|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
08-09-2007, 06:34 PM
|
#1 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Trojan Downloader Issues
I have a trojan that resides in my Temp Files and the Content.IE5 folder in Local Settings. I've done many different things from full scans in safe mode and online scans, and vundofix.exe. All of the scans seem to slow it down, but it returns. Heres the dss log. Thanks for any help in advance.
Deckard's System Scanner v20070807.62 Run by me on 2007-08-09 at 20:27:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 10: 2007-08-10 00:27:29 UTC - RP10 - Deckard's System Scanner Restore Point 9: 2007-08-07 02:39:38 UTC - RP9 - System Checkpoint 8: 2007-08-04 19:54:23 UTC - RP8 - Software Distribution Service 3.0 7: 2007-08-04 05:21:22 UTC - RP7 - Removed Command & Conquer 3 Tiberium Wars™ Demo. 6: 2007-08-04 05:13:29 UTC - RP6 - Installed Windows Internet Explorer 7. -- First Restore Point -- 1: 2007-08-04 04:07:23 UTC - RP1 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as me.exe) -------------------------------------------------- Logfile of HijackThis v1.99.1 Scan saved at 8:28:26 PM, on 8/9/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\RegSrvc.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\System32\svchost.exe C:\Documents and Settings\me\My Documents\_Jake\Downloads & Apps\Programs\Spyware Tools\dss.exe C:\DOCUME~1\me\MYDOCU~1\_Jake\DOWNLO~1\Programs\SPYWAR~1\HIJACK~1\me.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {3F17C32D-CE1B-452E-8830-F0E86E79AFEF} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - (no file) O2 - BHO: (no name) - {CC23617D-6A1A-4F06-B96B-2F16CDA3C973} - C:\WINDOWS\system32\pmkhi.dll O2 - BHO: (no name) - {FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F} - C:\WINDOWS\system32\efccbaa.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\litlvmdj.dll",forkonce O4 - HKLM\..\RunServices: [WindXpUpdate32] WindXpUpdate O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: awvvv - C:\WINDOWS\system32\awvvv.dll (file missing) O20 - Winlogon Notify: byxwv - C:\WINDOWS\system32\byxwv.dll (file missing) O20 - Winlogon Notify: efccbaa - C:\WINDOWS\SYSTEM32\efccbaa.dll O20 - Winlogon Notify: pmkhi - C:\WINDOWS\system32\pmkhi.dll O20 - Winlogon Notify: wincsg32 - wincsg32.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe -- File Associations ----------------------------------------------------------- All associations okay. -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 giveio - c:\windows\system32\giveio.sys R0 hotcore - c:\windows\system32\drivers\hotcore.sys <Not Verified; Paragon Software Group; HotBackup> R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver> R1 Ext2fs - c:\windows\system32\drivers\ext2fs.sys R1 fanio (FanIO driver) - c:\windows\system32\drivers\fanio.sys <Not Verified; Christian Diefer; fanio.sys> R1 IfsDrives - c:\windows\system32\drivers\ifsdrives.sys R1 OMCI (OMCI WDM Device Driver) - c:\windows\system32\drivers\omci.sys <Not Verified; Dell Computer Corporation; OMCI Driver> R2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.2.1.0) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.2> R2 ousbehci (NEC PCI to USB Enhanced Host Controller) - c:\windows\system32\drivers\ousbehci.sys <Not Verified; OrangeWare Corporation; USB 2.0 Enhanced Host Controller Driver> R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver> R3 ousb2hub (OrangeWare USB 2.0 Hub Support) - c:\windows\system32\drivers\ousb2hub.sys <Not Verified; OrangeWare Corporation; USB 2.0 Hub Driver> S0 gdxwdm - c:\windows\system32\drivers\gdxwdm.sys (file missing) S3 CO_Mon - c:\windows\system32\drivers\co_mon.sys S3 efipsk - c:\docume~1\me\locals~1\temp\efipsk.sys (file missing) S3 NAL (Nal Service ) - c:\windows\system32\drivers\iqvw32.sys <Not Verified; Intel Corporation; Intel(R) iQVW32.SYS> S3 SIWIO - c:\windows\temp\siwio.sys (file missing) -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 RegSrvc - c:\windows\system32\regsrvc.exe <Not Verified; Intel Corporation; RegSrvc Module> R2 StarWindServiceAE (StarWind AE Service) - c:\program files\alcohol soft\alcohol 120\starwind\starwindserviceae.exe <Not Verified; Rocket Division Software; StarWind Alcohol Edition> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: Broadcom 570x Gigabit Integrated Controller Device ID: PCI\VEN_14E4&DEV_165D&SUBSYS_865D1028&REV_01\4&39A85202&0&00F0 Manufacturer: Broadcom Name: Broadcom 570x Gigabit Integrated Controller #2 PNP Device ID: PCI\VEN_14E4&DEV_165D&SUBSYS_865D1028&REV_01\4&39A85202&0&00F0 Service: b57w2k -- Files created between 2007-07-09 and 2007-08-09 ----------------------------- 2014-02-15 15:15:33 966656 --a------ C:\WINDOWS\system32\W70MLRES.DLL <Not Verified; Intel Corporation; Intel(R) PRO/Wireless 7100 Adapter> 2014-02-15 15:15:33 983040 --a------ C:\WINDOWS\system32\W20MLRES.DLL <Not Verified; Intel Corporation; Intel(R) PRO/Wireless 2100 Adapter> 2014-02-15 15:10:07 0 d-------- C:\Program Files\Apoint 2014-02-15 15:08:36 0 d-------- C:\Program Files\CONEXANT 2014-02-15 15  26 0 d-------- C:\Program Files\Intel2014-02-15 15:05:57 0 d-------- C:\WINDOWS\system32\ReinstallBackups 2014-02-15 14:57:14 0 d-------- C:\Program Files\SigmaTel 2014-02-15 14:57:02 0 d-------- C:\dell 2014-02-15 14:55:02 176128 --a------ C:\WINDOWS\system32\RcdScan.dll <Not Verified; Dell Computer Corporation; RcdScan Module> 2014-02-15 14:55:02 446464 -ra------ C:\WINDOWS\system32\hhactivex.dll <Not Verified; Blue Sky Software Corporation.; RoboHELP HTML 2000> 2014-02-15 14:54:57 0 d--h----- C:\Program Files\InstallShield Installation Information 2014-02-15 14:54:40 0 d-------- C:\Program Files\Common Files\InstallShield 2014-02-15 14:24:31 51 --a------ C:\WINDOWS\WFXDEL.BAT 2014-02-15 14:23:20 0 d-------- C:\Documents and Settings\me\WINDOWS 2014-02-15 14:21:53 24848 --a------ C:\WINDOWS\system32\msjter35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet> 2014-02-15 14:21:53 123664 --a------ C:\WINDOWS\system32\Msjint35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet> 2014-02-15 14:21:52 252176 --a------ C:\WINDOWS\system32\msrd2x35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet> 2014-02-15 14:21:51 1046288 --a------ C:\WINDOWS\system32\msjet35.dll <Not Verified; Microsoft Corporation; Microsoft® Jet> 2014-02-15 14:21:50 368912 --a------ C:\WINDOWS\system32\vbar332.dll <Not Verified; Microsoft Corporation; Microsoft Visual Basic for Applications> 2014-02-15 14:20:23 0 d---s---- C:\WINDOWS\system32\Microsoft 2014-02-15 14:19:55 0 d-------- C:\Documents and Settings\me\Application Data\Symantec 2014-02-15 14:19:47 0 d-------- C:\Documents and Settings\All Users\Application Data\Symantec 2014-02-15 14:19:46 0 d-------- C:\Program Files\Symantec 2014-02-15 14:19:35 0 d-------- C:\Program Files\Common Files\Symantec Shared 2014-02-15 14:19:31 94208 --a------ C:\WINDOWS\system32\msstkprp.dll <Not Verified; Microsoft Corporation; msprop32> 2014-02-15 14:19:27 306688 --a------ C:\WINDOWS\IsUninst.exe <Not Verified; InstallShield Software Corporation; InstallShield® unInstaller> 2007-08-09 20:19:31 125504 --a------ C:\WINDOWS\system32\litlvmdj.dll 2007-08-08 00:56:42 0 dr-h----- C:\Documents and Settings\me\Recent 2007-08-07 08:18:39 125504 -----n--- C:\WINDOWS\system32\bgkugaew.dll 2007-08-06 20:00:32 231520 -----n--- C:\WINDOWS\system32\pmkhi.dll 2007-08-04 17:39:13 0 d-------- C:\Program Files\Megaman - X Rush to Battle 2007-08-04 16:45:19 0 d-------- C:\Program Files\Common Files\Viewpoint 2007-08-04 00:51:57 0 d-------- C:\WINDOWS\network diagnostic 2007-08-03 11:51:13 1757899 --ahs---- C:\WINDOWS\system32\vvvwa.bak2 2007-08-02 18:40:40 6467 --ahs---- C:\WINDOWS\system32\vvvwa.bak1 2007-07-16 00:21:55 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2007-07-16 00:20:53 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla 2007-07-15 22:36:37 1764627 --ahs---- C:\WINDOWS\system32\vwxyb.bak2 2007-07-15 02:23:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\Simply Super Software 2007-07-15 02:22:13 0 d-------- C:\Documents and Settings\Administrator\Application Data\Grisoft 2007-07-15 02:20:28 0 d-------- C:\WINDOWS\CSC 2007-07-14 22:58:15 0 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2007-07-14 22:54:58 0 d-------- C:\Documents and Settings\me\Application Data\Simply Super Software 2007-07-10 21:59:13 0 d-------- C:\Documents and Settings\me\Application Data\Grisoft 2007-07-10 21:09:45 0 d-------- C:\Program Files\DHShutdown 2007-07-10 20:49:23 28672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-07-10 20:07:16 0 d-------- C:\WINDOWS\system32\Panda Software 2007-07-10 01:02:44 0 d-------- C:\Program Files\FrostWire -- Find3M Report --------------------------------------------------------------- 2007-08-09 20:16:18 0 d-------- C:\Program Files\Mozilla Thunderbird 2007-08-08 00:57:48 0 d-------- C:\Documents and Settings\me\Application Data\AVG7 2007-08-05 10:22:36 0 d-------- C:\Program Files\Winamp 2007-08-04 18:35:08 0 d-------- C:\Program Files\Viewpoint 2007-08-04 18:31:11 0 d-------- C:\Program Files\SpeedFan 2007-08-04 16:45:19 0 d-------- C:\Program Files\Common Files 2007-08-04 16:12:22 0 d-------- C:\Documents and Settings\me\Application Data\FrostWire 2007-08-04 00:21:36 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll <Not Verified; BitComet; BitComet BCTP Helper> 2007-08-04 00:21:07 0 d-------- C:\Program Files\BitComet 2007-08-03 20:09:54 0 d-------- C:\Documents and Settings\me\Application Data\OpenOffice.org2 2007-07-24 01:34:32 0 d-------- C:\Program Files\Common Files\Adobe 2007-07-15 09:58:33 0 d-------- C:\Program Files\Common Files\WhenU 2007-07-10 20:07:20 0 d-------- C:\Program Files\System Shock 2 2007-07-10 18:56:25 14506 --a------ C:\WINDOWS\mozver.dat 2007-07-10 01:05:23 0 d-------- C:\Program Files\Java 2007-07-07 19:29:41 0 d-------- C:\Documents and Settings\me\Application Data\uTorrent 2007-07-07 19:21:09 0 d-------- C:\Program Files\LucasArts 2007-07-07 11:34:38 31254 -----n--- C:\WINDOWS\system32\efccbaa.dll 2007-07-05 13:08:54 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll <Not Verified; Sony DADC Austria AG.; > 2007-07-01 01:01:40 0 d-------- C:\Program Files\Combined Community Codec Pack 2007-06-30 02:39:41 285 --a------ C:\WINDOWS\EReg072.dat 2007-06-05 21:56:04 335 --a----c- C:\WINDOWS\nsreg.dat 2007-06-05 21:55:30 118784 --a------ C:\WINDOWS\GREUninstall.exe -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F17C32D-CE1B-452E-8830-F0E86E79AFEF}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C6039E6C-BDE9-4de5-BB40-768CAA584FDC}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CC23617D-6A1A-4F06-B96B-2F16CDA3C973}] 08/06/2007 08:00 PM 231520 --------- C:\WINDOWS\system32\pmkhi.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F}] 07/07/2007 11:34 AM 31254 --------- C:\WINDOWS\system32\efccbaa.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/2007 03:43 AM] "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [05/28/2003 05:32 PM] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [05/25/2007 12:43 AM] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [07/29/2003 02:30 PM] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [06/11/2003 12:07 AM] "Comodo Firewall"="C:\Program Files\Comodo\Firewall\CPF.exe" [02/06/2007 07:16 PM] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [01/02/2006 05:41 PM] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM] "SystemOptimizer"="C:\WINDOWS\system32\litlvmdj.dll" [08/09/2007 08:19 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [07/02/2007 06:29 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices] "WindXpUpdate32"=WindXpUpdate [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsHistory"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{FD2A7D3A-3DA1-4CA5-AD39-B4C3A72B567F}"= C:\WINDOWS\system32\efccbaa.dll [07/07/2007 11:34 AM 31254] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvvv] C:\WINDOWS\system32\awvvv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxwv] C:\WINDOWS\system32\byxwv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccbaa] efccbaa.dll 07/07/2007 11:34 AM 31254 C:\WINDOWS\system32\efccbaa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhi] C:\WINDOWS\system32\pmkhi.dll 08/06/2007 08:00 PM 231520 C:\WINDOWS\system32\pmkhi.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincsg32] wincsg32.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^me^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=C:\Documents and Settings\me\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam] "J:\Program Files\Steam\Steam.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WindXpUpdate32] WindXpUpdate [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e6379e0-942c-11db-a45e-000cf149f678}] AutoRun\command- F:\wd_windows_tools\setup.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 serial.alcohol-soft.com 127.0.0.1 www.alcohol-soft.com 127.0.0.1 images.alcohol-soft.com 127.0.0.1 trial.alcohol-soft.com 127.0.0.1 alcohol-soft.com -- End of Deckard's System Scanner: finished at 2007-08-09 at 20:29:34 --------- |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
08-10-2007, 12:12 AM
|
#2 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
1. Download this file - http://download.bleepingcomputer.com...a/ComboFix.exe
* IMPORTANT !!! Place combofix.exe on your Desktop  2. Go to  → Run → paste in the single line command & click OK"%userprofile%\desktop\combofix.exe" /killall3. When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 02:43 PM
|
#3 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Trojan Downloader Issues
Thanks for helping. Heres the ComboFix log:
ComboFix 07-08-12 - "me" 2007-08-11 16:22:04.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.641 [GMT -4:00] Command switches used :: /killall ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\byehpfqc.ini C:\WINDOWS\system32\cqfpheyb.dll C:\WINDOWS\system32\efccbaa.dll C:\WINDOWS\system32\ihkmp.ini C:\WINDOWS\system32\kuucmxiv.ini C:\WINDOWS\system32\pmkhi.dll C:\WINDOWS\system32\vixmcuuk.dll ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_DOMAINSERVICE ((((((((((((((((((((((((( Files Created from 2007-07-11 to 2007-08-11 ))))))))))))))))))))))))))))))) 2007-08-11 16:20 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-09 20:27 <DIR> d-------- C:\Deckard 2007-08-04 17:39 <DIR> d-------- C:\Program Files\Megaman - X Rush to Battle 2007-08-04 16:45 <DIR> d-------- C:\Program Files\Common Files\Viewpoint 2007-08-04 00:51 <DIR> d-------- C:\WINDOWS\network diagnostic 2007-08-03 11:51 1,757,899 --ahs---- C:\WINDOWS\system32\vvvwa.bak2 2007-08-02 18:40 6,467 --ahs---- C:\WINDOWS\system32\vvvwa.bak1 2007-07-25 00:19 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe 2007-07-25 00:19 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll 2007-07-15 22:48 1,192,819 --a------ C:\WINDOWS\system32\hmapekaj.ini.ren 2007-07-15 22:36 1,764,627 --ahs---- C:\WINDOWS\system32\vwxyb.bak2 2007-07-15 02:23 <DIR> d-------- C:\DOCUME~1\ADMINI~1\APPLIC~1\Simply Super Software 2007-07-15 02:20 <DIR> d-------- C:\WINDOWS\CSC 2007-07-14 22:58 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-07-14 22:54 <DIR> d-------- C:\DOCUME~1\me\APPLIC~1\Simply Super Software 2007-07-14 22:49 128,576 --a------ C:\WINDOWS\system32\ylsdmwij.dll.ren 2007-07-14 22:49 1,103,060 --a------ C:\WINDOWS\system32\jiwmdsly.ini.ren (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2014-02-15 15:10 --------- d-------- C:\Program Files\Apoint 2014-02-15 15:09 --------- d-------- C:\Program Files\CONEXANT 2014-02-15 14:57 --------- d-------- C:\Program Files\SigmaTel 2014-02-15 14:24 51 --a------ C:\WINDOWS\WFXDEL.BAT 2014-02-15 14:19 --------- d-------- C:\DOCUME~1\me\APPLIC~1\Symantec 2007-08-09 20:16 --------- d-------- C:\Program Files\Mozilla Thunderbird 2007-08-05 10:22 --------- d-------- C:\Program Files\Winamp 2007-08-04 18:35 --------- d-------- C:\Program Files\Viewpoint 2007-08-04 18:31 --------- d-------- C:\Program Files\SpeedFan 2007-08-04 16:12 --------- d-------- C:\DOCUME~1\me\APPLIC~1\FrostWire 2007-08-04 00:21 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll 2007-08-04 00:21 --------- d-------- C:\Program Files\BitComet 2007-08-03 20:09 --------- d-------- C:\DOCUME~1\me\APPLIC~1\OpenOffice.org2 2007-07-24 20:20 685816 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-07-15 09:58 --------- d-------- C:\Program Files\Common Files\WhenU 2007-07-15 02:27 1955753 --a------ C:\WINDOWS\system32\vwxyb.ini.ren 2007-07-14 22:36 1952746 --a------ C:\WINDOWS\system32\vwxyb.bak2.ren 2007-07-10 21:09 --------- d-------- C:\Program Files\DHShutdown 2007-07-10 20:49 28672 --a------ C:\WINDOWS\system32\drivers\CO_Mon.sys 2007-07-10 20:07 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-10 20:07 --------- d-------- C:\Program Files\System Shock 2 2007-07-10 20:06 --------- d-------- C:\Program Files\FrostWire 2007-07-07 19:29 --------- d-------- C:\DOCUME~1\me\APPLIC~1\uTorrent 2007-07-07 19:21 --------- d-------- C:\Program Files\LucasArts 2007-07-07 11:40 6369 --a------ C:\WINDOWS\system32\vwxyb.bak1.ren 2007-07-05 13:08 98304 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-07-01 01:01 --------- d-------- C:\Program Files\Combined Community Codec Pack 2007-06-05 21:55 118784 --a------ C:\WINDOWS\GREUninstall.exe 2007-05-16 11:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 11:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 11:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 11:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 11:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F17C32D-CE1B-452E-8830-F0E86E79AFEF}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43] "PRONoMgr.exe"="C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2003-05-28 17:32] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-05-25 00:43] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-07-29 14:30] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-06-11 00:07] "Comodo Firewall"="C:\Program Files\Comodo\Firewall\CPF.exe" [2007-02-06 19:16] "ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-05-06 09:29] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56] "AlcoholAutomount"="C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" [2007-07-02 06:29] "Steam"="J:\Program Files\Steam\Steam.exe" [2007-06-28 21:27] C:\Documents and Settings\me\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2007-05-11 03 32]Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2007-05-11 00:29:22] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsHistory"=1 (0x1) "NoRecentDocsMenu"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvvv] C:\WINDOWS\system32\awvvv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxwv] C:\WINDOWS\system32\byxwv.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincsg32] wincsg32.dll R0 hotcore;hotcore;C:\WINDOWS\system32\drivers\hotcore.sys R0 speedfan;speedfan;C:\WINDOWS\system32\speedfan.sys R1 Ext2fs;Ext2fs;C:\WINDOWS\system32\DRIVERS\ext2fs.sys R1 fanio;FanIO driver;\??\C:\WINDOWS\system32\drivers\fanio.sys R1 IfsDrives;IfsDrives;C:\WINDOWS\system32\DRIVERS\IfsDrives.sys R2 ousbehci;NEC PCI to USB Enhanced Host Controller;C:\WINDOWS\system32\Drivers\ousbehci.sys R3 HSFHWICH;HSFHWICH;C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys R3 O2SCBUS;O2Micro SmartCardBus Reader;C:\WINDOWS\system32\DRIVERS\ozscr.sys R3 ousb2hub;OrangeWare USB 2.0 Hub Support;C:\WINDOWS\system32\DRIVERS\ousb2hub.sys R3 w70n51;Intel(R) PRO/Wireless 7100 Adapter Driver ;C:\WINDOWS\system32\DRIVERS\w70n51.sys S0 gdxwdm;GDXWDM;C:\WINDOWS\system32\DRIVERS\GDXWDM.sys S3 efipsk;efipsk;\??\C:\DOCUME~1\me\LOCALS~1\Temp\efipsk.sys S3 NAL;Nal Service ;\??\C:\WINDOWS\System32\Drivers\iqvw32.sys S3 SIWIO;SIWIO;\??\C:\WINDOWS\TEMP\SiwIo.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\autorun.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6e6379e0-942c-11db-a45e-000cf149f678}] AutoRun\command- F:\wd_windows_tools\setup.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-11 16:34:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-11 16:38:06 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-11 16:37 --- E O F --- And the new HijackThis log: Logfile of HijackThis v1.99.1 Scan saved at 4:41:42 PM, on 8/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\Program Files\Comodo\Firewall\cmdagent.exe C:\WINDOWS\system32\oodag.exe C:\WINDOWS\System32\RegSrvc.exe C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Comodo\Firewall\CPF.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint\Apntex.exe J:\Program Files\Steam\Steam.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\me\My Documents\_Jake\Downloads & Apps\Programs\Spyware Tools\hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7} - (no file) O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O2 - BHO: (no name) - {3F17C32D-CE1B-452E-8830-F0E86E79AFEF} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Comodo Firewall] "C:\Program Files\Comodo\Firewall\CPF.exe" /background O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" -H O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [AlcoholAutomount] "C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe" /automount O4 - HKCU\..\Run: [Steam] "J:\Program Files\Steam\Steam.exe" -silent O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} - http://security.symantec.com/sscv6/S...in/AvSniff.cab O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: awvvv - C:\WINDOWS\system32\awvvv.dll (file missing) O20 - Winlogon Notify: byxwv - C:\WINDOWS\system32\byxwv.dll (file missing) O20 - Winlogon Notify: wincsg32 - wincsg32.dll (file missing) O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe |
|
|
|
|
08-11-2007, 03:13 PM
|
#4 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
Go to Start > Control Panel > Add or Remove Programs and uninstall the following programs:
--------------- Do a HijackThis scan & place a check next to these items and select "Fix checked": O2 - BHO: (no name) - {2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7} - (no file) O2 - BHO: (no name) - {3F17C32D-CE1B-452E-8830-F0E86E79AFEF} - (no file) O20 - Winlogon Notify: awvvv - C:\WINDOWS\system32\awvvv.dll (file missing) O20 - Winlogon Notify: byxwv - C:\WINDOWS\system32\byxwv.dll (file missing) O20 - Winlogon Notify: wincsg32 - wincsg32.dll (file missing) --------------- Open notepad and copy/paste the text in the quotebox below into it: Code:
http://www.techsupportforum.com/security-center/hijackthis-log-help/173288-trojan-downloader-issues.html
Collect::
C:\WINDOWS\WFXDEL.BAT
D:\autorun.bat
File::
C:\WINDOWS\system32\vvvwa.bak2
C:\WINDOWS\system32\vvvwa.bak1
C:\WINDOWS\system32\hmapekaj.ini.ren
C:\WINDOWS\system32\vwxyb.bak2
C:\WINDOWS\system32\ylsdmwij.dll.ren
C:\WINDOWS\system32\jiwmdsly.ini.ren
C:\Program Files\Viewpoint
C:\WINDOWS\system32\vwxyb.ini.ren
C:\WINDOWS\system32\vwxyb.bak2.ren
C:\WINDOWS\system32\vwxyb.bak1.ren
Folder::
C:\Program Files\Common Files\Viewpoint
C:\Program Files\Common Files\WhenU
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2BC42A41-E859-4ECA-9A70-DC9FEA03C2A7}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3F17C32D-CE1B-452E-8830-F0E86E79AFEF}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awvvv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxwv]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wincsg32]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Additonally, ComboFix will generate a zipped file on your Desktop, called Submit [Date Time].zip Please submit this file before proceeding to the next step. --------------- Click here perform an online scan >> Online Scanner --------------- In your next post, please include fresh logs from:
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 10:24 PM
|
#5 (permalink) | |||
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Trojan Downloader Issues
Okay, everything has been done. I submitted the malware from the ComboFix scan as well.
Heres the Combo Scan log: Quote:
Quote:
Quote:
|
|||
|
|
|
|
08-11-2007, 10:41 PM
|
#6 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
pen NOTEPAD.exe and copy/paste the text in the quotebox below into it:
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
) do (
del /a/f %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
for %%g in (
"C:\Program Files\Viewpoint"
%systemdrive%\VundoFix Backups
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
It should look like this:  Double click on fix.bat & allow it to run Post back to tell me what it says
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 10:53 PM
|
#7 (permalink) |
|
Registered User
Join Date: Aug 2007
Posts: 6
OS: XP
|
Re: Trojan Downloader Issues
Its running now, and I forgot to mention early that Viewpoint and WhenU aren't installed. I checked in both the Windows Add/Remove Programs and Add/Remove Pro. There is an entry in C:/Program Files and C:/Program Files/Common Files for Viewpoint, but they are just empty folders. The .bat is just opening a command prompt, but it doesn't appear to be running, is that how it should look?
|
|
|
|
|
08-11-2007, 11:16 PM
|
#8 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
Oops. ...I made a typo. Please use this instead.
Code:
@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"
for %%g in (
"C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery"
"C:\Program Files\Viewpoint"
%systemdrive%\VundoFix Backups
%systemdrive%\Deckard
%systemdrive%\Qoobox
) do (
rd /s/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Disable("")>SR.vbs
echo.GetObject("winmgmts:" ^& "{impersonationLevel=impersonate}!\\" ^& "." ^& "\root\default").Get("SystemRestore").Enable("")>>SR.vbs
wscript SR.vbs
(
echo.REGEDIT4&echo.
echo.[hkey_current_user\software\microsoft\windows\currentversion\explorer\advanced]
echo."hidden"=dword:00000002
echo."hidefileext"=dword:00000001
echo."showsuperhidden"=dword:00000000
)>rehide.reg
regedit /s rehide.reg
del rehide.reg SR.vbs
nircmd wait 7000
del %0
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 11:37 PM
|
#10 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
Your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:
Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released. Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.
To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html After doing all these, your system will be optimised against future threats. It's okay to delete the Hijack This folder in a couple weeks if everything is working okay. Have a safe & happy computing day.  Kindly respond to this thread once more so we can mark this thread as resolved.
__________________
Question - what have you done for the community today? |
|
|
|
|
08-11-2007, 11:54 PM
|
#12 (permalink) |
|
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
Join Date: May 2005
Posts: 24,335
OS: N/A
|
Re: Trojan Downloader Issues
No worries. Donations are always welcomed but it's not mandatory. Just happy to help
__________________
Question - what have you done for the community today? |
|
|
|
| Thread Tools | |
|
|
