|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
03-22-2008, 10:20 PM
|
#1 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 5
OS: xp sp2
|
Trojan.Vundo/Metajuan infection
I've been having trouble removing the Vundo trojan for the last month or so. It hasn't been critically important as it really hasn't caused much damage from what I can tell. Seems to be contained but still gives popups to my vestigial IE, as well when i login to Windows it get the notice saying something about how "epxtsas.dll" could not be found or something similar. Norton continually finds threats, "fixes" them, and I move on. But it never seems to totally go away. Here is my Hijackthis log. Thanks in advance:
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:11:17 PM, on 3/22/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\NAVW32.EXE C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\ctfmon.exe C:\QUICKENW\QWDLLS.EXE C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloads.yahoo.com/internetexplorer/welcome R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [a04897ec] rundll32.exe "C:\WINDOWS\system32\ovisjfhb.dll",b O4 - HKLM\..\Run: [BMa37ba470] Rundll32.exe "C:\WINDOWS\system32\epxtslas.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKUS\S-1-5-21-842925246-884357618-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'David') O4 - HKUS\S-1-5-21-842925246-884357618-839522115-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'David') O4 - HKUS\S-1-5-21-842925246-884357618-839522115-1003\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'David') O4 - HKUS\S-1-5-21-842925246-884357618-839522115-1003\..\Run: [Orb] C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe (User 'David') O4 - S-1-5-21-842925246-884357618-839522115-1003 Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (User 'David') O4 - S-1-5-21-842925246-884357618-839522115-1003 User Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe (User 'David') O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...37/mcfscan.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 10943 bytes |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
03-26-2008, 05:48 AM
|
#2 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04
|
Re: Trojan.Vundo/Metajuan infection
Hi parkerfutbol3
I apologize for the delay getting to your log. The helpers here are all volunteers and we have been very busy here lately. If you are still having malware problems, I will be glad to help. Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. For Windows 2000, you will need your Windows 2000 installation CD. Follow the instructions here: http://support.microsoft.com/kb/216417 Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding. ================= In your next post, please include fresh logs from:
|
|
|
|
|
03-26-2008, 11:42 AM
|
#3 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 5
OS: xp sp2
|
Re: Trojan.Vundo/Metajuan infection
OK here are my fresh HijackThis and ComboFix logs:
HijackThis Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:41:05 AM, on 3/26/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\stsystra.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\Program Files\Logitech\QuickCam\Quickcam.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\QUICKENW\QWDLLS.EXE C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\WINDOWS\explorer.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloads.yahoo.com/internetexplorer/welcome R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: (no name) - {056C066F-F621-4E28-B92D-2DBAD1FF346C} - C:\WINDOWS\system32\pmnll.dll (file missing) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {16AFDD49-549D-4A24-9B81-48B820AC0797} - C:\WINDOWS\system32\ddaba.dll (file missing) O2 - BHO: (no name) - {283A02CB-BE91-4D3F-A5E8-4C07A788107F} - C:\WINDOWS\system32\jkhfe.dll (file missing) O2 - BHO: {adf27b15-c7fb-3cfb-31c4-13501dc58892} - {29885cd1-0531-4c13-bfc3-bf7c51b72fda} - C:\WINDOWS\system32\vijsuonc.dll (file missing) O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: {56bbb1c9-b0f1-f8cb-6884-2cc1249b4c0e} - {e0c4b942-1cc2-4886-bc8f-1f0b9c1bbb65} - C:\WINDOWS\system32\jvdcwesf.dll (file missing) O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKLM\..\Run: [BMa37ba470] Rundll32.exe "C:\WINDOWS\system32\epxtslas.dll",s O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...37/mcfscan.cab O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll O20 - Winlogon Notify: jkkljki - jkkljki.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 11294 bytes and here is the Combofix log ComboFix 08-03-25.4 - Boys 2008-03-26 9:45:21.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.521 [GMT -7:00] Running from: C:\Documents and Settings\Boys\Desktop\ComboFix.exe . -- Script messages for sUBs -- MTEE /+ d-delA.dat Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement" GREP -Eisf temp00 VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll" ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMa37ba470.