 22:55 <DIR> d-------- C:\VundoFix Backups
    2007-10-01 22:53 <DIR> d-------- C:\Program Files\Trend Micro
    2007-09-27 23:01 106,897 --a------ C:\WINDOWS\system32\cscu.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-08-26 12:14 --------- d-------- C:\Program Files\MSTpscre
    2007-08-22 20:54 --------- d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2007-08-22 20:49 --------- d--h----- C:\Program Files\InstallShield Installation Information
    2007-08-22 20:49 --------- d-------- C:\Program Files\Common Files\InstallShield
    2007-08-22 20:48 --------- d-------- C:\Program Files\Common Files\AOL
    2007-08-22 19:35 --------- d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-08-19 17:24 --------- d-------- C:\Program Files\PowerISO
    2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll
    2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll
    2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll
    2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll
    2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll
    2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-06_23.44.17.76 )))))))))))))))))))))))))))))))))))))))))
    .
    ----a-w 14,048 2005-02-25 03:35:06 C:\WINDOWS\$hf_mig$\KB901214\spmsg.dll
    ----a-w 209,632 2005-02-25 03:35:06 C:\WINDOWS\$hf_mig$\KB901214\spuninst.exe
    ----a-w 22,240 2005-02-25 03:35:06 C:\WINDOWS\$hf_mig$\KB901214\update\spcustom.dll
    ----a-w 718,048 2005-02-25 03:35:06 C:\WINDOWS\$hf_mig$\KB901214\update\update.exe
    ----a-w 371,936 2005-02-25 03:35:08 C:\WINDOWS\$hf_mig$\KB901214\update\updspapi.dll
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\spuninst.exe
    ----a-w 1,022,976 2007-08-22 12:55:28 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\browseui.dll
    ----a-w 151,040 2007-08-22 12:55:29 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\cdfview.dll
    ----a-w 1,054,208 2007-08-22 12:55:30 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\danim.dll
    ----a-w 357,888 2007-08-22 12:55:30 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\dxtmsft.dll
    ----a-w 205,824 2007-08-22 12:55:31 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\dxtrans.dll
    ----a-w 55,808 2007-08-22 12:55:31 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\extmgr.dll
    ----a-w 18,432 2007-08-21 10:19:39 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\iedw.exe
    ----a-w 251,904 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\iepeers.dll
    ----a-w 96,256 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\inseng.dll
    ----a-w 16,384 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\jsproxy.dll
    ----a-w 3,064,832 2007-08-22 12:55:36 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mshtml.dll
    ----a-w 449,024 2007-08-22 12:55:37 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mshtmled.dll
    ----a-w 146,432 2007-08-22 12:55:37 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\msrating.dll
    ----a-w 532,480 2007-08-22 12:55:38 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mstime.dll
    ----a-w 39,424 2007-08-22 12:55:38 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\pngfilt.dll
    ----a-w 1,498,112 2007-08-22 12:55:40 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\shdocvw.dll
    ----a-w 474,112 2007-08-22 12:55:41 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\shlwapi.dll
    ----a-w 617,984 2007-08-22 12:55:43 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\urlmon.dll
    ----a-w 665,600 2007-08-22 12:55:44 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\wininet.dll
    ----a-w 350,720 2007-08-21 10:13:33 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\xpsp3res.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\updspapi.dll
    ----a-w 14,048 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spmsg.dll
    ----a-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spuninst.exe
    ----a-w 584,192 2007-07-09 13:09:42 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\rpcrt4.dll
    ----a-w 115,712 2007-06-13 06:53:14 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\xpsp3res.dll
    ----a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\rpcrt4.dll
    ----a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\xpsp3res.dll
    ----a-w 22,752 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\spcustom.dll
    ----a-w 716,000 2005-10-12 23:12:28 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\update.exe
    ----a-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\updspapi.dll
    ----a-w 14,048 2005-02-25 03:35:06 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\spmsg.dll
    ----a-w 209,632 2005-02-25 03:35:06 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\spuninst.exe
    ----a-w 74,240 2005-06-29 01:46:00 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\sp2gdr\mscms.dll
    ----a-w 22,240 2005-02-25 03:35:06 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\update\spcustom.dll
    ----a-w 718,048 2005-02-25 03:35:06 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\update\update.exe
    ----a-w 371,936 2005-02-25 03:35:08 C:\WINDOWS\SoftwareDistribution\Download\851ca0947900bb8445d41485b8290a6f\update\updspapi.dll
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spuninst.exe
    ----a-w 683,520 2007-08-21 06:15:44 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2gdr\inetcomm.dll
    ----a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2qfe\inetcomm.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\updspapi.dll
    ----a-w 16,384 2007-10-10 03:06:42 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
    ----a-w 32,768 2007-10-10 03:06:42 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    .
    ----a-w 14,048 2005-02-25 04:35:06 C:\WINDOWS\$hf_mig$\KB901214\spmsg.dll
    ----a-w 209,632 2005-02-25 04:35:06 C:\WINDOWS\$hf_mig$\KB901214\spuninst.exe
    ----a-w 22,240 2005-02-25 04:35:06 C:\WINDOWS\$hf_mig$\KB901214\update\spcustom.dll
    ----a-w 718,048 2005-02-25 04:35:06 C:\WINDOWS\$hf_mig$\KB901214\update\update.exe
    ----a-w 371,936 2005-02-25 04:35:08 C:\WINDOWS\$hf_mig$\KB901214\update\updspapi.dll
    ----a-w 16,384 2007-10-03 17:17:40 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
    ----a-w 32,768 2007-10-03 17:17:40 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0A953C25-71ED-4777-AB7E-D4F736097A3E}]
    2004-10-08 05:01 106897 --a------ C:\WINDOWS\system32\cscu.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 05:04]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-07-26 00:33]
    "nwiz"="nwiz.exe" [2005-07-26 00:34 C:\WINDOWS\system32\nwiz.exe]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-07-26 00:34]
    "SoundMan"="SOUNDMAN.EXE" [2005-05-17 19:48 C:\WINDOWS\SOUNDMAN.EXE]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-01-25 22:15]
    "Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2006-01-12 21:52]
    "avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-09-09 10:26]
    "HostManager"="C:\Program Files\Common Files\AOL\1170093156\ee\AOLSoftware.exe" [2006-09-25 17:52]
    "Disk Monitor"="C:\Documents and Settings\Scot\Disk_Monitor.exe" []
    "Tpscrex"="C:\Program Files\MSTpscre\Tpscrex.exe" []

