|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
12-05-2007, 10:25 AM
|
#1 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Pop Ups - Vundo.GN
My e-Trust agent found Vundo.GN in C:\Windows\System32\awvtt.dll. I contacted CA's tech. support and they removed the Vundo, and now I'm getting IE Pop Ups whenever I launch an IE session. CA can't seem to fix the pop up issue.
The Panda ActiveScan failed stating An Error has occurred. It has not been possible to start the scan system. Deckard's System Scanner v20071014.68 Run by lcramer on 2007-12-05 12:11:04 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 85: 2007-12-05 17:11:16 UTC - RP348 - Deckard's System Scanner Restore Point 84: 2007-12-05 16:36:52 UTC - RP347 - Installed AVG 7.5 83: 2007-12-05 16:35:51 UTC - RP346 - Removed AVG 7.5 82: 2007-12-04 13:33:16 UTC - RP345 - System Checkpoint 81: 2007-11-30 18:45:07 UTC - RP344 - Installed AVG 7.5 -- First Restore Point -- 1: 2007-11-01 04:28:29 UTC - RP264 - System Checkpoint Backed up registry hives. Performed disk cleanup. -- HijackThis (run as lcramer.exe) --------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:19:09 PM, on 12/5/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\NetWaiting\netWaiting.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\Novell\GroupWise\Notify.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\lcramer\Desktop\dss.exe C:\Program Files\Microsoft Office\Office\WINWORD.EXE C:\PROGRA~1\TRENDM~1\HIJACK~1\lcramer.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.phoenixspecialty.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WinAble] C:\Program Files\WinAble\winable.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189175730336 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = phoenixssc.com O17 - HKLM\Software\..\Telephony: DomainName = phoenixssc.com O17 - HKLM\System\CCS\Services\Tcpip\..\{8B3B76F5-1223-48FE-B8AA-6C2B23E150FF}: NameServer = 192.25.25.15,192.25.25.17 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = phoenixssc.com O18 - Protocol: WebCD - {41AAF073-8687-4877-AAA2-228AB7D195AD} - C:\Program Files\Motion Selector\WebCD\FirstProtocol.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: dnWhoDisp - Unknown owner - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Harmony - Rockwell Software Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: MB4-TOMCAT - Alexandria Software Consulting - C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe O23 - Service: MySql - Unknown owner - C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe O23 - Service: RSLinx Classic (RSLinx) - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9987 bytes -- File Associations ----------------------------------------------------------- .scr - AutoCADScriptFile - shell\open\command - "C:\WINDOWS\system32\notepad.exe" "%1" -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R0 PBADRV - c:\windows\system32\drivers\pbadrv.sys <Not Verified; Dell Inc; PBA Driver> R1 APPDRV - c:\windows\system32\drivers\appdrv.sys <Not Verified; Dell Inc; Application Driver> R1 core - c:\windows\system32\drivers\core.sys R2 AegisP (AEGIS Protocol (IEEE 802.1x) v3.4.9.0) - c:\windows\system32\drivers\aegisp.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 3.4.9.0> R2 s24trans (WLAN Transport) - c:\windows\system32\drivers\s24trans.sys <Not Verified; Intel Corporation; Intel Wireless LAN Packet Driver> R2 Sentinel - c:\windows\system32\drivers\sentinel.sys <Not Verified; Rainbow Technologies, Inc.; Sentinel System Driver> S1 abpicw2k (AB PIC/AIC+ Driver) - c:\windows\system32\drivers\abpicw2k.sys <Not Verified; Rockwell Software, Inc.; RSLinx> S1 VirtualBackplane (A-B Virtual Backplane) - c:\windows\system32\drivers\virtualbackplane.sys (file missing) S2 DS1410D - c:\windows\system32\drivers\ds1410d.sys (file missing) S3 ABKTCX (Rockwell Software 1784-KTC(X) Driver) - c:\windows\system32\drivers\abktcx.sys <Not Verified; Rockwell Software Inc.; abktcx Driver> S3 HMI - c:\windows\system32\drivers\g3usb.sys <Not Verified; Red Lion Controls Inc.; G3 HMI USB Driver> S3 RS_SS_NT (RSLinx Classic S-S SD/SD2 Device Driver) - c:\windows\system32\rs_ss_nt.sys <Not Verified; Rockwell Software, Inc.; RSLinx> S3 RsiKtControl - c:\windows\system32\rsikt.sys <Not Verified; Rockwell Software, Inc.; RSLinx> S3 RSSERIAL (RSLinx Classic Serial Driver) - c:\windows\system32\rsserial.sys <Not Verified; Rockwell Software Inc.; Rsserial Driver> S3 Sntnlusb (Rainbow USB SuperPro) - c:\windows\system32\drivers\sntnlusb.sys <Not Verified; Rainbow Technologies Inc.; Rainbow Technologies USB Security Device Driver> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 DataSvr2 - "c:\program files\wave systems corp\common\dataserver.exe" <Not Verified; Wave Systems Corp.; Authentication Manager> R2 iGateway (iTechnology iGateway 4.2) - "c:\program files\ca\sharedcomponents\itechnology\igateway.exe" <Not Verified; CA, Inc.; iTechnology iGateway> R2 MB4-TOMCAT - c:\program files\motion selector\application\tomcat\bin\tomcat.exe <Not Verified; Alexandria Software Consulting; JavaService> R2 MySql - c:\program files\motion selector\application\mysql\bin\mysqld-max-nt.exe R2 NICCONFIGSVC - c:\program files\dell\nicconfigsvc\nicconfigsvc.exe <Not Verified; Dell Inc.; NicConfigSvc> R2 RegSrvc (Intel(R) PROSet/Wireless Registry Service) - c:\program files\intel\wireless\bin\regsrvc.exe <Not Verified; Intel Corporation; Intel(R) PROSet/Wireless Registry Service> R2 RSLinx (RSLinx Classic) - c:\progra~1\rockwe~1\rslinx\rslinx.exe /service <Not Verified; Rockwell Software, Inc.; RSLinx Classic> R2 tcsd_win32.exe (NTRU Hybrid TSS v2.0.7 TCS) - "c:\program files\ntru cryptosystems\ntru hybrid tss v2.0.7\bin\tcsd_win32.exe" R2 WLANKEEPER (Intel(R) PROSet/Wireless SSO Service) - c:\program files\intel\wireless\bin\wlkeeper.exe <Not Verified; Intel(R) Corporation; SSO Service> R3 Harmony - "c:\program files\rockwell software\rscommon\rsobserv.exe" <Not Verified; Rockwell Software Inc.; Rockwell Software Harmony services> S2 RNADiagnosticsService (FactoryTalk Diagnostics Local Reader) - "c:\program files\common files\rockwell\rnadiagnosticssrv.exe" <Not Verified; Rockwell Automation; Factory Talk Diagnostics> S3 Autodesk Network Licensing Service - c:\program files\common files\autodesk shared\service\adsknetsrv.exe S3 dnWhoDisp - c:\program files\rockwell software\rslinx\dnwhodisp.exe <Not Verified; ; dnWhoDisp Module> S3 OpcEnum - c:\windows\system32\opcenum.exe <Not Verified; OPC Foundation; OPC Server Enumerator 1.10> S3 OracleOraHome81ClientCache - c:\oracle\ora81\bin\onrsd.exe -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\197F121434FC000 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\197F121434FC000 Service: NIC1394 -- Files created between 2007-11-05 and 2007-12-05 ----------------------------- 2007-12-05 12:18:31 0 d-------- C:\Program Files\Trend Micro 2007-12-05 12:10:45 0 d-------- H:\Deckard 2007-12-05 11:44:02 0 d-------- C:\Program Files\SpywareBlaster 2007-12-05 11:36:53 0 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-12-05 11:22:06 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-12-03 16:13:29 0 d-------- C:\Documents and Settings\bblakeney\Application Data\Autodesk 2007-12-03 16:11:01 0 dr-h----- C:\Documents and Settings\bblakeney\Application Data 2007-12-03 16:11:01 0 d-------- C:\Documents and Settings\bblakeney\Application Data\Sun 2007-12-03 16:11:01 0 d---s---- C:\Documents and Settings\bblakeney\Application Data\Microsoft 2007-12-03 16:11:01 0 d-------- C:\Documents and Settings\bblakeney\Application Data\Intel 2007-12-03 16:11:01 0 d-------- C:\Documents and Settings\bblakeney\Application Data\Identities 2007-12-03 16:11:00 0 dr------- C:\Documents and Settings\bblakeney\Favorites 2007-12-03 16:11:00 0 d-------- C:\Documents and Settings\bblakeney\Desktop 2007-12-03 16:11:00 0 d--hs---- C:\Documents and Settings\bblakeney\Cookies 2007-12-03 16:10:59 0 dr-h----- C:\Documents and Settings\bblakeney\SendTo 2007-12-03 16:10:59 0 dr-h----- C:\Documents and Settings\bblakeney\Recent 2007-12-03 16:10:59 0 d--h----- C:\Documents and Settings\bblakeney\PrintHood 2007-12-03 16:10:59 0 d--h----- C:\Documents and Settings\bblakeney\NetHood 2007-12-03 16:10:59 0 dr------- C:\Documents and Settings\bblakeney\My Documents 2007-12-03 16:10:59 0 d--h----- C:\Documents and Settings\bblakeney\Local Settings 2007-12-03 16:10:58 0 d--h----- C:\Documents and Settings\bblakeney\Templates 2007-12-03 16:10:58 0 dr------- C:\Documents and Settings\bblakeney\Start Menu 2007-12-03 16:10:58 634880 --a------ C:\Documents and Settings\bblakeney\NTUSER.DAT 2007-11-29 13:46:15 0 d-------- C:\WINDOWS\pss 2007-11-29 13:40:22 0 d-------- C:\Program Files\RealVNC 2007-11-28 12:55:51 0 d-------- C:\Documents and Settings\arodgers\Application Data\Macromedia 2007-11-28 12:15:42 0 d-------- C:\Documents and Settings\arodgers\Application Data\Intel 2007-11-28 12:15:42 0 d-------- C:\Documents and Settings\arodgers\Application Data\Identities 2007-11-28 12:15:41 0 dr------- C:\Documents and Settings\arodgers\Favorites 2007-11-28 12:15:41 0 d-------- C:\Documents and Settings\arodgers\Desktop 2007-11-28 12:15:41 0 d--hs---- C:\Documents and Settings\arodgers\Cookies 2007-11-28 12:15:41 0 dr-h----- C:\Documents and Settings\arodgers\Application Data 2007-11-28 12:15:41 0 d-------- C:\Documents and Settings\arodgers\Application Data\Sun 2007-11-28 12:15:41 0 d---s---- C:\Documents and Settings\arodgers\Application Data\Microsoft 2007-11-28 12:15:39 0 d--h----- C:\Documents and Settings\arodgers\Templates 2007-11-28 12:15:39 0 dr------- C:\Documents and Settings\arodgers\Start Menu 2007-11-28 12:15:39 0 dr-h----- C:\Documents and Settings\arodgers\SendTo 2007-11-28 12:15:39 0 dr-h----- C:\Documents and Settings\arodgers\Recent 2007-11-28 12:15:39 0 d--h----- C:\Documents and Settings\arodgers\PrintHood 2007-11-28 12:15:39 0 d--h----- C:\Documents and Settings\arodgers\NetHood 2007-11-28 12:15:39 0 dr------- C:\Documents and Settings\arodgers\My Documents 2007-11-28 12:15:39 0 d--h----- C:\Documents and Settings\arodgers\Local Settings 2007-11-28 12:15:38 962560 --a------ C:\Documents and Settings\arodgers\NTUSER.DAT 2007-11-20 14:59:27 0 d-------- C:\WINDOWS\system32\Debug 2007-11-09 11:01:42 0 d-------- H:\CA-REPORT 2007-11-09 09:18:30 0 d--h----- C:\WINDOWS\system32\GroupPolicy 2007-11-07 16:38:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-11-06 13:46:56 0 d-------- C:\Program Files\XoftSpySE 2007-11-06 13:07:34 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe 2007-11-06 12:15:32 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia 2007-11-05 13:35:50 0 d-------- C:\Documents and Settings\Administrator\Application Data\Google 2007-11-05 06:01:56 378721 ---hs---- C:\WINDOWS\system32\ttvwa.ini2 -- Find3M Report --------------------------------------------------------------- 2007-12-03 16:11:20 101419 --a------ C:\WINDOWS\system32\nvModes.dat 2007-11-21 13:03:17 0 d-------- C:\Program Files\Common Files 2007-11-07 14:02:45 0 d-------- C:\Program Files\Yahoo! 2007-11-07 09:26:01 0 d-------- C:\Program Files\Google 2007-11-06 13:07:36 0 d-------- C:\Program Files\Common Files\Adobe 2007-11-06 11:58:09 377566 ---hs---- C:\WINDOWS\system32\ttvwa.bak2 2007-11-05 16:15:57 0 d-------- C:\Program Files\Temporary 2007-10-31 23:29:00 6470 --ahs---- C:\WINDOWS\system32\ttvwa.bak1 2007-10-31 23:23:56 41723 ---hs---- C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe 2007-09-07 09:32:31 73216 --a------ C:\WINDOWS\ST6UNST.EXE <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows> -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [01/19/2006 03:14 PM] "SigmatelSysTrayApp"="stsystra.exe" [11/16/2005 09:35 PM C:\WINDOWS\stsystra.exe] "Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [01/16/2007 09:27 PM] "nwiz"="nwiz.exe" [01/19/2006 03:14 PM C:\WINDOWS\system32\nwiz.exe] "NVHotkey"="nvHotkey.dll" [01/19/2006 03:14 PM C:\WINDOWS\system32\nvhotkey.dll] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [07/27/2004 04:50 PM] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [07/27/2004 04:50 PM] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [12/28/2005 11:55 AM] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [12/28/2005 11:56 AM] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [12/09/2005 08:29 PM] "Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [03/09/2006 12:26 PM] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [09/08/2005 05:20 AM] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [02/20/2006 12:39 PM] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [10/07/2005 07:13 PM] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [06/06/2005 10:46 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 05:00 AM] "WinAble"="C:\Program Files\WinAble\winable.exe" [] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 11:24 AM] "ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [09/10/2003 02:24 AM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 9:05:26 PM] AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [3/5/2005 8:18:22 AM] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [4/28/2006 9:31:58 PM] EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [11/30/2005 9:39:02 AM] GroupWise Notify.lnk - C:\Novell\GroupWise\Notify.exe [5/12/2006 7:34:00 AM] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1/21/2000 3:15:54 AM] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=wxvault.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 wvauth C:\WINDOWS\system32\awvtt.dll -- End of Deckard's System Scanner: finished at 2007-12-05 12:19:35 ------------ Last edited by laughalot; 12-05-2007 at 10:31 AM. |
|
     |
| Sponsored Links |
|
12-09-2007, 05:26 AM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Hi and welcome to TSF.
Apologies for any delay in replying, but we have been rather busy lately, and, of course, all our helpers are volunteers. You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply. Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below. Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your log is clean. Remember that although your symptoms may vanish, this does NOT mean that your system is clean. If there is anything you don't understand, please ask BEFORE proceeding with the fixes. Please ensure that you follow the instructions in the order I have them listed. Combofix Download ComboFix and save it to your desktop. **Note: It is important that it is saved directly to your desktop** CAUTION! Combofix should not be run without supervision - we cannot be held responsible if you end up re-installing Windows! 1. Close any open browsers and physically disconnect from the Internet. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. See here for a guide to disabling AV, Firewall and Anti-malware programmes.
NOTE: ComboFix should not take more than 20 minutes to run - this includes the reboot if malware is found. If it does:
Do not mouseclick combofix's window whilst it's running. This may cause it to stall.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
12-10-2007, 08:02 AM
|
#3 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
Here are the exe's that popped up in task manager:
swreg.cfexe hidfind.exe findstr.exe sed.cfexe vfind.cfexe I was not able to always end them, they would appear then disappear in TaskM. I did keep getting a windows popup stating "This application has failed to start because detoured.dll was not found. Re-installing the application may fix this problem." Here are the log files: ComboFix 07-12-09.1 - lcramer 2007-12-10 9:18:43.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.595 [GMT -5:00] * Created a new restore point . Rootkit driver pe386 is present. ... attempting disinfection Rootkit driver msguard is present. ... attempting disinfection pe386 ...... driver unloaded successfully. msguard ...... driver unloaded successfully. ((((((((((((((((((((((((( Files Created from 2007-11-10 to 2007-12-10 ))))))))))))))))))))))))))))))) . 2007-12-05 12:18 . 2007-12-05 12:18 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-05 11:51 . 2007-12-05 11:51 <DIR> d-------- C:\ie-spyad_zo 2007-12-05 11:44 . 2007-12-05 11:44 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-12-05 11:36 . 2007-12-05 11:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-12-05 11:22 . 2007-12-05 11:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-12-05 11:22 . 2007-12-05 11:42 30,590 --a------ C:\WINDOWS\system32\pavas.ico 2007-12-05 11:22 . 2007-12-05 11:42 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2007-12-05 11:22 . 2007-12-05 11:42 1,406 --a------ C:\WINDOWS\system32\Help.ico 2007-12-03 16:13 . 2007-12-03 16:14 <DIR> d-------- C:\Documents and Settings\bblakeney\Application Data\Autodesk 2007-12-03 16:11 . 2006-04-28 21:24 <DIR> d-------- C:\Documents and Settings\bblakeney\Application Data\Intel 2007-11-29 13:40 . 2007-11-29 13:40 <DIR> d-------- C:\Program Files\RealVNC 2007-11-28 12:15 . 2006-04-28 21:24 <DIR> d-------- C:\Documents and Settings\arodgers\Application Data\Intel 2007-11-20 15:00 . 2007-10-18 21:14 184,080 --a------ C:\WINDOWS\system32\drivers\ino_fltr.sys 2007-11-20 15:00 . 2007-08-06 22:07 27,536 --a------ C:\WINDOWS\system32\drivers\ino_flpy.sys 2007-11-20 14:59 . 2007-11-20 14:59 <DIR> d-------- C:\WINDOWS\system32\Debug 2007-11-20 13:04 . 2007-11-26 09:46 <DIR> d-------- C:\DEDUCT . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-09 16:02 996 ----a-w C:\reg5.reg 2007-11-09 16:02 654 ----a-w C:\reg30.reg 2007-11-09 16:02 6,844 ----a-w C:\reg19.reg 2007-11-09 16:02 6,668 ----a-w C:\reg29.reg 2007-11-09 16:02 572 ----a-w C:\reg28.reg 2007-11-09 16:02 5,068 ----a-w C:\reg20.reg 2007-11-09 16:02 426 ----a-w C:\reg33.reg 2007-11-09 16:02 322 ----a-w C:\reg23.reg 2007-11-09 16:02 314 ----a-w C:\reg43.reg 2007-11-09 16:02 300 ----a-w C:\reg21.reg 2007-11-09 16:02 3,490 ----a-w C:\reg1.reg 2007-11-09 16:02 28,564 ----a-w C:\reg18.reg 2007-11-09 16:02 278 ----a-w C:\reg38.reg 2007-11-09 16:02 276 ----a-w C:\reg32.reg 2007-11-09 16:02 248 ----a-w C:\reg44.reg 2007-11-09 16:02 248 ----a-w C:\reg42.reg 2007-11-09 16:02 248 ----a-w C:\reg41.reg 2007-11-09 16:02 248 ----a-w C:\reg40.reg 2007-11-09 16:02 230 ----a-w C:\reg2.reg 2007-11-09 16:02 212 ----a-w C:\reg39.reg 2007-11-09 16:02 212 ----a-w C:\reg37.reg 2007-11-09 16:02 212 ----a-w C:\reg36.reg 2007-11-09 16:02 212 ----a-w C:\reg35.reg 2007-11-09 16:02 12,480 ----a-w C:\reg27.reg 2007-11-09 16:02 1,294 ----a-w C:\reg34.reg 2007-11-09 15:05 --------- d-----w C:\Program Files\XoftSpySE 2007-11-07 21:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-11-07 19:02 --------- d-----w C:\Program Files\Yahoo! 2007-11-07 14:26 --------- d-----w C:\Program Files\Google 2007-11-06 18:07 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-06 17:02 378,721 --sh--w C:\WINDOWS\system32\ttvwa.ini2 2007-11-06 16:58 377,566 --sh--w C:\WINDOWS\system32\ttvwa.bak2 2007-11-05 19:14 115,712 ----a-w C:\VundoFix.exe 2007-11-01 04:29 6,470 --sha-w C:\WINDOWS\system32\ttvwa.bak1 2007-10-26 03:36 8,454,656 ------w C:\WINDOWS\system32\dllcache\shell32.dll 1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL 1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL 1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL 1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL 1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL 1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\AutoCAD Digital Signatures Icon Overlay Handler] @={36A21736-36C2-4C11-8ACB-D4136F2B57BD} [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Offline Files] [HKEY_CLASSES_ROOT\CLSID\{36A21736-36C2-4C11-8ACB-D4136F2B57BD}] 2007-02-12 01:12 44648 --a------ C:\WINDOWS\system32\AcSignIcon.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24] "ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 05:00 C:\WINDOWS\system32\rundll32.exe] "SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 21:35 C:\WINDOWS\stsystra.exe] "Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [2007-01-16 21:27] "nwiz"="nwiz.exe" [2006-01-19 15:14 C:\WINDOWS\system32\nwiz.exe] "NVHotkey"="nvHotkey.dll" [2006-01-19 15:14 C:\WINDOWS\system32\nvhotkey.dll] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29] "Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-02-20 12:39] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 19:13] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 08:18:22] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-04-28 21:31:58] EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02] GroupWise Notify.lnk - C:\Novell\GroupWise\Notify.exe [2006-05-12 07:34:00] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 03:15:54] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wxvault.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 wvauth R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys R2 MB4-TOMCAT;MB4-TOMCAT;C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe R3 USBCCID;USB Smart Card reader;C:\WINDOWS\system32\DRIVERS\usbccid.sys S1 abpicw2k;AB PIC/AIC+ Driver;C:\WINDOWS\system32\DRIVERS\abpicw2k.sys S1 VirtualBackplane;A-B Virtual Backplane;C:\WINDOWS\system32\Drivers\VirtualBackplane.sys S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;C:\WINDOWS\system32\Drivers\ABKTCX.sys S3 HMI;HMI;C:\WINDOWS\system32\drivers\g3usb.sys S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;C:\oracle\ora81\BIN\ONRSD.EXE S3 RS_SS_NT;RSLinx Classic S-S SD/SD2 Device Driver;C:\WINDOWS\system32\RS_SS_NT.SYS S3 RsiKtControl;RsiKtControl;C:\WINDOWS\system32\RSIKT.SYS S3 RSSERIAL;RSLinx Classic Serial Driver;C:\WINDOWS\system32\RSSERIAL.SYS . ************************************************************************** catchme 0.3.1331 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-10 10:12:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-10 10:34:40 - machine was rebooted . --- E O F --- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:36, on 2007-12-10 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\cmd.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\ComboFix\swreg.cfexe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.phoenixspecialty.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189175730336 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = phoenixssc.com O17 - HKLM\Software\..\Telephony: DomainName = phoenixssc.com O17 - HKLM\System\CCS\Services\Tcpip\..\{8B3B76F5-1223-48FE-B8AA-6C2B23E150FF}: NameServer = 192.25.25.15,192.25.25.17 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = phoenixssc.com O18 - Protocol: WebCD - {41AAF073-8687-4877-AAA2-228AB7D195AD} - C:\Program Files\Motion Selector\WebCD\FirstProtocol.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: dnWhoDisp - Unknown owner - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Harmony - Rockwell Software Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: MB4-TOMCAT - Alexandria Software Consulting - C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe O23 - Service: MySql - Unknown owner - C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe O23 - Service: RSLinx Classic (RSLinx) - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9048 bytes |
|
|
|
|
12-10-2007, 01:03 PM
|
#4 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Hi again
Looking better – how are things running now? Don’t worry about noting any services while combofix is running – it’s unlikely to happen. Just let it do what it has to do. Combofix
Code:
File:: C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\ttvwa.ini2 C:\WINDOWS\system32\ttvwa.bak2 C:\WINDOWS\system32\ttvwa.bak1 Folder:: C:\DEDUCT Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=-  Save this as CFScript.txt, in the same location as ComboFix.exe  Refering to the picture above, drag CFScript into ComboFix.exe When finished, it will produce a log for you at "C:\ComboFix.txt" Do not mouseclick combofix's window whilst it's running. This may cause it to stall. CAUTION! Anyone else thinking of using the above script does so at their own risk - you may end up re-installing Windows! Please post the log C:\ComboFix.txt along with a fresh HijackThis Log for further review. Online Scan Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner Next Click on Kaspersky Online Scanner  A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
Now under select a target to scan: Select My Computer
 Now click on the Save as Text button:
* Turn off the real time scanner of any existing antivirus program while performing the online scan Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%. Logs required C:\Combofix.txt Kaspersky Log HijackThis Log
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
12-11-2007, 07:33 AM
|
#5 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
Its getting better. Don't think Kaspersky cleaned anything. I think the log files shows the infected files. Here are the log files:
10:30 2007-12-11ComboFix 07-12-09.1 - lcramer 2007-12-11 8:13:36.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.516 [GMT -5:00] Running from: C:\Documents and Settings\lcramer\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\lcramer\Desktop\CFScript.txt * Created a new restore point FILE C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\ttvwa.bak1 C:\WINDOWS\system32\ttvwa.bak2 C:\WINDOWS\system32\ttvwa.ini2 . ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 2007-12-11 10:20 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 11/12/2007 Kaspersky Anti-Virus database records: 479839 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ O:\ P:\ R:\ S:\ T:\ Scan Statistics: Total number of scanned objects: 75790 Number of viruses found: 4 Number of infected objects: 8 Number of suspicious objects: 0 Duration of the scan process: 00:54:03 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped C:\Documents and Settings\All Users\Application Data\Wave Systems Corp\AuthManager\AuthPkg.txt Object is locked skipped C:\Documents and Settings\All Users\Application Data\Wave Systems Corp\AuthManager\biolsp.txt Object is locked skipped C:\Documents and Settings\lcramer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-695a979f.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped C:\Documents and Settings\lcramer\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-6b26dca8-695a979f.zip ZIP: infected - 1 skipped C:\Documents and Settings\lcramer\Cookies\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\History\History.IE5\MSHist012007112620071203\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\History\History.IE5\MSHist012007120320071210\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\History\History.IE5\MSHist012007121020071211\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\History\History.IE5\MSHist012007121120071212\index.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\Temp\IMG17.tmp Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\lcramer\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\lcramer\NTUSER.DAT Object is locked skipped C:\Documents and Settings\lcramer\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\CA\eTrustITM\DB\rtmaster.dbf Object is locked skipped C:\Program Files\CA\eTrustITM\DB\rtmaster.ntx Object is locked skipped C:\Program Files\CA\eTrustITM\RPCMtDB\jobserv.dbf Object is locked skipped C:\Program Files\CA\eTrustITM\RPCMtDB\jobserv.ntx Object is locked skipped C:\Program Files\CA\SharedComponents\PPRealtime\logs\2007-12-11.csv Object is locked skipped C:\Program Files\Motion Selector\Application\mysql\data\ibdata1 Object is locked skipped C:\Program Files\Motion Selector\Application\mysql\data\ib_logfile0 Object is locked skipped C:\Program Files\Motion Selector\Application\mysql\data\PLCLAPTOP2.err Object is locked skipped C:\Program Files\Motion Selector\Application\tomcat\logs\catalina_log.2007-12-11.txt Object is locked skipped C:\Program Files\Motion Selector\Application\tomcat\logs\service.err Object is locked skipped C:\Program Files\Motion Selector\Application\tomcat\logs\service.out Object is locked skipped C:\Program Files\RealVNC\VNC4\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped C:\Program Files\RealVNC\VNC4\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped C:\Program Files\RealVNC\VNC4\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped C:\Program Files\RealVNC\VNC4\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP344\A0034237.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.agh skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP344\A0034239.exe Infected: Trojan-Downloader.Win32.Small.gll skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP351\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Prefetch\layout.ini Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{EC682FA6-E60A-420F-BEAE-161585123436}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\DEFAULT Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\FTDiag.evt Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SYSTEM Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\TEMP\hsperfdata_SYSTEM\2888 Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:27, on 2007-12-11 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.phoenixspecialty.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189175730336 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = phoenixssc.com O17 - HKLM\Software\..\Telephony: DomainName = phoenixssc.com O17 - HKLM\System\CCS\Services\Tcpip\..\{8B3B76F5-1223-48FE-B8AA-6C2B23E150FF}: NameServer = 192.25.25.15,192.25.25.17 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = phoenixssc.com O18 - Protocol: WebCD - {41AAF073-8687-4877-AAA2-228AB7D195AD} - C:\Program Files\Motion Selector\WebCD\FirstProtocol.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: dnWhoDisp - Unknown owner - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Harmony - Rockwell Software Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: MB4-TOMCAT - Alexandria Software Consulting - C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe O23 - Service: MySql - Unknown owner - C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe O23 - Service: RSLinx Classic (RSLinx) - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9743 bytes |
|
|
|
|
12-11-2007, 11:44 AM
|
#6 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Hi
Looks like you've only posted part of the combofix log - I need the complete log please. Kaspersky doesn't fix anything, so don't worry about that.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
12-11-2007, 01:50 PM
|
#8 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Not yet - I'll review what we have and return with further instructions.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
12-11-2007, 02:14 PM
|
#9 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Hi again
Kaspersky is fine – we’ll clean out System Restore later. You do need to clear out your Sun Java cache – see here. Open Hijack This and click on Scan. Check the following entries (make sure you do not miss any) O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat" Please remember to close all other windows, including browsers then click Fix checked. We’ll run combofix again – please follow these instructions:- 1. Close any open browsers and physically disconnect from the Internet. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. See here for a guide to disabling AV, Firewall and Anti-malware programmes.
Do not mouseclick combofix's window whilst it's running. This may cause it to stall.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner Last edited by Glaswegian; 12-11-2007 at 02:37 PM. |
|
|
|
|
12-18-2007, 06:33 AM
|
#10 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
I'm not getting anything in my combo log file??
ComboFix 07-12-09.1 - lcramer 2007-12-18 9:23:47.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.492 [GMT -5:00] Running from: C:\Documents and Settings\lcramer\Desktop\ComboFix.exe . Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:20, on 2007-12-18 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\Program Files\RealVNC\VNC4\WinVNC4.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\Program Files\CA\eTrustITM\ppcl.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\Program Files\CA\eTrustITM\realmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Apoint\Apntex.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\NetWaiting\netWaiting.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.phoenixspecialty.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189175730336 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = phoenixssc.com O17 - HKLM\Software\..\Telephony: DomainName = phoenixssc.com O17 - HKLM\System\CCS\Services\Tcpip\..\{8B3B76F5-1223-48FE-B8AA-6C2B23E150FF}: NameServer = 192.25.25.15,192.25.25.17 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = phoenixssc.com O18 - Protocol: WebCD - {41AAF073-8687-4877-AAA2-228AB7D195AD} - C:\Program Files\Motion Selector\WebCD\FirstProtocol.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: dnWhoDisp - Unknown owner - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Harmony - Rockwell Software Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: MB4-TOMCAT - Alexandria Software Consulting - C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe O23 - Service: MySql - Unknown owner - C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe O23 - Service: RSLinx Classic (RSLinx) - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 9921 bytes |
|
|
|
|
12-19-2007, 02:30 PM
|
#11 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Pop Ups - Vundo.GN
Hi again
Try running HJT and fix the O4 Combofix entry again, just as I described earlier. Then run combofix and see if it works this time.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. Ad-Aware::SpywareBlaster::SpyBot::SpywareGuard::SnoopFree::AVG Free::HOSTS File::HijackThis::Donate::Photographers Corner |
|
|
|
|
12-19-2007, 08:18 PM
|
#12 (permalink) |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Pop Ups - Vundo.GN
Laughalot,
Glaswegian is not going to be available for a little while, so I will help you in the meantime. Please follow his intructions to run HijackThis, Scan, and check box for: O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat" Select: Fix checked ~~~~ Then, let’s see if we can get ComboFix to run and produce a report. Please delete ComboFix, and the following folder: C:\ComboFix Now, download the new version of ComboFix Save to the Desktop <<< Important!! Double-click combofix.exe to run the program Follow the prompts. (Don't click on the window while the program is running, it may cause your system to stall.) When finished, a log, ComboFix.txt, is produced. ~~~~ Please post the ComboFix.txt, and a new HijackThis log in your reply.
__________________
|
|
|
|
|
01-02-2008, 06:15 AM
|
#15 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
Here you go:
ComboFix 08-01-02.1 - lcramer 2008-01-02 8:59:46.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503 [GMT -5:00] Running from: C:\Documents and Settings\lcramer\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\ttvwa.ini . ---- Previous Run ------- . C:\DEDUCT C:\DEDUCT\DLASHX_W.zip C:\DEDUCT\xrhbircr.zip C:\WINDOWS\system32\Help.ico C:\WINDOWS\system32\pavas.ico C:\WINDOWS\system32\ttvwa.bak1 C:\WINDOWS\system32\ttvwa.bak2 C:\WINDOWS\system32\ttvwa.ini2 . ((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 ))))))))))))))))))))))))))))))) . 2007-12-11 08:35 . 2007-12-11 08:35 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-12-11 08:35 . 2007-12-11 08:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-12-10 08:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-12-05 12:18 . 2007-12-05 12:18 <DIR> d-------- C:\Program Files\Trend Micro 2007-12-05 11:51 . 2007-12-05 11:51 <DIR> d-------- C:\ie-spyad_zo 2007-12-05 11:44 . 2007-12-05 11:44 <DIR> d-------- C:\Program Files\SpywareBlaster 2007-12-05 11:36 . 2007-12-05 11:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-12-05 11:22 . 2007-12-05 11:42 <DIR> d-------- C:\WINDOWS\system32\ActiveScan 2007-12-05 11:22 . 2007-12-05 11:42 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2007-12-03 16:13 . 2007-12-03 16:14 <DIR> d-------- C:\Documents and Settings\bblakeney\Application Data\Autodesk 2007-12-03 16:11 . 2006-04-28 21:24 <DIR> d-------- C:\Documents and Settings\bblakeney\Application Data\Intel . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-11-29 18:40 --------- d-----w C:\Program Files\RealVNC 2007-11-09 16:02 996 ----a-w C:\reg5.reg 2007-11-09 16:02 654 ----a-w C:\reg30.reg 2007-11-09 16:02 6,844 ----a-w C:\reg19.reg 2007-11-09 16:02 6,668 ----a-w C:\reg29.reg 2007-11-09 16:02 572 ----a-w C:\reg28.reg 2007-11-09 16:02 5,068 ----a-w C:\reg20.reg 2007-11-09 16:02 426 ----a-w C:\reg33.reg 2007-11-09 16:02 322 ----a-w C:\reg23.reg 2007-11-09 16:02 314 ----a-w C:\reg43.reg 2007-11-09 16:02 300 ----a-w C:\reg21.reg 2007-11-09 16:02 3,490 ----a-w C:\reg1.reg 2007-11-09 16:02 28,564 ----a-w C:\reg18.reg 2007-11-09 16:02 278 ----a-w C:\reg38.reg 2007-11-09 16:02 276 ----a-w C:\reg32.reg 2007-11-09 16:02 248 ----a-w C:\reg44.reg 2007-11-09 16:02 248 ----a-w C:\reg42.reg 2007-11-09 16:02 248 ----a-w C:\reg41.reg 2007-11-09 16:02 248 ----a-w C:\reg40.reg 2007-11-09 16:02 230 ----a-w C:\reg2.reg 2007-11-09 16:02 212 ----a-w C:\reg39.reg 2007-11-09 16:02 212 ----a-w C:\reg37.reg 2007-11-09 16:02 212 ----a-w C:\reg36.reg 2007-11-09 16:02 212 ----a-w C:\reg35.reg 2007-11-09 16:02 12,480 ----a-w C:\reg27.reg 2007-11-09 16:02 1,294 ----a-w C:\reg34.reg 2007-11-09 15:05 --------- d-----w C:\Program Files\XoftSpySE 2007-11-07 21:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft 2007-11-07 19:02 --------- d-----w C:\Program Files\Yahoo! 2007-11-07 14:26 --------- d-----w C:\Program Files\Google 2007-11-06 18:07 --------- d-----w C:\Program Files\Common Files\Adobe 2007-11-05 19:14 115,712 ----a-w C:\VundoFix.exe 1998-12-09 02:53 99,840 ----a-w C:\Program Files\Common Files\IRAABOUT.DLL 1998-12-09 02:53 70,144 ----a-w C:\Program Files\Common Files\IRAMDMTR.DLL 1998-12-09 02:53 48,640 ----a-w C:\Program Files\Common Files\IRALPTTR.DLL 1998-12-09 02:53 31,744 ----a-w C:\Program Files\Common Files\IRAWEBTR.DLL 1998-12-09 02:53 186,368 ----a-w C:\Program Files\Common Files\IRAREG.DLL 1998-12-09 02:53 17,920 ----a-w C:\Program Files\Common Files\IRASRIAL.DLL . ((((((((((((((((((((((((((((( snapshot@2007-12-10_10.19.14.25 ))))))))))))))))))))))))))))))))))))))))) . - 2007-03-13 15:57:10 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE + 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE + 2008-01-02 13:56:43 9,100 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{0B8B0FAA-4C78-4277-99CE-06DCC2576747}.bin + 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll + 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe + 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll - 2007-12-03 21:11:20 101,419 ----a-w C:\WINDOWS\system32\nvModes.dat + 2007-12-19 15:28:16 101,374 ----a-w C:\WINDOWS\system32\nvModes.dat - 2007-12-10 13:25:39 64,038 ----a-w C:\WINDOWS\system32\perfc009.dat + 2007-12-19 15:30:58 64,038 ----a-w C:\WINDOWS\system32\perfc009.dat - 2007-12-10 13:25:39 403,594 ----a-w C:\WINDOWS\system32\perfh009.dat + 2007-12-19 15:30:58 403,594 ----a-w C:\WINDOWS\system32\perfh009.dat - 2007-07-22 23:39:27 279,552 ----a-w C:\WINDOWS\system32\swreg.exe + 2000-08-31 13:00:00 156,160 ----a-w C:\WINDOWS\system32\swreg.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208] "ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24 20480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-01-19 15:14 7401472] "SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 21:35 397312 C:\WINDOWS\stsystra.exe] "Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [2007-01-16 21:27 407632] "nwiz"="nwiz.exe" [2006-01-19 15:14 1519616 C:\WINDOWS\system32\nwiz.exe] "NVHotkey"="nvHotkey.dll" [2006-01-19 15:14 73728 C:\WINDOWS\system32\nvhotkey.dll] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 11:55 667718] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 11:56 602182] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29 49152] "Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-03-09 12:26 98304] "DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20 122940] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-02-20 12:39 839680] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 19:13 176128] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 22:46 57344] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26] AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 08:18:22] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-04-28 21:31:58] EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2005-11-30 09:39:02] GroupWise Notify.lnk - C:\Novell\GroupWise\Notify.exe [2006-05-12 07:34:00] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 03:15:54] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 wvauth R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 15:35] R2 MB4-TOMCAT;MB4-TOMCAT;C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe [2001-10-14 10:14] S1 abpicw2k;AB PIC/AIC+ Driver;C:\WINDOWS\system32\DRIVERS\abpicw2k.sys [2004-06-03 03:08] S1 VirtualBackplane;A-B Virtual Backplane;C:\WINDOWS\system32\Drivers\VirtualBackplane.sys [] S3 ABKTCX;Rockwell Software 1784-KTC(X) Driver;C:\WINDOWS\system32\Drivers\ABKTCX.sys [2004-06-03 03:08] S3 HMI;HMI;C:\WINDOWS\system32\drivers\g3usb.sys [2006-03-07 06:55] S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;C:\oracle\ora81\BIN\ONRSD.EXE [2000-10-19 10:55] S3 RS_SS_NT;RSLinx Classic S-S SD/SD2 Device Driver;C:\WINDOWS\system32\RS_SS_NT.SYS [2004-06-03 03:08] S3 RsiKtControl;RsiKtControl;C:\WINDOWS\system32\RSIKT.SYS [2004-06-03 03:08] S3 RSSERIAL;RSLinx Classic Serial Driver;C:\WINDOWS\system32\RSSERIAL.SYS [2004-06-03 03:08] . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-02 09:09:40 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-01-02 9:12:02 - machine was rebooted [lcramer] ComboFix-quarantined-files.txt 2008-01-02 14:11:57 ComboFix2.txt 2007-12-10 15:34:51 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:53, on 2008-01-02 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16544) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\Program Files\CA\eTrustITM\realmon.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Apoint\Apoint.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe C:\WINDOWS\system32\svchost.exe c:\progra~1\common~1\instal~1\update~1\isuspm.exe C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.phoenixspecialty.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [Document Manager] C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [combofix] "C:\WINDOWS\system32\cmd.exe" /c "cd /d C:\ComboFix\ & Combobatch.bat" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKUS\S-1-5-21-515967899-1425521274-1801674531-1106\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe (User '?') O4 - HKUS\S-1-5-21-515967899-1425521274-1801674531-1106\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-21-515967899-1425521274-1801674531-1147\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe (User '?') O4 - HKUS\S-1-5-21-515967899-1425521274-1801674531-3138\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe (User '?') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: EMBASSY Trust Suite Secure Update.lnk = C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe O4 - Global Startup: GroupWise Notify.lnk = C:\Novell\GroupWise\Notify.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1189175730336 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = phoenixssc.com O17 - HKLM\Software\..\Telephony: DomainName = phoenixssc.com O17 - HKLM\System\CCS\Services\Tcpip\..\{8B3B76F5-1223-48FE-B8AA-6C2B23E150FF}: NameServer = 192.25.25.15,192.25.25.17 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = phoenixssc.com O18 - Protocol: WebCD - {41AAF073-8687-4877-AAA2-228AB7D195AD} - C:\Program Files\Motion Selector\WebCD\FirstProtocol.dll O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: DataSvr2 - Wave Systems Corp. - C:\Program Files\Wave Systems Corp\Common\DataServer.exe O23 - Service: dnWhoDisp - Unknown owner - C:\Program Files\Rockwell Software\RSLINX\dnwhodisp.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: Harmony - Rockwell Software Inc. - C:\Program Files\Rockwell Software\RSCommon\RSOBSERV.EXE O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRealtime\bin\ITMRTSVC.exe O23 - Service: MB4-TOMCAT - Alexandria Software Consulting - C:\Program Files\Motion Selector\Application\tomcat\bin\tomcat.exe O23 - Service: MySql - Unknown owner - C:\Program Files\Motion Selector\Application\mysql\bin\mysqld-max-nt.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPZipm12.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: FactoryTalk Diagnostics Local Reader (RNADiagnosticsService) - Rockwell Automation - C:\Program Files\Common Files\Rockwell\RNADiagnosticsSrv.exe O23 - Service: RSLinx Classic (RSLinx) - Rockwell Software, Inc. - C:\PROGRA~1\ROCKWE~1\RSLinx\RSLINX.EXE O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: NTRU Hybrid TSS v2.0.7 TCS (tcsd_win32.exe) - Unknown owner - C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.7\bin\tcsd_win32.exe O23 - Service: VNC Server Version 4 (WinVNC4) - RealVNC Ltd. - C:\Program Files\RealVNC\VNC4\WinVNC4.exe O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe -- End of file - 10275 bytes |
|
|
|
|
01-03-2008, 08:04 PM
|
#16 (permalink) |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Pop Ups - Vundo.GN
There are some files showing on the ComboFix log for which no information is found:
C:\reg5.reg C:\reg30.reg C:\reg19.reg C:\reg29.reg C:\reg28.reg C:\reg20.reg C:\reg33.reg C:\reg23.reg C:\reg43.reg C:\reg21.reg C:\reg1.reg C:\reg18.reg C:\reg38.reg C:\reg32.reg C:\reg44.reg C:\reg42.reg C:\reg41.reg C:\reg40.reg C:\reg2.reg C:\reg39.reg C:\reg37.reg C:\reg36.reg C:\reg35.reg C:\reg27.reg C:\reg34.reg They may be of no concern, but to be safe, rather than sorry, do the following: Enable the viewing of Hidden Files and Folders as follows:
Then, go to: VirusTotal 
For each file, please provide the scan results in your reply.
__________________
|
|
|
|
|
01-04-2008, 07:39 AM
|
#17 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
I did not scan all the files, please let me know if I need to do that. See below results from the files that I did scan.
File reg1.reg received on 01.04.2008 14:08:44 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg18.reg received on 01.04.2008 14:18:41 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg28.reg received on 01.04.2008 14:24:45 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg21.reg received on 01.04.2008 14:38:29 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg33.reg received on 01.04.2008 14:44:31 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg44.reg received on 01.04.2008 14:53:41 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg40.reg received on 01.04.2008 15:09:38 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg37.reg received on 01.04.2008 15:17:18 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg5.reg received on 01.04.2008 15:31:49 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) File reg23.reg received on 01.04.2008 16:24:50 (CET) Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED Result: 0/32 (0%) |
|
|
|
|
01-04-2008, 08:37 AM
|
#19 (permalink) |
|
Registered User
Join Date: Dec 2007
Posts: 12
OS: XP
|
Re: Pop Ups - Vundo.GN
At startup getting a window with:
docmgr.exe - Unable to Locate Component (This is in the Title bar of the window) Red Circle with white X = This application has failed to start because detoured.dll was not found. Re-installing the application may fix this problem. |
|
|
|
|
01-04-2008, 09:38 AM
|
#20 (permalink) |
|
Analyst/Security Team Hen
Join Date: Mar 2007
Posts: 899
OS: XP and Vista
|
Re: Pop Ups - Vundo.GN
Please download FileFind
Right-click and select: Extract all Follow the prompts Save to the Desktop. To run FileFind, please do the following: Click on FileFind.exe In: Directory, the following should show: C:\ In: File, enter: detoured.dll Click on the Search button Once the utility has found the file click on: Export This saves a text file to your C:\ drive as: Export.txt Copy and paste the Export.txt in your reply. ~~~~ Also, there is a new version of ComboFix. Please remove ComboFix and the C:\ComboFix folder, and download the new version: ComboFix Save to the Desktop <<< Important!! Double-click combofix.exe to run the program Follow the prompts. (Don't click on the window while the program is running, it may cause your system to stall.) When finished, a log, ComboFix.txt, is produced. ~~~~ Please post the new ComboFix.txt in your reply.
__________________
Last edited by Aaflac; 01-04-2008 at 10:01 AM. |
|
|
|
| Thread Tools | |
|
|