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\abadd.ini C:\WINDOWS\system32\abadd.ini2 C:\WINDOWS\system32\awtss.dll C:\WINDOWS\system32\kmllm.ini C:\WINDOWS\system32\kmllm.ini2 C:\WINDOWS\system32\llnmp.ini C:\WINDOWS\system32\llnmp.ini2 C:\WINDOWS\system32\mllmk.dll C:\WINDOWS\system32\orutv.ini C:\WINDOWS\system32\orutv.ini2 C:\WINDOWS\system32\sstwa.ini C:\WINDOWS\system32\sstwa.ini2 C:\WINDOWS\system32\vycdd.ini C:\WINDOWS\system32\vycdd.ini2 C:\WINDOWS\system32\wyadd.ini C:\WINDOWS\system32\wyadd.ini2 H:\Autorun.inf . ((((((((((((((((((((((((( Files Created from 2008-02-26 to 2008-03-26 ))))))))))))))))))))))))))))))) . 2008-03-22 22:12 . 2008-03-22 22:12 57,312 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-03-22 22:05 . 2008-03-22 22:05 <DIR> d-------- C:\Program Files\Safari 2008-03-22 21:06 . 2008-03-22 21:06 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-12 18:44 . 2008-03-12 21:57 <DIR> d-------- C:\Documents and Settings\David\Application Data\U3 2008-03-12 03:01 . 2008-03-12 03:01 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-03-11 22:38 . 2007-10-11 18:57 195,096 --a------ C:\WINDOWS\system32\lvci1150.dll 2008-03-11 22:38 . 2008-03-26 10:29 0 --a------ C:\WINDOWS\system32\drivers\logiflt.iad 2008-03-11 22:36 . 2008-03-11 22:36 <DIR> d-------- C:\Program Files\Logitech 2008-03-09 19:58 . 2008-03-09 19:09 294 ---hs---- C:\WINDOWS\system32\ubpiecyp.ini 2008-03-09 19:13 . 2008-03-22 21:15 834 ---hs---- C:\WINDOWS\system32\bhfjsivo.ini 2008-03-01 17:50 . 2008-03-01 18:59 <DIR> d-------- C:\Program Files\EsetOnlineScanner 2008-03-01 17:39 . 2008-03-04 18:19 1,194 ---hs---- C:\WINDOWS\system32\jaxhsdru.ini 2008-03-01 17:15 . 2008-03-01 17:15 632 --a------ C:\WINDOWS\eReg.dat 2008-03-01 08:33 . 2008-03-01 17:24 714 ---hs---- C:\WINDOWS\system32\cofciweh.ini 2008-02-29 08:33 . 2008-02-29 17:00 414 ---hs---- C:\WINDOWS\system32\qeyvomxn.ini 2008-02-28 08:36 . 2008-02-28 08:36 354 ---hs---- C:\WINDOWS\system32\nlieeyvu.ini 2008-02-27 08:33 . 2008-02-28 08:33 294 ---hs---- C:\WINDOWS\system32\ihrvdmru.ini 2008-02-26 20:12 . 2008-02-26 20:12 <DIR> d-------- C:\Program Files\iPod 2008-02-26 08:34 . 2008-02-26 20:08 774 ---hs---- C:\WINDOWS\system32\hfwyxsrg.ini . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-26 17:29 0 ----a-w C:\WINDOWS\system32\drivers\lvuvc.hs 2008-03-26 17:17 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-23 05:07 --------- d-----w C:\Documents and Settings\Boys\Application Data\Apple Computer 2008-03-22 22:24 --------- d-----w C:\Program Files\Norton Internet Security 2008-03-12 05:39 --------- d-----w C:\Program Files\Common Files\LogiShrd 2008-03-12 05:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\LogiShrd 2008-03-02 00:09 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-02 00:09 --------- d-----w C:\Program Files\EA GAMES 2008-03-02 00:08 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-02 00:07 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 3 2008-02-28 16:28 --------- d-----w C:\Documents and Settings\Boys\Application Data\uTorrent 2008-02-27 06:27 --------- d-----w C:\Program Files\Unlocker 2008-02-27 06:27 --------- d-----w C:\Program Files\Eusing Free Registry Cleaner 2008-02-27 06:25 --------- d-----w C:\Program Files\Orb Networks 2008-02-27 03:12 --------- d-----w C:\Program Files\iTunes 2008-02-26 06:31 --------- d-----w C:\Program Files\Chikka 2008-02-20 05:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7 2008-02-20 00:25 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2008-02-20 00:22 3,072 ----a-w C:\WINDOWS\system32\drivers\kgpfr.cfg 2008-02-20 00:22 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard 2008-02-20 00:21 --------- d-----w C:\Program Files\Common Files\iS3 2008-02-16 02:15 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2008-02-16 02:15 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-16 01:45 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2008-02-16 01:44 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-12 23:53 --------- d-----w C:\Program Files\Lavasoft 2008-02-12 23:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft 2008-02-12 23:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-10 17:32 --------- d-----w C:\Documents and Settings\Boys\Application Data\Yahoo! 2008-02-09 17:25 --------- d-----w C:\Documents and Settings\David\Application Data\Yahoo! 2008-02-09 08:48 --------- d-----w C:\Program Files\Counter-Strike Source 2008-02-09 04:32 --------- d-----w C:\Program Files\Macromedia 2008-02-09 04:32 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-02-09 01:59 --------- d-----w C:\Documents and Settings\David\Application Data\Apple Computer 2008-02-08 10:08 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-02-08 08:11 --------- d-----w C:\Program Files\Viewpoint 2008-02-08 04:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logitech 2008-02-08 02:46 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-07 07:29 --------- d-----w C:\Documents and Settings\Boys\Application Data\iTSync 2008-02-07 06:15 --------- d-----w C:\Program Files\Stardock 2008-02-07 06:15 --------- d-----w C:\Program Files\Common Files\Stardock 2008-02-07 05:43 --------- d-----w C:\Program Files\AOD 2008-02-07 05:43 --------- d-----w C:\Program Files\AIM 2008-02-07 05:43 --------- d-----w C:\Documents and Settings\Boys\Application Data\Aim 2008-02-07 05:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint 2008-02-07 03:25 --------- d-----w C:\Program Files\uTorrent 2008-02-07 01:56 --------- d-----w C:\Program Files\Trillian 2008-02-07 01:51 --------- d-----w C:\Program Files\Yahoo! 