|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-04-2007, 03:54 AM
|
#1 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 43
OS: winXP
|
trojan.vundo [moved from gen.security]
i keepp getting a virus alert from norton antivirus about "trojan.vundo". even after fixing the problem, it keeps popping up after half and hour or so. (there are two alerts: 1st alert says denied access to the file, 2nd it says the file is automatically deleted )(both file paths are different) i tried finding the files but found nothing. i also ran a full system scan but no problems are found.
 help?
|
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
06-04-2007, 06:20 AM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: trojan.vundo
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
06-05-2007, 04:29 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2007
Location: Small Town, Wv.
Posts: 3
OS: windows xp
|
Re: trojan.vundo
Hi. Yep I Know What This One Is. I Have My Boyfriends Computer And Fought This For Days. It Won! Did A Recovery On It And Now I Need Help On Here To See If I Can Get My Data ( All) Back Or Not. I Read That This Is A Hard Io One To Get Rid Of. Same Thing Happened To This One As It Did Youres.good Luck
|
|
|
|
|
06-06-2007, 01:13 AM
|
#4 (permalink) |
|
Registered User
Join Date: Jun 2007
Posts: 12
OS: XP
|
Re: trojan.vundo
1. Use/Download Windows Defender
2. Download Definition Updates (only 4MB) 3. Scan your computer 4. As soon as it finds the Vundo Virus, set the thing to delete it, then if it doesn't work Windows Defender will end ALL processes in the computer temporarily (don't worry it won't wreck any thing!!!) except for Windows Defender. THEN it can delete the stuff that is linked to that virus. After that it'll restart. 5. Turn on your computer, the Virus is now vulnarable, you can now use you anti-virus program to delete it permanantly! 6. Done, Now your computer is fresh!!! Last edited by Kazejimonji; 06-06-2007 at 01:16 AM. |
|
|
|
|
06-06-2007, 01:37 AM
|
#5 (permalink) |
|
Moderator Hardware Team
|
Re: trojan.vundo
Thanks for the advice Kazejimonji, but the user needs to follow the instructions in Glaswegian's link.
While your method might remove the virus, there's no way of knowing if Tuaho's computer has any other infections or security problems without a full examination.
__________________
 New members: Subscribe to your thread (Thread Tools) to receive an instant email notification when you get a reply. TSF Folding@Home Team 85015 - details here |
|
|
|
|
06-06-2007, 01:55 AM
|
#7 (permalink) |
|
Moderator Hardware Team
|
Re: trojan.vundo
We know about Windows Defender, and your instructions may have worked perfectly on your system, but without seeing the log files requested in Glaswegian's link, Tuaho's system could have other infections or security weakspots which will be fixed by the security team. Thanks anyway.
__________________
New members: Subscribe to your thread (Thread Tools) to receive an instant email notification when you get a reply. TSF Folding@Home Team 85015 - details here |
|
|
|
|
06-07-2007, 01:56 AM
|
#9 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 43
OS: winXP
|
Re: trojan.vundo
Ok heres the panda log:
Incident Status Location Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\efcbxxu.dll Dialer:dialer.su Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\uninstall\Switch Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\cookies.txt[.doubleclick.net/] Adware:Adware/SpywareNo Not disinfected C:\Documents and Settings\GBK\Local Settings\Temp\win2E.tmp.exe Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\awvtr.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\ddccbxv.dll Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\fccaxya.dll And the dss log: Deckard's System Scanner v20070603.47 Run by GBK on 2007-06-07 at 15:36:39 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- System Restore is disabled; attempting to re-enable...success. -- Last 1 Restore Point(s) -- 1: 2007-06-07 07:36:45 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of HijackThis v1.99.1 Scan saved at 2007-06-07 15:38:37 Platform: Windows XP Service Pack 2 (5.01.2600) MSIE: Internet Explorer (7.00.6000.16441) Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Symantec Shared\CCSETMGR.EXE C:\Program Files\Common Files\Symantec Shared\CCEVTMGR.EXE C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVAPSVC.EXE C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\Symantec Shared\CCAPP.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Cacheman\Cacheman.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Documents and Settings\GBK\Desktop\dss.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.ap.dell.com/content/defa...=my&l=en&s=gen R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {BEDF30ED-41B2-4CDC-875A-ED063C81AF7B} - C:\WINDOWS\system32\efcbxxu.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVSHEXT.DLL O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/229?80026ebbcbfc4bbf95cadd4ea1d4957a O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/230?80026ebbcbfc4bbf95cadd4ea1d4957a O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra 'Tools' menuitem: (no name) - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: efcbxxu - C:\WINDOWS\system32\efcbxxu.dll O20 - Winlogon Notify: winpsa32 - C:\WINDOWS\system32\winpsa32.dll (file missing) O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKEEPER.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 Vax347b - c:\windows\system32\drivers\vax347b.sys R0 Vax347s - c:\windows\system32\drivers\vax347s.sys R1 omci (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Inc; OMCI Driver> R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.6.0.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.6.0.0> R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver> S3 DSproct - c:\program files\dell support\gtaction\triggers\dsproct.sys <Not Verified; GTek Technologies Ltd.; processt> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel(R) PROSet/Wireless Registry Service> R2 WLANKEEPER (Intel(R) PROSet/Wireless SSO Service) - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel(R) Corporation; SSO Service> -- Scheduled Tasks ------------------------------------------------------------- 2007-06-07 15:37:22 256 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job 2007-06-07 14:09:08 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job 2007-06-01 20:00:00 544 --a------ C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - GBK.job 2007-06-01 17:15:00 386 --a------ C:\WINDOWS\Tasks\1-Click Maintenance.job -- Files created between 2007-05-07 and 2007-06-07 ----------------------------- 2007-06-06 12:35:14 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-06-02 19:35:52 0 d-------- C:\Program Files\Windows Live Favorites 2007-06-02 19:30:43 0 d-------- C:\Documents and Settings\GBK\Application Data\CyberLink 2007-06-02 16:32:12 29206 --a------ C:\WINDOWS\system32\ddccbxv.dll 2007-06-02 16:30:34 29206 --a------ C:\WINDOWS\system32\fccaxya.dll 2007-06-02 16:30:30 35063 --a------ C:\WINDOWS\system32\awvtr.dll 2007-06-02 16:25:07 29206 --a------ C:\WINDOWS\system32\efcbxxu.dll 2007-05-31 23:35:26 0 d-------- C:\Program Files\Cacheman 2007-05-31 18:49:25 0 d-------- C:\Documents and Settings\GBK\Application Data\Help 2007-05-31 18:48:03 28 --a------ C:\WINDOWS\system32\autoscan.dll 2007-05-31 18:19:16 0 d-------- C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage 2007-05-31 15:54:34 0 d-------- C:\Program Files\Britannica 2007-05-30 15:24:13 0 d-------- C:\Documents and Settings\GBK\Application Data\Apple Computer 2007-05-30 15:19:31 1755 --a------ C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache 2007-05-30 15:18:19 0 d-------- C:\Program Files\QuickTime 2007-05-30 15:17:39 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2007-05-30 15:01:17 1156 --a------ C:\WINDOWS\mozver.dat 2007-05-30 14:55:08 0 d-------- C:\Program Files\3ivx 2007-05-29 16:31:30 0 d-------- C:\WINDOWS\RegisteredPackages 2007-05-29 14:46:47 0 d-------- C:\Program Files\NCH Swift Sound 2007-05-29 12:40:19 0 d-------- C:\Program Files\BearShare 2007-05-29 08:41:21 2277376 --a------ C:\WINDOWS\system32\TUKernel.exe <Not Verified; Microsoft Corporation; Microsoft® Windows® Operating System> 2007-05-28 23:28:07 0 d-------- C:\Program Files\Muti ID3 Tag Editor 2007-05-12 01:49:26 0 d-------- C:\Program Files\KONAMI 2007-05-12 01:01:12 0 d-------- C:\Program Files\Sierra 2007-05-11 22:55:44 5248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2007-05-11 22:55:44 159616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2007-05-11 00:18:31 0 d-------- C:\Program Files\Microsoft ActiveSync 2007-05-11 00:16:15 0 d-------- C:\WINDOWS\SHELLNEW 2007-05-11 00:16:07 0 d-------- C:\Program Files\Microsoft.NET 2007-05-10 22:20:51 0 d-------- C:\Program Files\THQ 2007-05-10 21  57 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; >2007-05-10 20:46:25 0 d-------- C:\Program Files\ESTsoft 2007-05-10 03:01:09 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-05-09 00 17 0 d-------- C:\Program Files\Windows Defender2007-05-08 23:45:19 0 d-------- C:\WINDOWS\pss 2007-05-08 23:11:21 46352 --a------ C:\WINDOWS\setdebug.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:20 171280 --a------ C:\WINDOWS\system32\jit.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:20 139536 --a------ C:\WINDOWS\system32\javaee.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:20 6550 --a------ C:\WINDOWS\jautoexp.dat 2007-05-08 23:11:19 313856 --a------ C:\WINDOWS\system32\dx3j.dll <Not Verified; Microsoft Corporation; Microsoft® DirectX for Java> 2007-05-08 23:11:14 113 --a------ C:\WINDOWS\system32\zonedon.reg 2007-05-08 23:11:14 113 --a------ C:\WINDOWS\system32\zonedoff.reg 2007-05-08 23:11:14 171792 --a------ C:\WINDOWS\system32\wjview.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:14 286992 --a------ C:\WINDOWS\system32\vmhelper.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:14 21264 --a------ C:\WINDOWS\system32\msjdbc10.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:13 947472 --a------ C:\WINDOWS\system32\msjava.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:13 154384 --a------ C:\WINDOWS\system32\msawt.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:13 172304 --a------ C:\WINDOWS\system32\jview.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:12 15120 --a------ C:\WINDOWS\system32\jdbgmgr.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:12 404752 --a------ C:\WINDOWS\system32\javart.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:12 63248 --a------ C:\WINDOWS\system32\javaprxy.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:12 187152 --a------ C:\WINDOWS\system32\javacypt.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:11:11 49424 --a------ C:\WINDOWS\system32\clspack.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows (R) Operating System> 2007-05-08 23:09:01 0 d-------- C:\Documents and Settings\GBK\Application Data\Template 2007-05-08 21:55:03 0 d-------- C:\Program Files\MSXML 4.0 2007-05-08 21:31:52 0 d-------- C:\Program Files\Alcohol Soft 2007-05-08 21:22:34 0 d-------- C:\Documents and Settings\GBK\Application Data\Screenshot Sender 2007-05-08 21:16:59 0 d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus! 2007-05-08 21:16:53 0 d-------- C:\Program Files\Messenger Plus! Live 2007-05-08 20:46:32 0 d-------- C:\Documents and Settings\GBK\Contacts 2007-05-08 20:37:52 0 d-------- C:\WINDOWS\network diagnostic 2007-05-08 18:05:07 0 d-------- C:\Documents and Settings\GBK\Application Data\Command & Conquer 3 Tiberium Wars 2007-05-08 17:56:21 0 d-------- C:\Documents and Settings\GBK\Application Data\Talkback 2007-05-08 17:56:14 0 --a------ C:\WINDOWS\nsreg.dat 2007-05-08 17:56:09 0 d-------- C:\Documents and Settings\GBK\Application Data\Mozilla 2007-05-08 17:38:01 0 d-------- C:\Program Files\Electronic Arts 2007-05-08 17:24:10 0 d-------- C:\Program Files\Fraps 2007-05-08 17:10:48 0 d-------- C:\Documents and Settings\GBK\Application Data\Windows Desktop Search 2007-05-08 17:08:02 0 d-------- C:\Program Files\Windows Desktop Search 2007-05-08 17:07:04 0 d-------- C:\Program Files\TuneUp Utilities 2007 2007-05-08 17:07:04 0 d-------- C:\Documents and Settings\GBK\Application Data\TuneUp Software 2007-05-08 17 25 0 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software2007-05-08 17 23 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard2007-05-08 17:05:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Live Toolbar 2007-05-08 17:04:26 0 d-------- C:\Program Files\Windows Live Toolbar 2007-05-08 17:03:27 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-05-08 17:02:36 0 d-------- C:\Program Files\MSN Messenger 2007-05-08 16:57:59 0 d-------- C:\Program Files\Windows Media Connect 2 2007-05-08 16:56:57 0 d-------- C:\WINDOWS\system32\LogFiles 2007-05-08 16:56:57 0 d-------- C:\WINDOWS\system32\drivers\UMDF 2007-05-08 16:51:33 0 d-------- C:\WINDOWS\system32\PreInstall 2007-05-08 16:41:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage 2007-05-08 16:32:00 0 d-------- C:\Documents and Settings\GBK\Application Data\Macromedia 2007-05-08 15:45:05 0 d-------- C:\WINDOWS\system32\SoftwareDistribution 2007-05-08 15:42:10 0 dr------- C:\Documents and Settings\GBK\Favorites 2007-05-08 15:42:10 0 d-------- C:\Documents and Settings\GBK\Desktop 2007-05-08 15:42:10 0 d--hs---- C:\Documents and Settings\GBK\Cookies 2007-05-08 15:42:10 0 dr-h----- C:\Documents and Settings\GBK\Application Data 2007-05-08 15:42:10 0 d-------- C:\Documents and Settings\GBK\Application Data\Symantec 2007-05-08 15:42:10 0 d-------- C:\Documents and Settings\GBK\Application Data\Intel 2007-05-08 15:42:10 0 d-------- C:\Documents and Settings\GBK\Application Data\Identities 2007-05-08 15:42:10 0 d--h----- C:\Documents and Settings\GBK\Application Data\Gtek 2007-05-08 15:42:10 0 d-------- C:\Documents and Settings\GBK\Application Data\ATI 2007-05-08 15:42:09 0 d--h----- C:\Documents and Settings\GBK\Templates 2007-05-08 15:42:09 0 dr------- C:\Documents and Settings\GBK\Start Menu 2007-05-08 15:42:09 0 dr-h----- C:\Documents and Settings\GBK\SendTo 2007-05-08 15:42:09 0 dr-h----- C:\Documents and Settings\GBK\Recent 2007-05-08 15:42:09 0 d--h----- C:\Documents and Settings\GBK\PrintHood 2007-05-08 15:42:09 2883584 --ah----- C:\Documents and Settings\GBK\NTUSER.DAT 2007-05-08 15:42:09 0 d--h----- C:\Documents and Settings\GBK\NetHood 2007-05-08 15:42:09 0 dr------- C:\Documents and Settings\GBK\My Documents 2007-05-08 15:42:09 0 d--h----- C:\Documents and Settings\GBK\Local Settings 2007-05-08 15:41:50 262144 --a------ C:\Documents and Settings\All Users\NTUSER.DAT 2007-05-08 15:41:41 0 d-------- C:\Documents and Settings\Default User\Application Data\Symantec 2007-05-08 15:41:41 0 d-------- C:\Documents and Settings\Default User\Application Data\Identities 2007-05-08 15:41:41 0 d-------- C:\Documents and Settings\Default User\Application Data\ATI -- Find3M Report --------------------------------------------------------------- 2007-06-07 15:39:20 0 d-------- C:\Program Files\Common Files\Symantec Shared 2007-06-07 14:55:47 0 d-------- C:\Program Files\Symantec 2007-06-07 14:51:17 0 d-------- C:\Program Files\Messenger 2007-06-05 13:11:40 0 d-------- C:\Program Files\Norton Internet Security 2007-06-03 22:56:56 0 d-------- C:\Program Files\Microsoft Works 2007-05-12 01:46:44 0 d-------- C:\Program Files\Dell 2007-05-12 01:01:13 0 d--h----- C:\Program Files\InstallShield Installation Information 2007-05-04 04:47:21 0 d-------- C:\Program Files\CyberLink 2007-05-04 04:46:40 0 d-------- C:\Program Files\Dell Support 2007-05-04 04:42:19 0 d-------- C:\Program Files\Sonic 2007-05-04 04:42:19 0 d-------- C:\Program Files\Common Files\InstallShield 2007-05-04 04:42:13 0 d-------- C:\Program Files\Common Files\Sonic Shared 2007-05-04 04:41:06 0 d-------- C:\Program Files\Common Files\TiVo Shared 2007-05-04 04:40:30 0 d-------- C:\Program Files\Digital Line Detect 2007-05-04 04:40:17 0 d-------- C:\Program Files\NetWaiting 2007-05-04 04:39:31 0 d-------- C:\Program Files\ATI Technologies 2007-05-04 04:39:02 0 d-------- C:\Program Files\Broadcom 2007-05-04 04:38:39 0 d-------- C:\Program Files\Synaptics 2007-05-04 04:36:52 0 d-------- C:\Program Files\CONEXANT 2007-05-04 04:36:45 0 d-------- C:\Program Files\Sigmatel 2007-05-04 04:35:57 0 d-------- C:\Program Files\Intel, Inc 2007-05-04 04:35:32 319488 --a------ C:\WINDOWS\system32\AegisI5Installer.exe <Not Verified; ; AegisInstall Application> 2007-05-04 04:35:12 0 d-------- C:\Program Files\Intel 2007-05-04 04:31:47 0 d-------- C:\Program Files\Java 2007-05-04 04:31:18 0 d-------- C:\Program Files\Common Files\Java 2007-03-16 11:55:58 40960 --a------ C:\WINDOWS\system32\frapsvid.dll <Not Verified; Beepa P/L; FRAPS> -- Registry Dump --------------------------------------------------------------- [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {2F85D76C-0569-466F-A488-493E6BD0E955} C:\Program Files\Windows Desktop Search\dsWebAllow.dll {5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll {9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll {9ECB9560-04F9-4bbc-943D-298DDF1699E1} C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} C:\Program Files\Windows Live Toolbar\msntb.dll {BEDF30ED-41B2-4CDC-875A-ED063C81AF7B} C:\WINDOWS\system32\efcbxxu.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "IntelZeroConfig"="\"C:\\Program Files\\Intel\\Wireless\\bin\\ZCfgSvc.exe\"" "IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "dla"="C:\\WINDOWS\\system32\\dla\\tfswctrl.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background" "Cacheman"="C:\\PROGRA~1\\Cacheman\\Cacheman.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=hex:00,00,00,00 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"="" "{BEDF30ED-41B2-4CDC-875A-ED063C81AF7B}"="" HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcbxxu HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32 HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa Authentication Packages REG_MULTI_SZ msv1_0\0\0 Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0 Notification Packages REG_MULTI_SZ scecli\0\0 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC" "IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "PCMService"="\"C:\\Program Files\\Dell\\MediaDirect\\PCMService.exe\"" "PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName" "PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC" "SigmatelSysTrayApp"="stsystra.exe" "ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "ATICCC"="\"C:\\Program Files\\ATI Technologies\\ATI.ACE\\cli.exe\" runtime -Delay" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0 hklm\software\Microsoft\Windows NT\CurrentVersion\Svchost *netsvcs* UxTuneUp *newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_COMHOST -- End of Deckard's System Scanner: finished at 2007-06-07 at 15:40:26 ----- Hope this helps-the alert i get from norton: 1st alert Object name: C:\Documents and Settings\GBK\Local Settings\Temporary Internet Files\Content.IE5\1CB9ENSJ\lo1[1] virus name: Trojan.Vundo Action Taken: Unable to repair this file Action Taken: Access to the file was denied 2nd alert Object name: C:\WINDOWS\system32\mlljk.dll Virus name: Trojan.Vundo Action Taken: The file was automatically deleted Later, norton will say tht it is finished and i should restart my computer to complete the task. Oh, windows defender didnt detect anything but thx for the tip anyway |
|
|
|
|
06-08-2007, 11:55 PM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,494
OS: N/A
|
Re: trojan.vundo [moved from gen.security]
1. Download this file -> http://download.bleepingcomputer.com...a/ComboFix.exe
2. Double click on combofix.exe & follow the prompts. 3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
06-09-2007, 03:16 AM
|
#11 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 43
OS: winXP
|
Re: trojan.vundo [moved from gen.security]
ComboFix 07-06-09.4 - C:\Documents and Settings\GBK\Desktop\ComboFix.exe
"GBK" - 2007-06-09 16:56:25 - Service Pack 2 NTFS (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\ddccbxv.dll C:\WINDOWS\system32\fccaxya.dll C:\WINDOWS\system32\efcbxxu.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 ))))))))))))))))))))))))))))))) 2007-06-09 16:53 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-08 13:00 <DIR> d-------- C:\Program Files\Lavasoft 2007-06-08 13:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-06-07 15:36 <DIR> d-------- C:\Deckard 2007-06-06 12:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-06-02 19:30 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\CyberLink 2007-06-02 16:30 35,063 --a------ C:\WINDOWS\system32\awvtr.dll 2007-05-31 23:35 <DIR> d-------- C:\Program Files\Cacheman 2007-05-31 22:47 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe 2007-05-31 18:49 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\Help 2007-05-31 18:48 28 --a------ C:\WINDOWS\system32\autoscan.dll 2007-05-31 18:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage 2007-05-31 15:54 <DIR> d-------- C:\Program Files\Britannica 2007-05-30 15:24 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\Apple Computer 2007-05-30 15:18 <DIR> d-------- C:\Program Files\QuickTime 2007-05-30 15:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-05-30 15:01 1,156 --a------ C:\WINDOWS\mozver.dat 2007-05-30 14:55 <DIR> d-------- C:\Program Files\3ivx 2007-05-29 16:31 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-05-29 14:46 <DIR> d-------- C:\Program Files\NCH Swift Sound 2007-05-29 12:40 <DIR> d-------- C:\Program Files\BearShare 2007-05-29 08:41 2,277,376 --a------ C:\WINDOWS\system32\TUKernel.exe 2007-05-28 23:28 <DIR> d-------- C:\Program Files\Muti ID3 Tag Editor 2007-05-28 22:58 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-05-12 01:49 <DIR> d-------- C:\Program Files\KONAMI 2007-05-12 01:01 <DIR> d-------- C:\Program Files\Sierra 2007-05-11 22:55 5,248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2007-05-11 22:55 159,616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2007-05-11 00:20 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2007-05-11 00:18 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2007-05-11 00:16 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-05-11 00:16 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-05-10 22:34 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-05-10 22:33 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-05-10 22:33 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-05-10 22:33 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-05-10 22:33 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-05-10 22:33 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-05-10 22:33 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-05-10 22:33 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-05-10 21:06 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-05-10 20:46 <DIR> d-------- C:\Program Files\ESTsoft 2007-05-10 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-05-09 11:45 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-05-09 11:45 208,248 --a------ C:\WINDOWS\system32\muweb.dll 2007-05-09 00:06 <DIR> d-------- C:\Program Files\Windows Defender (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-08 05:01:04 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-06-08 04:59:33 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-06-07 06:56:05 -------- d-----w C:\Program Files\Windows Live Toolbar 2007-06-07 06:55:58 -------- d-----w C:\Program Files\Windows Desktop Search 2007-06-07 06:55:47 -------- d-----w C:\Program Files\Symantec 2007-06-07 06:51:17 -------- d-----w C:\Program Files\Messenger 2007-06-07 06:27:43 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Symantec 2007-06-06 05:18:24 -------- d-----w C:\Program Files\MSN Messenger 2007-06-06 05:17:20 -------- d-----w C:\Program Files\Messenger Plus! Live 2007-06-05 05:11:40 -------- d-----w C:\Program Files\Norton Internet Security 2007-06-03 14:56:56 -------- d-----w C:\Program Files\Microsoft Works 2007-05-29 07:37:10 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-05-28 14:37:52 48,776 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-05-28 14:37:52 115,000 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-05-11 17:46:44 -------- d-----w C:\Program Files\Dell 2007-05-11 17:01:13 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-05-08 15:09:01 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Template 2007-05-08 13:55:03 -------- d-----w C:\Program Files\MSXML 4.0 2007-05-08 13:31:52 -------- d-----w C:\Program Files\Alcohol Soft 2007-05-08 13:22:34 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Screenshot Sender 2007-05-08 10:08:14 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Command & Conquer 3 Tiberium Wars 2007-05-08 09:56:21 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Talkback 2007-05-08 09:56:14 0 ----a-w C:\WINDOWS\nsreg.dat 2007-05-08 09:38:01 -------- d-----w C:\Program Files\Electronic Arts 2007-05-08 09:24:10 -------- d-----w C:\Program Files\Fraps 