Results 1 to 3 of 3

Thread: Virtumonde/Virtumonde Dll Infection

  1. #1
    Junior Member
    Join Date
    Mar 2008
    Posts
    6

    Default Virtumonde/Virtumonde Dll Infection

    My computer was running slow, so I ran spybot. The scan showed 10 entries for Virtumonde Dll, and 4 entries for Virtumonde. I did a Kaspersky Online scan, bot they did not show up. I have attached a my ComboFix, and my HJT log ( unfortunately this is not my first Virtumonde infection ).

    ComboFix 09-04-23.02 - Deo Volente 04/22/2009 23:16.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.450 [GMT -5:00]
    Running from: c:\documents and settings\Deo Volente\Desktop\ComboFix.exe
    AV: avast! antivirus 4.8.1335 [VPS 090422-0] *On-access scanning disabled* (Updated)
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    c:\windows\BMb36b57ef.txt
    c:\windows\gufizite.dll
    c:\windows\juyadewi.dll
    c:\windows\kakekuze.dll
    c:\windows\system32\bonalopi.dll
    c:\windows\system32\eidvqkqt.ini
    c:\windows\system32\getaviwi.dll
    c:\windows\system32\hunazazi.dll
    c:\windows\system32\jevayeyi.dll
    c:\windows\system32\kovabova.dll
    c:\windows\system32\lelohute.dll
    c:\windows\system32\oserepov.ini
    c:\windows\system32\piyudijo.dll
    c:\windows\system32\pokumala.dll
    c:\windows\system32\qugjfrly.ini
    c:\windows\system32\tuwejipe.dll
    c:\windows\system32\vopereso.dll
    c:\windows\system32\wibopovo.dll
    c:\windows\system32\wojujive.dll

    ----- BITS: Possible infected sites -----

    hxxp://download.esd.intuit.com
    .
    ((((((((((((((((((((((((( Files Created from 2009-03-23 to 2009-04-23 )))))))))))))))))))))))))))))))
    .

    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w C:\zizikedu.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w C:\lifeheje.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\documents and settings\All Users\Application Data\lebapide.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 ---ha-w c:\windows\hogineje
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w C:\nukiyofi.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\documents and settings\All Users\Application Data\voyebabe.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\documents and settings\All Users\Application Data\halivevi.dll
    2009-04-15 00:43 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
    2009-04-15 00:43 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
    2009-04-15 00:43 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe
    2009-04-15 00:43 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
    2009-04-15 00:43 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
    2009-04-15 00:43 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
    2009-04-15 00:43 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
    2009-04-15 00:43 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
    2009-04-15 00:43 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
    2009-04-15 00:43 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
    2009-04-15 00:42 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
    2009-04-15 00:42 . 2009-03-27 06:58 1203922 ------w c:\windows\system32\dllcache\sysmain.sdb
    2009-04-15 00:42 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
    2009-04-13 19:18 . 2009-04-13 19:19 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    2009-04-03 00:27 . 2009-04-03 00:27 -------- d-----w c:\documents and settings\All Users\Application Data\FreeRIP
    2009-03-29 17:25 . 2009-04-04 04:26 -------- d-----w c:\documents and settings\Deo Volente\Application Data\eMusic
    2009-03-29 17:25 . 2009-03-29 17:25 -------- d-----w c:\documents and settings\Deo Volente\Local Settings\Application Data\eMusic

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-04-23 04:07 . 2008-12-06 21:05 -------- d-----w c:\documents and settings\Deo Volente\Application Data\HPAppData
    2009-04-23 03:54 . 2008-03-12 23:47 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\program files\darususi.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\program files\wutupaba.dll
    2009-04-23 03:41 . 2009-04-23 03:41 0 --sha-w c:\program files\vuverisa.dll
    2009-04-23 03:21 . 2008-12-01 00:49 -------- d-----w c:\documents and settings\All Users\Application Data\HP
    2009-04-23 02:44 . 2008-03-12 23:47 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-04-23 02:03 . 2009-01-23 02:03 46592 --sha-w c:\windows\system32\tinonere.exe
    2009-04-17 21:38 . 2008-12-05 21:25 -------- d-----w c:\documents and settings\Hend Family\Application Data\HPAppData
    2009-04-13 19:19 . 2009-04-13 19:18 -------- d-----w c:\program files\iTunes
    2009-04-13 19:18 . 2009-04-13 19:18 -------- d-----w c:\program files\iPod
    2009-04-13 19:18 . 2009-02-23 00:43 -------- d-----w c:\program files\Common Files\Apple
    2009-04-04 04:26 . 2007-11-21 21:43 -------- d-----w c:\program files\eMusic Download Manager
    2009-04-04 04:26 . 2006-04-21 13:05 -------- d--h--w c:\program files\InstallShield Installation Information
    2009-04-03 00:27 . 2009-04-03 00:27 -------- d-----w c:\program files\FreeRIP3
    2009-04-03 00:15 . 2009-03-02 01:15 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
    2009-04-01 23:07 . 2006-04-21 12:59 -------- d-----w c:\program files\Java
    2009-03-28 18:50 . 2007-10-30 02:32 -------- d-----w c:\program files\dl_Cats
    2009-03-21 14:06 . 2009-03-21 14:06 989696 ------w c:\windows\system32\dllcache\kernel32.dll
    2009-03-21 06:20 . 2007-11-21 04:31 5852 --sha-w c:\windows\system32\KGyGaAvL.sys
    2009-03-19 21:32 . 2009-02-23 00:47 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-03-15 06:42 . 2009-03-15 06:41 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    2009-03-15 06:39 . 2009-03-15 06:39 -------- d-----w c:\program files\Bonjour
    2009-03-14 02:44 . 2007-11-14 01:53 -------- d-----w c:\documents and settings\Deo Volente\Application Data\AdobeUM
    2009-03-13 23:02 . 2009-03-13 23:02 -------- d-----w c:\documents and settings\Hend Family\Application Data\Apple Computer
    2009-03-09 10:19 . 2008-11-28 04:48 410984 ----a-w c:\windows\system32\deploytk.dll
    2009-03-09 05:18 . 2007-11-12 22:52 -------- d-----w c:\documents and settings\Deo Volente\Application Data\Apple Computer
    2009-03-06 14:22 . 2005-08-16 09:18 284160 ----a-w c:\windows\system32\pdh.dll
    2009-03-06 04:59 . 2009-03-15 06:38 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
    2009-03-06 04:59 . 2009-02-23 00:43 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
    2009-03-06 04:55 . 2008-02-26 00:03 -------- d-----w c:\documents and settings\Deo Volente\Application Data\Move Networks
    2009-03-03 00:18 . 2007-08-22 12:55 826368 ------w c:\windows\system32\dllcache\wininet.dll
    2009-03-03 00:18 . 2005-08-16 09:18 826368 ----a-w c:\windows\system32\wininet.dll
    2009-03-02 01:15 . 2009-03-02 01:15 -------- d-----w c:\program files\Easy CD-DA Extractor 12
    2009-03-02 01:15 . 2009-03-02 01:15 -------- d-----w c:\documents and settings\All Users\Application Data\Easy CD-DA Extractor
    2009-02-28 04:54 . 2007-08-14 00:43 636072 ------w c:\windows\system32\dllcache\iexplore.exe
    2009-02-23 00:46 . 2009-02-23 00:45 -------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer
    2009-02-23 00:46 . 2007-11-12 20:20 -------- d-----w c:\program files\QuickTime
    2009-02-20 10:20 . 2007-11-20 21:55 13824 ------w c:\windows\system32\dllcache\ieudinit.exe
    2009-02-20 10:20 . 2007-08-14 00:39 70656 ------w c:\windows\system32\dllcache\ie4uinit.exe
    2009-02-20 05:14 . 2007-08-13 23:56 161792 ------w c:\windows\system32\dllcache\ieakui.dll
    2009-02-09 12:10 . 2005-08-16 09:18 729088 ----a-w c:\windows\system32\lsasrv.dll
