Results 1 to 10 of 10

Thread: Virtumonde Removal

  1. 2009-01-14, 18:59 #1
    dirtywater31
    dirtywater31 is offline
    Junior Member
    Join Date
    Jan 2009
    Posts
    5

    Default Virtumonde Removal

    Have tried on many occasion to remove but always seems to come back after computer restart if internet is connected.

    Here is my HJT Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:53:41 PM, on 1/14/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\ASUS\Probe\AsusProb.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\ACAD2000\acad.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.royaliron.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: {1eaac1d4-38d9-12e9-c604-50745d000858} - {858000d5-4705-406c-9e21-9d834d1caae1} - C:\WINDOWS\system32\tmiate.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - C:\WINDOWS\system32\kojofaba.dll
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
    O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [F-Secure Gatekeeper] umwyaw.exe
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [TaskMon] C:\WINDOWS\system32\taskmon.exe
    O4 - HKLM\..\Run: [CPM7f8c2ca6] Rundll32.exe "C:\WINDOWS\system32\vojedayu.dll",a
    O4 - HKLM\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s
    O4 - HKLM\..\RunServices: [F-Secure Gatekeeper] umwyaw.exe
    O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingA428] command /c del "c:\windows\system32\vojedayu.dll_old"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC7209] cmd /c del "c:\windows\system32\vojedayu.dll_old"
    O4 - HKLM\..\RunOnce: [SpybotDeletingA2003] command /c del "C:\WINDOWS\system32\fibikavi.dll_old"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC4371] cmd /c del "C:\WINDOWS\system32\fibikavi.dll_old"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
    O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunServices: [F-Secure Gatekeeper] umwyaw.exe
    O4 - HKCU\..\RunOnce: [SpybotDeletingB490] command /c del "c:\windows\system32\vojedayu.dll_old"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD3800] cmd /c del "c:\windows\system32\vojedayu.dll_old"
    O4 - HKCU\..\RunOnce: [SpybotDeletingB9074] command /c del "C:\WINDOWS\system32\fibikavi.dll_old"
    O4 - HKCU\..\RunOnce: [SpybotDeletingD9315] cmd /c del "C:\WINDOWS\system32\fibikavi.dll_old"
    O4 - HKUS\S-1-5-19\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [bigajuhiki] Rundll32.exe "C:\WINDOWS\system32\posetoma.dll",s (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
    O20 - AppInit_DLLs: tmiate.dll C:\WINDOWS\system32\dimidiva.dll c:\windows\system32\vojedayu.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\vojedayu.dll (file missing)
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\vojedayu.dll (file missing)
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    --
    End of file - 9289 bytes
  2. 2009-01-18, 20:37 #2
    shelf life
    shelf life is offline
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi dirtywater31,

    we will get a download to use. Link and directions:

    Please download Malwarebytes' Anti-Malware (MBAM) to your desktop:

    http://www.malwarebytes.org/mbam.php

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform FULL SCAN, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    *** Be sure that everything is checked, and click Remove Selected.***
    * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

    please post the MBAM log in reply. Also after you use MBAM, rescan and post a new hjt log in your reply.
    How Can I Reduce My Risk?
  3. 2009-01-20, 15:33 #3
    dirtywater31
    dirtywater31 is offline
    Junior Member
    Join Date
    Jan 2009
    Posts
    5

    Default

    Malwarebytes' Anti-Malware 1.33
    Database version: 1668
    Windows 5.1.2600 Service Pack 3

    1/20/2009 9:21:38 AM
    mbam-log-2009-01-20 (09-21-21).txt

    Scan type: Full Scan (C:\|T:\|)
    Objects scanned: 79000
    Time elapsed: 24 minute(s), 58 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 3
    Registry Keys Infected: 10
    Registry Values Infected: 10
    Registry Data Items Infected: 4
    Folders Infected: 0
    Files Infected: 46