2007-05-08 09:10:48 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Windows Desktop Search 2007-05-08 09:07:11 -------- d-----w C:\Program Files\TuneUp Utilities 2007 2007-05-08 09:07:04 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\TuneUp Software 2007-05-03 20:51:00 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\ATI 2007-05-03 20:47:21 -------- d-----w C:\Program Files\CyberLink 2007-05-03 20:46:58 -------- d--h--w C:\DOCUME~1\GBK\APPLIC~1\Gtek 2007-05-03 20:46:40 -------- d-----w C:\Program Files\Dell Support 2007-05-03 20:44:05 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys 2007-05-03 20:42:19 -------- d-----w C:\Program Files\Sonic 2007-05-03 20:42:19 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-03 20:42:13 -------- d-----w C:\Program Files\Common Files\Sonic Shared 2007-05-03 20:41:06 -------- d-----w C:\Program Files\Common Files\TiVo Shared 2007-05-03 20:40:30 -------- d-----w C:\Program Files\Digital Line Detect 2007-05-03 20:40:17 -------- d-----w C:\Program Files\NetWaiting 2007-05-03 20:39:31 -------- d-----w C:\Program Files\ATI Technologies 2007-05-03 20:39:02 -------- d-----w C:\Program Files\Broadcom 2007-05-03 20:38:39 -------- d-----w C:\Program Files\Synaptics 2007-05-03 20:36:52 -------- d-----w C:\Program Files\CONEXANT 2007-05-03 20:36:45 -------- d-----w C:\Program Files\Sigmatel 2007-05-03 20:35:57 -------- d-----w C:\Program Files\Intel, Inc 2007-05-03 20:35:37 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Intel 2007-05-03 20:35:32 319,488 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe 2007-05-03 20:35:32 21,425 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2007-05-03 20:35:12 -------- d-----w C:\Program Files\Intel 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 14:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 14:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 14:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 14:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 14:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 14:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 14:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 14:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-13 07:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-03-28 10:51:54 538,256 ----a-w C:\WINDOWS\system32\SymNeti.dll 2007-03-28 10:51:52 161,424 ----a-w C:\WINDOWS\system32\SymRedir.dll 2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 03:55:58 40,960 ----a-w C:\WINDOWS\system32\frapsvid.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {2F85D76C-0569-466F-A488-493E6BD0E955}=C:\Program Files\Windows Desktop Search\dsWebAllow.dll [2006-03-26 22:44] {5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 01:05] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}=C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2006-09-20 07:14] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}=C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-23 12:13] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 15:56] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 18:04] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 17:58] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 11:48] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54] "Cacheman"="C:\PROGRA~1\Cacheman\Cacheman.exe" [2003-07-31 14:13] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=00000000 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"="C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 13:11] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winpsa32] winpsa32.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background "DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 "SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC "SigmatelSysTrayApp"=stsystra.exe "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* UxTuneUp *Newly Created Service* - COMHOST Contents of the 'Scheduled Tasks' folder 2007-06-01 09:15:00 C:\WINDOWS\tasks\1-Click Maintenance.job 2007-06-09 04:37:03 C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job 2007-06-09 08:44:45 C:\WINDOWS\tasks\MP Scheduled Scan.job 2007-06-01 12:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - GBK.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-09 17:01:22 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-09 17:03:08 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-06-09 17:03 --- E O F --- Logfile of HijackThis v1.99.1 Scan saved at 17:13:38, on 09/06/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\Cacheman\Cacheman.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\notepad.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\notepad.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.ap.dell.com/content/defa...=my&l=en&s=gen R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; O2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/229?80026ebbcbfc4bbf95cadd4ea1d4957a O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/230?80026ebbcbfc4bbf95cadd4ea1d4957a O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe |
|
|
|
|
06-09-2007, 03:08 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,494
OS: N/A
|
Re: trojan.vundo [moved from gen.security]
Before fixing anything, please upload this file:
C:\WINDOWS\system32\awvtr.dll to this website: http://www.bleepingcomputer.com/subm....php?channel=4 Kindly include a link to this topic in the message. Delete the file after it has been uploaded -------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O20 - Winlogon Notify: winpsa32 - winpsa32.dll (file missing) --------------- Please perform an online scan using Internet Explorer at http://www.kaspersky.com/virusscanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
06-10-2007, 05:39 AM
|
#13 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 43
OS: winXP
|
Re: trojan.vundo [moved from gen.security]
after running combofix for the 1st time and restarting my computer, i dont get any alerts from norton on trojan.vundo. however, i did get an alert on infostealer as soon as i started kaspersky online scan. it is located somewhere in C:\Deckard\System Scanner. sorry i couldnt give a more detailed address. kaspersky did detect a number of malwares. hope u can fix them. thanks for getting rid of trojan.vundo!!
------------------------------------------------------------------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 19:08:52, on 10/06/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16441) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\PROGRA~1\Cacheman\Cacheman.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.ap.dell.com/content/defa...=my&l=en&s=gen R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhost; O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background O4 - HKCU\..\Run: [Cacheman] C:\PROGRA~1\Cacheman\Cacheman.exe O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/229?80026ebbcbfc4bbf95cadd4ea1d4957a O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-my\msntabres.dll.mui/230?80026ebbcbfc4bbf95cadd4ea1d4957a O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, June 10, 2007 7 36 PMOperating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.83.0 Kaspersky Anti-Virus database last update: 10/06/2007 Kaspersky Anti-Virus database records: 341869 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ F:\ Scan Statistics: Total number of scanned objects: 70358 Number of viruses found: 9 Number of infected objects: 67 / 0 Number of suspicious objects: 0 Duration of the scan process: 00:40:41 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2007-06-10_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\05945937.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\061E0176.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\08FA1EE3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0ACC7B2C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\0C7177A3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\109A3034.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\123E5C6C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1563438F.exe/data0001.cab/VVSN.exe Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1563438F.exe/data0001.cab Infected: not-a-virus:AdWare.Win32.SaveNow.z skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1563438F.exe Embedded CAB: infected - 2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1563438F.exe CryptFF: infected - 2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\15F90B23.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\178923BC.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\17F12224.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\19D705C0.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1FD97895.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2027543A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\22984CF4.exe Infected: Trojan.Win32.Dialer.qn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\29C74EC7.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2A7D704B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2E3E2BDB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\2F15441A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe/data0000.cab/rock.exe/pwdump2/samdump.dll Infected: not-a-virus:PSWTool.Win32.PWDump.2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe/data0000.cab/rock.exe/pwdump2/pwdump2.exe Infected: not-a-virus:PSWTool.Win32.PWDump.2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe/data0000.cab/rock.exe Infected: not-a-virus:PSWTool.Win32.PWDump.2 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe/data0000.cab/RockXP4.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe/data0000.cab Infected: not-a-virus:PSWTool.Win32.RAS.a skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe Rsrc-Package: infected - 5 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe UPack: infected - 5 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe PE_Patch: infected - 5 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34595D30.exe CryptFF: infected - 5 skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34693084.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\34EC7717.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\36D96469.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\39403102.htm Infected: Trojan-Downloader.Win32.Small.cwj skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\402375EA.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44450F5C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\47C61D33.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4B4257F5.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\4E966526.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\56D960E6.dll Infected: Trojan.Win32.Dialer.qn skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\58915597.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5D0E5983.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5EEF172A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\627217DB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\633D7A1F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\699D7520.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\6FB218B8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\71DC3930.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\782A28D6.exe Infected: Trojan-Downloader.Win32.LoadAdv.gen skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\78B065F3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AB673BD.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7BFC052C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7F9D3D31.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\Documents and Settings\GBK\Application Data\Microsoft\MSNLiveFav\LiveFavorites.xml Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\cert8.db Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\formhistory.dat Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\history.dat Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\key3.db Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\parent.lock Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\search.sqlite Object is locked skipped C:\Documents and Settings\GBK\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\GBK\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped C:\Documents and Settings\GBK\Cookies\index.dat Object is locked skipped C:\Documents and Settings\GBK\Desktop\Gary\Setups\Backup\Vista Transformation Pack 6.0.exe/WISE0030.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\GBK\Desktop\Gary\Setups\Backup\Vista Transformation Pack 6.0.exe/WISE0053.BIN/WISE0005.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\GBK\Desktop\Gary\Setups\Backup\Vista Transformation Pack 6.0.exe/WISE0053.BIN Infected: not-a-virus:RiskTool.Win32.CloseApp.a skipped C:\Documents and Settings\GBK\Desktop\Gary\Setups\Backup\Vista Transformation Pack 6.0.exe WiseSFX: infected - 3 skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\pending.dat Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\Working\database_8C34_D301_34D2_ECE8\dfsr.db Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\Working\database_8C34_D301_34D2_ECE8\fsr.log Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\Working\database_8C34_D301_34D2_ECE8\fsrtmp.log Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Messenger\tuaho@hotmail.com\SharingMetadata\Working\database_8C34_D301_34D2_ECE8\tmp.edb Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Windows Live Contacts\tuaho@hotmail.com\real\members.stg Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Microsoft\Windows Live Contacts\tuaho@hotmail.com\shadow\members.stg Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Application Data\Mozilla\Firefox\Profiles\9sih4kmh.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\GBK\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\GBK\Local Settings\History\History.IE5\MSHist012007061020070611\index.dat Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DF4CEC.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DF4D1E.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DF7F0E.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DF7F2E.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DFE901.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temp\~DFE998.tmp Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temporary Internet Files\Content.IE5\0PDT9BIZ\ADSAdClient31[2].htm Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temporary Internet Files\Content.IE5\7X8V76SV\c[1].gif Object is locked skipped C:\Documents and Settings\GBK\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\GBK\NTUSER.DAT Object is locked skipped C:\Documents and Settings\GBK\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-06-10.14-18-06.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0252NAV~.TMP Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0830NAV~.TMP Object is locked skipped C:\QooBox\Quarantine\C\WINDOWS\system32\ddccbxv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\efcbxxu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\QooBox\Quarantine\C\WINDOWS\system32\fccaxya.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP1\A0000007.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000149.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000185.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000186.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP2\A0000188.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\A0000451.exe Infected: Trojan.Win32.Dialer.qn skipped C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP3\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{A6AFAD7B-7D5F-45C7-A38D-4054428AB863}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. ------------------------------------------------------------------------------------------------------------- ComboFix 07-06-09.4 - C:\Documents and Settings\GBK\Desktop\Support\ComboFix.exe "GBK" - 2007-06-10 19:13:27 - Service Pack 2 NTFS ((((((((((((((((((((((((( Files Created from 2007-05-10 to 2007-06-10 ))))))))))))))))))))))))))))))) 2007-06-10 14:43 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-06-10 14:43 <DIR> d-------- C:\WINDOWS\LastGood 2007-06-09 16:53 49,152 --a------ C:\WINDOWS\nircmd.exe 2007-06-08 13:00 <DIR> d-------- C:\Program Files\Lavasoft 2007-06-08 13:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft 2007-06-07 15:36 <DIR> d-------- C:\Deckard 2007-06-06 12:35 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys 2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys 2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys 2007-06-02 19:30 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\CyberLink 2007-05-31 23:35 <DIR> d-------- C:\Program Files\Cacheman 2007-05-31 22:47 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe 2007-05-31 18:49 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\Help 2007-05-31 18:48 28 --a------ C:\WINDOWS\system32\autoscan.dll 2007-05-31 18:19 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Office Genuine Advantage 2007-05-31 15:54 <DIR> d-------- C:\Program Files\Britannica 2007-05-30 15:24 <DIR> d-------- C:\DOCUME~1\GBK\APPLIC~1\Apple Computer 2007-05-30 15:18 <DIR> d-------- C:\Program Files\QuickTime 2007-05-30 15:17 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer 2007-05-30 15:01 1,156 --a------ C:\WINDOWS\mozver.dat 2007-05-30 14:55 <DIR> d-------- C:\Program Files\3ivx 2007-05-29 16:31 <DIR> d-------- C:\WINDOWS\RegisteredPackages 2007-05-29 14:46 <DIR> d-------- C:\Program Files\NCH Swift Sound 2007-05-29 12:40 <DIR> d-------- C:\Program Files\BearShare 2007-05-29 08:41 2,277,376 --a------ C:\WINDOWS\system32\TUKernel.exe 2007-05-28 22:58 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys 2007-05-12 01:49 <DIR> d-------- C:\Program Files\KONAMI 2007-05-12 01:01 <DIR> d-------- C:\Program Files\Sierra 2007-05-11 22:55 5,248 --a------ C:\WINDOWS\system32\drivers\Vax347s.sys 2007-05-11 22:55 159,616 --a------ C:\WINDOWS\system32\drivers\Vax347b.sys 2007-05-11 00:20 24,816 --a------ C:\WINDOWS\system32\mdimon.dll 2007-05-11 00:18 <DIR> d-------- C:\Program Files\Microsoft ActiveSync 2007-05-11 00:16 <DIR> d-------- C:\WINDOWS\SHELLNEW 2007-05-11 00:16 <DIR> d-------- C:\Program Files\Microsoft.NET 2007-05-10 22:34 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-05-10 22:33 68,888 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-05-10 22:33 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-05-10 22:33 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-05-10 22:33 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-05-10 22:33 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-05-10 22:33 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll 2007-05-10 22:33 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-05-10 21:06 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-05-10 20:46 <DIR> d-------- C:\Program Files\ESTsoft 2007-05-10 03:01 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-06-10 11:12:23 -------- d-----w C:\Program Files\Common Files\Symantec Shared 2007-06-10 06:17:42 -------- d-----w C:\Program Files\Windows Desktop Search 2007-06-09 18:17:55 -------- d-----w C:\Program Files\CyberLink 2007-06-08 04:59:33 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2007-06-07 06:56:05 -------- d-----w C:\Program Files\Windows Live Toolbar 2007-06-07 06:55:56 -------- d-----w C:\Program Files\Windows Defender 2007-06-07 06:55:47 -------- d-----w C:\Program Files\Symantec 2007-06-07 06:51:17 -------- d-----w C:\Program Files\Messenger 2007-06-07 06:27:43 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Symantec 2007-06-06 05:18:24 -------- d-----w C:\Program Files\MSN Messenger 2007-06-06 05:17:20 -------- d-----w C:\Program Files\Messenger Plus! Live 2007-06-05 05:11:40 -------- d-----w C:\Program Files\Norton Internet Security 2007-06-03 14:56:56 -------- d-----w C:\Program Files\Microsoft Works 2007-05-29 07:37:10 -------- d-----w C:\Program Files\Windows Media Connect 2 2007-05-28 14:37:52 48,776 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-05-28 14:37:52 115,000 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-05-11 17:46:44 -------- d-----w C:\Program Files\Dell 2007-05-11 17:01:13 -------- d--h--w C:\Program Files\InstallShield Installation Information 2007-05-08 15:09:01 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Template 2007-05-08 13:55:03 -------- d-----w C:\Program Files\MSXML 4.0 2007-05-08 13:31:52 -------- d-----w C:\Program Files\Alcohol Soft 2007-05-08 13:22:34 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Screenshot Sender 2007-05-08 10:08:14 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Command & Conquer 3 Tiberium Wars 2007-05-08 09:56:21 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Talkback 2007-05-08 09:56:14 0 ----a-w C:\WINDOWS\nsreg.dat 2007-05-08 09:38:01 -------- d-----w C:\Program Files\Electronic Arts 2007-05-08 09:24:10 -------- d-----w C:\Program Files\Fraps 2007-05-08 09:07:11 -------- d-----w C:\Program Files\TuneUp Utilities 2007 2007-05-08 09:07:04 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\TuneUp Software 2007-05-03 20:51:00 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\ATI 2007-05-03 20:46:58 -------- d--h--w C:\DOCUME~1\GBK\APPLIC~1\Gtek 2007-05-03 20:46:40 -------- d-----w C:\Program Files\Dell Support 2007-05-03 20:44:05 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys 2007-05-03 20:42:19 -------- d-----w C:\Program Files\Sonic 2007-05-03 20:42:19 -------- d-----w C:\Program Files\Common Files\InstallShield 2007-05-03 20:42:13 -------- d-----w C:\Program Files\Common Files\Sonic Shared 2007-05-03 20:41:06 -------- d-----w C:\Program Files\Common Files\TiVo Shared 2007-05-03 20:40:30 -------- d-----w C:\Program Files\Digital Line Detect 2007-05-03 20:40:17 -------- d-----w C:\Program Files\NetWaiting 2007-05-03 20:39:31 -------- d-----w C:\Program Files\ATI Technologies 2007-05-03 20:39:02 -------- d-----w C:\Program Files\Broadcom 2007-05-03 20:38:39 -------- d-----w C:\Program Files\Synaptics 2007-05-03 20:36:52 -------- d-----w C:\Program Files\CONEXANT 2007-05-03 20:36:45 -------- d-----w C:\Program Files\Sigmatel 2007-05-03 20:35:57 -------- d-----w C:\Program Files\Intel, Inc 2007-05-03 20:35:37 -------- d-----w C:\DOCUME~1\GBK\APPLIC~1\Intel 2007-05-03 20:35:32 319,488 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe 2007-05-03 20:35:32 21,425 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys 2007-05-03 20:35:12 -------- d-----w C:\Program Files\Intel 2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll 2007-04-16 14:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-04-16 14:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-04-16 14:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-04-16 14:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-04-16 14:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-04-16 14:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-04-16 14:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-04-16 14:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-04-16 14:44:20 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-04-16 14:44:18 208,248 ----a-w C:\WINDOWS\system32\muweb.dll 2007-04-13 07:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-03-28 10:51:54 538,256 ----a-w C:\WINDOWS\system32\SymNeti.dll 2007-03-28 10:51:52 161,424 ----a-w C:\WINDOWS\system32\SymRedir.dll 2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-16 03:55:58 40,960 ----a-w C:\WINDOWS\system32\frapsvid.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\system32\dla\tfswshx.dll [2004-12-06 01:05] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22] {9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 20:33] {9ECB9560-04F9-4bbc-943D-298DDF1699E1}=C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll [2006-09-20 07:14] {A8F38D8D-E480-4D52-B7A2-731BB6995FDD}=C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll [2007-05-23 12:13] {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\Windows Live Toolbar\msntb.dll [2007-02-12 15:56] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 18:04] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 17:58] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 11:48] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54] "Cacheman"="C:\PROGRA~1\Cacheman\Cacheman.exe" [2003-07-31 14:13] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoSharedDocuments"=00000000 [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-] "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background "DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 "SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe "PCMService"="C:\Program Files\Dell\MediaDirect\PCMService.exe" "PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName "PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC "SigmatelSysTrayApp"=stsystra.exe "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start "ISUSPM Startup"=C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" -hide HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* UxTuneUp *Newly Created Service* - COMHOST Contents of the 'Scheduled Tasks' folder 2007-06-01 09:15:00 C:\WINDOWS\tasks\1-Click Maintenance.job 2007-06-10 10:37:01 C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job 2007-06-01 12:00:00 C:\WINDOWS\tasks\Norton AntiVirus - Run Full System Scan - GBK.job ************************************************************************** catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-10 19:14:08 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-06-10 19:14:27 C:\ComboFix-quarantined-files.txt ... 2007-06-10 19:14 C:\ComboFix2.txt ... 2007-06-09 17:03 --- E O F --- |
|
|
|
|
06-10-2007, 05:44 AM
|
#14 (permalink) |
|
Registered User
Join Date: Apr 2007
Posts: 43
OS: winXP
|
Re: trojan.vundo [moved from gen.security]
sorry forgot 2 things:
1) i already uploaded C:\WINDOWS\system32\awvtr.dll on the bleeping computer website and deleted it. 2) the alert on infostealer was on norton not kaspersky. |
|
|
|
|
06-10-2007, 06:03 AM
|
#15 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,494
OS: N/A
|
Re: trojan.vundo [moved from gen.security]
Of the stuff Kaspersky found,
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\ is your antivirus program's quarantine cache. You should delete the contents. Please use Symantec's guide to remove the files from quarantine. http://service1.symantec.com/SUPPORT...on=1#_Section1 C:\QooBox\ is ComboFix's quarantine folder. You can safely delete it C:\System Volume Information\ is where System Restore's cache is stored. Whatever is in there can't harm you unless you choose to perform a manual restore. Nevertheless, we shall be reseting/clearing the cache in a little while ---------------------- Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