2008-02-07 01:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! 2008-02-07 01:43 --------- d-----w C:\Program Files\Bonjour 2008-02-07 01:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer 2008-02-07 01:42 --------- d-----w C:\Program Files\QuickTime 2008-02-07 01:42 --------- d-----w C:\Program Files\Common Files\Apple 2008-02-07 01:42 --------- d-----w C:\Program Files\Apple Software Update 2008-02-07 01:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple 2008-02-07 01:36 --------- d-----w C:\Program Files\Neevia.Com 2008-02-07 01:31 --------- d-----w C:\Program Files\Wide Angle Software 2008-02-07 00:53 --------- d-----w C:\Program Files\InterActual 2008-02-07 00:53 --------- d-----w C:\Program Files\Dell 2008-02-07 00:53 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-02-07 00:53 --------- d-----w C:\Program Files\Common Files\Roxio Shared 2008-02-07 00:42 --------- d-----w C:\Program Files\Intuit 2008-02-06 06:39 --------- d-----w C:\Documents and Settings\Boys\Application Data\Symantec 2008-02-06 06:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion 2008-02-06 06:00 --------- d-----w C:\Program Files\Microsoft Works 2008-02-06 06:00 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-02-06 06:00 --------- d-----w C:\Program Files\Common Files\L&H 2008-02-06 05:42 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-02-06 05:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-02-06 05:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-02-06 05:35 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-02-06 05:35 --------- d-----w C:\Program Files\Symantec 2008-02-06 05:22 --------- d-----w C:\Documents and Settings\David\Application Data\Symantec 2008-02-06 05:22 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec 2008-02-06 05:18 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys 2008-02-06 04:51 --------- d-----w C:\Program Files\SigmaTel 2008-02-06 04:48 --------- d-----w C:\Program Files\Citrix 2008-02-06 04:48 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Citrix 2008-02-06 04:41 --------- d-----w C:\Program Files\Intel 2008-02-06 04:40 5 ----a-w C:\WINDOWS\system32\drivers\DELL_XPS_Dell DXP061 .MRK 2008-02-06 04:40 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_XPS_Dell DXP061 .MRK 2008-02-06 04:05 --------- d-----w C:\Program Files\microsoft frontpage 2006-10-03 10:43 2,402,550 ----a-w C:\WINDOWS\inf\SET138.tmp 2004-08-04 10:00 1,431,144 ----a-w C:\WINDOWS\inf\SET1BC.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{056C066F-F621-4E28-B92D-2DBAD1FF346C}] C:\WINDOWS\system32\pmnll.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{16AFDD49-549D-4A24-9B81-48B820AC0797}] C:\WINDOWS\system32\ddaba.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{283A02CB-BE91-4D3F-A5E8-4C07A788107F}] C:\WINDOWS\system32\jkhfe.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29885cd1-0531-4c13-bfc3-bf7c51b72fda}] C:\WINDOWS\system32\vijsuonc.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e0c4b942-1cc2-4886-bc8f-1f0b9c1bbb65}] C:\WINDOWS\system32\jvdcwesf.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 17:00 282624 C:\WINDOWS\stsystra.exe] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 18:22 53096] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 04:12 94208] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [ ] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-16 12:39 7323648] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832] "BMa37ba470"="C:\WINDOWS\system32\epxtslas.dll" [ ] C:\Documents and Settings\David\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-02-06 23:15:50 3450608] C:\Documents and Settings\Boys\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664] Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-02-06 23:15:50 3450608] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Billminder.lnk - C:\QUICKENW\BILLMIND.EXE [2008-02-06 17:42:47 36864] Quicken Startup.lnk - C:\QUICKENW\QWDLLS.EXE [2008-02-06 17:42:56 36864] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll 2008-02-05 21:48 10536 C:\Program Files\Citrix\GoToAssist\508\g2awinlogon.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkljki] jkkljki.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R2 mrtRate;mrtRate;C:\WINDOWS\system32\drivers\mrtRate.sys [1999-08-10 14:51] S3 GoToAssist;GoToAssist;"C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe" Start=service [] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] \Shell\AutoRun\command - H:\wd_windows_tools\WDEULA.exe *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-02-29 16:58:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-01 04:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - David.job" - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exep/TASK: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-26 10:30:20 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe -> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE . ************************************************************************** . Completion time: 2008-03-26 10:34:14 - machine was rebooted ComboFix-quarantined-files.txt 2008-03-26 17:34:11 . 2008-03-12 10:01:43 --- E O F --- Thank you so much for your help! Last edited by tetonbob; 03-26-2008 at 02:05 PM. Reason: removed code tags, they make logs more difficult to review |