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
    "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme

    R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
    R0 qufoglgi;qufoglgi;C:\WINDOWS\system32\drivers\ylitivvl.dat
    R2 713xTVCard;SAA7134 TV Card;C:\WINDOWS\system32\DRIVERS\SAA713x.sys
    R2 Par1284;Par1284;\??\C:\Program Files\FlexiSIGN-PRO 7.5v5\Program\Par1284.sys
    R3 PhilTune;Philips TV Tuner;C:\WINDOWS\system32\Drivers\PhilTune.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd81a016-99bc-11db-8e60-806d6172696f}]
    AutoRun\command- I:\Setup.exe

    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-09 21:00:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-09 21:02:12 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-10-09 21:01
    C:\ComboFix2.txt ... 2007-10-06 23:45
    .
    --- E O F ---

  6. #16
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    HJT Log


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:03:49 PM, on 10/9/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avscan.exe
    C:\WINDOWS\system32\cmd.exe
    C:\WINDOWS\system32\cmd.exe
    C:\ComboFix\nircmd.cfexe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
    C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
    C:\Program Files\Common Files\AOL\1170093156\ee\AOLSoftware.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Adobe\Acrobat 7.0\Distillr\AcroDist.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Common Files\AOL\1170093156\ee\aolsoftware.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Documents and Settings\Scot\Desktop\scanner.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {0A953C25-71ED-4777-AB7E-D4F736097A3E} - C:\WINDOWS\system32\cscu.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1170093156\ee\AOLSoftware.exe
    O4 - HKLM\..\Run: [Disk Monitor] C:\Documents and Settings\Scot\Disk_Monitor.exe
    O4 - HKLM\..\Run: [Tpscrex] C:\Program Files\MSTpscre\Tpscrex.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-21-1715567821-57989841-682003330-1004\..\Run: [AOL Fast Start] "C:\Program Files\America Online 9.0\AOL.EXE" -b (User 'Michelle')
    O4 - HKUS\S-1-5-21-1715567821-57989841-682003330-1004\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AdobeUpdateManager.exe" AcPro7_0_8 -reboot 1 (User 'Michelle')
    O4 - HKUS\S-1-5-21-1715567821-57989841-682003330-1004\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Michelle')
    O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
    O4 - S-1-5-21-1715567821-57989841-682003330-1004 Startup: AOL OpenRide.lnk = C:\Program Files\Common Files\AOL\Launch\aollaunch.exe (User 'Michelle')
    O4 - S-1-5-21-1715567821-57989841-682003330-1004 User Startup: AOL OpenRide.lnk = C:\Program Files\Common Files\AOL\Launch\aollaunch.exe (User 'Michelle')
    O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
    O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
    O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1167762646265
    O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/luxr/def...jolauncher.cab
    O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/6...l/gtdownls.cab
    O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -
    O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
    O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
    O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
    O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
    O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    --
    End of file - 7710 bytes