    2009-02-09 12:10 . 2005-08-16 09:18 401408 ----a-w c:\windows\system32\rpcss.dll
    2009-02-09 12:10 . 2005-08-16 09:18 714752 ----a-w c:\windows\system32\ntdll.dll
    2009-02-09 12:10 . 2005-08-16 09:18 617472 ----a-w c:\windows\system32\advapi32.dll
    2009-02-09 11:13 . 2008-10-16 04:13 1846784 ------w c:\windows\system32\dllcache\win32k.sys
    2009-02-09 11:13 . 2005-08-16 09:18 1846784 ----a-w c:\windows\system32\win32k.sys
    2009-02-08 00:02 . 2008-10-16 04:13 2066048 ------w c:\windows\system32\dllcache\ntkrnlpa.exe
    2009-02-06 11:11 . 2005-08-16 09:18 110592 ----a-w c:\windows\system32\services.exe
    2009-02-06 11:08 . 2008-10-16 04:13 2189056 ------w c:\windows\system32\dllcache\ntoskrnl.exe
    2009-02-06 11:06 . 2008-10-16 04:13 2145280 ------w c:\windows\system32\dllcache\ntkrnlmp.exe
    2009-02-06 11:06 . 2005-08-16 09:18 2145280 ----a-w c:\windows\system32\ntoskrnl.exe
    2009-02-06 10:39 . 2005-08-16 09:18 35328 ----a-w c:\windows\system32\sc.exe
    2009-02-06 10:32 . 2008-10-16 04:13 2023936 ------w c:\windows\system32\dllcache\ntkrpamp.exe
    2009-02-06 10:32 . 2004-08-04 03:59 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe
    2009-02-03 19:59 . 2009-02-03 19:59 56832 ------w c:\windows\system32\dllcache\secur32.dll
    2009-02-03 19:59 . 2005-08-16 09:18 56832 ----a-w c:\windows\system32\secur32.dll
    2009-02-03 04:40 . 2007-10-31 04:38 71136 ----a-w c:\documents and settings\Deo Volente\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2007-11-26 23:46 . 2007-11-26 23:45 134 ----a-w c:\documents and settings\Hend Family\Local Settings\Application Data\fusioncache.dat
    2007-11-25 18:50 . 2007-11-25 18:50 171183 ----a-w c:\documents and settings\All Users\SPL9F.tmp
    2007-10-27 05:36 . 2007-10-27 05:36 134 ----a-w c:\documents and settings\Deo Volente\Local Settings\Application Data\fusioncache.dat
    2005-08-17 01:52 . 2005-08-17 01:52 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
    2008-02-06 05:26 . 2007-11-21 04:31 88 --sh--r c:\windows\system32\338A3BD31B.sys
    2006-05-03 09:06 . 2008-10-01 04:29 163328 --sh--r c:\windows\system32\flvDX.dll
    2007-02-21 10:47 . 2008-10-01 04:29 31232 --sh--r c:\windows\system32\msfDX.dll
    2008-03-16 12:30 . 2008-10-01 04:29 216064 --sh--r c:\windows\system32\nbDX.dll
    2008-09-25 04:05 . 2008-09-25 04:05 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092420080925\index.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
    "EasyLinkAdvisor"="c:\program files\Linksys EasyLink Advisor\LinksysAgent.exe" [2006-10-30 392832]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ShowLOMControl"="1 (0x1)" [X]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-09-29 67584]
    "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-16 1392640]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 761947]
    "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 45056]
    "DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-10 49152]
    "dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
    "ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
    "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
    "MSKDetectorExe"="c:\program files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-13 1117184]
    "avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
    "WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-03-27 36352]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
    "DLCCCATS"="c:\windows\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2006-02-24 73728]
    "SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2005-11-17 397312]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
    Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-4-21 24576]
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
    Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-1-21 65588]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver]
    @=""

