|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
06-12-2008, 04:37 AM
|
#1 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
[SOLVED] Suspected "vundo" problem
Hi to all at the TSF, I throw myself at your mercy!
I have developed a bit of a horrible problem with my PC and decided to search for some help, which led to me being brought here by google. After having a quick browse, I was really impressed at the service you guys are offering! If anything, you guys are the ones who seemingly should be getting paid, rather than these cowboys who will take your PC away and then (claim to have) spend hours trying to fix it, only to have fresh installed your Windows rather than repairing the problem!! (Sorry, that example got a bit specific- not something I've personally suffered though!) Anyway, I have babbled long enough! I'm normally able to get on top of any problems I develop with a couple of sweeps with different security programs I have installed- this one just wont go away though. I really don't know what it is that triggered it off and I don't know what other effects I'm suffering besides the performance related issues- but I would like to get it resolved!!! Super Anti Spyware, AVG and Spybot all pick up this vundo thing and locate the same entries/files etc, and though they claim to have healed/deleted them, the problem just comes back. As best I can tell, there's possibly something located in a (hidden) Temporary Internet Files folder, although I haven't got the exact path. Also, Spybot keeps picking up persistent attempts for a 'Browser Helper Object' to do something- which I keep denying- and it also appears that a number of randomly named files are being created in my system32 folder. These files are DLL and they also seem to trigger a process called rundll32.exe. I've tried to kill these processes and used the cmd to delete the offending files- but new ones then just get created instead. When Spybot starts picking them up and I deny them, it seems to alternate- first the Browser Helper Object, then the DLL- but no matter how many times I deny the change, it just keeps coming straight back up with the other one. Around the same time, my Firefox had suddenly refused to load facebook, but was still loading other pages. I think that's about as descriptive as I can be. Oh, and I believe a couple of registry keys get picked up by a spyware scan too. I tried to do your five steps and I've done pretty much everything- however, the Panda Security checker did not want to install properly and though it did in the end, it didn't scan. It stayed on the scan screen for about two seconds, then a pop up appeared saying I was not infected followed by a paragraph which included the phrase 'no protection was found'. I can't remember the full sentence but it's almost like 'protection' was a typo that was meant to say 'infection', based on the context of the sentence. If that makes any sense whatsoever.... As it stands at this exact moment, I'm not being bothered by Spybot but that will inevitably start again at some point. There is one instance of rundll32.exe running. My main.txt follows: Deckard's System Scanner v20071014.68 Run by Dannyboy! on 2008-06-12 08:46:54 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created a Deckard's System Scanner Restore Point. -- Last 5 Restore Point(s) -- 22: 2008-06-12 07:46:59 UTC - RP116 - Deckard's System Scanner Restore Point 21: 2008-06-12 07:44:24 UTC - RP115 - Removed NinjaVideo Helper 20: 2008-06-11 15:31:28 UTC - RP114 - System Checkpoint 19: 2008-06-10 14:53:45 UTC - RP113 - System Checkpoint 18: 2008-06-09 14:32:36 UTC - RP112 - System Checkpoint -- First Restore Point -- 1: 2008-06-08 14:20:47 UTC - RP95 - System Checkpoint Backed up registry hives. Performed disk cleanup. System Drive C: has 27.26 GiB (less than 15%) free. -- HijackThis Clone ------------------------------------------------------------ Emulating logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2008-06-12 08:51:58 Platform: Windows XP Service Pack 3, v.3311 (5.01.2600) MSIE: Internet Explorer (8.00.6001.17184) Boot mode: Normal Running processes: C:\WINDOWS\system32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Grisoft\AVG7\avgamsvr.exe C:\Program Files\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Grisoft\AVG7\avgemc.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\CTHELPER.EXE C:\Program Files\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Safari\Safari.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\system32\msiexec.exe C:\Documents and Settings\Dannyboy!\Desktop\dss.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie O2 - BHO: (no name) - {25996837-9A25-4D8C-A62D-A1294FF307C1} - C:\WINDOWS\system32\jkkjJdCr.dll (file missing) O2 - BHO: (no name) - {4F7634AE-50F3-4E15-8805-BDC7BF7C19A8} - blank (file missing) O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\ydtucicq.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: (no name) - {5DBFA7AE-38CD-4861-8E2F-33519FCDE725} - blank (file missing) O2 - BHO: (no name) - {5E6AD50A-BB92-47E3-B458-8A889CF2634E} - C:\WINDOWS\system32\awtttqnO.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O2 - BHO: (no name) - {850CBAAD-72B8-4001-A433-B611BFFFD5A3} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {E25EE903-37EB-467B-B1F0-F71063F6B8C8} - C:\WINDOWS\system32\efcBrsQI.dll (file missing) O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing) O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (file missing) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://download.microsoft.com/downlo...OGAControl.cab O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} () - http://messenger.zone.msn.com/binary/MJSS.cab69309.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary...n.cab56986.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1174847536953 O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) - http://download.sopcast.com/download/SOPCORE.CAB O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary...o.cab56649.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) - http://www.yougamers.com/systeminfo/MSC3.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{B7C49087-ACDB-40EE-B952-E1EBA86BA129}: NameServer = 87.194.0.51,87.194.0.52 O18 - Protocol: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: AtiExtEvent - C:\WINDOWS\system32\ O20 - Winlogon Notify: efcBrsQI - C:\WINDOWS\system32\efcBrsQI.dll (file missing) O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe -- End of file - 13486 bytes -- HijackThis Fixed Entries (C:\Program Files\hijackthis\backups\) ------------- backup-20070624-181610-266 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 backup-20070624-181610-276 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 backup-20070624-181610-451 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 backup-20070624-181610-828 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 backup-20070820-224747-482 O17 - HKLM\System\CCS\Services\Tcpip\..\{4E31E2A1-D9D1-45B6-978C-ACC382E0C54C}: NameServer = 85.255.116.170,85.255.112.213 backup-20070820-224747-502 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) backup-20070820-224748-100 O17 - HKLM\System\CCS\Services\Tcpip\..\{A88FAF56-0926-441F-849E-F9A9C46114BE}: NameServer = 85.255.116.170,85.255.112.213 backup-20070820-224748-197 O17 - HKLM\System\CCS\Services\Tcpip\..\{62234CC4-8E57-48DE-923E-1DF304D3A7EA}: NameServer = 85.255.116.170,85.255.112.213 backup-20070820-224748-299 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213 backup-20070820-224748-801 O17 - HKLM\System\CCS\Services\Tcpip\..\{61F7AE8A-DA69-4C09-846E-1C88BB9145A3}: NameServer = 85.255.116.170,85.255.112.213 backup-20070820-224748-833 O17 - HKLM\System\CCS\Services\Tcpip\..\{99476C9A-D7E6-4028-B7DC-144366FE3763}: NameServer = 85.255.116.170,85.255.112.213 backup-20070820-224748-962 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213 backup-20070820-224748-968 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213 -- File Associations ----------------------------------------------------------- .cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%* .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows> R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware> S0 viasraid - c:\windows\system32\drivers\viasraid.sys (file missing) S1 atitray - c:\program files\radeon omega drivers\v3.8.360\ati tray tools\atitray.sys (file missing) S1 sdpiosys - c:\windows\system32\drivers\sdpiosys.sys (file missing) S3 ALCXSENS (Service for WDM 3D Audio Driver) - c:\windows\system32\drivers\alcxsens.sys (file missing) S3 ALCXWDM (Service for Realtek AC97 Audio (WDM)) - c:\windows\system32\drivers\alcxwdm.sys (file missing) S3 BCM43XX (BCM 802.11b Network Adapter Driver) - c:\windows\system32\drivers\bcmwl5.sys (file missing) S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip> S3 RTL8023 (Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver) - c:\windows\system32\drivers\rtlnic51.sys (file missing) S3 SABProcEnum - c:\progra~1\mozilla firefox\sabprocenum.sys (file missing) S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- R2 Diskeeper - "c:\program files\diskeeper corporation\diskeeper\dkservice.exe" <Not Verified; Diskeeper Corporation; Diskeeper (TM) Disk Defragmenter> S3 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service> S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe S4 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service> -- Device Manager: Disabled ---------------------------------------------------- Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318} Description: 1394 Net Adapter Device ID: V1394\NIC1394\1108509623C04 Manufacturer: Microsoft Name: 1394 Net Adapter PNP Device ID: V1394\NIC1394\1108509623C04 Service: NIC1394 -- Scheduled Tasks ------------------------------------------------------------- 2008-06-09 13:30:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job -- Files created between 2008-05-12 and 2008-06-12 ----------------------------- 2008-06-12 01:38:00 0 d-------- C:\ie-spyad_zo 2008-06-12 01:12:56 0 d-------- C:\Program Files\Panda Security 2008-06-12 00:56:00 98816 --a------ C:\WINDOWS\system32\jcdhvpqw.dll 2008-06-12 00:53:08 80896 --a------ C:\WINDOWS\system32\onextdnj.dll 2008-06-12 00:53:00 89600 --a------ C:\WINDOWS\system32\mtuykryl.dll 2008-06-12 00:50:43 92160 --a------ C:\WINDOWS\system32\ydtucicq.dll 2008-06-12 00:50:00 517896 --ahs---- C:\WINDOWS\system32\Onqtttwa.ini2 2008-06-12 00:49:57 321536 --a------ C:\WINDOWS\system32\awtttqnO.dll 2008-06-11 14:20:58 109056 --a------ C:\WINDOWS\system32\deqcuxxp.dll 2008-06-11 14:17:58 91648 --a------ C:\WINDOWS\system32\xmfsenew.dll 2008-06-11 14:14:58 92160 --a------ C:\WINDOWS\system32\mhfehniq.dll 2008-06-11 14:12:38 100864 --a------ C:\WINDOWS\system32\wshgakwb.dll 2008-06-11 14:11:58 503679 --ahs---- C:\WINDOWS\system32\rCdJjkkj.ini2 2008-06-11 11:03:09 184320 --a------ C:\WINDOWS\system32\nwrlsnfu.dll 2008-06-11 10:57:28 92160 --a------ C:\WINDOWS\system32\uonhppfv.dll 2008-06-11 10:33:09 489826 --ahs---- C:\WINDOWS\system32\yGPrsBeg.ini2 2008-06-11 03:25:49 184320 --a------ C:\WINDOWS\system32\wptaubhd.dll 2008-06-11 03:25:41 157184 --a------ C:\WINDOWS\system32\tdukmbxy.dll 2008-06-11 03:25:34 92160 --a------ C:\WINDOWS\system32\idmsqgwu.dll 2008-06-10 03:27:17 109056 --a------ C:\WINDOWS\system32\qsosswhn.dll 2008-06-10 03:27:15 92160 --a------ C:\WINDOWS\system32\htteqcjs.dll 2008-06-10 03:24:15 92160 --a------ C:\WINDOWS\system32\wwbijorm.dll 2008-06-09 16:22:01 0 d-------- C:\Program Files\Safari 2008-06-09 03:25:16 108544 --a------ C:\WINDOWS\system32\tkcfckvu.dll 2008-06-09 03:22:43 92160 --a------ C:\WINDOWS\system32\oekhbkff.dll 2008-06-09 03:22:36 100352 --a------ C:\WINDOWS\system32\trgtgkyn.dll 2008-06-08 15:20:37 490086 --ahs---- C:\WINDOWS\system32\dNWENqru.ini2 2008-06-08 14:33:01 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\CyberLink 2008-06-08 14:30:46 0 d-------- C:\Program Files\Common Files\CyberLink 2008-06-08 13:50:07 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink 2008-06-08 13:49:57 0 d-------- C:\Program Files\CyberLink 2008-06-03 17:17:21 0 d-------- C:\Program Files\Apple Software Update 2008-05-27 18:04:30 0 d-------- C:\WINDOWS\CD95F661A5C444F5A6AAECDD91C240B5.TMP 2008-05-26 18:58:22 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Pioneer 2008-05-26 18:57:14 0 d-------- C:\WINDOWS\system32\ipp20 2008-05-26 18:56:56 0 d-------- C:\Program Files\Pioneer 2008-05-26 15  54 0 dr-h----- C:\$VAULT$.AVG2008-05-26 11:59:48 0 d-------- C:\Program Files\Capcom 2008-05-20 22:56:24 0 d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink 2008-05-20 22:56:23 0 d-------- C:\Program Files\DVD Shrink 2008-05-18 14:10:22 0 d-------- C:\Program Files\Eidos 2008-05-18 12:40:18 0 d-------- C:\Program Files\DAEMON Tools Lite 2008-05-18 12:35:33 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\DAEMON Tools 2008-05-15 03:36:42 0 d-------- C:\Program Files\Activision 2008-05-15 00:40:58 0 d-------- C:\WINDOWS\system32\Lang 2008-05-15 00:26:36 23600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64> 2008-05-14 23:46:57 0 d-------- C:\Program Files\ATI Technologies 2008-05-14 23:37:29 0 d-------- C:\Program Files\GIGABYTE 2008-05-14 23:35:19 0 d-------- C:\WINDOWS\nview 2008-05-14 23:33:32 208896 --a------ C:\WINDOWS\system32\WinSys2.exe <Not Verified; ; DOT Application> 2008-05-14 23:33:32 200704 --a------ C:\WINDOWS\system32\WinSys.exe <Not Verified; ; DOT Application> 2008-05-14 23:33:32 9728 --a------ C:\WINDOWS\system32\sysinfoX64.sys 2008-05-14 23:33:31 8192 --a------ C:\WINDOWS\system32\sysinfo.sys 2008-05-14 23:33:31 114688 --a------ C:\WINDOWS\system32\sysinfo.dll <Not Verified; Crystal Dew World; SysInfo> 2008-05-14 23:33:31 69632 --a------ C:\WINDOWS\system32\sw24.exe 2008-05-14 23:33:31 208896 --a------ C:\WINDOWS\system32\sw20.exe <Not Verified; ; sw20 Application> 2008-05-14 23:33:31 131072 --a------ C:\WINDOWS\system32\smdll.dll <Not Verified; ; SMdll Dynamic Link Library> 2008-05-14 23:33:31 1626112 --a------ C:\WINDOWS\system32\nwiz.exe 2008-05-14 23:33:31 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll 2008-05-14 23:33:31 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll 2008-05-14 23:33:30 1018772 --a------ C:\WINDOWS\system32\nvucode.bin 2008-05-14 23:33:30 466944 --a------ C:\WINDOWS\system32\nvshell.dll 2008-05-14 23:33:30 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll 2008-05-14 23:33:29 1474560 --a------ C:\WINDOWS\system32\nview.dll 2008-05-14 23:33:29 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe 2008-05-14 23:33:27 442368 --a------ C:\WINDOWS\system32\nvappbar.exe 2008-05-14 23:33:25 1748992 --a------ C:\WINDOWS\system32\msicpl.dll <Not Verified; MSI; MSI MsiCpl> 2008-05-14 23:33:25 130048 --a------ C:\WINDOWS\system32\MadCHook.dll <Not Verified; www.madshi.net; madCHook> 2008-05-14 23:33:25 425984 --a------ C:\WINDOWS\system32\keystone.exe 2008-05-14 23:33:25 266240 --a------ C:\WINDOWS\system32\HookShield.dll 2008-05-14 23:33:25 262144 --a------ C:\WINDOWS\system32\HookMAp.dll 2008-05-14 23:33:25 32768 --a------ C:\WINDOWS\system32\Auxiliary.dll 2008-05-14 22:26:15 0 d-------- C:\WINDOWS\OPTIONS 2008-05-14 22:25:55 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\InstallShield 2008-05-14 22:23:58 0 d-------- C:\WINDOWS\system32\RTCOM 2008-05-14 22:23:58 49152 -ra------ C:\WINDOWS\system32\ChCfg.exe 2008-05-14 22:22:58 0 d-------- C:\Program Files\Realtek 2008-05-14 22:22:34 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library> 2008-05-13 20:13:07 0 d-------- C:\Program Files\VirtualDJ 2008-05-13 02:53:16 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2008-05-13 02:50:16 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100> 2008-05-13 02:50:16 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100> 2008-05-13 02:50:08 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?> 2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 02:50:08 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll 2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 02:50:06 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®> 2008-05-13 02:49:02 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll -- Find3M Report --------------------------------------------------------------- 2008-06-12 08:36:24 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\uTorrent 2008-06-12 08:00:06 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\AVG7 2008-06-12 01:41:55 0 d-------- C:\Program Files\SpywareBlaster 2008-06-09 16:41:30 57076 --ah----- C:\WINDOWS\system32\mlfcache.dat 2008-06-09 16:23:01 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Apple Computer 2008-06-08 14:30:46 0 d--h----- C:\Program Files\InstallShield Installation Information 2008-06-08 14:30:46 0 d-------- C:\Program Files\Common Files 2008-06-06 15:33:54 0 d-------- C:\Program Files\DC++ 2008-06-04 23:23:16 0 d-------- C:\Program Files\SUPERAntiSpyware 2008-05-30 04:55:37 0 d-------- C:\Program Files\mIRC 2008-05-26 09:15:05 0 d-------- C:\Program Files\Java 2008-05-23 21:07:51 0 d-------- C:\Program Files\ARWizard3 2008-05-20 09:33:26 0 d-------- C:\Program Files\Microsoft Silverlight 2008-05-19 12:44:53 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\dvdcss 2008-05-16 12:43:01 0 d-------- C:\Program Files\DivX 2008-05-04 17:29:09 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program> 2008-05-04 17:05:29 0 d-------- C:\Program Files\VIA 2008-04-28 09:52:02 0 d-------- C:\Program Files\NinjaVideo 2008-04-18 01:30:04 0 d-------- C:\Program Files\Viewpoint 2008-04-18 01:28:58 335 --a------ C:\WINDOWS\nsreg.dat 2008-04-18 01:28:58 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Mozilla 2008-04-17 21:15:17 0 d-------- C:\Program Files\Kontiki -- Registry Dump --------------------------------------------------------------- *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25996837-9A25-4D8C-A62D-A1294FF307C1}] C:\WINDOWS\system32\jkkjJdCr.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7634AE-50F3-4E15-8805-BDC7BF7C19A8}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}] 12/06/2008 00:50 92160 --a------ C:\WINDOWS\system32\ydtucicq.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5DBFA7AE-38CD-4861-8E2F-33519FCDE725}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E6AD50A-BB92-47E3-B458-8A889CF2634E}] 12/06/2008 00:49 321536 --a------ C:\WINDOWS\system32\awtttqnO.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{850CBAAD-72B8-4001-A433-B611BFFFD5A3}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E25EE903-37EB-467B-B1F0-F71063F6B8C8}] C:\WINDOWS\system32\efcBrsQI.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTHelper"="CTHELPER.EXE" [11/08/2006 14:56 C:\WINDOWS\CTHELPER.EXE] "CTxfiHlp"="CTXFIHLP.EXE" [11/08/2006 14:56 C:\WINDOWS\system32\CTXFIHLP.EXE] "DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [22/11/2005 17:38] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [18/04/2008 08:24] "KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" [] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [29/06/2007 00:43] "nwiz"="nwiz.exe" [29/06/2007 00:43 C:\WINDOWS\system32\nwiz.exe] "WinSys2"="C:\WINDOWS\system32\winsys2.exe" [29/04/2006 11:36] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [29/06/2007 00:43] "RTHDCPL"="RTHDCPL.EXE" [10/05/2007 10:08 C:\WINDOWS\RTHDCPL.EXE] "Alcmtr"="ALCMTR.EXE" [03/05/2005 10:43 C:\WINDOWS\Alcmtr.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25] "Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [24/11/2006 01:06] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/02/2008 00:13] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [19/02/2008 14:10] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/02/2008 10:29] "msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 12:34] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 12:43] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [04/03/2008 02:33] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [18/10/2006 20:05] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=0 (0x0) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 13:55 77824] "{E25EE903-37EB-467B-B1F0-F71063F6B8C8}"= C:\WINDOWS\system32\efcBrsQI.dll [ ] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy] C:\WINDOWS\System32\dimsntfy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcBrsQI] efcBrsQI.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtttqnO [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] @="Service" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] @="Volume shadow copy" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShutDown] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] eapsvcs eaphost dot3svc dot3svc HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs napagent hkmsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] AutoRun\command- D:\setup.exe -- Hosts ----------------------------------------------------------------------- 127.0.0.1 www.007guard.com 127.0.0.1 007guard.com 127.0.0.1 008i.com 127.0.0.1 www.008k.com 127.0.0.1 008k.com 127.0.0.1 www.00hq.com 127.0.0.1 00hq.com 127.0.0.1 010402.com 127.0.0.1 www.032439.com 127.0.0.1 032439.com 8744 more entries in hosts file. -- End of Deckard's System Scanner: finished at 2008-06-12 08:53:49 ------------ My extra.txt is attached. I shall patiently await your response! Thanks for your time :) |
|
     |
| Sponsored Links |
|
06-12-2008, 04:18 PM
|
#2 (permalink) | |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Quote:
My name is Katana and I will be helping you to remove any infection(s) that you may have. Please observe these rules while we work: 1. If you don't know, stop and ask! Don't keep going on. 2. Please reply to this thread. Do not start a new topic. 3. Please continue to respond until I give you the "All Clear" (Just because you can't see a problem doesn't mean it isn't there) If you can do those three things, everything should go smoothly :D I apologize for the delay in responding, but as you can probably see the forums are quite busy. Unfortunately there are far more people needing help than there are helpers. ---------------------------------------------------------------------------------------- Disable Teatimer First step:
Download and Run ComboFix (by sUBs) Please visit this webpage for instructions for downloading and running ComboFix: Bleeping Computer ComboFix Tutorial Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.
__________________
 |
|
|
|
|
|
06-12-2008, 05:05 PM
|
#3 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Hi Katana,
Many thanks for your swift response. As requested, the logs you mentioned are attached. (I had to change the file extension of the hijackthis log to .txt as it wouldn't upload with the .log default.) Regards :) Last edited by Dannyb0y; 06-12-2008 at 05:07 PM. |
|
|
|
|
06-12-2008, 06:14 PM
|
#4 (permalink) | |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Quote:
 Do you Overclock your computer, or more to the point, do you know what winsys2.exe relates to ? Custom CFScript
CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall. Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system. Submit a File For Analysis We need to have the files below Scanned by Uploading them/it to Virus Total Please visit Virustotal Copy/paste the the following file path into the window C:\WINDOWS\system32\winsys2.exe Click Submit/Send File Please post back, to let me know the results. If Virustotal is too busy please try Jotti Kaspersky Online Scanner . Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal NOTE:- This scan is best done from IE (Internet Explorer) Go Here http://www.kaspersky.com/kos/eng/par...avwebscan.html Read the Requirements and limitations before you click Accept. Allow the ActiveX download if necessary Once the database has downloaded, click Next. Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK. Click on "My Computer" and then put the kettle on! When the scan has completed, click Save Report As... Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt) Click Save - by default the file will be saved to your Desktop, but you can change this if you wish. **Note** To optimize scanning time and produce a more sensible report for review:
Installed Programs Please could you give me a list of the programs that are installed.
Click on save list button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad into your next post. Logs/Information to Post in Reply Please post the following logs/Information in your reply
__________________
|
|
|
|
|
|
06-13-2008, 09:22 AM
|
#5 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Here are the VirusTotal results:
http://www.virustotal.com/analisis/3...238c3ac75b3110 Something to do with the Panda Security software??? I've also attached the new combofix log and hijackthis uninstall list. I've not included the Kapersky results yet because at the time of posting it's seven hours into the scan with 53% completed.... This seems to be because it takes an aeon to scan a rar file and I have a fair few of those lying about. I didn't want you to think I wasn't dealing with things as soon as I'd received a reply from you though and decided to post these bits to be getting on with. I shall edit this post with the Kapersky log once it is done, which I pray will be within the next few hours!!! Also, I forgot to answer the other part of your query- the computer is running fine. All my security apps are still turned off as I've not been told to turn anything back on (since I was last told I should turn them off!!) so I've not been getting bothered with any Spybot alerts. I just checked my processes and I don't currently appear to have a rundll32 going, which can only be a good sign! Last edited by Dannyb0y; 06-13-2008 at 09:29 AM. |
|
|
|
|
06-13-2008, 09:31 AM
|
#6 (permalink) | |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Quote:
__________________
|
|
|
|
|
|
06-13-2008, 12:25 PM
|
#7 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Right, Kapersky is done at last!
When I downloaded the updates, there was no 'Next' button as per the instructions. Also, I could find no mention of the adjustments you advised in the settings. I ran a scan on the whole computer though and while it didn't appear to give me a log file, it gave me the option to save the results as an html file, which I've just attempted to attach- but it's telling me it's an invalid file. I'm going to zip it and see if I can attach it then, but do tell me if I've got it all wrong! I've left the window that Kapersky ran in open, just in case I need to do anything else with it. *EDIT* Just went over the instructions and can see I should have saved as a .txt file. Have made the appropriate change. Last edited by Dannyb0y; 06-13-2008 at 12:40 PM. Reason: Clearly not paying enough attention to the instructions I've been given |
|
|
|
|
06-13-2008, 01:24 PM
|
#8 (permalink) |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
That looks fine
 The only thing I am curious about are the Pro.Evolution.Soccer zip files. An EICAR-Test-File is a file that is designed to test antivirus programs, why would it be in those zip folders ? Do you know anything about them ? Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6u6 http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The Java Runtime Environment (JRE) 6 update 6 allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check for any item with Java Runtime Environment (JRE or J2SE) in the name.
Repeat as many times as necessary to remove each Java version. Reboot your computer once all Java components are removed. Then from your desktop double-click on the download to install the newest version. Please post a fresh HJT log along with any info you have on the Pro.Evolution.Soccer zip files
__________________
|
|
|
|
|
06-13-2008, 03:00 PM
|
#9 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
I just did a search for 'Pro Evolution' and all it turned up were some mobile phone games I was given a while back. I've never used them and all they've done is sit there but they're so small that I decided to keep them. I did have a demo of the PC version of one of the Pro Evolution Soccer games but I'm certain that's been deleted. Besides that, I don't know anything else about them. They can be deleted if they are being problematic!
I have removed and installed Java as requested. When I ran HijackThis, I got an error which I have painstakingly reproduced here!!: Error Details: An unexpected error has occurred at procedure: modRegistry_IniGetString(sFile=system.ini, sSection=boot, sValue=Shell) Error #5 - Invalid procedure call or argument Windows version: Windows NT 5.01.2600 MSIE version: 8.0.6001.17184 HijackThis version: 2.0.2 I only included this in case it may have affected any results. The program did eventually give me a result and log though, which I've included as requested. Currently have one rundll32.exe running, performance has been a little erratic- the most basic of functions have been very sluggish at times. |
|
|
|
|
06-14-2008, 02:11 AM
|
#10 (permalink) | |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Fix With HJT
Close all other windows and then start HiJack This Click Do A System Scan Only When it has finished scanning put a check next to the following lines IF still present Quote:
Now click Fix checked Click yes to any prompts Close HijackThis Please post a fresh HJT log along with details of how things are running after the above fix
__________________
|
|
|
|
|
|
06-14-2008, 10:36 AM
|
#11 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Okay,
Well things certainly seem more stable now than they have been. After I did the last set of steps, I still had a rundll32.exe running- which I ended. It hasn't returned as of yet. I ran a Spybot scan and that came back as clean, but AVG has been picking stuff up. I've run a couple of detailed system scans today and a couple of trojans were detected in items that have never shown up as infected before, and I've healed those. I also deleted the Pro Evolution stuff. There were some items located in a hidden folder called E:/RECYCLER which I can only presume were something to do with the Recycle Bin from an installation I previously had on that drive. I deleted all those files and the folder. Overall, system is running better- but not perfectly. I am attaching the latest hijack log as requested. |
|
|
|
|
06-16-2008, 02:07 AM
|
#12 (permalink) |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Sorry for the delay, I didn't get notified of your response.
Let's have a last couple of scans to make sure Please Download GMER to your desktop Please create a folder in the Program Files folder called GMER. Download GMER and extract it to the C:\program files\GMER folder you have just made. Run the Gmer.exe program by double-clicking the executable file gmer.exe. You may be prompted to scan immediately if GMER detects rootkit activity. If you are prompted to scan your system click "yes" to begin the scan. If you are not prompted, Click the "Rootkit" tab, then click "Scan". DO NOT touch the PC at ALL for Whatever reason/s until it has 100% completed its scan, or attempted scan in case of some error etc ! At the end of the scan, click "Copy" to copy the scan results to the clipboard. Then paste the results in a notepad file and also paste them back in your next reply. Please post the results from the GMER scan in your reply. Delete the copy of ComboFix.exe that you have, and download the updated version ComboFix.exe 1 ComboFix.exe 2 ComboFix.exe 3 Please re-run ComboFix and post the log.
__________________
|
|
|
|
|
06-18-2008, 03:48 AM
|
#13 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Hi Katana,
I'm really sorry for the delay also, I've just not had a chance the last couple of days!! I've attached the things you asked for to this post! |
|
|
|
|
06-18-2008, 04:38 PM
|
#14 (permalink) |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Those logs are fine, what was AVG picking up ?
How are things now, is the machine running OK ? FYI, Lots of programs can use rundll32.exe, so it doesn't automatically mean it is malware if you see it running.
__________________
|
|
|
|
|
06-20-2008, 10:57 AM
|
#15 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
File name: C:\System Volume Information\_restore{42A596F2-34FD49CE-AAA
Malware name: Win32:Trojan-gen {Other} Malware type: Virus/Worm VPS version: 080619-0, 19/06/2008 is what just came up in Avast (which I have just moved to since SuperAntiSpyware wouldn't update properly- wise move?). Whether it's the exact same file that keeps coming up, I don't know- but it's always in that location I believe. Everything else is fine to be honest. The reason I mentioned the rundll32.exe is because I don't normally see it running and it's always there until I kill the process. The only other issue is that on boot, it is taking a beyond reasonable amount of time for everything to load up. Things are certainly improved, no doubt!! But I'm not sure I'm fully fixed yet... And as I was writing this I got an error from Avast (after telling it to move that file to the chest): Last edited by Dannyb0y; 06-20-2008 at 11:03 AM. |
|
|
|
|
06-20-2008, 12:24 PM
|
#16 (permalink) |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
That's not a problem, we will be clearing system restore in a moment.
Avast is a fine choice Most scanners have trouble removing things from restore points, as they are locked from access. As for the boot time, I recommend you look at Winpatrol ( there is a link in the "Prevention" section of this post.) Congratulations your logs look clean Let's see if I can help you keep it that way First lets tidy up
The following is some info to help you stay safe and clean. ( Vista users must ensure that any programs are Vista compatible BEFORE installing ) You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future. Online Scanners I would recommend a scan at one or more of the following sites at least once a month. http://www.pandasecurity.com/activescan http://www.kaspersky.com/kos/eng/par...avwebscan.html !!! Make sure that all your programs are updated !!! Secunia Software Inspector does all the work for you, .... see HERE for details AntiSpyware
Prevention
Internet Browsers
Cleaning Temporary Internet Files and Tracking Cookies
Also PLEASE read this article.....So How Did I Get Infected In The First Place The last and most important thing I can tell you is UPDATE. If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk. Malware changes on a day to day basis. You should update every week at the very least. If you follow this advice then (with a bit of luck) you will never have to hear from me again  If you could post back one more time to let me know everything is OK, then I can have this thread archived. Happy surfing K'
__________________
Last edited by Katana; 06-20-2008 at 12:28 PM. |
|
|
|
|
06-24-2008, 07:16 PM
|
#17 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
Sorry for the delay, I wanted to give it some time to see how things were going.
As a general rule, everything seems okay now. There's nothing being detected by my scans anymore and I'm fairly confident I'm malware free now. My system startup is still taking it's sweet time (at least one minute for everything to have loaded up) but I guess I'm going to have to live with that. Thanks for all your time and help- I'll be sure to spread the word about this excellent site! |
|
|
|
|
06-25-2008, 01:44 AM
|
#18 (permalink) |
|
Analyst, Security Team
Join Date: Nov 2007
Location: Manchester, UK
Posts: 1,210
OS: W2K SP4 + XP SP2 + Vista
|
Re: Suspected "vundo" problem
Why not try Winpatrol It is an excellent startup manager.
Install Winpatrol, and when running click on the Startup Programs tab The following items can safely be disabled. [CTHelper] CTHELPER.EXE [CTxfiHlp] CTXFIHLP.EXE [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup [nwiz] nwiz.exe /install [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit [RTHDCPL] RTHDCPL.EXE [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe Just click on each item and then click Disable (if the program is running, Winpatrol will ask if you wish to stop it) Reboot your computer and see if that has helped the boot time.
__________________
Last edited by Katana; 06-25-2008 at 01:45 AM. |
|
|
|
|
06-25-2008, 07:32 AM
|
#19 (permalink) |
|
Registered User
Join Date: Jun 2008
Location: South London
Posts: 10
OS: Windows XP Home Version 2002 SP3 v.3311
|
Re: Suspected "vundo" problem
I certainly never realised I was actually able to turn those processes off. I've always been curious about what they actually do, but didn't want to risk stopping anything critical! I just rebooted and it seemed like everything started quicker (avast, avg, winpatrol- which I had already installed as per the first time you mentioned it) but it seems to be the wireless which is taking ages to kick in. Until that's loaded, things seem quite sluggish and anything I may try and do (open an explorer window, start firefox) don't seem to want to kick in until the last of my systray icons are open.
I can live with that though I guess. So I suppose that means I'm sorted now!!! :D |
|
|
|
| Thread Tools | |
|
|
