EMPNADS, TBPS TOOLBAR +more intrusions?!

IT'S LATER IN THE DAY SO I GAVE THE QOOLOGIC2 A TRY AGAIN, BUT WHAT HAPPENED WAS DITTO OF WHAT HAPPENED EARLIER TODAY. SO, I RAN THE QOOLOGIC SCAN WE USED THE PREVIOUS TIME TO SEE IF IT WOULD FUNCTION PROPERLY AND IT DID GIVING ME THE BELOW LOG INFORMATION. MAYBE IT WILL BE HELPFUL?
C:\Documents and Settings\MARY\My Documents\My Downloads\QOOLOGIC\index\qoologic

PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder…………
————————
C:\WINDOWS\system32\ccbxnbn.exe: .aspack
C:\WINDOWS\system32\ntdll.dll: .aspack

Files Found in all users startup Folder…………
————————
Files Found in all users windows Folder…………
————————
Finished

That one file is bothering me and I think it is the root of the problem.

Scan this file C:\WINDOWS\system32\ccbxnbn.exe at the link below. It will produce a log please post the log. Try not to reboot.

Scan here http://virusscan.jotti.org/

HERE IS THE SCAN. COMPUTER WAS NOT REBOOTED. I WILL TRY NOT REBOOT AGAIN UNTIL I GET YOUR REPLY. WE REBOOT OUR SYSTEM EVERYTIME WE PERFORM ADAWARE OR OTHER PROTECTION SCANS BY HABIT,,,,SO I HOPE WE DON'T FORGET AND REBOOT BEFORE I GET THE NEXT STEPS TO GET RID OF THIS NUISANCE…. OUR SYSTEM IS ACTUALLY RUNNING GOOD AND POPUP FREE….BUT THINGS ARE LURKING AND IT DRIVES ME NUTS—UNDERSTATMENT. THANKS, SIGGYX. lOOKING FORWARD TO DOING THE NEXT STEPS.

Jotti's malware scan 2.99-TRANSITION_TO_3.00

File to upload & scan:
Service
Service load: 0% 100%

File: ccbxnbn.exe
Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database)
MD5 ef4fe6a71c124322a2f96e0105f7395c
Packers detected: ASPACK
Scanner results
AntiVir Found TR/Dldr.Qoologic.Q
ArcaVir Found Trojan.Downloader.Qoologic.Q
Avast Found Win32:Qoologic-K
AVG Antivirus Found Downloader.Generic.YM
BitDefender Found Trojan.Downloader.Qoologic.Q
ClamAV Found nothing
Dr.Web Found Trojan.Qoologic
F-Prot Antivirus Found nothing
Fortinet Found W32/Qoologic.Q-tr
Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Qoologic.q
NOD32 Found Win32/TrojanDownloader.Qoologic
Norman Virus Control Found nothing
VBA32 Found Trojan-Downloader.Win32.Qoologic.q

Powered by

Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, I cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

Also, I am aware of the implications of a setup like this. I am sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). I am aware, in spite of efforts to proactively counter these, false positives might occur, for example. I do not consider this a very big issue, so please do not e-mail me about it. This is a simple online scan service, not the university of Wichita.

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

Virus definitions are updated every hour. There is a 15Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception.

This service costs me money. Dedicated hosting, undonated scanner licenses etc… If you find this service useful, please consider a (small) donation to help cover expenses.

Sponsored by donations (in random order) from: Stormbyte Technologies LLC, The ClamAV project, James Love, Gideon Pertzov, Malcolm Murray, Nigel Thomas, Wendy Dickerson, Anthony Midmore, "ethereal", Mark Rubins, Steve S., Eric Johansen, Eric Schechter, Paul Bokel, Wilders Security, Wilfried Lilie, Prevx, and some people who prefer to remain anonymous… many thanks to all!

Statistics
Last file scanned at least one scanner reported something about: Trojan.Perflog in GBmegahack.zip, detected by:

Scanner Malware name
AntiVir TR/Spy.Perfloger.O
ArcaVir Trojan.Spy.Perfloger.O
Avast X
AVG Antivirus X
BitDefender Trojan.Keylogger.RT.A
ClamAV X
Dr.Web Trojan.DownLoader.2605
F-Prot Antivirus X
Fortinet X
Kaspersky Anti-Virus not-a-virus:Monitor.Win32.Perflogger.az
NOD32 Win32/Spy.PerfKey.N
Norman Virus Control X
VBA32 Trojan.Perflog


You're free to (mis)interpret these automated, flawed statistics at your own discretion.


46138 files (29489 of those unique) have been uploaded & scanned since 07/06/2005, the day of the last database purge.
7914 of those 29489 files contained a virus or any other form of malware.
This page has been visited 72198 times in this time period.

If you have suggestions and/or comments, please send me them!



Frequently asked questions - Feedback



Page generated by JTPL

Copyright © 2004-2005 Jordi Bosveld <[removed]>

Sorry was called away for work. Can you check this file also and post the scan log for it C:\WINDOWS\system32\ntdll.dll

Here's the scan:
Service load: 0% 100%

File: ntdll.dll
Status: OK
MD5 bb5cbffc096497506167bce1d9690ef2
Packers detected: -
Scanner results
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
VBA32 Found nothing

Last file scanned at least one scanner reported something about: a variant of Win32/Puper in 2C7ADFD9.EXE, detected by:

Scanner Malware name
AntiVir X
ArcaVir X
Avast X
AVG Antivirus Generic.EB
BitDefender X
ClamAV X
Dr.Web X
F-Prot Antivirus X
Fortinet X
Kaspersky Anti-Virus Trojan.Win32.Puper.u
NOD32 a variant of Win32/Puper
Norman Virus Control X
VBA32 X

Have kill box remove this C:\WINDOWS\system32\ccbxnbn.exe Then scan with googilic and post a log as well as a hijackthis log please.

Scan with hijackthis and put a check besdie these lines and choose FIX O4 - HKLM\..\Run: [gujzoc] C:\WINDOWS\system32\gujzoc.exe O4 - HKLM\..\Run: [KavSvc] C:\WINDOWS\system32\rrvlkv.exe reg_run O23 - Service: hrityat - Unknown owner - C:\WINDOWS\system32\hrityat.exe 1.click Start> Run> type in CMD tap enter. Copy/Paste the following into command prompt: sc delete hrityat At the command prompt: type exit. Then run killbox and delete these files C:\WINDOWS\system32\gujzoc.exe C:\WINDOWS\system32\rrvlkv.exe C:\WINDOWS\system32\hrityat.exe C:\WINDOWS\system32\ccbxnbn.exe Reboot and post a new log please.

hi….. the last applications of HJT etc. rid me of all but one of the start up warning screens, but I can see on the lists I last sent for review that bad stuff is still around, coming and going as they please. Do I have a particularly stubborn "bug" crawling around? <_<

(Next step? haven't had posts of new instructions in a couple days? If any have been sent….haven't gotten them. )

Sorry, I have out of town and then had some family obligations. I'm really sorry for not being able to post to you. Please post a new hijackthis log and I will look. I know what this issue is we just need to disable it to kill it.

—————- FindNarrator NT-2K-XP —————- Warning! This utility will find legitimate files in addition to malware. Do not remove anything unless you are sure you know what you're doing. ***** Operating System ***** Microsoft Windows XP Home Edition 5.1 Service Pack 2 (Build 2600) ********* Date/Time ******** Monday, July 04, 2005 (7/4/2005) 8:12 PM, Pacific Standard Time *********** Path *********** FindNarrator.bat is running from: C:\Documents and Settings\[removed]\My Documents\My Downloads\FindIt%20NT-2K-XP\FindIt NT-2K-XP —————- Strings.exe Qoologic Results —————- —————- Strings.exe Aspack Results —————- C:\WINDOWS\system32\ccbxnbn.exe: .aspack C:\WINDOWS\system32\ntdll.dll: .aspack —————- Active Setup Installed Components —————- ! REG.EXE VERSION 3.0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\97811f79-b68d-4269-91db-0e28b672ea32 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{881dd1c5-3dcf-431b-b061-f3f88e8be88a} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{03F998B2-0E00-11D3-A498-00104B6EB52E} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{08B0E5C0-4FCB-11CF-AAA5-00401C608500} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{10072CEC-8CC1-11D1-986E-00A0C955B42F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{1B00725B-C455-4DE6-BFB6-AD540AD427CD} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{283807B5-2C60-11D0-A31D-00AA00B92C03} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{36f8ec70-c29a-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3bf42070-b3b1-11d1-b5c5-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3e7bb08a-a7a3-4692-8eac-ac5e7895755b} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4278c270-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA842-CC51-11CF-AAFA-00AA00B6015B} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA848-CC51-11CF-AAFA-00AA00B6015C} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4b218e3e-bc98-4770-93d3-2731b9329278} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f216970-c90c-11d1-b5c7-0000f8051515} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5945c046-1e7d-11d1-bc44-00c04fd912be} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5A8D6EE0-3E18-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CC2A9BA0-3BDD-11D0-821E-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CDD7975E-60F8-41d5-8149-19E51D6F71D0} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{D27CDB6E-AE6D-11cf-96B8-444553540000} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9} HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E} —————- Context Menu Handlers —————- REGEDIT4 [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\ggfsnfny] @="{4b236be5-48d7-49eb-981f-796a173a5d2f}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Offline Files] @="{750fdf0e-2a26-11d1-a3ea-080036587f03}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With] @="{09799AFB-AD67-11d1-ABCD-00C04FC30936}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\Open With EncryptionMenu] @="{A470F8CF-A1E8-4f65-8335-227475AA5C46}" [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{48F45200-91E6-11CE-8A4F-0080C81A28D4}] [HKEY_CLASSES_ROOT\*\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}] @="Start Menu Pin" —————- Run Key —————- REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ZTgServerSwitch"="c:\\program files\\support.com\\client\\lserver\\server.vbs" "NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" "Pop3trap.exe"="\"C:\\Program Files\\Trend Micro\\PC-cillin 2000\\Pop3trap.exe\"" "WebTrapNT.exe"="\"C:\\Program Files\\Trend Micro\\PC-cillin 2000\\WebTrapNT.exe\"" "msnappau"="\"C:\\Program Files\\MSN Apps\\Updater\\01.03.0000.1005\\en-us\\msnappau.exe\"" "iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\"" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe" "cfgmgr52"="RunDLL32.EXE C:\\WINDOWS\\cfgmgr52.dll,DllRun" "KavSvc"="C:\\WINDOWS\\system32\\rrvlkv.exe reg_run" —————- FindNarrator NT-2K-XP —————-