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> No action taken.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{b8daa2b3-1adb-4c8d-9204-362bbe1eb1d5} (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> No action taken.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bigajuhiki (Trojan.Vundo.H) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingb1036 (Trojan.Vundo.H) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingd6337 (Trojan.Vundo.H) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletinga3359 (Trojan.Vundo.H) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\spybotdeletingc1348 (Trojan.Vundo.H) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskmon (Trojan.Downloader) -> No action taken.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> No action taken.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vehuyafa.dll -> No action taken.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> No action taken.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\SYSTEM32\bufezeza.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\azezefub.ini (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\fajutuse.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\esutujaf.ini (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\tituzeki.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\ikezutit.ini (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> No action taken.
    C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\SYSTEM32\jawepuwa.dll_old (Trojan.Vundo.H) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068632.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068633.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068634.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068639.exe (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068643.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068645.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068676.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068678.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068686.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068688.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068702.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068703.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068713.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068714.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068716.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068717.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP625\A0068957.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069035.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069036.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP630\A0069169.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069324.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069322.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069323.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069325.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069326.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069327.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069328.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069329.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069331.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069334.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069335.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069345.dll (Trojan.Vundo) -> No action taken.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069361.dll (Trojan.Vundo) -> No action taken.
    C:\Documents and Settings\Scott\Local Settings\Temp\Temporary Internet Files\Content.IE5\7PE1LQRL\InstallAVg_770522170802[1].exe (Rogue.Installer) -> No action taken.
    C:\WINDOWS\SYSTEM32\sosafuji.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\SYSTEM32\hepozili.dll (Trojan.Vundo) -> No action taken.
  4. 2009-01-20, 23:22 #4
    shelf life
    shelf life is offline
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi,

    check MBAM for updates then do a full scan again, and this time after the scan:

    * When the scan is complete, click OK, then Show Results to view the results.
    *** Be sure that everything is checked, and click Remove Selected.***

    * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

    after you are done with MBAM, rescan and post a new hjt log.
    How Can I Reduce My Risk?
  5. 2009-01-21, 15:52 #5
    dirtywater31
    dirtywater31 is offline
    Junior Member
    Join Date
    Jan 2009
    Posts
    5

    Default

    Malwarebytes' Anti-Malware 1.33
    Database version: 1674
    Windows 5.1.2600 Service Pack 3

    1/21/2009 8:43:48 AM
    mbam-log-2009-01-21 (08-43-48).txt

    Scan type: Full Scan (C:\|T:\|)
    Objects scanned: 79142
    Time elapsed: 25 minute(s), 44 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 2
    Registry Keys Infected: 10
    Registry Values Infected: 6
    Registry Data Items Infected: 4
    Folders Infected: 0
    Files Infected: 46

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b8daa2b3-1adb-4c8d-9204-362bbe1eb1d5} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{b64f4a7c-97c9-11da-8bde-f66bad1e3f3a} (Rogue.WinAntivirus) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bigajuhiki (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\F-Secure Gatekeeper (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\taskmon (Trojan.Downloader) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\vehuyafa.dll -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: system32\vehuyafa.dll -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\StartMenuLogOff (Hijack.StartMenu) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\SYSTEM32\bufezeza.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\azezefub.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\fajutuse.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\esutujaf.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\pidezabi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\ibazedip.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\tituzeki.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\ikezutit.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\dataheme.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\vehuyafa.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\SYSTEM32\ayfjmc.dll (Trojan.Vundo) -> Delete on reboot.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068632.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068633.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP619\A0068634.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068639.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068643.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP620\A0068645.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068676.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP622\A0068678.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068686.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068688.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068702.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP623\A0068703.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068713.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068714.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068716.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP624\A0068717.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP625\A0068957.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069035.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP627\A0069036.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP630\A0069169.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069324.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069322.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069323.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069325.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069326.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069327.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069328.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069329.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069331.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069334.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069335.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069345.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{E05EDB9B-C940-4646-9F64-9D3DC94AAA8E}\RP633\A0069361.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\sosafuji.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\SYSTEM32\hepozili.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
  6. 2009-01-21, 23:24 #6
    shelf life
    shelf life is offline
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi,

    ok good. lets get one more tool for another look. Its called combofix. There is a guide you should read. One thing you should do is install the ms recovery console. You can do it manually as posted in the guide or combofix will do it for before it scans. Disabled any AV/anti-malware before using combofix.

    the guide is here:
    http://www.bleepingcomputer.com/comb...o-use-combofix
    Post the combofix log in your reply.
    How Can I Reduce My Risk?
  7. 2009-01-22, 17:28 #7
    dirtywater31
    dirtywater31 is offline
    Junior Member
    Join Date
    Jan 2009
    Posts
    5

    Default

    ComboFix 09-01-21.02 - Scott 2009-01-22 10:49:32.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.631 [GMT -5:00]
    Running from: c:\documents and settings\Scott\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\start.exe
    c:\windows\system32\aravawaw.ini
    c:\windows\system32\asepuwid.ini
    c:\windows\system32\awadeyuw.ini
    c:\windows\system32\ayisalup.ini
    c:\windows\system32\azowoyuh.ini
    c:\windows\system32\ehetazep.ini
    c:\windows\system32\ejtmpt.dll
    c:\windows\system32\hupetetu.dll
    c:\windows\system32\ihikabiw.ini
    c:\windows\system32\imagijuv.ini
    c:\windows\system32\isiwosom.ini
    c:\windows\system32\ivakibif.ini
    c:\windows\system32\jskjwq.dll
    c:\windows\system32\lelimafu.dll
    c:\windows\system32\luruwono.dll
    c:\windows\system32\mawuwaha.dll
    c:\windows\system32\nizefipu.dll
    c:\windows\system32\oreroraz.ini
    c:\windows\system32\yeneriho.dll
    c:\windows\Web\default.htt
    T:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
    .

    2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
    2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\documents and settings\Scott\Application Data\Malwarebytes
    2009-01-20 08:54 . 2009-01-20 08:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
    2009-01-20 08:54 . 2009-01-14 16:11 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
    2009-01-20 08:54 . 2009-01-14 16:11 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
    2009-01-14 12:53 . 2009-01-14 12:53 <DIR> d-------- c:\program files\Trend Micro
    2009-01-09 08:00 . 2009-01-09 08:07 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
    2009-01-06 11:51 . 2009-01-06 11:51 <DIR> d-------- c:\program files\Autodesk
    2008-12-29 08:47 . 2008-12-29 08:47 0 --a------ c:\windows\SYSTEM32\efulizul.tmp
    2008-12-24 11:35 . 2008-12-24 11:35 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
    2008-12-24 11:35 . 2008-12-24 11:35 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
    2008-12-24 08:24 . 2008-12-24 08:24 <DIR> d-------- c:\program files\Lavasoft
    2008-12-24 08:24 . 2008-12-24 08:24 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2008-12-24 08:24 . 2008-12-24 08:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-16 13:06 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-01-16 13:06 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-01-06 16:51 --------- d-----w c:\program files\Common Files\Autodesk Shared
    2009-01-02 15:54 --------- d-----w c:\program files\FriendBlasterPro
    2009-01-02 14:33 --------- d-----w c:\program files\ACAD2000
    2008-12-15 13:22 --------- d-----w c:\program files\Java
    2006-07-02 21:21 266 --sha-w c:\program files\desktop.ini
    2006-07-02 21:21 11,079 ---ha-w c:\program files\folder.htt
    2008-08-30 16:55 32,768 --sha-w c:\windows\SYSTEM32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083020080831\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SlowFile Icon Overlay]
    @="{7D688A77-C613-11D0-999B-00C04FD655E1}"
    [HKEY_CLASSES_ROOT\CLSID\{7D688A77-C613-11D0-999B-00C04FD655E1}]
    2008-04-13 19:12 8461312 --a------ c:\windows\SYSTEM32\SHELL32.DLL

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-29 68856]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ASUS Probe"="c:\program files\ASUS\Probe\AsusProb.exe" [2002-12-06 617984]
    "ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-09 71328]
    "Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2006-07-03 100056]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-15 136600]
    "TCASUTIEXE"="TCAUDIAG.exe" [2003-02-12 c:\windows\SYSTEM32\TCAUDIAG.EXE]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2003-06-18 54472]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.VDOM"= vdowave.drv

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.exe.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.exe.lnk
    backup=c:\windows\pss\Adobe Gamma Loader.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    --a------ 2008-04-13 19:12 1695232 c:\program files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
    --a------ 2003-05-30 08:42 585728 c:\program files\Analog Devices\SoundMAX\SMax4.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
    --a------ 2003-05-29 15:28 790528 c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
    "LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001
    "UpdatesDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Messenger\\MSMSGS.EXE"=
    "c:\\Program Files\\Norton AntiVirus\\NAVAPSVC.EXE"=
    "c:\\Program Files\\Java\\jre6\\bin\\jqs.exe"=
    "c:\\Program Files\\Common Files\\Symantec Shared\\Security Center\\SymWSC.exe"=
    "c:\\Program Files\\Analog Devices\\SoundMAX\\SMAgent.exe"=
    "c:\\Program Files\\Common Files\\Symantec Shared\\ccEvtMgr.exe"=

    R4 tcaicchg;tcaicchg;c:\windows\SYSTEM32\TCAICCHG.SYS [2000-06-06 21233]
    R4 TCAITDI;TCAITDI Protocol;c:\windows\SYSTEM32\DRIVERS\TCAITDI.SYS [2001-09-04 19534]
    S0 viaraid;viaraid;c:\windows\system32\DRIVERS\viaraid.sys --> c:\windows\system32\DRIVERS\viaraid.sys [?]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6b6bfa3d-c675-11db-ad22-000ea60690dd}]
    \Shell\AutoRun\command - e:\jdsecure\Windows\JDSecure31.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-01-05 c:\windows\Tasks\Drawings A-H.job
    - c:\windows\system32\ntbackup.exe [2008-04-13 19:12]

    2009-01-06 c:\windows\Tasks\Drawings I-P.job
    - c:\windows\system32\ntbackup.exe [2008-04-13 19:12]

    2009-01-07 c:\windows\Tasks\Drawings R-Z.job
    - c:\windows\system32\ntbackup.exe [2008-04-13 19:12]

    2006-11-30 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Scott.job
    - c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 17:22]

    2008-09-13 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
    - c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 17:22]

    2009-01-22 c:\windows\Tasks\Symantec NetDetect.job
    - c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-06-18 16:17]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)
    HKCU-Run-F-Secure Gatekeeper - umwyaw.exe
    HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    Notify-WgaLogon - (no file)
    MSConfigStartUp-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    MSConfigStartUp-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    MSConfigStartUp-NeroFilterCheck - c:\program files\Common Files\Nero\Lib\NeroCheck.exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.royaliron.com/
    DPF: DirectAnimation Java Classes - file://c:\windows\SYSTEM\dajava.cab
    DPF: Internet Explorer Classes for Java - file://c:\windows\SYSTEM\iejava.cab
    DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    FF - ProfilePath - c:\documents and settings\Scott\Application Data\Mozilla\Firefox\Profiles\bbwfdja8.default\

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-22 10:56:16
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
    c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
    c:\program files\Lavasoft\Ad-Aware\aawservice.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Norton AntiVirus\NAVAPSVC.EXE
    c:\program files\Norton AntiVirus\SAVScan.exe
    c:\program files\Analog Devices\SoundMAX\SMAgent.exe
    c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    c:\windows\SYSTEM32\wdfmgr.exe
    c:\program files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    .
    **************************************************************************
    .
    Completion time: 2009-01-22 10:58:53 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-01-22 15:58:47

    Pre-Run: 103,198,036,480 bytes free
    Post-Run: 104,271,409,664 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout = 30
    default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS = "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    186 --- E O F --- 2008-12-18 21:50:54
  8. 2009-01-22, 23:23 #8
    shelf life
    shelf life is offline
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi,

    ok good. Must be looking better on your end.
    Rescan and post one more hjt log.
    How Can I Reduce My Risk?
  9. 2009-01-26, 15:53 #9
    dirtywater31
    dirtywater31 is offline
    Junior Member
    Join Date
    Jan 2009
    Posts
    5

    Default

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:52:24 AM, on 1/26/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ASUS\Probe\AsusProb.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\Program Files\ACAD2000\acad.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.royaliron.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)
    O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG.exe -off
    O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_1_0 -reboot 1
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/re...s/MSNPUpld.cab
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

    --
    End of file - 7177 bytes
    Last edited by tashi; 2009-02-05 at 06:39. Reason: Archive timestamp
  10. 2009-01-26, 23:34 #10
    shelf life
    shelf life is offline
    Emeritus
    Join Date
    Nov 2005
    Location
    @localhost
    Posts
    6,066

    Default

    hi dirtywater31,

    ok. Thanks for the info. we will use hjt. First disable spybots tea timer so it wont go nuts:

    1. Run Spybot-S&D in Advanced Mode.
    2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
    3. On the left hand side, Click on Tools
    4. Then click on the Resident Icon in the List
    5. Uncheck "Resident TeaTimer" and OK any prompts.
    6. Restart your computer.


    start HJT, click the "Scan" button. check the items below, close any open windows, then click "Fixed checked"

    O2 - BHO: (no name) - {b7cca5b1-b41c-4067-8b15-c4fe8bfa9a41} - (no file)

    O4 - HKCU\..\Run: [F-Secure Gatekeeper] umwyaw.exe
    ----------------------------------------
    reboot computer and check MBAM for updates and run it once more.Post the MBAM log. Last: post a new hjt log also
    How Can I Reduce My Risk?
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules