Virtumonde but different dll?

hjt

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:07, on 2007-08-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Cisco Systems\VPN Client\cvpnd.exe
C:\Archivos de programa\AVC Finger-sensing Pad Driver\FspadSvr.exe
C:\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe
C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
C:\Archivos de programa\Network Associates\VirusScan\Mcshield.exe
C:\Archivos de programa\Network Associates\VirusScan\VsTskMgr.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nutsrv4.exe
C:\oracle\ora92\bin\omtsreco.exe
C:\WINDOWS\ProPatches\Scheduler\stSchedEx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Network Associates\Common Framework\UdaterUI.exe
C:\Archivos de programa\Network Associates\Common Framework\McTray.exe
C:\WINDOWS\system32\LVComsX.exe
C:\Archivos de programa\Internet Explorer\IEXPLORE.EXE
C:\Archivos de programa\Ares\Ares.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.ieci.geci:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.int;*.geci;128.*;documentum.*;<local>
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll
O4 - HKLM\..\Run: [NuTCSetupEnviron] C:\Archivos de programa\Rational\Rational Test\nutcroot\bin\ncoeenv.exe
O4 - HKLM\..\Run: [CCDoctorLogonTesting] "c:\Atria\bin\ccdoctor.exe" /LogonStartup
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Archivos de programa\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: VirtuaWin.lnk = C:\Archivos de programa\VirtuaWin\VirtuaWin.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4A3CBDDD-C4DC-4C38-B44F-704DAEF628AE} (PjAdoInfo3 Class) - http://10.228.137.37/projectserver/objects/pjclient.cab
O16 - DPF: {759FD3DE-F0EF-4A76-909C-88CF840D4173} (DmDragDrop Class) - http://localhost:9090/dco/wdk/native/WdkPluginCab.CAB
O16 - DPF: {89B8153D-C170-41D7-BB4B-CD4D63FE900C} (Pj11esnC Class) - http://10.228.137.37/projectserver/objects/3082/pjcintl.cab
O16 - DPF: {B1B47DEB-76C1-4701-9F19-5671101C3344} (PictureSelect.Selector) - http://www.revelaonline.com/class/RevelaonlinePictureManager.cab
O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www1.aeat.es/imagenes/comun/cactivex.cab
O16 - DPF: {BA2174B0-C012-11DA-A94D-0800200C9A66} (DmDragDrop Class) - http://documentum:1975/dco/wdk/native/WdkPluginCab.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = grupoeci.elcorteingles.corp
O17 - HKLM\Software\..\Telephony: DomainName = grupoeci.elcorteingles.corp
O17 - HKLM\System\CCS\Services\Tcpip\..\{3787471A-6F44-475F-B1D8-B928E127E071}: NameServer = 192.168.50.170,192.168.50.171
O17 - HKLM\System\CCS\Services\Tcpip\..\{5AC9E483-93DE-45C2-BE3B-733BD13A2191}: NameServer = 80.58.61.250,80.58.61.254
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA032721-3D92-4450-8B90-A77BAD0D7744}: NameServer = 128.90.0.203,128.90.0.204
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = grupoeci.elcorteingles.corp
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = geci,eci.geci,ieci.geci
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = grupoeci.elcorteingles.corp
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = geci,eci.geci,ieci.geci
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = geci,eci.geci,ieci.geci
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe
O23 - Service: IBM CICS Universal Client (CICSClient) - IBM Corporation - C:\Archivos de programa\IBM\IBM CICS Transaction Gateway\bin\cclserv.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Archivos de programa\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Servidor de applet JDBC de DB2 (DB2JDS) - International Business Machines Corporation - C:\Archivos de programa\IBM\SQLLIB\BIN\db2jds.exe
O23 - Service: Servidor de seguridad DB2 (DB2NTSECSERVER) - International Business Machines Corporation - C:\Archivos de programa\IBM\SQLLIB\BIN\db2sec.exe
O23 - Service: FspadSvc - Unknown owner - C:\Archivos de programa\AVC Finger-sensing Pad Driver\FspadSvr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: IBM CICS Transaction Gateway (IBMCICSTransactionGateway) - IBM Corporation - C:\Archivos de programa\IBM\IBM CICS Transaction Gateway\bin\CTGSERVICE.EXE
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: Tivoli Endpoint (lcfd) - Unknown owner - C:\Tivoli\lcf\bin\w32-ix86\mrt\lcfd.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Archivos de programa\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Archivos de programa\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NetOp Helper ver. 7.65 (2004342) (NetOp Host for NT Service) - Danware Data A/S - C:\Archivos de programa\NetOp Remote Control\HOST\NHOSTSVC.EXE
O23 - Service: NuTCRACKERService - DataFocus, Inc. - C:\WINDOWS\system32\nutsrv4.exe
O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\oracle\ora92\bin\omtsreco.exe
O23 - Service: OracleOraHome92ClientCache - Unknown owner - C:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: ServiceLayer - Nokia. - C:\Archivos de programa\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Shavlik Remote Scheduler Service (Shavlik Scheduler) - Shavlik Technologies - C:\WINDOWS\ProPatches\Scheduler\stSchedEx.exe
O23 - Service: Apache Tomcat (Tomcat5) - Apache Software Foundation - C:\Tomcat 5.0\bin\tomcat5.exe

--
End of file - 7966 bytes
 
Hi

Logs look good.

All viruses are in system restore and inactive.

I give you later instructions how to empty it.

Other than that, any problems left?
 
Due to the lack of feedback this Topic is closed.

If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
 
You must log in or register to reply here.
Back
Top