  7. #17
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Ok, more brute force is needed:

    1. Please download The Avenger by Swandog46 to your Desktop.
    • Click on Avenger.zip to open the file
    • Extract avenger.exe to your desktop


    2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

    Files to delete:
    C:\WINDOWS\system32\cscu.dll
    C:\WINDOWS\system32\drivers\bwoncqcb.dat
    C:\WINDOWS\system32\drivers\ylitivvl.dat

    Drivers to unload:
    qufoglgi

    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


    3. Now, start The Avenger program by clicking on its icon on your desktop.
    • Under "Script file to execute" choose "Input Script Manually".
    • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
    • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
    • Click Done
    • Now click on the Green Light to begin execution of the script
    • Answer "Yes" twice when prompted.
    4. The Avenger will automatically do the following:
    • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
    • On reboot, it will briefly open a black command window on your desktop, this is normal.
    • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
    • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
    5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply

    Re-run combofix

    Post:

    - a fresh HijackThis log
    - c:\avenger.txt
    - combofix report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  8. #18
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    Avenger Log


    Logfile of The Avenger version 1, by Swandog46
    Running from registry key:
    \Registry\Machine\System\CurrentControlSet\Services\nykiyeal

    *******************

    Script file located at: \??\C:\Documents and Settings\fcgyvvrc.txt
    Script file opened successfully.

    Script file read successfully

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:



    File C:\WINDOWS\system32\cscu.dll not found!
    Deletion of file C:\WINDOWS\system32\cscu.dll failed!

    Could not process line:
    C:\WINDOWS\system32\cscu.dll
    Status: 0xc0000034

    File C:\WINDOWS\system32\drivers\bwoncqcb.dat deleted successfully.
    File C:\WINDOWS\system32\drivers\ylitivvl.dat deleted successfully.
    Driver qufoglgi unloaded successfully.

    Completed script processing.

    *******************

    Finished! Terminate.


    It took about 4 tries to get it to work. It would reboot and freeze during boot and go to "The Dreaded Blue Screen of Death"

    Finally it just worked

  9. #19
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    ComboFix 07-10-11.1 - Scot 2007-10-10 19:30:40.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.660 [GMT -7:00]
    Running from: C:\Documents and Settings\Scot\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2007-09-11 to 2007-10-11 )))))))))))))))))))))))))))))))
    .

    2007-10-06 23:35 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-01 22:55 <DIR> d-------- C:\VundoFix Backups
    2007-10-01 22:53 <DIR> d-------- C:\Program Files\Trend Micro



    to large for single post

  10. #20
    Junior Member
    Join Date
    Oct 2007
    Posts
    20

    Default

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-08-26 19:14 --------- d-----w C:\Program Files\MSTpscre
    2007-08-23 03:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2007-08-23 03:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-08-23 03:49 --------- d-----w C:\Program Files\Common Files\InstallShield
    2007-08-23 03:48 --------- d-----w C:\Program Files\Common Files\AOL
    2007-08-23 02:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-20 00:24 --------- d-----w C:\Program Files\PowerISO
    2007-08-20 00:05 --------- d-----w C:\Program Files\Common Files\Adobe
    2007-07-31 02:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-31 02:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-31 02:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-31 02:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-31 02:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-31 02:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-31 02:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-31 02:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-03-08 01:15 18,312 ----a-w C:\Documents and Settings\Michelle\Application Data\GDIPFONTCACHEV1.DAT

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •