12 replies to this topic

[Cesar]

Hello there, if anyone can please tell me how to clean this Trojan Horse would be well appreciated. Logfile of HijackThis v1.99.1 Scan saved at 10:42:46 p.m., on 9/05/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\WINDOWS\System32\smss.exe C:\WINDOWS\WINDOWS\system32\winlogon.exe C:\WINDOWS\WINDOWS\system32\services.exe C:\WINDOWS\WINDOWS\system32\lsass.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\System32\svchost.exe C:\WINDOWS\WINDOWS\Explorer.EXE C:\WINDOWS\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\WINDOWS\system32\cisvc.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe C:\WINDOWS\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\MOZILL~1\FIREFOX.EXE C:\WINDOWS\WINDOWS\system32\cidaemon.exe C:\Program Files\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v3] "C:\WINDOWS\WINDOWS\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{CCBD0F73-D553-49D6-9331-B5361DD9BD5F}: NameServer = 203.97.33.14 203.97.37.14 O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\WINDOWS\system32\ZONELABS\vsmon.exe

[Susan528]

Hello Cesar and welcome do TomCoyote,

Your Windows files in the log are double? – Windows\Windows
Do you know when this happened?

Run hijackthis. Click Do a System Scan Only. Put a Check in the box on the left side on these:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm

Close ALL windows and browsers except HijackThis and click Fix checked and exit.

Download SmitfraudFix (by S!Ri) to your Desktop.
http://siri.urz.free...mitfraudFix.zip
Extract all the files to your Destop. A folder named SmitfraudFix will be created on your Desktop.



______________________________
Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press Enter



This program will scan large amounts of files on your computer for known patterns so please be patient while it works. When it is done, the results of the scan will be displayed and it will create a log named rapport.txt in the root of your drive, eg: Local Disk C: or partition where your operating system is installed. Please post that log along with all others requested in your next reply.


IMPORTANT: Do NOT run any other options until you are asked to do so!

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Please post:
C:\rapport.txt
and a fresh hijackthis log.

[Cesar]

Hello Susan and thanks for your help, here are the rapport and the fresh log: SmitFraudFix v2.172 Scan done at 9:20:26.58, Thu 10/05/2007 Run from C:\Documents and Settings\Cesar\Desktop\SmitfraudFix OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\WINDOWS\System32\smss.exe C:\WINDOWS\WINDOWS\system32\winlogon.exe C:\WINDOWS\WINDOWS\system32\services.exe C:\WINDOWS\WINDOWS\system32\lsass.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\System32\svchost.exe C:\WINDOWS\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\WINDOWS\Explorer.EXE C:\WINDOWS\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\WINDOWS\system32\cisvc.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe C:\WINDOWS\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\WINDOWS\system32\ctfmon.exe C:\WINDOWS\WINDOWS\system32\cidaemon.exe C:\WINDOWS\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\WINDOWS »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\WINDOWS\system32 »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Cesar »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Cesar\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\CESAR\FAVORI~1 »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32 »»»»»»»»»»»»»»»»»»»»»»»» DNS »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End Logfile of HijackThis v1.99.1 Scan saved at 9:22:47 a.m., on 10/05/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\WINDOWS\System32\smss.exe C:\WINDOWS\WINDOWS\system32\winlogon.exe C:\WINDOWS\WINDOWS\system32\services.exe C:\WINDOWS\WINDOWS\system32\lsass.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\System32\svchost.exe C:\WINDOWS\WINDOWS\system32\ZONELABS\vsmon.exe C:\WINDOWS\WINDOWS\Explorer.EXE C:\WINDOWS\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\WINDOWS\system32\cisvc.exe C:\WINDOWS\WINDOWS\system32\svchost.exe C:\WINDOWS\WINDOWS\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe C:\WINDOWS\WINDOWS\AGRSMMSG.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\WINDOWS\system32\ctfmon.exe C:\WINDOWS\WINDOWS\system32\cidaemon.exe C:\Program Files\HijackThis\HijackThis.exe O4 - HKLM\..\Run: [pdfFactory Pro Dispatcher v3] "C:\WINDOWS\WINDOWS\system32\spool\DRIVERS\W32X86\3\fppdis3a.exe" /source=HKLM O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\WINDOWS\system32\ctfmon.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (file missing) O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\WINDOWS\system32\ZONELABS\vsmon.exe

[Susan528]

Hi Cesar,

I did not see any abnormal files in the Smitfraud fix so let's do the following:

Please perform an online scan with Internet Explorer at
http://www.kaspersky...apter=161739400

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    Extended
  • Scan Options:
    Scan Archives
    Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

**Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

• Close all applications and windows.
• Double-click on dss.exe to run it, and follow the prompts.
• When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
• Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt to your post. in your reply

Please post (reply) with the results from Kaspersky and Deckard’s scanner.

[Cesar]

Hello Susan, sorry but I have forgotten to mention that I use Mozilla Firefox. I went to run Kaspersky and I coudn't as it only seems to run on Internet Explorer. What else can I do now to provide the right information?

[Susan528]

You never use IE? Does it not work?

======
Uninstall Manager

Let's see if we can find out what it got installed.

• Open HijackThis
• Click on the configure button on the bottom right
• Click on the tab "Misc Tools"
• Click on the Box that says "Uninstall Manager"
• Click on the button "Save list"
• Copy and past the List from notepad into your post

Edited by Susan528, 10 May 2007 - 06:03 AM.

[Cesar]

Hello Susan, here is the list: Agere Systems PCI Soft Modem AVG Anti-Rootkit Free AVG Anti-Spyware 7.5 AVG Free Edition Browser Protection Volume DeepBurner v1.7.1.213 EncryptOnClick FinePixViewer Ver.4.3 FireTune FUJIFILM USB Driver Google Earth HijackThis 1.99.1 Internet Explorer Secure Plug-in J2SE Runtime Environment 5.0 Update 11 Java™ SE Runtime Environment 6 Update 1 MGI PhotoSuite SE (Remove Only) Microsoft Office 2000 Premium Mozilla Firefox (1.5.0.9) Mozilla Firefox (2.0.0.3) Mozilla Thunderbird (1.5.0.10) Norton AntiVirus Help Numbers Up! VP V1.2.2 pdfFactory Pro RealPlayer Security Messenger Security Update for Windows XP (KB923789) The Magic of the Alphabet Windows Installer 3.1 (KB893803) ZoneAlarm ============================= FYI the scanner I have been using is AVG which detected the trojan, but for some reason seems to be coming back

[Cesar]

Hello again, I have just done another scan with AVG antispyware and this was the report: AVG Anti-Spyware - Scan Report --------------------------------------------------------- + Created at: 1:09:11 p.m. 11/05/2007 + Scan result: C:\System Volume Information\_restore{112078F9-2B5C-4146-B792-9312A7068784}\RP64\A0009255.exe -> Adware.SpySheriff : No action taken. C:\System Volume Information\_restore{112078F9-2B5C-4146-B792-9312A7068784}\RP65\A0009406.exe -> Downloader.Zlob.avn : No action taken. ::Report end

[Susan528]

You need to clear your restore points. You do not appear to have Window Updates installed and therefore your system is very susceptible to infection.

System Restore for Windows XP
Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

• Turn off System Restore.
• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.

Reboot.

Turn ON System Restore.

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

Please follow this WGA troubleshooting procedure:

• . Download and install the WGA Diagnostic Tool:
  http://go.microsoft....k/?linkid=56062
• . After running the WGA Diagnostic Tool, click
  on the "Validation" tab and then click on "Copy to Clipboard".

Please post (reply) with the results.

[Cesar]

Diagnostic Report (1.7.0012.0): ----------------------------------------- WGA Data--> Validation Status: Blocked VLK Detailed Status: N/A Windows Product Key: *****-*****-X8QCH-D7PTH-KYYPB Windows Product Key Hash: cu8JeoyTUlD3Kpyl7fqnUyQKtxw= Windows Product ID: 55274-642-4643641-23051 Windows Product ID Type: 1 Windows License Type: Volume Windows OS version: 5.1.2600.2.00010100.2.0.pro ID: b9625df7-8dc8-4997-b9b1-a6e4ad91507a Is Admin: Yes AutoDial: No Registry: 0x0 WGA Version: Failed to retrieve file version. - 0x80070006 Signed By: N/A, hr = 0x80070002 Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: Resolution Status: N/A Notifications Data--> Cached Result: N/A File Exists: No Version: N/A WgaTray.exe Signed By: N/A, hr = 0x80070002 WgaLogon.dll Signed By: N/A, hr = 0x80070002 OGA Data--> Office Status: 109 N/A OGA Version: Failed to retrieve file version. - 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: FCEE394C-3178-80070002 Browser Data--> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Default Browser: C:\PROGRA~1\MOZILL~1\FIREFOX.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data--> Other data--> Office Details: <GenuineResults><MachineData><UGUID>b9625df7-8dc8-4997-b9b1-a6e4ad91507a</UGUID><Version>1.7.0012.0</Version><OS>5.1.2600.2.00010100.2.0.pro</OS><PKey>*****-*****-*****-*****-KYYPB</PKey><PID>55274-642-4643641-23051</PID><PIDType>1</PIDType><SID>S-1-5-21-2000478354-839522115-1202660629</SID><SYSTEM><Manufacturer>Compaq</Manufacturer><Model>Compaq PC </Model></SYSTEM><BIOS><Manufacturer>Compaq</Manufacturer><Version>786K1</Version><SMBIOSVersion major="2" minor="3"/><Date>20010216000000.000000+000</Date></BIOS><HWID>A59F39D701842059</HWID><UserLCID>1409</UserLCID><SystemLCID>0409</SystemLCID><TimeZone>New Zealand Standard Time(GMT+12:00)</TimeZone><iJoin>0</iJoin><SBID><stat>3</stat><msppid></msppid><name></name><model></model></SBID><OEM/></MachineData> <Software><Office><Result>109</Result><Products/></Office></Software></GenuineResults>

[Susan528]

Your Windows did not appear to be genuine. You will not be able to do Windows Updates until you get this straightened out with Microsoft.

Go to the following website and create a post in the
"WGA Validation Problems" forum and paste the
results of the WGA Diagnostic Data in a detailed post.
http://forums.micros....aspx?SiteID=25
A WGA troubleshooting specialist will analyze the data and
recommend an appropriate solution.

If you have an illegal copy of Windows, you have an option to pay for it and make it good, uninstall and go to a free version of Linux, or just deal with all the insecurities and problems you now have, TC does not support the use of illegal software.

[Cesar]

Thank you Susan, I think Linux will be the best option. Regards Cesar

[Susan528]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php