|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
03-18-2008, 09:07 AM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Constant pop-ups - Virtumonde
This has been happening now for a few days. When I access Internet Explorer, it takes a long time to load a page and as soon as it is done a pop up happens. The pop ups are mostly something about my computer has been attacked and to click here to fix but there are some porn sites and others. At first I used Spybot Search and Destroy and it showed that I had a Smitfraud.C of which I thought Spybot had taken care of but the next scan revealed that it had Virtumonde and every scan revealed that. Then I stumbled upon this website. Here is the log that it said to get in the before you post from the Panda online scanner... actually it is an attachment (Panda.txt) as it made my post too long.
This is the main.txt that came from the Deckard System Scanner: Deckard's System Scanner v20071014.68 Run by administrator on 2008-03-18 07:51:25 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as administrator.exe) --------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 7:51:51 AM, on 3/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\TriActive\MicroAgent\bin\ma.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UltraVNC\WinVNC.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\UPS\WSTD\UPSNA1Msgr.exe C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\Rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\UPS\WSTD\WSTDMessaging.exe C:\temp\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\administrator.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: {735f43a2-94fa-7c8b-2e94-0e30ba43aab7} - {7baa34ab-03e0-49e2-b8c7-af492a34f537} - C:\WINDOWS\system32\abrpisre.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll O2 - BHO: (no name) - {DCF82803-5777-4563-A2C8-B82D1A2FF9F7} - C:\WINDOWS\system32\pmnlm.dll O2 - BHO: (no name) - {E9383002-FC55-4330-B9C9-67E03BC5C840} - C:\WINDOWS\system32\yayxwut.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe O4 - HKLM\..\Run: [matray] C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe O4 - HKLM\..\Run: [88c173ab] rundll32.exe "C:\WINDOWS\system32\uruukqcr.dll",b O4 - HKLM\..\Run: [BM8bf24037] Rundll32.exe "C:\WINDOWS\system32\lktxhvix.dll",s O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-21-2862767139-1280451873-2731968677-1414\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'scoordinator') O4 - HKUS\S-1-5-21-2862767139-1280451873-2731968677-1414\..\Run: [BM8bf24037] Rundll32.exe "C:\WINDOWS\system32\lktxhvix.dll",s (User 'scoordinator') O4 - HKUS\S-1-5-21-2862767139-1280451873-2731968677-1414\..\Run: [88c173ab] rundll32.exe "C:\WINDOWS\system32\uruukqcr.dll",b (User 'scoordinator') O4 - HKUS\S-1-5-21-2862767139-1280451873-2731968677-1414\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'scoordinator') O4 - HKUS\S-1-5-21-2862767139-1280451873-2731968677-1414\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'scoordinator') O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1205771713426 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} - http://qmedia.xlontech.net/100170/sd...ie06041001.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pscipco.local O17 - HKLM\Software\..\Telephony: DomainName = pscipco.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pscipco.local O20 - Winlogon Notify: yayxwut - C:\WINDOWS\SYSTEM32\yayxwut.dll O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MAS 500 Listener (Listener) - Scanco, LLC - C:\Program Files\Sage Software\Sage MAS 500 Client\Managed Applications\Listener.exe O23 - Service: TriActive MicroAgent (MA) - TriActive, Inc. - C:\Program Files\TriActive\MicroAgent\bin\ma.exe O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe -- End of file - 9708 bytes -- Files created between 2008-02-18 and 2008-03-18 ----------------------------- 2008-03-18 07:51:44 0 d-------- C:\Program Files\Trend Micro 2008-03-18 07:09:10 0 d-------- C:\Documents and Settings\TEMP\Application Data\Google 2008-03-18 06:45:27 0 d-------- C:\Documents and Settings\TEMP\Application Data\Real 2008-03-18 06:44:44 0 d--h----- C:\Documents and Settings\TEMP\Templates 2008-03-18 06:44:44 0 dr------- C:\Documents and Settings\TEMP\Start Menu 2008-03-18 06:44:44 0 dr-h----- C:\Documents and Settings\TEMP\SendTo 2008-03-18 06:44:44 0 dr-h----- C:\Documents and Settings\TEMP\Recent 2008-03-18 06:44:44 0 d--h----- C:\Documents and Settings\TEMP\PrintHood 2008-03-18 06:44:44 0 d--h----- C:\Documents and Settings\TEMP\NetHood 2008-03-18 06:44:44 0 dr------- C:\Documents and Settings\TEMP\My Documents 2008-03-18 06:44:44 0 d--h----- C:\Documents and Settings\TEMP\Local Settings 2008-03-18 06:44:44 0 dr------- C:\Documents and Settings\TEMP\Favorites 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Desktop 2008-03-18 06:44:44 0 d--hs---- C:\Documents and Settings\TEMP\Cookies 2008-03-18 06:44:44 0 dr-h----- C:\Documents and Settings\TEMP\Application Data 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Symantec 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Sun 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Sage Software 2008-03-18 06:44:44 0 d---s---- C:\Documents and Settings\TEMP\Application Data\Microsoft 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Identities 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Help 2008-03-18 06:44:44 0 d-------- C:\Documents and Settings\TEMP\Application Data\Adobe 2008-03-18 06:44:43 1048576 --ah----- C:\Documents and Settings\TEMP\NTUSER.DAT 2008-03-17 21:59:20 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-17 21:59:06 0 d-------- C:\Program Files\SpywareBlaster 2008-03-17 14:40:01 0 d-------- C:\WINDOWS\system32\ActiveScan 2008-03-17 11:11:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-03-17 11:01:07 0 d-------- C:\Documents and Settings\scoordinator\Application Data\AdwareAlert 2008-03-17 10:44:32 99392 --a------ C:\WINDOWS\system32\abrpisre.dll 2008-03-17 10:41:14 95296 --a------ C:\WINDOWS\system32\uruukqcr.dll 2008-03-17 10:40:30 93760 --a------ C:\WINDOWS\system32\lktxhvix.dll 2008-03-16 16:33:14 99904 --a------ C:\WINDOWS\system32\lsmdsire.dll 2008-03-16 16:32:40 95296 --a------ C:\WINDOWS\system32\taasrjff.dll 2008-03-15 16:32:53 98368 --a------ C:\WINDOWS\system32\dmfbgsxf.dll 2008-03-15 16:29:50 98368 --a------ C:\WINDOWS\system32\vcamkxdb.dll 2008-03-15 14:31:47 0 d-------- C:\Documents and Settings\doby\Application Data\Real 2008-03-15 14:30:54 0 d--h----- C:\Documents and Settings\doby\Templates 2008-03-15 14:30:54 0 dr------- C:\Documents and Settings\doby\Start Menu 2008-03-15 14:30:54 0 dr-h----- C:\Documents and Settings\doby\SendTo 2008-03-15 14:30:54 0 dr-h----- C:\Documents and Settings\doby\Recent 2008-03-15 14:30:54 0 d--h----- C:\Documents and Settings\doby\PrintHood 2008-03-15 14:30:54 0 d--h----- C:\Documents and Settings\doby\NetHood 2008-03-15 14:30:54 0 dr------- C:\Documents and Settings\doby\My Documents 2008-03-15 14:30:54 0 d--h----- C:\Documents and Settings\doby\Local Settings 2008-03-15 14:30:54 0 dr------- C:\Documents and Settings\doby\Favorites 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Desktop 2008-03-15 14:30:54 0 d--hs---- C:\Documents and Settings\doby\Cookies 2008-03-15 14:30:54 0 dr-h----- C:\Documents and Settings\doby\Application Data 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Symantec 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Sun 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Sage Software 2008-03-15 14:30:54 0 d---s---- C:\Documents and Settings\doby\Application Data\Microsoft 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Identities 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Help 2008-03-15 14:30:54 0 d-------- C:\Documents and Settings\doby\Application Data\Adobe 2008-03-15 14:30:53 786432 --ah----- C:\Documents and Settings\doby\NTUSER.DAT 2008-03-15 11:45:28 2 --a------ C:\Documents and Settings\administrator.PSCIPCO\WSSEMAPHORES.dat 2008-03-14 16:32:54 0 d-------- C:\Program Files\Enigma Software Group 2008-03-14 16:32:47 0 d-------- C:\Documents and Settings\administrator.PSCIPCO\Application Data\Macromedia 2008-03-14 16:31:27 98368 --a------ C:\WINDOWS\system32\rgaycoux.dll 2008-03-14 16:30:15 0 d-------- C:\Documents and Settings\administrator.PSCIPCO\Application Data\Google 2008-03-14 16:26:58 96832 --a------ C:\WINDOWS\system32\nxywiayu.dll 2008-03-14 15:01:30 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-14 14:44:21 0 dr-h----- C:\Documents and Settings\scoordinator\Recent 2008-03-14 14:42:05 0 d-------- C:\Program Files\CCleaner 2008-03-14 06:19:13 94784 --a------ C:\WINDOWS\system32\yxlqyqti.dll 2008-03-14 06:17:06 90688 --a------ C:\WINDOWS\system32\qihvmqsx.dll 2008-03-14 05:20:00 94784 --a------ C:\WINDOWS\system32\xmddmiey.dll 2008-03-14 05:14:51 90688 --a------ C:\WINDOWS\system32\nrwmquij.dll 2008-03-13 13:30:47 0 d-------- C:\Program Files\JavaCore 2008-03-13 13:25:48 0 d-------- C:\Program Files\Temporary 2008-03-13 13:25:48 0 d-------- C:\Program Files\nvcoi 2008-03-13 07:26:03 90176 --a------ C:\WINDOWS\system32\umhptrhu.dll 2008-03-13 05:15:46 93760 --a------ C:\WINDOWS\system32\shnrbbkk.dll 2008-03-13 05:13:35 90176 --a------ C:\WINDOWS\system32\kradhjgc.dll 2008-03-12 13:20:43 323944 --ahs---- C:\WINDOWS\system32\mlnmp.ini2 2008-03-12 13:20:39 290816 --a------ C:\WINDOWS\system32\pmnlm.dll 2008-03-12 13:18:04 37376 --a------ C:\WINDOWS\system32\ddccywu.dll 2008-03-12 13:15:13 37376 --a------ C:\WINDOWS\system32\yayxwut.dll 2008-02-28 18:11:00 0 d-------- C:\Program Files\TriActive 2008-02-26 16:26:44 0 d-------- C:\Program Files\Microsoft Analysis Services 2008-02-26 16:26:09 0 d-------- C:\UPS 2008-02-22 08:26:15 0 d-------- C:\Documents and Settings\scoordinator\Application Data\Talkback 2008-02-22 08:25:05 0 --a------ C:\WINDOWS\nsreg.dat 2008-02-22 08:23:25 0 d-------- C:\Program Files\Common Files\xing shared 2008-02-22 08:22:58 0 d-------- C:\Documents and Settings\scoordinator\Application Data\Mozilla -- Find3M Report --------------------------------------------------------------- 2008-03-17 17:57:23 0 d-------- C:\Program Files\UltraVNC 2008-03-17 17:50:32 0 d-------- C:\Program Files\QuickTime 2008-03-17 17:33:09 0 d-------- C:\Program Files\iTunes 2008-03-17 17:31:32 0 d-------- C:\Program Files\Google 2008-03-17 11:11:38 0 d-------- C:\Program Files\Common Files\Adobe 2008-03-14 16:30:14 0 d-------- C:\Documents and Settings\administrator.PSCIPCO\Application Data\Real 2008-02-26 16:29:31 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-02-26 16:29:20 0 d-------- C:\Program Files\Common Files\InstallShield 2008-02-26 16:24:56 0 d-------- C:\Program Files\Common Files 2008-02-22 08:23:10 0 d-------- C:\Program Files\Common Files\Real -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7baa34ab-03e0-49e2-b8c7-af492a34f537}] 03/17/2008 10:44 AM 99392 --a------ C:\WINDOWS\system32\abrpisre.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DCF82803-5777-4563-A2C8-B82D1A2FF9F7}] 03/12/2008 01:20 PM 290816 --a------ C:\WINDOWS\system32\pmnlm.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9383002-FC55-4330-B9C9-67E03BC5C840}] 03/12/2008 01:15 PM 37376 --a------ C:\WINDOWS\system32\yayxwut.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [11/19/2003 04:48 PM] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [07/13/2004 08:10 PM] "WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [08/06/2005 07:45 PM] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [04/27/2007 09:41 AM] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [04/27/2007 11:25 AM] "Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [01/16/2007 09:27 PM] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [02/22/2008 08:22 AM] "NA1Messenger"="C:\UPS\WSTD\UPSNA1Msgr.exe" [12/13/2007 05:53 PM] "matray"="C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe" [02/28/2008 06:11 PM] "88c173ab"="C:\WINDOWS\system32\uruukqcr.dll" [03/17/2008 10:41 AM] "BM8bf24037"="C:\WINDOWS\system32\lktxhvix.dll" [03/17/2008 10:40 AM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [10/13/2004 10:24 AM] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 04:00 AM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [09/17/2007 05:09 AM] [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "TSClientMSIUninstaller"=cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" C:\Documents and Settings\administrator.PSCIPCO\Start Menu\Programs\Startup\ DESKTOP.INI [8/11/2004 4:15:06 PM] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [6/7/2005 1:25:30 PM] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [10/23/2006 1:48:20 AM] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [10/23/2006 12:01:50 AM] DESKTOP.INI [8/11/2004 4:15:06 PM] UPS WorldShip Messaging Utility.lnk - C:\UPS\WSTD\WSTDMessaging.exe [12/13/2007 5:55:54 PM] UPS WorldShip PLD Reminder Utility.lnk - C:\UPS\WSTD\wstdPldReminder.exe [12/12/2007 11:05:04 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"=1 (0x1) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{E9383002-FC55-4330-B9C9-67E03BC5C840}"= C:\WINDOWS\system32\yayxwut.dll [03/12/2008 01:15 PM 37376] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxwut] yayxwut.dll 03/12/2008 01:15 PM 37376 C:\WINDOWS\SYSTEM32\yayxwut.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnlm.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 Pml Driver HPZ12 Net Driver HPZ12 *Newly Created Service* - GUSVC -- End of Deckard's System Scanner: finished at 2008-03-18 07:52:20 ------------ Attached is a copy of the extra.txt as requested. I had a problem loading the HiJack this so I scanned again and it was able to load so these are secondary scans. Thanks, SPG |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
03-19-2008, 08:37 AM
|
#2 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
When looking at it today, I get a pop up from the antivirus (e-trust from CA) that says "The Win32Chisyne.DU was detected in c:\\WINDOWS\SYSTEM32\PMNLM.dll" and it keeps repopping up and repopping up.
|
|
|
|
|
03-19-2008, 08:52 AM
|
#3 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Please visit this webpage for instructions for downloading and running ComboFix:
http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you.  Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-19-2008, 09:48 AM
|
#4 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
Thanks for the response!!
Here is the log from ComboFix: ComboFix 08-03-18.1 - administrator 2008-03-19 9:38:31.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.584 [GMT -6:00] Running from: C:\Documents and Settings\administrator.PSCIPCO\Desktop\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat C:\Program Files\JavaCore C:\Program Files\JavaCore\JavaCore.exe C:\Program Files\JavaCore\UnInstall.exe C:\Program Files\Temporary C:\Program Files\Temporary\InsiDERInst.exe C:\WINDOWS\BM8bf24037.xml C:\WINDOWS\cookies.ini C:\WINDOWS\pskt.ini C:\WINDOWS\system32\abrpisre.dll C:\WINDOWS\system32\atckhamm.dll C:\WINDOWS\system32\ddccywu.dll C:\WINDOWS\system32\dmfbgsxf.dll C:\WINDOWS\system32\drivers\fad.sys C:\WINDOWS\system32\kradhjgc.dll C:\WINDOWS\system32\lktxhvix.dll C:\WINDOWS\system32\lsmdsire.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\SYSTEM32\mlnmp.ini C:\WINDOWS\SYSTEM32\mlnmp.ini2 C:\WINDOWS\system32\nrwmquij.dll C:\WINDOWS\system32\nxywiayu.dll C:\WINDOWS\system32\qihvmqsx.dll C:\WINDOWS\SYSTEM32\rcqkuuru.ini C:\WINDOWS\system32\rgaycoux.dll C:\WINDOWS\system32\shnrbbkk.dll C:\WINDOWS\system32\taasrjff.dll C:\WINDOWS\system32\umhptrhu.dll C:\WINDOWS\system32\uruukqcr.dll C:\WINDOWS\system32\vcamkxdb.dll C:\WINDOWS\system32\xmddmiey.dll C:\WINDOWS\system32\yayxwut.dll C:\WINDOWS\system32\yxlqyqti.dll ----- BITS: Possible infected sites ----- hxxp://cast . ((((((((((((((((((((((((( Files Created from 2008-02-19 to 2008-03-19 ))))))))))))))))))))))))))))))) . 2008-03-19 09:16 . 2008-03-19 09:15 4,608,744 --a------ C:\temp\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe 2008-03-19 09:16 . 2008-03-19 08:58 1,599,141 --a------ C:\temp\ComboFix.exe 2008-03-18 08:53 . 2006-08-02 12:52 <DIR> d--hs---- C:\Documents and Settings\scoordinator\UserData 2008-03-18 08:53 . 2008-02-22 08:26 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\Talkback 2008-03-18 08:53 . 2008-01-29 07:05 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\Move Networks 2008-03-18 08:53 . 2006-05-31 10:42 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\InterTrust 2008-03-18 08:53 . 2007-05-02 09:30 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\Apple Computer 2008-03-18 08:53 . 2008-03-17 11:01 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\AdwareAlert 2008-03-18 08:42 . 2005-04-29 01:55 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\Symantec 2008-03-18 08:42 . 2007-01-18 12:22 <DIR> d-------- C:\Documents and Settings\scoordinator\Application Data\Sage Software 2008-03-18 07:51 . 2008-03-18 07:51 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-18 07:46 . 2008-03-18 07:46 <DIR> d-------- C:\Deckard 2008-03-18 07:45 . 2008-03-18 07:28 686,630 --a------ C:\temp\dss.exe 2008-03-17 22:05 . 2008-03-17 22:05 <DIR> d-------- C:\temp\ZonedOut 2008-03-17 22:04 . 2008-03-17 22:04 240,904 --a------ C:\temp\ZonedOut.zip 2008-03-17 21:59 . 2008-03-17 21:59 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-03-17 21:59 . 2008-03-17 21:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-17 14:40 . 2008-03-17 19:07 <DIR> d-------- C:\WINDOWS\SYSTEM32\ActiveScan 2008-03-17 14:40 . 2008-03-17 14:40 30,590 --a------ C:\WINDOWS\SYSTEM32\pavas.ico 2008-03-17 14:40 . 2008-03-17 14:40 2,550 --a------ C:\WINDOWS\SYSTEM32\Uninstall.ico 2008-03-17 14:40 . 2008-03-17 14:40 1,406 --a------ C:\WINDOWS\SYSTEM32\Help.ico 2008-03-17 13:55 . 2008-03-17 14:04 1,374 --a------ C:\WINDOWS\imsins.BAK 2008-03-17 11:03 . 2007-04-11 11:29 21,822,168 --a------ C:\temp\AdbeRdr80_en_US.exe 2008-03-17 10:38 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll.mui 2008-03-16 16:33 . 2008-03-17 08:20 1,352,289 --ahs---- C:\WINDOWS\SYSTEM32\elekoayu.ini 2008-03-15 16:30 . 2008-03-16 16:30 1,352,109 --ahs---- C:\WINDOWS\SYSTEM32\xvrecckx.ini 2008-03-15 11:45 . 2008-03-15 11:45 2 --a------ C:\Documents and Settings\administrator.PSCIPCO\WSSEMAPHORES.dat 2008-03-14 16:32 . 2008-03-14 16:32 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-03-14 16:28 . 2008-03-15 15:37 1,352,049 --ahs---- C:\WINDOWS\SYSTEM32\mjerpgwu.ini 2008-03-14 16:12 . 2008-03-14 16:13 127 --a------ C:\WINDOWS\wininit.ini 2008-03-14 15:01 . 2008-03-17 11:50 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-03-14 15:01 . 2008-03-17 11:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-14 14:42 . 2008-03-14 14:42 <DIR> d-------- C:\Program Files\CCleaner 2008-03-14 14:41 . 2008-03-14 14:41 <DIR> d-------- C:\temp\Crap Cleaner 2008-03-14 06:22 . 2008-03-14 16:26 1,351,629 --ahs---- C:\WINDOWS\SYSTEM32\slpibria.ini 2008-03-14 05:17 . 2008-03-14 05:17 1,351,095 --ahs---- C:\WINDOWS\SYSTEM32\bochjixj.ini 2008-03-13 13:36 . 2008-03-13 13:36 74,112 --a------ C:\WINDOWS\B154.EXE.BIN.0.AVB 2008-03-13 13:25 . 2008-03-13 13:25 <DIR> d-------- C:\Program Files\nvcoi 2008-03-13 05:14 . 2008-03-14 05:08 1,343,315 --ahs---- C:\WINDOWS\SYSTEM32\anlwidjm.ini 2008-02-28 18:11 . 2008-02-28 18:11 <DIR> d-------- C:\Program Files\TriActive 2008-02-26 16:30 . 2008-02-26 16:30 162 --a------ C:\WINDOWS\wstdUPSWSHIP.INI 2008-02-26 16:26 . 2008-02-26 16:26 <DIR> d-------- C:\UPS 2008-02-26 16:26 . 2008-02-26 16:26 <DIR> d-------- C:\Program Files\Microsoft Analysis Services 2008-02-26 16:24 . 2008-02-26 16:24 2,290 --a------ C:\WINDOWS\SYSTEM32\msrCheckResult.xml 2008-02-22 08:25 . 2008-02-22 08:25 0 --a------ C:\WINDOWS\nsreg.dat 2008-02-22 08:23 . 2008-02-22 08:23 <DIR> d-------- C:\Program Files\Common Files\xing shared . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-17 23:57 --------- d-----w C:\Program Files\UltraVNC 2008-03-17 23:50 --------- d-----w C:\Program Files\QuickTime 2008-03-17 23:33 --------- d-----w C:\Program Files\iTunes 2008-03-17 23:31 --------- d-----w C:\Program Files\Google 2008-03-17 17:11 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-26 22:29 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-26 22:29 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-02-22 14:23 --------- d-----w C:\Program Files\Common Files\Real 2007-01-22 18:05 77,576 ----a-w C:\Documents and Settings\rparry\Application Data\GDIPFONTCACHEV1.DAT 2005-09-08 06:59 77,304 ----a-w C:\Documents and Settings\jfillmore\Application Data\GDIPFONTCACHEV1.DAT 2005-01-26 21:16 62,024 ----a-w C:\Documents and Settings\DDOWNEY\Application Data\GDIPFONTCACHEV1.DAT 2004-09-23 17:26 61,248 ----a-w C:\Documents and Settings\rhanks\Application Data\GDIPFONTCACHEV1.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E652E436-D160-48BF-8E64-2FD6AC2353FF}] C:\WINDOWS\system32\pmnlm.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 04:00 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-17 05:09 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 16:48 32881] "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-07-13 20:10 339968] "WinVNC"="C:\Program Files\UltraVNC\WinVNC.exe" [2005-08-06 19:45 974848] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41 282624] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-04-27 11:25 257088] "Realtime Monitor"="C:\Program Files\CA\eTrustITM\realmon.exe" [2007-01-16 21:27 407632] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-22 08:22 185896] "NA1Messenger"="C:\UPS\WSTD\UPSNA1Msgr.exe" [2007-12-13 17:53 20480] "matray"="C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe" [2008-02-28 18:11 221184] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "TSClientMSIUninstaller"="cmd.exe" [2004-08-04 04:00 388608 C:\WINDOWS\SYSTEM32\CMD.EXE] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe [2005-06-07 13:25:30 82026] Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048] Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872] UPS WorldShip Messaging Utility.lnk - C:\UPS\WSTD\WSTDMessaging.exe [2007-12-13 17:55:54 65536] UPS WorldShip PLD Reminder Utility.lnk - C:\UPS\WSTD\wstdPldReminder.exe [2007-12-12 23:05:04 31744] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoWelcomeScreen"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\yayxwut] yayxwut.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Windows Media Player\\wmplayer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R2 MA;TriActive MicroAgent;"C:\Program Files\TriActive\MicroAgent\bin\ma.exe" [2008-02-28 18:11] S3 Listener;MAS 500 Listener;"C:\Program Files\Sage Software\Sage MAS 500 Client\Managed Applications\Listener.exe" [2007-03-16 15:57] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 . Contents of the 'Scheduled Tasks' folder "2008-03-19 09:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job" - C:\Program Files\AdwareAlert\AdwareAlert.ex - C:\Program Files\AdwareAlert "2008-03-19 01:58:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-19 09:44:18 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************** . Completion time: 2008-03-19 9:45:47 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-19 15:45:44 . 2008-03-18 11:20:59 --- E O F --- Here is the log from HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 09:48, on 2008-03-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\TriActive\MicroAgent\bin\ma.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UltraVNC\WinVNC.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\CA\eTrustITM\realmon.exe C:\UPS\WSTD\UPSNA1Msgr.exe C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\UPS\WSTD\WSTDMessaging.exe C:\WINDOWS\explorer.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll O2 - BHO: (no name) - {E652E436-D160-48BF-8E64-2FD6AC2353FF} - C:\WINDOWS\system32\pmnlm.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe O4 - HKLM\..\Run: [matray] C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1205771713426 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} - http://qmedia.xlontech.net/100170/sd...ie06041001.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pscipco.local O17 - HKLM\Software\..\Telephony: DomainName = pscipco.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pscipco.local O20 - Winlogon Notify: yayxwut - yayxwut.dll (file missing) O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MAS 500 Listener (Listener) - Scanco, LLC - C:\Program Files\Sage Software\Sage MAS 500 Client\Managed Applications\Listener.exe O23 - Service: TriActive MicroAgent (MA) - TriActive, Inc. - C:\Program Files\TriActive\MicroAgent\bin\ma.exe O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe -- End of file - 8530 bytes Standing by for next set of instructions. Thanks again! |
|
|
|
|
03-19-2008, 09:58 AM
|
#5 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Please go to: VirusTotal
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-19-2008, 10:06 AM
|
#6 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
Thanks for the prompt reply!!
Here is the requested information. File b154.exe.bin received on 03.12.2008 07:24:21 (CET) Current status: finished Result: 19/32 (59.38%) Compact Print results Antivirus Version Last Update Result AhnLab-V3 2008.3.12.0 2008.03.12 - AntiVir 7.6.0.73 2008.03.11 TR/Matcash.DLN Authentium 4.93.8 2008.03.11 - Avast 4.7.1098.0 2008.03.11 - AVG 7.5.0.516 2008.03.11 Downloader.Generic6.AKIR BitDefender 7.2 2008.03.12 Trojan.Matcash.DLN CAT-QuickHeal 9.50 2008.03.10 TrojanDownloader.Agent.kha ClamAV 0.92.1 2008.03.11 - DrWeb 4.44.0.09170 2008.03.11 - eSafe 7.0.15.0 2008.03.09 - eTrust-Vet 31.3.5607 2008.03.11 Win32/VMalum.BXTD Ewido 4.0 2008.03.11 Downloader.Agent.kha FileAdvisor 1 2008.03.12 - Fortinet 3.14.0.0 2008.03.12 W32/BCF!tr.dldr F-Prot 4.4.2.54 2008.03.11 - F-Secure 6.70.13260.0 2008.03.12 Trojan-Downloader.Win32.Agent.kha Ikarus T3.1.1.20 2008.03.12 Trojan.Matcash.DLN Kaspersky 7.0.0.125 2008.03.12 Trojan-Downloader.Win32.Agent.kha McAfee 5249 2008.03.11 Downloader-BCF Microsoft 1.3301 2008.03.12 Trojan:Win32/Matcash.KU NOD32v2 2939 2008.03.12 - Norman 5.80.02 2008.03.11 W32/DLoader.FQHO Panda 9.0.0.4 2008.03.12 - Prevx1 V2 2008.03.12 Trojan.Downloader Rising 20.35.12.00 2008.03.11 - Sophos 4.27.0 2008.03.12 Mal/Generic-A Sunbelt 3.0.930.0 2008.03.05 Trojan-Downloader.Matcash Symantec 10 2008.03.12 Downloader TheHacker 6.2.92.243 2008.03.12 - VBA32 3.12.6.2 2008.03.05 suspected of Win32.Trojan.Downloader (http://...) VirusBuster 4.3.26:9 2008.03.11 - Webwasher-Gateway 6.6.2 2008.03.11 Trojan.Matcash.DLN Additional information File size: 74112 bytes MD5: 6edb5b6d6af87ae0b1028651b9c1667e SHA1: ab7492a7a9fdd152c22ae04523b71a8db5007f36 PEiD: - Prevx info: http://info.prevx.com/aboutprogramte...2EF400887BF7E3 Standing By! |
|
|
|
|
03-19-2008, 10:12 AM
|
#7 (permalink) | |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Next steps....
Open notepad and copy/paste the text in the quotebox below into it: Quote:
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. ---------------------------------------------------------------------------------------------
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
|
03-19-2008, 10:25 AM
|
#8 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
I submitted the file (the website said to let you know).
Below is the log from HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:26, on 2008-03-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\TriActive\MicroAgent\bin\ma.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\zstatus.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\CA\eTrustITM\realmon.exe C:\UPS\WSTD\UPSNA1Msgr.exe C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\UPS\WSTD\WSTDMessaging.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe O4 - HKLM\..\Run: [matray] C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1205771713426 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} - http://qmedia.xlontech.net/100170/sd...ie06041001.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pscipco.local O17 - HKLM\Software\..\Telephony: DomainName = pscipco.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pscipco.local O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MAS 500 Listener (Listener) - Scanco, LLC - C:\Program Files\Sage Software\Sage MAS 500 Client\Managed Applications\Listener.exe O23 - Service: TriActive MicroAgent (MA) - TriActive, Inc. - C:\Program Files\TriActive\MicroAgent\bin\ma.exe O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe -- End of file - 8299 bytes |
|
|
|
|
03-19-2008, 10:31 AM
|
#9 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Thanks for uploading the file. You can delete it from your desktop.
Next steps.... Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only
For Technical Support, double-click the e-mail address located at the bottom of each menu. --------------------------------------------------------------------------------------------- Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
--------------------------------------------------------------------------------------------- Please run this online scan to help look for remnants. First, Go to Start>Control Panel>Add/Remove Programs and remove Kaspersky online scanner if present prior to downloading the most up-to-date one. Next, establish an internet connection & perform an online scan using Internet Explorer at Kaspersky Online Scanner Answer Yes, when prompted to install an ActiveX component.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. --------------------------------------------------------------------------------------------- Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here. --------------------------------------------------------------------------------------------- How is the machine behaving?
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-19-2008, 11:23 AM
|
#10 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
The Kaspersky scan is taking a long time to download so I will run that and post what you requested when done.
The machine is acting more like it is supposed to. The pop ups have stopped and it has been faster since the first help you have given me. Thank you very much! I will post what you requested once I am able to. |
|
|
|
|
03-19-2008, 11:37 AM
|
#11 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Sounds good.
Be sure to close all other applications while running the scan. Having open applications can cause it to take more time.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-19-2008, 02:24 PM
|
#12 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 16
OS: XP SP2
|
Re: Constant pop-ups - Virtumonde
Here are the results from the Kaspersky scan:
------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT 2008-03-19 14:25 Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 19/03/2008 Kaspersky Anti-Virus database records: 640648 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 65918 Number of viruses found: 8 Number of infected objects: 62 Number of suspicious objects: 0 Duration of the scan process: 00:40:08 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\administrator.PSCIPCO\Cookies\index.dat Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\Desktop\[4]-Submit_2008-03-19@10.23.zip/B154.EXE.BIN.0.AVB/b154.exe Infected: Trojan-Downloader.Win32.Agent.kha skipped C:\Documents and Settings\administrator.PSCIPCO\Desktop\[4]-Submit_2008-03-19@10.23.zip/B154.EXE.BIN.0.AVB Infected: Trojan-Downloader.Win32.Agent.kha skipped C:\Documents and Settings\administrator.PSCIPCO\Desktop\[4]-Submit_2008-03-19@10.23.zip ZIP: infected - 2 skipped C:\Documents and Settings\administrator.PSCIPCO\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\NTUSER.DAT Object is locked skipped C:\Documents and Settings\administrator.PSCIPCO\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\CA\eTrustITM\DB\rtmaster.dbf Object is locked skipped C:\Program Files\CA\eTrustITM\DB\rtmaster.ntx Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\master.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\mastlog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\model.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\modellog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\tempdb.mdf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Data\templog.ldf Object is locked skipped C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\LOG\ERRORLOG Object is locked skipped C:\Program Files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped C:\Program Files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped C:\QooBox\Quarantine\C\Program Files\JavaCore\JavaCore.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.c skipped C:\QooBox\Quarantine\C\Program Files\Temporary\InsiDERInst.exe.vir Infected: not-a-virus:AdWare.Win32.Insider.d skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\abrpisre.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\ddccywu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\dmfbgsxf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\kradhjgc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lktxhvix.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\lsmdsire.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nrwmquij.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\nxywiayu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\qihvmqsx.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\rgaycoux.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\shnrbbkk.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\taasrjff.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\umhptrhu.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\uruukqcr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\vcamkxdb.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\xmddmiey.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\C\WINDOWS\SYSTEM32\yxlqyqti.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-03-19_ 94358.52.zip/yayxwut.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-03-19_ 94358.52.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP841\A0053389.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0053486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0053487.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0053488.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0053489.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0054778.exe Infected: not-a-virus:AdWare.Win32.Insider.c skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0054779.exe Infected: not-a-virus:AdWare.Win32.Insider.d skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP843\A0054780.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP844\A0054821.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP850\A0055891.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP850\A0055892.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP850\A0055893.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP853\A0056581.exe/stream/data0002 Infected: Trojan-Downloader.Win32.Small.buy skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP853\A0056581.exe/stream/data0004 Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP853\A0056581.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.u skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP853\A0056581.exe NSIS: infected - 3 skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP855\A0058776.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058830.exe Infected: not-a-virus:AdWare.Win32.Insider.c skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058832.exe Infected: not-a-virus:AdWare.Win32.Insider.d skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058835.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058837.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058838.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058839.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058840.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058841.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058842.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058843.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058844.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058845.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058846.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058847.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058848.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058849.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058850.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058851.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP857\A0058852.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP860\change.log Object is locked skipped C:\WINDOWS\CSC\00000001 Object is locked skipped C:\WINDOWS\Debug\Netlogon.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Sage MAS.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\FP00001.SHD Object is locked skipped C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\FP00001.SPL Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\hsperfdata_SYSTEM\1580 Object is locked skipped C:\WINDOWS\Temp\Perflib_Perfdata_75c.dat Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed. Here are the results from the latest HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:25, on 2008-03-19 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\basfipm.exe C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe C:\Program Files\CA\eTrustITM\InoRpc.exe C:\Program Files\CA\eTrustITM\InoRT.exe C:\Program Files\CA\eTrustITM\InoTask.exe C:\Program Files\TriActive\MicroAgent\bin\ma.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UltraVNC\WinVNC.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\CA\eTrustITM\realmon.exe C:\UPS\WSTD\UPSNA1Msgr.exe C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe C:\Program Files\iPod\bin\iPodService.exe C:\UPS\WSTD\WSTDMessaging.exe C:\WINDOWS\system32\zstatus.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\UltraVNC\WinVNC.exe" -servicehelper O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Realtime Monitor] "C:\Program Files\CA\eTrustITM\realmon.exe" -s O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [NA1Messenger] C:\UPS\WSTD\UPSNA1Msgr.exe O4 - HKLM\..\Run: [matray] C:\Program Files\TriActive\MicroAgent\bin\matray-2.0.21.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user') O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: UPS WorldShip Messaging Utility.lnk = C:\UPS\WSTD\WSTDMessaging.exe O4 - Global Startup: UPS WorldShip PLD Reminder Utility.lnk = C:\UPS\WSTD\wstdPldReminder.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1205771713426 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx O16 - DPF: {E3E02F12-2ADB-478C-8742-5F0819F9F0F4} - http://qmedia.xlontech.net/100170/sd...ie06041001.cab O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = pscipco.local O17 - HKLM\Software\..\Telephony: DomainName = pscipco.local O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = pscipco.local O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing) O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINDOWS\system32\basfipm.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iTechnology iGateway 4.2 (iGateway) - CA, Inc. - C:\Program Files\CA\SharedComponents\iTechnology\igateway.exe O23 - Service: eTrust ITM RPC Service (InoRPC) - CA - C:\Program Files\CA\eTrustITM\InoRpc.exe O23 - Service: eTrust Antivirus Realtime Service (InoRT) - CA - C:\Program Files\CA\eTrustITM\InoRT.exe O23 - Service: eTrust ITM Job Service (InoTask) - CA - C:\Program Files\CA\eTrustITM\InoTask.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: MAS 500 Listener (Listener) - Scanco, LLC - C:\Program Files\Sage Software\Sage MAS 500 Client\Managed Applications\Listener.exe O23 - Service: TriActive MicroAgent (MA) - TriActive, Inc. - C:\Program Files\TriActive\MicroAgent\bin\ma.exe O23 - Service: VNC Server (winvnc) - UltraVNC - C:\Program Files\UltraVNC\WinVNC.exe -- End of file - 8448 bytes Thanks and will be standing by. |
|
|
|
|
03-19-2008, 02:29 PM
|
#13 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
Please delete this file from your desktop
"C:\Documents and Settings\administrator.PSCIPCO\Desktop\[4]-Submit_2008-03-19@10.23.zip" The other finds by Kaspersky will be addressed by uninstalling ComboFix using the instructions below. Your logs appear clean.You should be good to go. We still have a few items to address. Go to  -> Run -> copy/paste in the following single line command & click OKcombofix /u  This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points. Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:
Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer Here are some additional utilities that will further enhance your safety.
In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles If you want to fight back the Malware Writers that have made your life a misery, please take a look here and read what you can do against it. Please respond to this thread one more time so we can mark this thread as resolved.
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
|
03-19-2008, 02:51 PM
|
#15 (permalink) |
|
Manager, Security Center, TSF Academy; Analyst, Security Team
Join Date: Jan 2005
Location: Transylvania County, North Carolina, USA
Posts: 35,734
OS: 2000 Pro; XP Pro; XP Home
|
Re: Constant pop-ups - Virtumonde
You're quite welcome for the help.
Surf Safely! 
__________________
Practice Safe Surfing Because what you don't know, CAN hurt you. Microsoft MVP - Consumer Security 2009
|
|
|
|
| Thread Tools | |
|
|