|
|
|
|
03-27-2008, 01:16 AM
|
#4 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04
|
Re: Trojan.Vundo/Metajuan infection
Hi parkerfutbol3
Before we go any further with the cleaning process could you please carry out the following instructions. Please download the zip parkerfutbol3.zip file attached to this post and unzip it to your desktop Double click it to run and it will create a zip file _sUBs_.zip on your desk top please attach that in your next post (if it doesn't create a zip there will be a text file on your desk top called ProgFile please attach that in your next post. I will have more instructions for cleaning your system when you have posted again |
|
|
|
|
03-28-2008, 01:37 PM
|
#5 (permalink) |
|
Registered User
Join Date: Mar 2008
Posts: 5
OS: xp sp2
|
Re: Trojan.Vundo/Metajuan infection
OK I ran the last attachment and now am attaching the _subs_.zip file.
Also, when logging in to any of the accounts on my computer i get this error.  Is there anything critical about this or is it just because of the removal of the virus files? It's been happening since before talking with you. Thanks |
|
|
|
|
03-29-2008, 03:31 AM
|
#6 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04
|
Re: Trojan.Vundo/Metajuan infection
Hi parkerfutbol3
The error message is from the infection it should stopp appearing after the next run of cleaning up,  Please read this post completely before begining the fix. If there's anything that you do not understand, kindly ask your questions before proceeding. Please ensure that there aren't any opened browsers when you are carrying out the procedures below. Save the following instructions in Notepad as this webpage would not be available when you're carrying out the fix. IT IS IMPORTANT THAT YOU DON'T MISS A STEP & PERFORM EVERYTHING IN THE RIGHT ORDER. =============================================== 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. =============================================== Open notepad and carefully copy/paste all the text in the code box below into it: Code:
File::
C:\WINDOWS\system32\ubpiecyp.ini
C:\WINDOWS\system32\bhfjsivo.ini
C:\WINDOWS\system32\jaxhsdru.ini
C:\WINDOWS\system32\cofciweh.ini
C:\WINDOWS\system32\qeyvomxn.ini
C:\WINDOWS\system32\nlieeyvu.ini
C:\WINDOWS\system32\ihrvdmru.ini
C:\WINDOWS\system32\hfwyxsrg.ini
C:\WINDOWS\system32\drivers\lvuvc.hs
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{056C066F-F621-4E28-B92D-2DBAD1FF346C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{16AFDD49-549D-4A24-9B81-48B820AC0797}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{283A02CB-BE91-4D3F-A5E8-4C07A788107F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29885cd1-0531-4c13-bfc3-bf7c51b72fda}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{e0c4b942-1cc2-4886-bc8f-1f0b9c1bbb65}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BMa37ba470"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkkljki]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000000
 Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply. Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall Additonally, ComboFix will generate a zipped file on your desktop called Submit [Date Time].zip When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis. Ensure you are connected to the internet and click OK on the message box. A browser will open. Simply follow the instructions to copy/paste/send the requested file. ================================================ Establish an internet connection & perform an online scan with Internet Explorer at one of the following links
Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. ================= Please Run a scan with HiJackThis and save the log ================= In your next post, please include fresh logs from:
|
|
|
|
|
04-01-2008, 09:25 AM
|
#8 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04
|
Re: Trojan.Vundo/Metajuan infection
ComboFix 08-03-25.4 - Boys 2008-03-29 11:27:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.477 [GMT -7:00] Running from: C:\Documents and Settings\Boys\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Boys\Desktop\CFScript.txt * Created a new restore point FILE :: C:\WINDOWS\system32\bhfjsivo.ini C:\WINDOWS\system32\cofciweh.ini C:\WINDOWS\system32\drivers\lvuvc.hs C:\WINDOWS\system32\hfwyxsrg.ini C:\WINDOWS\system32\ihrvdmru.ini C:\WINDOWS\system32\jaxhsdru.ini C:\WINDOWS\system32\nlieeyvu.ini C:\WINDOWS\system32\qeyvomxn.ini C:\WINDOWS\system32\ubpiecyp.ini . -- Script messages for sUBs -- Findstr -MIF:/ "\\TTC\.pdb InsertAdvertisement" GREP -Eisf temp00 VFind -tf -s282624 "C:\Program Files\????????*[0-9].dll" ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\bhfjsivo.ini C:\WINDOWS\system32\cofciweh.ini C:\WINDOWS\system32\drivers\lvuvc.hs C:\WINDOWS\system32\hfwyxsrg.ini C:\WINDOWS\system32\ihrvdmru.ini C:\WINDOWS\system32\jaxhsdru.ini C:\WINDOWS\system32\nlieeyvu.ini C:\WINDOWS\system32\qeyvomxn.ini C:\WINDOWS\system32\tiifstap.dllbox C:\WINDOWS\system32\ubpiecyp.ini . ((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-29 ))))))))))))))))))))))))))))))) . 2008-03-26 11:43 . 2008-03-26 11:43 <DIR> d-------- C:\Program Files\Unity 2008-03-22 22:12 . 2008-03-22 22:12 57,312 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-03-22 22:05 . 2008-03-22 22:05 <DIR> d-------- C:\Program Files\Safari 2008-03-22 21:06 . 2008-03-22 21:06 <DIR> d-------- C:\Program Files\Trend Micro 2008-03-12 18:44 . 2008-03-12 21:57 <DIR> d-------- C:\Documents and Settings\David\Application Data\U3 2008-03-12 03:01 . 2008-03-12 03:01 127 --a------ C:\WINDOWS\system32\MRT.INI 2008-03-11 22:38 . 2007-10-11 18:57 195,096 --a------ C:\WINDOWS\system32\lvci1150.dll 2008-03-11 22:38 . 2008-03-28 12:25 0 --a------ C:\WINDOWS\system32\drivers\logiflt.iad 2008-03-11 22:36 . 2008-03-11 22:36 <DIR> d-------- C:\Program Files\Logitech 2008-03-01 17:50 . 2008-03-01 18:59 <DIR> d-------- C:\Program Files\EsetOnlineScanner 2008-03-01 17:15 . 2008-03-01 17:15 632 --a------ C:\WINDOWS\eReg.dat . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-28 19:31 --------- d-----w C:\Program Files\Norton Internet Security 2008-03-26 17:35 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-03-23 05:07 --------- d-----w C:\Documents and Settings\Boys\Application Data\Apple Computer 2008-03-12 05:39 --------- d-----w C:\Program Files\Common Files\LogiShrd 2008-03-12 05:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\LogiShrd 2008-03-02 00:09 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-03-02 00:09 --------- d-----w C:\Program Files\EA GAMES 2008-03-02 00:08 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-03-02 00:07 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 3 2008-02-28 16:28 --------- d-----w C:\Documents and Settings\Boys\Application Data\uTorrent 2008-02-27 06:27 --------- d-----w C:\Program Files\Unlocker 2008-02-27 06:27 --------- d-----w C:\Program Files\Eusing Free Registry Cleaner 2008-02-27 06:25 --------- d-----w C:\Program Files\Orb Networks 2008-02-27 03:12 --------- d-----w C:\Program Files\iTunes 2008-02-27 03:12 --------- d-----w C:\Program Files\iPod 2008-02-26 06:31 --------- d-----w C:\Program Files\Chikka 2008-02-20 05:46 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Avg7 2008-02-20 00:25 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\STOPzilla! 2008-02-20 00:22 3,072 ----a-w C:\WINDOWS\system32\drivers\kgpfr.cfg 2008-02-20 00:22 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\SITEguard 2008-02-20 00:21 --------- d-----w C:\Program Files\Common Files\iS3 2008-02-16 02:15 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared 2008-02-16 02:15 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-16 01:45 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy 2008-02-16 01:44 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-02-12 23:53 --------- d-----w C:\Program Files\Lavasoft 2008-02-12 23:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft 2008-02-12 23:52 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-11 17:39 253,952 ----a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll 2008-02-11 17:39 237,568 ----a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll 2008-02-10 17:32 --------- d-----w C:\Documents and Settings\Boys\Application Data\Yahoo! 2008-02-09 17:25 --------- d-----w C:\Documents and Settings\David\Application Data\Yahoo! 2008-02-09 08:48 --------- d-----w C:\Program Files\Counter-Strike Source 2008-02-09 04:32 --------- d-----w C:\Program Files\Macromedia 2008-02-09 04:32 --------- d-----w C:\Program Files\Common Files\Macromedia 2008-02-09 01:59 --------- d-----w C:\Documents and Settings\David\Application Data\Apple Computer 2008-02-08 21:53 110,592 ----a-w C:\WINDOWS\system32\OnlineScannerLang.dll 2008-02-08 10:08 --------- d-----w C:\Program Files\Windows Media Connect 2 2008-02-08 08:11 --------- d-----w C:\Program Files\Viewpoint 2008-02-08 04:30 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Logitech 2008-02-08 02:46 --------- d-----w C:\Program Files\MSXML 4.0 2008-02-07 07:29 --------- d-----w C:\Documents and Settings\Boys\Application Data\iTSync 2008-02-07 06:15 --------- d-----w C:\Program Files\Stardock 2008-02-07 06:15 --------- d-----w C:\Program Files\Common Files\Stardock 2008-02-07 05:43 --------- d-----w C:\Program Files\AOD 2008-02-07 05:43 --------- d-----w C:\Program Files\AIM 2008-02-07 05:43 --------- d-----w C:\Documents and Settings\Boys\Application Data\Aim 2008-02-07 05:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint 2008-02-07 03:25 --------- d-----w C:\Program Files\uTorrent 2008-02-07 01:56 --------- d-----w C:\Program Files\Trillian 2008-02-07 01:51 --------- d-----w C:\Program Files\Yahoo! 2008-02-07 01:51 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! 2008-02-07 01:43 --------- d-----w C:\Program Files\Bonjour 2008-02-07 01:43 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer 2008-02-07 01:42 --------- d-----w C:\Program Files\QuickTime 2008-02-07 01:42 --------- d-----w C:\Program Files\Common Files\Apple 2008-02-07 01:42 --------- d-----w C:\Program Files\Apple Software Update 2008-02-07 01:42 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple 2008-02-07 01:36 --------- d-----w C:\Program Files\Neevia.Com 2008-02-07 01:31 --------- d-----w C:\Program Files\Wide Angle Software 2008-02-07 00:53 --------- d-----w C:\Program Files\InterActual 2008-02-07 00:53 --------- d-----w C:\Program Files\Dell 2008-02-07 00:53 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-02-07 00:53 --------- d-----w C:\Program Files\Common Files\Roxio Shared 2008-02-07 00:42 --------- d-----w C:\Program Files\Intuit 2008-02-06 06:39 --------- d-----w C:\Documents and Settings\Boys\Application Data\Symantec 2008-02-06 06:12 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion 2008-02-06 06:00 --------- d-----w C:\Program Files\Microsoft Works 2008-02-06 06:00 --------- d-----w C:\Program Files\Microsoft ActiveSync 2008-02-06 06:00 --------- d-----w C:\Program Files\Common Files\L&H 2008-02-06 05:42 --------- d-----w C:\Program Files\Microsoft Silverlight 2008-02-06 05:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-02-06 05:35 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-02-06 05:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-02-06 05:35 10,740 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-02-06 05:35 --------- d-----w C:\Program Files\Symantec 2008-02-06 05:22 --------- d-----w C:\Documents and Settings\David\Application Data\Symantec 2008-02-06 05:22 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec 2008-02-06 05:18 10,344 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys 2008-02-06 04:51 --------- d-----w C:\Program Files\SigmaTel 2008-02-06 04:48 --------- d-----w C:\Program Files\Citrix 2008-02-06 04:48 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Citrix 2008-02-06 04:41 --------- d-----w C:\Program Files\Intel 2008-02-06 04:40 5 ----a-w C:\WINDOWS\system32\drivers\DELL_XPS_Dell DXP061 .MRK 2008-02-06 04:40 5 ----a-w C:\WINDOWS\system32\drivers\1028_DELL_XPS_Dell DXP061 .MRK 2008-02-06 04:05 --------- d-----w C:\Program Files\microsoft frontpage 2008-02-05 16:48 77,824 ----a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe 2006-10-03 10:43 2,402,550 ----a-w C:\WINDOWS\inf\SET138.tmp 2004-08-04 10:00 1,431,144 ----a-w C:\WINDOWS\inf\SET1BC.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 18:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-20 17:00 282624 C:\WINDOWS\stsystra.exe] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-02-11 18:22 53096] "DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 04:12 94208] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024] "UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [ ] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-16 12:39 7323648] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 14:10 267048] "LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984] "LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832] C:\Documents and Settings\David\Start Menu\Programs\Startup\ Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-02-06 23:15:50 3450608] C:\Documents and Settings\Boys\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664] Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-02-06 23:15:50 3450608] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Billminder.lnk - C:\QUICKENW\BILLMIND.EXE [2008-02-06 17:42:47 36864] Quicken Startup.lnk - C:\QUICKENW\QWDLLS.EXE [2008-02-06 17:42:56 36864] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist] C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll 2008-02-05 21:48 10536 C:\Program Files\Citrix\GoToAssist\508\g2awinlogon.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R2 mrtRate;mrtRate;C:\WINDOWS\system32\drivers\mrtRate.sys [1999-08-10 14:51] *Newly Created Service* - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-02-29 16:58:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-29 03:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - David.job" - C:\PROGRA~1\NORTON~1\NORTON~1\Navw32.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-29 12:02:43 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-29 12:17:00 ComboFix-quarantined-files.txt 2008-03-29 19:15:30 ComboFix2.txt 2008-03-26 17:34:15 . 2008-03-12 10:01:43 --- E O F --- ------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER REPORT Sunday, March 30, 2008 9:52:51 AM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 30/03/2008 Kaspersky Anti-Virus database records: 673066 ------------------------------------------------------------------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ Scan Statistics: Total number of scanned objects: 148402 Number of viruses found: 5 Number of infected objects: 61 Number of suspicious objects: 0 Duration of the scan process: 01:15:15 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\Confid.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\Content.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\Privacy.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\Restrict.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\settings.dat Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Common Client\WebHist.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\HPPAppActivity.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\LiveUpdate\2008-03-30_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\03455F03.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\041D0C57.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\04283AF1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\057C497B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\079F6CB7.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0AC207F9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0D9940C3.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0DDC1FDA.WIN Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0DF01F75.DLL Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0F9652E2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\0FF16E2E.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\13BD3B61.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\14CD0C92.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\14E81C85.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\14FF08A8.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\16752E14.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\16997BED.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jxa skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\1B3A1418.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\21216592.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\22EF7517.exe Infected: Trojan-Downloader.Win32.Small.ieg skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\233C7541.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\258020C6.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2C9E3E0D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixf skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2CA16809.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2CA51206.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2CA83C02.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2DB42EDB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\2DCF0B18.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\3145666C.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\32BA4D54.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\32C44B49.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\33A47EA1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\34A27084.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ixd skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\3C7A2A07.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\3D8869D2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\3F7D5194.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\41CF2B06.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\45D761CA.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\4DBC3B60.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\4F052E92.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\52656AC9.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\537B5DE1.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\55C7635A.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\561A1A6F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\5A587D87.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\5B127112.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\64930D85.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\6B12515F.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\6B542A7B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\6C722748.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\6C797B41.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\6C7C253D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\71543A73.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\73AA3DE2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\76A032C0.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\76AD5AB2.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\76B24C08.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\7E93007D.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec\Norton AntiVirus\Quarantine\7EC6244B.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\Documents and Settings\Boys\Application Data\Aim\prfdfgqg\soccaparker\cert8.db Object is locked skipped C:\Documents and Settings\Boys\Application Data\Aim\prfdfgqg\soccaparker\key3.db Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\cert8.db Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\history.dat Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\key3.db Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\parent.lock Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\search.sqlite Object is locked skipped C:\Documents and Settings\Boys\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Boys\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped C:\Documents and Settings\Boys\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Application Data\Mozilla\Firefox\Profiles\eyadrt2g.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Boys\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Temp\~DF4DAF.tmp Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Boys\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Boys\My Documents\My Music\iTunes\iTunes Library.itl Object is locked skipped C:\Documents and Settings\Boys\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Boys\NTUSER.DAT.LOG Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\e06abc2d8132536cc2\update\eula.rtf Object is locked skipped C:\e06abc2d8132536cc2\update\idndl.exe Object is locked skipped C:\e06abc2d8132536cc2\update\ie7.cat Object is locked skipped C:\e06abc2d8132536cc2\update\iecustom.dll Object is locked skipped C:\e06abc2d8132536cc2\update\iereseticons.exe Object is locked skipped C:\e06abc2d8132536cc2\update\iesetup.exe Object is locked skipped C:\e06abc2d8132536cc2\update\legitlibm.dll Object is locked skipped C:\e06abc2d8132536cc2\update\nlsdl.exe Object is locked skipped C:\e06abc2d8132536cc2\update\update.exe Object is locked skipped C:\e06abc2d8132536cc2\update\update.exe.manifest Object is locked skipped C:\e06abc2d8132536cc2\update\update.inf Object is locked skipped C:\e06abc2d8132536cc2\update\update.ver Object is locked skipped C:\e06abc2d8132536cc2\update\updspapi.dll Object is locked skipped C:\e06abc2d8132536cc2\update\xmllitesetup.exe Object is locked skipped C:\Program Files\Common Files\Symantec Shared\AntiSpam\Log\Spam.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVApp.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVError.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\AVVirus.log Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0253NAV~.TMP Object is locked skipped C:\Program Files\Norton Internet Security\Norton AntiVirus\Savrt\0829NAV~.TMP Object is locked skipped C:\QooBox\Quarantine\catchme2008-03-26_103012.87.zip/mllmk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped C:\QooBox\Quarantine\catchme2008-03-26_103012.87.zip ZIP: infected - 1 skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{9CFA339B-B1FC-4DE1-AB8E-C95384D6A751}\RP13\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:53:24 AM, on 3/30/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe C:\WINDOWS\stsystra.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\QUICKENW\QWDLLS.EXE C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Stardock\ObjectDock\ObjectDock.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe C:\Program Files\AIM\aim.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloads.yahoo.com/internetexplorer/welcome R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe O4 - Global Startup: Billminder.lnk = C:\QUICKENW\BILLMIND.EXE O4 - Global Startup: Quicken Startup.lnk = C:\QUICKENW\QWDLLS.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...37/mcfscan.cab O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\508\G2AWinLogon.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\508\g2aservice.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 10618 bytes |
|
|
|
|
04-01-2008, 09:35 AM
|
#9 (permalink) |
|
Analyst, Security Team
Join Date: Feb 2005
Location: Eire
Posts: 2,006
OS: Vista, Ubuntu 8.04
|
Re: Trojan.Vundo/Metajuan infection
Hi ya parkerfutbol3
your logs are clean the infected items found by kasoersky are all in quarantine, we will remone them know Clear out Norton's Quarantine folder. If you're unsure on how to do it, you can use Symantec's guide. ================= The following procedure will clear out the tools we've used as well as the backups and quarantines created by the fix. It will also reset your System Restore by flushing out previous restore points (which contain the infections) and create a new restore point. Click Start > Run and copy/paste, or type the following bolded text into the Run box and click OK: ComboFix /u To help protect your computer in the future I recommend that you get the following free programs if you do not already have them: McAfee Site Advisor--free version. The folks there check out websites and based on their findings, rate it as Safe, Unknown, Caution, or Bad. SpywareBlaster 3.5.1 to help prevent spyware from installing in the first place. Install & update SpywareBlaster with the latest definitions. After you have updated, click the button - enable protection for all unprotected items.
IESpyAD Zoned Out to block access to malicious websites so you cannot be redirected to them from an infected site or email. This severely impairs attempts to infect your system as it basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. Update, and scan with your onboard Anti Malware and Anti Virus programs regularly. Without regular updates you will not be protected when new malicious programs are released. In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at these well written articles: PC Safety and Security--What Do I Need? HOW DID I GET INFECTED IN THE FIRST PLACE? by Tony Klein MAKING INTERNET EXPLORER SAFER **Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them. ----------------------------------------------------- Follow the list above and the potential for infection will reduce dramatically. Please respond to this thread one more time so we can mark this thread as resolved. |
|
|
|
| Thread Tools | |
|
|