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard]
    @=""

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\WINDOWS\\system32\\dlcccoms.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    S1 aswSP;avast! Self Protection; [x]
    S2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
    S2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [2008-10-10 13088]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
    \Shell\AutoRun\command - E:\setup.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-04-13 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 18:34]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{2f37bccd-d740-4fe4-af56-1a497803c84c} - c:\windows\system32\jevayeyi.dll
    HKCU-Run-ModemOnHold - c:\program files\NetWaiting\netWaiting.exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.dell.com
    uInternet Connection Wizard,ShellNext = hxxp://www.dell.com/
    uInternet Settings,ProxyOverride = *.local
    Trusted Zone: turbotax.com
    FF - ProfilePath - c:\documents and settings\Deo Volente\Application Data\Mozilla\Firefox\Profiles\fk4777p0.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1641676&SearchSource=3&q=
    FF - plugin: c:\documents and settings\Deo Volente\Application Data\Mozilla\Firefox\Profiles\fk4777p0.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
    FF - plugin: c:\program files\Microsoft Silverlight\npctrl.1.0.21115.0.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
    FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-04-22 23:22
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    c:\documents and settings\Deo Volente\Application Data\Gtek\GTUpdate\AUpdate\EasyLinkAdvisor\DB\{3CD525C1-A5D0-4B72-A758-42DB5B8A2B52}.xml 291 bytes

    scan completed successfully
    hidden files: 1

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(692)
    c:\windows\system32\Ati2evxx.dll
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(2292)
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
    c:\windows\system32\wmvcore.dll
    c:\windows\system32\WMASF.DLL
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\WLTRYSVC.EXE
    c:\windows\system32\BCMWLTRY.EXE
    c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
    c:\program files\Alwil Software\Avast4\aswUpdSv.exe
    c:\program files\Alwil Software\Avast4\ashServ.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\system32\dlcccoms.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\windows\system32\ati2evxx.exe
    c:\program files\Alwil Software\Avast4\ashMaiSv.exe
    c:\program files\Alwil Software\Avast4\ashWebSv.exe
    c:\windows\system32\dllhost.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\windows\ehome\ehmsas.exe
    c:\windows\system32\msiexec.exe
    c:\windows\system32\taskmgr.exe
    .
    **************************************************************************
    .
    Completion time: 2009-04-23 23:26 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-04-23 04:26
    ComboFix2.txt 2008-03-20 03:23

    Pre-Run: 58,766,843,904 bytes free
    Post-Run: 59,358,171,136 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    Current=4 Default=4 Failed=1 LastKnownGood=2 Sets=1,2,3,4
    272 --- E O F --- 2009-04-15 06:24


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:31:29 PM, on 4/22/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16827)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\system32\dlcccoms.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\system32\WLTRAY.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\msiexec.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\PROGRA~1\MICROS~4\Office\OUTLOOK.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\Finder.exe.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ShowLOMControl]
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [EasyLinkAdvisor] "C:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe
    O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    --
    End of file - 9222 bytes


    Do NOT run 'FIXES' before helpers have analyzed the HJT log

    Last edited by tashi; 2009-04-23 at 08:38. Reason: Added link to faq

  2. #2
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi there,


    Disable Spybot's TeaTimer to make sure it won't interfere with fixes. You can re-enable it when you're clean again:
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
      and OK any prompts.
    • Restart your computer



    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    File::
    C:\zizikedu.dll
    C:\lifeheje.dll
    c:\documents and settings\All Users\Application Data\lebapide.dll
    c:\windows\hogineje
    C:\nukiyofi.dll
    c:\documents and settings\All Users\Application Data\voyebabe.dll
    c:\documents and settings\All Users\Application Data\halivevi.dll
    c:\program files\darususi.dll
    c:\program files\wutupaba.dll
    c:\program files\vuverisa.dll
    c:\windows\system32\tinonere.exe
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify"=-

    Save this as
    CFScript

    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



    Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Download ATF (Atribune Temp File) Cleanerę by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache

    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.


    Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.


    Post back its report, a fresh hjt log and above mentioned ComboFix resultant log.
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

  3. #3
    Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Due to inactivity, this thread will now be closed.

    Note:If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

    If it has been less than four days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.
    Microsoft Windows Insider MVP 2016-2019
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •