bug has got me!

[edcal]

hello

did you catch the part about the other two files of the same name,just more spaces?

 

[Shaba]

Hi

Yes, I did.

That is characteristic for this infection

Same has happened to msconfig.exe, too (from RenV log from yesterday):

----a-w           158,208 2007-12-25 22:06:47  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig   .exe
----a-w           158,208 2007-12-28 19:25:09  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig  .exe
----a-w           502,272 2007-12-25 22:00:54  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig .exe

 

[edcal]

here they are my friend!

VirusTotal - Free Online Virus and Malware Scan - Result | Slovenščina | Dansk |
Русский | Română | Türkçe | Nederlands | Ελληνικά | Français | Svenska |
Português | Italiano | | | Magyar | Deutsch | Česky | Polski | Español
Virustotal is a service that analyzes suspicious files and facilitates
the quick detection of viruses, worms, trojans, and all kinds of malware
detected by antivirus engines. More information...
File qttask.exe received on 12.29.2007 16:02:41 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED


Result: 19/32 (59.38%)
Loading server information...
Your file is queued in position: 2.
Estimated start time is between 41 and 59 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are
going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned
(position: ) for an undefined time.
You can wait for web response (automatic reload) or type your email in the form
below and click "request" so the system sends you a notification when the scan
is finished.
Email:


AntivirusVersionLast UpdateResult
AhnLab-V32007.12.29.112007.12.29-
AntiVir7.6.0.462007.12.28HEUR/Malware
Authentium4.93.82007.12.29W32/Virtumonde.OQ
Avast4.7.1098.02007.12.28-
AVG7.5.0.5162007.12.29Dropper.Generic.THT
BitDefender7.22007.12.29Trojan.Dropper.Vundo.E
CAT-QuickHeal9.002007.12.29Win32.AdWare.Virtumonde.cli
ClamAV0.91.22007.12.29W32.Prep-1
DrWeb4.44.0.091702007.12.29Trojan.MulDrop.9328
eSafe7.0.15.02007.12.27-
eTrust-Vet31.3.54122007.12.29Win32/Trats.A
Ewido4.02007.12.29-
FileAdvisor12007.12.29-
Fortinet3.14.0.02007.12.29-
F-Prot4.4.2.542007.12.28W32/Virtumonde.OQ
F-Secure6.70.13030.02007.12.28-
IkarusT3.1.1.152007.12.29not-a-virus:AdWare.Win32.Virtumonde.cli
Kaspersky7.0.0.1252007.12.29not-a-virus:AdWare.Win32.Virtumonde.cli
McAfee51952007.12.28-
Microsoft1.31092007.12.29Virus:Win32/Trats.D
NOD32v227552007.12.29Win32/Adware.Virtumonde.CLI
Norman5.80.022007.12.28-
Panda9.0.0.42007.12.29-
Prevx1V22007.12.29-
Rising20.24.52.002007.12.29Worm.Win32.Vadar.h
Sophos4.24.02007.12.29W32/VirtInf-A
Sunbelt2.2.907.02007.12.28-
Symantec102007.12.29W32.Trats!inf
TheHacker6.2.9.1742007.12.28-
VBA323.12.2.52007.12.29Trojan.Virtumod.253
VirusBuster4.3.26:92007.12.28Win32.Trats.B
Webwasher-Gateway6.6.22007.12.28Heuristic.Malware
Additional information
File size: 450048 bytes
MD5: 91e7e399be835c487c1ff4811174d021
SHA1: a1029daeded8754c33922bf7701513112d8545ad
PEiD: -

ATTENTION: VirusTotal is a free service offered by Hispasec Sistemas. There are
no guarantees about the availability and continuity of this service. Although
the detection rate afforded by the use of multiple antivirus engines is far
superior to that offered by just one product, these results DO NOT guarantee the
harmlessness of a file. Currently, there is not any solution that offers a 100%
effectiveness rate for detecting viruses and malware.
VirusTotal © Hispasec Sistemas - Blog - Contact: info@virustotal.com

Ran on Sat 12/29/2007 -  9:58:07.45

----a-w            61,440 2007-12-29 14:50:17  C:\hp\KBD\KBD .EXE
----a-w           151,597 2007-12-28 18:29:39  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w           110,592 2007-12-29 14:50:13  C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w            49,152 2007-12-28 18:29:50  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w           241,664 2007-12-28 18:29:50  C:\Program Files\HP\hpcoretech\hpcmpmgr .exe
----a-w            49,152 2007-12-28 18:29:49  C:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05 .exe
----a-w            36,975 2007-12-28 18:29:42  C:\Program Files\Java\jre1.5.0_02\bin\jusched .exe
----a-w         1,694,208 2007-12-28 18:29:56  C:\Program Files\Messenger\msmsgs .exe
----a-w           450,048 2007-12-23 15:48:35  C:\Program Files\QuickTime\qttask   .exe
----a-w           450,048 2007-12-23 15:30:17  C:\Program Files\QuickTime\qttask  .exe
----a-w           450,048 2007-12-23 14:39:57  C:\Program Files\QuickTime\qttask .exe
----a-w            94,208 2007-12-29 14:50:14  C:\WINDOWS\KHALMNPR .EXE
----a-w            19,968 2007-12-29 14:50:15  C:\WINDOWS\Logi_MwX .Exe
----a-w            50,176 2007-12-28 18:29:51  C:\WINDOWS\eHome\ehtray .exe
----a-w           158,208 2007-12-25 22:06:47  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig   .exe
----a-w           158,208 2007-12-28 19:25:09  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig  .exe
----a-w           502,272 2007-12-25 22:00:54  C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig .exe
----a-w           233,472 2007-12-23 15:30:18  C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w            52,736 2007-12-23 23:17:55  C:\WINDOWS\system\hpsysdrv .exe
----a-w           155,648 2007-12-28 18:29:46  C:\WINDOWS\system32\NeroCheck .exe
----a-w            81,920 2007-12-29 14:50:13  C:\WINDOWS\system32\ps2 .exe

 Entries:               21  (21)
 Directories:            0  Files:            21
 Bytes:          5,251,740  Blocks:       10,259

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:01:36 AM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\Logi_MwX .Exe
C:\WINDOWS\system32\ps2 .exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\edcal.exe
C:\WINDOWS\System32\imapi.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q304&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://pavilion.buttonredirect.hp.com/2.0/chat/EN_US/index.html?VER=0&CYCLE=43&URL=http://www.hp.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F3 - REG:win.ini: load=C:\WINDOWS\system32\mllmj.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {AA19F31A-0383-4A94-88BC-C87602D9ACA2} - C:\WINDOWS\system32\mllmj.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NAV CfgWiz] c:\Program Files\Common Files\Symantec Shared\CfgWiz.exe /GUID NAV /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKUS\S-1-5-18\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [SetDefaultMIDI] MIDIDEF.EXE (User 'Default user')
O4 - S-1-5-18 Startup: AutoTBar.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoTBar.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/en-US/activex/TmHcmsX.CAB
O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/install/hpobjinstaller_gmn.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1189297494984
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://209.60.51.51/activex/AxisCamControl.cab
O16 - DPF: {B1826A9F-4AA0-4510-BA77-9013E74E4B9B} - http://www.trendmicro.com/spyware-scan/as4web.cab
O16 - DPF: {B2BE75F3-9197-11CF-ABF4-08000996E931} (Autodesk WHIP! Control) - http://www.kclcutsheets.com/KCLSearch/whip.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

--
End of file - 6689 bytes

 

[Shaba]

Hi

After this script some programs may not work and you may need to re-install once you're clean.

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\hp\KBD\KBD .EXE
C:\Program Files\Common Files\Real\Update_OB\realsched .exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
C:\Program Files\HP\hpcoretech\hpcmpmgr .exe
C:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05 .exe
C:\Program Files\Java\jre1.5.0_02\bin\jusched .exe
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\QuickTime\qttask   .exe
C:\Program Files\QuickTime\qttask  .exe
C:\Program Files\QuickTime\qttask .exe
C:\WINDOWS\KHALMNPR .EXE
C:\WINDOWS\Logi_MwX .Exe
C:\WINDOWS\eHome\ehtray .exe
C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig   .exe
C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig  .exe
C:\WINDOWS\pchealth\helpctr\Binaries\MSConfig .exe
C:\WINDOWS\SMINST\RECGUARD .EXE
C:\WINDOWS\system\hpsysdrv .exe
C:\WINDOWS\system32\NeroCheck .exe
C:\WINDOWS\system32\ps2 .exe
C:\WINDOWS\system32\mllmj.exe
C:\WINDOWS\system32\mllmj.dll

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"=-
"PS2"=-
"KBD"=-
"Logitech Utility"=-

[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Re-run RenV

Post:

- a fresh HijackThis log
- RenV log
- combofix report

 

[edcal]

combo fix still running seems to have stalled....... running in normanl mode....30 min now and has not reset clock nor displayed report..... if as before i could only get combofix to run and complete in msconfig "diagnostic mode"...... where from here?

ps.... desktop has disappeared, i will have to reboot...???

 

[edcal]

stall after showing location of report......eddie

 

[Shaba]

Hi

Yes, reboot.

If it didn't produce a log, do it again in safe mode, please.

 

[edcal]

in safe mode i can get no desktop at all........msconfig diagnostic mode ok ? (only way i have been able to get fix to complete)

 

[Shaba]

Hi

Yes, it's fine.

 

[edcal]

Hello

Okay here is the story.....I can no longer access msconfig thru the run command....I cannot access it thru the folder it was located in.....it is gone i guess....... in safe mode, I still have no desktop at all and no report was generated after the last combofix run.......I can only run in the normal (flashing mode)...any other options?

eddie

 

[Shaba]

Hi

I guessed that.

Unzip this
to C:\WINDOWS\PCHealth\HelpCtr\Binaries folder and try again after that, please

 

[edcal]

also I did notice that the name of the files deleted is different it now begins with a j instead of an m...dont remember the exact sequence but still 5 letters....

 

[Shaba]

Hi

Yes, vundo file names can mutate.

Can you access msconfig after unzipping to that folder?

 

[edcal]

the screen is flashing faster now and I am not quick enough to get it there.....but I did notice that the binaries folder is gone......I am not going to be quick enough to do this before the windows disappear....sry

 

[edcal]

my bad i did finally see the binaries folder

 

[Shaba]

Hi

EDIT: Good

Let me know it is this successful now.

 

[edcal]

i'll keep trying to get it there....will let you know

 

[Shaba]

Hi

Would it be easier to unzip it to Desktop?

If so, we can use a batch file for moving to correct folder.

 

[edcal]

i did just finally move it to desktop and ran it from there.....will have to reboot and run combofix again to get desktop back......do you then want the reports from there? and should I drop the config file into combofix again?

 

[Shaba]

Hi

Yes, please