What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Trojan.Hiloti, Browser crashing

38 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Well, Noodletech, The desktop is working a lot faster, not seeming so gummed up–which is a good sign. I'm not getting an AVAST warning of that website, which is also another good sign. I don't know if it's completely safe and clean. I might do a reboot of windows, save all my files onto external hard drives and wipe the slate clean, just to be safe. But at least its usable now. I can't thank you enough! I've never used one of these tech sites in the past; usually just worked my way through it over a few hours, and I have to say this has been a VERY helpful and easy experience. Especially for a malware so tricky. Let me know if there's anything I still need to do. But, again, thank you for all your help and patience. I will recommend this site. Sincerely, Paul (MercuryEnigma)
Post #17
Hi MercuryEnigma, I'm glad it's working better :). We're not quite done yet. A clean reformat might be a smart choice considering you had a rootkit infection, but until then, let's finish cleaning the system. Give Combofix another run and make sure to download the latest version when it prompts you. It should work this time. Go ahead and post the log once it finishes running.
Post #18
ComboFix 11-01-03.02 - Paulie Cee 01/03/2011 22:53:40.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1542 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\jgh.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\h8srtmainqt.dll
c:\documents and settings\Paulie Cee\Application Data\Temp3246.exe
c:\program files\Search Settings
C:\Thumbs.db
c:\windows\run.log
c:\windows\system32\11478.exe
c:\windows\system32\15724.exe
c:\windows\system32\18467.exe
c:\windows\system32\19169.exe
c:\windows\system32\26500.exe
c:\windows\system32\6334.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-04 to 2011-01-04 )))))))))))))))))))))))))))))))
.

2010-12-30 05:47 . 2010-12-30 05:47 54016 —-a-w- c:\windows\system32\drivers\dbyvh.sys
2010-12-30 02:09 . 2010-12-30 02:09 ——– d—–w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-12-28 00:12 . 2010-09-07 15:47 17744 —-a-w- c:\windows\system32\drivers\aswFsBlk.sys
2010-12-28 00:12 . 2010-09-07 15:52 165584 —-a-w- c:\windows\system32\drivers\aswSP.sys
2010-12-28 00:12 . 2010-09-07 15:47 23376 —-a-w- c:\windows\system32\drivers\aswRdr.sys
2010-12-28 00:12 . 2010-09-07 15:52 46672 —-a-w- c:\windows\system32\drivers\aswTdi.sys
2010-12-28 00:12 . 2010-09-07 15:47 100176 —-a-w- c:\windows\system32\drivers\aswmon2.sys
2010-12-28 00:12 . 2010-09-07 15:47 94544 —-a-w- c:\windows\system32\drivers\aswmon.sys
2010-12-28 00:12 . 2010-09-07 15:46 28880 —-a-w- c:\windows\system32\drivers\aavmker4.sys
2010-12-28 00:12 . 2010-09-07 16:12 38848 —-a-w- c:\windows\avastSS.scr
2010-12-28 00:12 . 2010-09-07 16:11 167592 —-a-w- c:\windows\system32\aswBoot.exe
2010-12-28 00:12 . 2010-12-28 00:12 ——– d—–w- c:\program files\Alwil Software
2010-12-28 00:12 . 2010-12-28 00:12 ——– d—–w- c:\documents and settings\All Users\Application Data\Alwil Software
2010-12-27 21:47 . 2010-12-27 21:47 54016 —-a-w- c:\windows\system32\drivers\aevo.sys
2010-12-27 20:16 . 2010-12-27 20:27 ——– d—–w- c:\documents and settings\All Users\Application Data\MFAData
2010-12-27 09:20 . 2010-12-27 09:20 ——– d-sh–w- c:\documents and settings\NetworkService\IETldCache
2010-12-25 18:19 . 2011-01-02 23:11 ——– d—–w- c:\program files\Oldgames
2010-12-25 06:52 . 2010-12-25 06:52 ——– d—–w- C:\HLPack
2010-12-15 19:12 . 2010-11-02 15:17 40960 -c—-w- c:\windows\system32\dllcache\ndproxy.sys
2010-12-15 19:11 . 2010-10-11 14:59 45568 -c—-w- c:\windows\system32\dllcache\wab.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-12-20 23:09 . 2010-01-23 18:58 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-12-20 23:08 . 2010-01-23 18:58 20952 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-11-18 18:12 . 2009-06-18 00:42 81920 —-a-w- c:\windows\system32\isign32.dll
2010-11-06 00:26 . 2001-08-23 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2010-11-06 00:26 . 2001-08-23 12:00 43520 —-a-w- c:\windows\system32\licmgr10.dll
2010-11-06 00:26 . 2001-08-23 12:00 1469440 ——w- c:\windows\system32\inetcpl.cpl
2010-11-03 12:25 . 2009-06-17 23:23 385024 —-a-w- c:\windows\system32\html.iec
2010-11-02 15:17 . 2001-08-23 12:00 40960 —-a-w- c:\windows\system32\drivers\ndproxy.sys
2010-10-28 13:13 . 2001-08-23 12:00 290048 —-a-w- c:\windows\system32\atmfd.dll
2010-10-26 13:25 . 2001-08-23 12:00 1853312 —-a-w- c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-07-09 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2009-06-17 65024]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-03-09 524632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"nwiz"="nwiz.exe" [2008-05-16 1630208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2006-01-06 188416]
"HPHmon04"="c:\windows\system32\hphmon04.exe" [2006-01-06 348160]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]
"avast5"="c:\program files\Alwil Software\Avast5\avastUI.exe" [2010-09-07 2838912]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-9-11 113664]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2010-8-4 184320]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OfficeSAS.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OfficeSAS.lnk
backup=c:\windows\pss\OfficeSAS.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
2009-07-09 20:07 49968 —-a-w- c:\program files\AIM6\aim6.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2010-09-24 06:10 421160 —-a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2010-03-09 14:02 26100520 —-a-r- c:\program files\Skype\Phone\Skype.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=
"c:\\Program Files\\Sony\\Station\\Launchpad\\_aunchPad.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/17/2009 7:08 PM 64160]
R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [4/13/2009 8:47 PM 77312]
R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [12/27/2010 7:12 PM 165584]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [12/27/2010 7:12 PM 17744]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1029456]
S0 wckqwd;wckqwd;c:\windows\system32\drivers\bjjkw.sys –> c:\windows\system32\drivers\bjjkw.sys [?]
S2 FlexService;Remote Connections Service;"c:\program files\RapidBIT\cisvc.exe" –> c:\program files\RapidBIT\cisvc.exe [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [5/3/2010 12:50 AM 136176]
S2 trackcam;TrackerCam Video Capture Driver;c:\windows\system32\drivers\trackcam.sys [9/4/2009 1:27 AM 77888]
S3 XIRLINK;IBM PC Camera;c:\windows\system32\drivers\C-itNT.sys [9/4/2009 1:14 AM 899884]
S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/6/2010 1:31 PM 691696]
.
Contents of the 'Scheduled Tasks' folder

2011-01-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 01:08]

2010-12-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 15:50]

2011-01-03 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 05:50]

2011-01-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-03 05:50]

2011-01-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 19:07]

2011-01-04 c:\windows\Tasks\User_Feed_Synchronization-{F45238CF-3301-4D40-9AA8-3347E2B0F381}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT1098640
uInternet Settings,ProxyOverride = *.local;
uInternet Settings,ProxyServer = http=127.0.0.1:5555
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Se&nd to OneNote - /105
FF - ProfilePath - c:\documents and settings\Paulie Cee\Application Data\Mozilla\Firefox\Profiles\bu4afqz0.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1098640&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - free-downloads.net Customized Web Search
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/?ref=hp
FF - prefs.js: network.proxy.type - 4
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - user.js: network.cookie.cookieBehavior - 0
FF - user.js: privacy.clearOnShutdown.cookies - false
FF - user.js: security.warn_viewing_mixed - false
FF - user.js: security.warn_viewing_mixed.show_once - false
FF - user.js: security.warn_submit_insecure - false
FF - user.js: security.warn_submit_insecure.show_once - false
.
- - - - ORPHANS REMOVED - - - -

BHO-{7c5c0f58-e061-457d-9033-77307f5ed00c} - (no file)
HKLM-Run-HPHUPD04 - c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe
MSConfigStartUp-BCSSync - c:\program files\Microsoft Office\Office14\BCSSync.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-03 23:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\System\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\¬ **\DirectSound\Device Presence]
"VxD"=dword:00000001
"WDM"=dword:00000001

[HKEY_LOCAL_MACHINE\System\ControlSet004\Hardware Profiles\0001\System\CurrentControlSet\Enum\¬ **\DirectSound\Mixer Defaults]
"Acceleration"=dword:00000000
.
Completion time: 2011-01-03 23:04:06
ComboFix-quarantined-files.txt 2011-01-04 04:03

Pre-Run: 34,105,790,464 bytes free
Post-Run: 45,834,510,336 bytes free

Current=4 Default=4 Failed=2 LastKnownGood=5 Sets=1,2,3,4,5
- - End Of File - - 10A443C9C927E368CBB7825A4127C292
Post #19
Hi MercuryEnigma,

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

http://forums.whatthetech.com/index.php?showtopic=116270&st=15

Driver::
wckqwd

Collect::
c:\windows\system32\drivers\bjjkw.sys

DDS::
uInternet Settings,ProxyServer = http=127.0.0.1:5555
Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

===================================================

Please go to: VirusTotal
  • [external image: Posted Image]
  • Click the Browse button and search for the following file: c:\windows\system32\drivers\dbyvh.sys
  • Click Open
  • Then click Send File
  • Please be patient while the file is scanned.
  • Once the scan results appear, please provide them in your next reply.
If it says already scanned – click "reanalyze now"

Please post a link to the results in your next reply.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI