Spyware / Malware / Virus Removal

Somebody Save Me

11 min read

Looking for the outcome? Ask AI

yunianto Topic Starter

Post #1June 8, 2007, 4:22 AM UTC

Hi All, can you help me ??
i've been injected by Vundo Trojan since 3weeks ago..
my pc become slower than usual, i can't open my IE anymore but i still can use FireFox as my browser.
i used Mcafee Enterprise Edition as my antivirus.
below is my hijack log generated on June 08, 2007 :

+————————————————————+
Logfile of HijackThis v1.99.1
Scan saved at 11:50:44 AM, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Babylon\Babylon.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
C:\Program Files\Citrix\ICA Client\pnagent.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\Cwcommu.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Notepad++\notepad++.exe
C:\Program Files\wamp\apache2\bin\httpd.exe
C:\Program Files\wamp\apache2\bin\httpd.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.mitrais.com/
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [setup] "rundll32.exe" "C:\WINDOWS\system32\mrhdbwgu.dll",realset
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Babylon Translator] "C:\Program Files\Babylon\Babylon.exe"
O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
O4 - Global Startup: Program Neighborhood Agent.lnk = C:\Program Files\Citrix\ICA Client\pnagent.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\Software\..\Telephony: DomainName = mitrais.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mitrais.com
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: OracleOraHome9ClientCache - Unknown owner - c:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - C:\Program Files\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "–defaults-file=C:\Program Files\wamp\mysql\my.ini" wampmysqld (file missing)
+——————————————+

Hope there's someone can solve my problem..
Thank before for your attention
^.^

dan12

Post #2June 8, 2007, 8:37 AM UTC

Hi, and welcome to Tom coyote forums

I'm dan12, I'll be glad to help you with your computer problems.

Please observe these rules while we work:

Perform all actions in the order given.
If you don't know, stop and ask! Don't keep going on.
Please reply to this thread. Do not start a new topic.
Stick with it till you're given the all clear.
REMEMBER, ABSENCE OF SYMPTOMS DOES NOT MEAN THE INFECTION IS ALL GONE.

If you can do these things, everything should go smoothly.

Please note you'll need to have Administrator priviledges to perform the fixes. (XP accounts are Administrator by default)
Please let me know if you are using a computer with multiple accounts, as this can affect the instructions given.

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

I'm presently looking over your log and hope not to be too long.
Will be back with you as soon as I can.
Thanks dan

dan12

Post #3June 8, 2007, 8:45 AM UTC

Hi yunianto

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum.

____________________

I believe we have some files hiding from us, I'm going to flush them out.

Please go to the C:\Program Files\HijackThis folder. Right click on the HijackThis.exe file and select "Rename". Rename it removal.exe,

Then run HijackThis again and post a new log please plus the sdfix report.

Thanks dan

yunianto

Post #4June 8, 2007, 11:41 AM UTC

Thanks Dan.. But my McAfee still detect the trojan named 'vtsts.dll' an run application 'winlogon.exe'.. This is my Report.txt after doing removal from 'safe mode': +—————————————–+ SDFix: Version 1.87 Run by [removed] Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Below files will be copied to Backups folder then removed: C:\WINDOWS\Temp\win141B.tmp.exe - Deleted C:\WINDOWS\Temp\win27B0.tmp.exe - Deleted C:\WINDOWS\Temp\win3C.tmp.exe - Deleted C:\WINDOWS\Temp\win141B.tmp.exe - Deleted C:\WINDOWS\Temp\win27B0.tmp.exe - Deleted C:\WINDOWS\Temp\win3C.tmp.exe - Deleted C:\WINDOWS\Temp\win*.tmp - Deleted Removing Temp Files… ADS Check: Checking if ADS is attached to system32 Folder C:\WINDOWS\system32 No streams found. Checking if ADS is attached to svchost.exe C:\WINDOWS\system32\svchost.exe No streams found. Checking if ADS is attached to ntoskrnl.exe C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\wamp\\Apache2\\bin\\httpd.exe"="C:\\Program Files\\wamp\\Apache2\\bin\\httpd.exe:*:Enabled:Apache HTTP Server" "C:\\WINDOWS\\system32\\fxsslm12.exe"="C:\\WINDOWS\\system32\\fxsslm12.exe:*:Enabled:Salutation Daemon" "C:\\Program Files\\FlashGet\\flashget.exe"="C:\\Program Files\\FlashGet\\flashget.exe:*:Enabled:Flashget" Remaining Files: ————— Backups Folder: - C:\SDFix\backups\backups.zip Listing Files with Hidden Attributes: C:\Documents and Settings\yunianto\NetHood\Design on home.mitrais.com\Desktop.ini C:\Documents and Settings\yunianto\NetHood\Maintenance on home.mitrais.com\Desktop.ini C:\Documents and Settings\yunianto\NetHood\Requirement on home.mitrais.com\Desktop.ini C:\Documents and Settings\yunianto\Local Settings\Temp\hvenppcr.dll C:\Documents and Settings\yunianto\Local Settings\Temp\iqrxcqhl.dll C:\Documents and Settings\yunianto\Local Settings\Temp\ovvqrnxh.dll C:\Documents and Settings\yunianto\Local Settings\Temp\qjtjkpik.dll C:\Documents and Settings\yunianto\Local Settings\Temp\smnqamxm.dll C:\Documents and Settings\yunianto\Local Settings\Temp\syimuueb.dll C:\Documents and Settings\yunianto\Local Settings\Temp\tdpbbsbm.dll C:\Documents and Settings\yunianto\Local Settings\Temp\uacnmwin.dll C:\Documents and Settings\yunianto\Local Settings\Temp\wrwxirfh.dll C:\Documents and Settings\yunianto\Local Settings\Temp\xaowdnor.dll C:\Documents and Settings\yunianto\Local Settings\Temp\xghnkjfb.dll C:\quarantine\vtsts.dll.Vir C:\WINDOWS\system32\vtsts.dll C:\Documents and Settings\yunianto\Local Settings\Temp\hotcgipe.exe C:\Documents and Settings\yunianto\Local Settings\Temp\hxcurjbm.exe C:\Documents and Settings\yunianto\Local Settings\Temp\nirrykhq.exe C:\Documents and Settings\yunianto\Local Settings\Temp\olbvryxx.exe C:\Documents and Settings\yunianto\Local Settings\Temp\simwelsh.exe C:\Documents and Settings\yunianto\Local Settings\Temp\slpghcwo.exe C:\Documents and Settings\yunianto\Local Settings\Temp\uitcpggj.exe C:\Documents and Settings\All Users\Application Data\Microsoft\visualstudio\7.1\vs000223.tmp C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp C:\WINDOWS\system32\config\default.tmp.LOG C:\WINDOWS\system32\config\software.tmp.LOG C:\WINDOWS\system32\config\system.tmp.LOG Listing User Accounts: User accounts for \\MTPC197 __vmware_user__ ACTUser Administrator ASPNET Guest HelpAssistant IUSR_MTPC197 IWAM_MTPC197 SQLDebugger SUPPORT_388945a0 Finished +—————————————–+

yunianto

Post #5June 8, 2007, 11:43 AM UTC

And this is my hijakthis.log after the removal finished from 'safe mode' :
+——————————————————————+
Logfile of HijackThis v1.99.1
Scan saved at 7:35:30 PM, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Babylon\Babylon.exe
C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
C:\Program Files\Citrix\ICA Client\pnagent.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\Cwcommu.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\devenv.exe
C:\Program Files\Hijackthis\removal.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.mitrais.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {6F78B537-70F2-4628-BA08-6F29D7D0F3F6} - C:\WINDOWS\system32\hfrkpaae.dll
O2 - BHO: (no name) - {713A7346-6EE8-4C5C-BD80-D9BBF6786012} - C:\WINDOWS\system32\urqqqnk.dll
O2 - BHO: (no name) - {D50ED6DE-EE36-4702-BFDB-5BF338A8D331} - C:\WINDOWS\system32\vtsts.dll
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:\WINDOWS\system32\ieluegwp.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\ohxnyuwh.dll",realset
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Babylon Translator] "C:\Program Files\Babylon\Babylon.exe"
O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
O4 - Global Startup: Program Neighborhood Agent.lnk = C:\Program Files\Citrix\ICA Client\pnagent.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\Software\..\Telephony: DomainName = mitrais.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mitrais.com
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: urqqqnk - C:\WINDOWS\SYSTEM32\urqqqnk.dll
O20 - Winlogon Notify: vtsts - C:\WINDOWS\system32\vtsts.dll
O20 - Winlogon Notify: winbdh32 - C:\WINDOWS\SYSTEM32\winbdh32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: OracleOraHome9ClientCache - Unknown owner - c:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - C:\Program Files\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "–defaults-file=C:\Program Files\wamp\mysql\my.ini" wampmysqld (file missing)

+——————————————————————+

dan12

Post #6June 8, 2007, 1:08 PM UTC

Hi yunianto

We have to do things in a certain way to achieve the results we want, so bare with me and we will get there.

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Please post vundofix.txt and a new HJT log in your next post.
Thanks dan

yunianto

Post #7June 12, 2007, 4:10 AM UTC

Hi Dan,

this is the log from VundoFix :
+————————————+

VundoFix V6.4.2

Checking Java version…

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Scan started at 5:46:53 PM 6/6/2007

Listing files found while scanning….

VundoFix V6.4.2

Checking Java version…

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Scan started at 6:12:52 PM 6/6/2007

Listing files found while scanning….

VundoFix V6.4.2

Checking Java version…

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Scan started at 3:12:36 PM 6/9/2007

Listing files found while scanning….

VundoFix V6.4.2

Checking Java version…

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Scan started at 4:44:28 PM 6/11/2007

Listing files found while scanning….

C:\WINDOWS\system32\bjhxvlye.dll
C:\WINDOWS\system32\hkndjvth.dll
C:\WINDOWS\system32\hwuynxho.ini
C:\WINDOWS\system32\ohxnyuwh.dll
C:\WINDOWS\system32\ststv.bak1
C:\WINDOWS\system32\ststv.bak2
C:\WINDOWS\system32\ststv.ini
C:\WINDOWS\system32\urqqqnk.dll
C:\WINDOWS\system32\vlvppalc.dll
C:\WINDOWS\system32\vtsts.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\bjhxvlye.dll
C:\WINDOWS\system32\bjhxvlye.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hkndjvth.dll
C:\WINDOWS\system32\hkndjvth.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\hwuynxho.ini
C:\WINDOWS\system32\hwuynxho.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\ohxnyuwh.dll
C:\WINDOWS\system32\ohxnyuwh.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ststv.bak1
C:\WINDOWS\system32\ststv.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ststv.bak2
C:\WINDOWS\system32\ststv.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ststv.ini
C:\WINDOWS\system32\ststv.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\urqqqnk.dll
C:\WINDOWS\system32\urqqqnk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vlvppalc.dll
C:\WINDOWS\system32\vlvppalc.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\vtsts.dll
C:\WINDOWS\system32\vtsts.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.4.2

Checking Java version…

Java version is 1.5.0.4
Old versions of java are exploitable and should be removed.

Scan started at 7:57:34 AM 6/12/2007

Listing files found while scanning….

No infected files were found.

+————————————+

And the below is from HJT :
<———————————–>
Logfile of HijackThis v1.99.1
Scan saved at 10:48:13 AM, on 6/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\PROGRA~1\MI6841~1\MSSQL$~1\binn\sqlservr.exe
C:\WINDOWS\system32\STacSV.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\sttray.exe
C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_04\bin\jucheck.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Babylon\Babylon.exe
C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
C:\Program Files\Citrix\ICA Client\pnagent.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\PROGRA~1\FUJIXE~1\CENTRE~1\EASYOP~1\Cwcommu.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Adobe\Acrobat 5.0\Reader\AcroRd32.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Notepad++\notepad++.exe
C:\Program Files\wamp\mysql\bin\mysqld-nt.exe
C:\WINDOWS\system32\mmc.exe
C:\WINDOWS\hh.exe
C:\Program Files\wamp\apache2\bin\httpd.exe
C:\Program Files\wamp\apache2\bin\httpd.exe
C:\Program Files\Hijackthis\removal.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://home.mitrais.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: (no name) - {6F78B537-70F2-4628-BA08-6F29D7D0F3F6} - C:\WINDOWS\system32\fxkcmtbd.dll
O2 - BHO: (no name) - {8B51BAE6-F4E9-473F-A245-FDF567D63960} - C:\WINDOWS\system32\vtsts.dll (file missing)
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:\WINDOWS\system32\ieluegwp.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] sttray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\ohxnyuwh.dll",realset
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Babylon Translator] "C:\Program Files\Babylon\Babylon.exe"
O4 - Global Startup: Printer Monitor.lnk = C:\Program Files\Fuji Xerox\CentreWare\EasyOperator\Cwtray.exe
O4 - Global Startup: Program Neighborhood Agent.lnk = C:\Program Files\Citrix\ICA Client\pnagent.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\Software\..\Telephony: DomainName = mitrais.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = mitrais.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = mitrais.com
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: winbdh32 - C:\WINDOWS\SYSTEM32\winbdh32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: SQL Server (SQLEXPRESS) (MSSQL$SQLEXPRESS) - Unknown owner - c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sSQLEXPRESS (file missing)
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: OracleOraHome9ClientCache - Unknown owner - c:\oracle\ora92\BIN\ONRSD.EXE
O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\WINDOWS\system32\STacSV.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: wampapache - Unknown owner - C:\Program Files\wamp\apache2\bin\httpd.exe" -k runservice (file missing)
O23 - Service: wampmysqld - Unknown owner - C:\Program Files\wamp\mysql\bin\mysqld-nt.exe" "–defaults-file=C:\Program Files\wamp\mysql\my.ini" wampmysqld (file missing)

<———————————–>

dan12

Post #8June 12, 2007, 4:42 PM UTC

Hi yunianto

I want to check a couple of files out.

Submit a file to Jotti
Please go here : http://virusscan.jotti.org/
On top of the page there is a field to add the filepath,browse and find the file click open which will place it in the field.

C:\WINDOWS\SYSTEM32\winbdh32.dll
C:\Program.exe

Then hit Submit
The scan will take a while before the result comes up so please be patient.
Then copy the result and post it here in this thread.

If Jotti's service load is too high, you can use the following scanner instead:
http://www.virustotal.com/xhtml/index_en.html

post resultsof jotti's
Thanks dan

yunianto

Post #9June 14, 2007, 1:09 AM UTC last edited June 14, 2007, 1:10 AM UTC

Antivirus Version Update Result ————————————————————————- AhnLab-V3 2007.6.12.2 06.13.2007 no virus found AntiVir 7.4.0.32 06.13.2007 TR/Crypt.PEC2X.Gen Authentium 4.93.8 06.13.2007 no virus found Avast 4.7.997.0 06.13.2007 Win32:Agent-HCX AVG 7.5.0.467 06.13.2007 no virus found BitDefender 7.2 06.14.2007 no virus found CAT-QuickHeal 9.00 06.13.2007 no virus found ClamAV devel-20070416 06.14.2007 no virus found DrWeb 4.33 06.14.2007 no virus found eSafe 7.0.15.0 06.13.2007 Suspicious Trojan/Worm eTrust-Vet 30.7.3715 06.13.2007 no virus found Ewido 4.0 06.13.2007 no virus found FileAdvisor 1 06.14.2007 no virus found Fortinet 2.85.0.0 06.14.2007 no virus found F-Prot 4.3.2.48 06.13.2007 no virus found F-Secure 6.70.13030.0 06.14.2007 Trojan.Win32.Agent.qt Ikarus T3.1.1.8 06.13.2007 Trojan.Win32.Agent.qt Kaspersky 4.0.2.24 06.14.2007 Trojan.Win32.Agent.qt McAfee 5052 06.13.2007 no virus found Microsoft 1.2503 06.13.2007 Trojan:Win32/Agent.PA NOD32v2 2328 06.13.2007 no virus found Norman 5.80.02 06.13.2007 W32/Agent.BMXC Panda 9.0.0.4 06.13.2007 Adware/SuperSpider Prevx1 V2 06.14.2007 Polynomial.Code.Exploit Sophos 4.18.0 06.12.2007 no virus found Sunbelt 2.2.907.0 06.09.2007 Trojan.Win32/Agent.PA Symantec 10 06.14.2007 no virus found TheHacker 6.1.6.132 06.11.2007 no virus found VBA32 [removed] 06.13.2007 no virus found VirusBuster 4.3.23:9 06.13.2007 no virus found Webwasher-Gateway 6.0.1 06.13.2007 Trojan.Crypt.PEC2X.Gen ————————————————————— Regards, yunianto

dan12

Post #10June 14, 2007, 6:43 AM UTC

Hi, out of the two files I gave you to upload which one does this apply to? can you send results of the other file also. Thanks

yunianto

Post #11June 14, 2007, 7:55 AM UTC

Hi Dan, The results are apllied to C:\WINDOWS\SYSTEM32\winbdh32.dll and ive tried to scan C:\Program.exe but there's not any result found. Regards, Yunianto

dan12

Post #12June 14, 2007, 8:13 AM UTC

Do you mean the result was no virus found or you were unable to get it uploaded. sorry to keep asking but I have to find Information out before I can act on the findings, as I'm sure you appreciate. dan

yunianto

Post #13June 15, 2007, 12:33 AM UTC

Haha.. Don't worry Dan.. u've helped me to get rid of my trojan, of course i'll appreciate it ^^ btw, i used 'http://www.virustotal.com/xhtml/index_en.html' to scan the file but when scan 'C:\Program.exe ', the result is : '0 bytes size received / Se ha recibido un archivo vacio' i think there's no Program.exe on my C: CMIIW Thank you Dan…

dan12

Post #14June 15, 2007, 5:44 AM UTC

Hi yunianto

Download ATF Cleaner by Atribune and save it to your Desktop.
Do not use yet!

Ewido is now known as ( AVG Anti-Spyware.)

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/

Install AVG Anti-Spyware by double clicking the installer.
Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
On the main screen under Your Computer's security.
- Click on Change state next to Resident shield. It should now change to inactive.
- Click on Change state next to Automatic updates. It should now change to inactive.
- Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
- Wait until you see the Update succesfull message.
Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

Dont use yet!
__________________________

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present)

O2 - BHO: (no name) - {6F78B537-70F2-4628-BA08-6F29D7D0F3F6} - C:\WINDOWS\system32\fxkcmtbd.dll
O2 - BHO: (no name) - {8B51BAE6-F4E9-473F-A245-FDF567D63960} - C:\WINDOWS\system32\vtsts.dll (file missing)
O2 - BHO: (no name) - {E12BFF69-38A7-406e-A8EF-2738107A7831} - C:\WINDOWS\system32\ieluegwp.dll
O4 - HKLM\..\Run: [ApachInc] rundll32.exe "C:\WINDOWS\system32\ohxnyuwh.dll",realset
O20 - Winlogon Notify: winbdh32 - C:\WINDOWS\SYSTEM32\winbdh32.dll
WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit

We need to reveal system folders

Close all programs so that you are at your desktop.
Double-click on the My Computer icon.
Select the Tools menu and click Folder Options
After the new window appears select the View tab.
Place a checkmark in the checkbox labeled Display the contents of system folders
Under the Hidden files and folders section select the radio button labeled Show hidden files and folders
Remove the checkmark from the checkbox labeled Hide file extensions for known file types
Remove the checkmark from the checkbox labeled Hide protected operating system files
Press the Apply and then the ok button and shut down my computer
Now your computer is configured to show all hidden files.
For you and the tools to be able to see appropriate files we need to Show Hidden Files

Re-boot into safe mode

Next, please reboot your computer in Safe Mode by doing the following:
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear use arrow up to highlight
Select the first option, to run Windows in Safe Mode hit enter.
For additional help in booting into Safe Mode, see the following site: HERE

Right click start, In the drop down menu click "Explore" Then navigate to each file\ folder in the left hand pane, which will reveal its content in the right hand pane, highlight file or folder right click and Delete, if present:

C:\WINDOWS\SYSTEM32\winbdh32.dll << This file
C:\WINDOWS\system32\ohxnyuwh.dll << This file
C:\WINDOWS\system32\ieluegwp.dll << This file
C:\WINDOWS\system32\vtsts.dll << This file
C:\WINDOWS\system32\fxkcmtbd.dll << This file

___________

Run ATF cleaner

Double click ATF-Cleaner.exe to run the program.
Check the following boxes:
- Windows Temp
- Current User Temp
- All Users Temp
- Temporary Internet Files
- Prefetch
- Recycle Bin
- Java Cache
The rest are optional - if you want to remove the lot, check Select All.
Now click Empty Selected.
When you get the Done Cleaning message, click OK.
If you use Firefox browser.
- Click Firefox at the top and choose: Select All
- If you would like to keep your saved passwords, please click No at the prompt.
- Click the Empty Selected button.
If you use Opera browser.
- Click Opera at the top and choose: Select All
- If you would like to keep your saved passwords, please click No at the prompt.
- Click the Empty Selected button.

Run AVG Anti-Spyware

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

Click on Scanner on the toolbar.
Click on the Settings tab.
- Under How to act?
  - Click on Recommended Action and choose Quarantine from the popup menu.
- Under How to scan?
  - All checkboxes should be ticked.
- Under Possibly unwanted software:
  - All checkboxes should be ticked.
- Under Reports:
  - Select Automatically generate report after every scan and uncheck Only if threats were found.
- Under What to scan?
  - Select Scan every file.
Click on the Scan tab.
Click on Complete System Scan to start the scan process.
Let the program scan the machine.
When the scan has finished, follow the instructions below.
IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
- Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
- At the bottom of the window click on the Apply all Actions button. (3)
  
  [external image: Posted Image]
When done, click the Save Scan Report button. (4)
- Click the Save Report as button.
- Save the report to your Desktop.
Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.

Reboot in Normal Mode.
_____________

please do an online scan with Kaspersky Online Scanner

Click on Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Extended (If available otherwise Standard)
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Copy and paste that information in your next post.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Please include new HJT log, AVG Anti-Spyware log and kaspersky log
in your next post
Thanks dan

dan12

Post #15June 16, 2007, 9:47 PM UTC

how we doing?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Somebody Save Me

✨ Ask AI

Ask AI