It Just Won't Go Away!-hijacker.small.jf

I couldn't tell you when I started having problems with Front Page-I was afraid to use it for several days-i used it after the last kapersky log I posted @ 3:53pm today. It's probably the firewall, there are question marks on front page. I'll change it some other day.

Your latest HJT log is clean, I'll wait for you to let me know if changing the Firewall settings fixes things for you with Front Page. The ? means the FW is set to prompt you each time Front Page tries to access the Internet, until you allow it access it won't be able to. As Front Page is a legit programme which you use regularly it's quite OK to give it a "free pass" through your defences. The slow boot up is I'm afraid one of the down sides to having a Firewall, they take a while to install their processes. However once running it shouldn't slow down the operation of your computer in any way you should notice. If changing the FW settings resolves your problems let me know and I'll give you a set of instructions for securing your computer against infection.

Thank you so much. Somewhere in my gut I knew I should have been a software engineer instead of a mechanical engineer, so I could understand this whole coding mess! Especially when I think I know what I'm doing and go crazy deleting things from the Registry. I put this computer together about two months ago, so I can do some freelance work, and didn't realize that I didn't install Nortons or McAfree, like on my other systems until you mentioned it in this thread. I'll make the ZA changes later today, when I wake up. My biggest worries was accessing my Paypal account and updating my website with spies on my computer. Gary, i think you are wonderful, and i appreciate your patience with me.

You're welcome, we're always happy to help. As I said, I'll wait to hear that your problems with Front Page are resolved before closing things. We still need to remove all the programs we've been using to clean your computer (they can be dangerous if used inappropriately) and to secure you against further infection.

Got up about 1/2 hr ago to find AVG 45min into a scan. I can't get on the internet (using PDA) and the scan so far shows trogan horse downloader agent mf j in my temp file as xrun.exe as soon as this scan is done(1h 17min & only 1/3 complete)..i'll have to reboot to send you the latest hjt log

Your HJT log doesn't show anything untoward.

Can you send me the log from AVG.

You should find it in this location.

C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

If AVG hasn't been set to produce a log, run an online scan with Kaspersky and send me that log instead.

Kaspersky Online Scanner

KASPERSKY ONLINE SCANNER REPORTKASPERSKY ONLINE SCANNER REPORT Wednesday, June 27, 2007 7:48:07 PM Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.93.0 Kaspersky Anti-Virus database last update: 27/06/2007 Kaspersky Anti-Virus database records: 354678 Scan Settings Scan using the following antivirus databaseextended Scan Archivestrue Scan Mail Basestrue Scan TargetMy Computer A:\ C:\ D:\ Scan Statistics Total number of scanned objects77199 Number of viruses found14 Number of infected objects32 Number of suspicious objects0 Duration of the scan process01:06:07 Infected Object NameVirus NameLast Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped C:\Documents and Settings\Honey Bee\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\History\History.IE5\MSHist012007062720070628\index.dat Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\Temp\~DFD852.tmp Object is locked skipped C:\Documents and Settings\Honey Bee\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Honey Bee\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Honey Bee\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Honey Bee\UserData\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Program Files\Adobe\Adobe Version Cue CS2\config\configuration\org.eclipse.core.runtime\.manager\.tmp48836.instance Object is locked skipped C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\data\ibdata1 Object is locked skipped C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\data\ib_logfile0 Object is locked skipped C:\Program Files\Adobe\Adobe Version Cue CS2\data\database\data\ib_logfile1 Object is locked skipped C:\Program Files\Adobe\Adobe Version Cue CS2\logs\VersionCue.log Object is locked skipped C:\Program Files\hijackthis\hijackthis\backups\backup-20070626-000258-795.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP100\A0024421.exe Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP100\A0024424.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP100\A0024427.dll Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP100\A0024434.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP100\A0024656.dll Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP103\A0025788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP103\A0025789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP103\A0026929.exe Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP103\A0026930.exe Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP103\change.log Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP93\A0021943.exe/data0002 Infected: Trojan-Dropper.Win32.Agent.mu skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP93\A0021943.exe/data0006 Infected: Trojan-Downloader.Win32.Agent.brf skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP93\A0021943.exe NSIS: infected - 2 skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0021956.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022090.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.o skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022149.exe Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022346.exe Infected: Trojan.Win32.Small.oa skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022347.exe Infected: not-a-virus:AdWare.Win32.Rond.a skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022349.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022349.exe NSIS: infected - 1 skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP94\A0022350.exe Object is locked skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP96\A0023848.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP99\A0024393.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\System Volume Information\_restore{DACF11CE-6225-499D-9B7A-7BB1252ED6E5}\RP99\A0024394.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Internet Logs\fwdbglog.txt Object is locked skipped C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped C:\WINDOWS\Internet Logs\HONEY-7JKCMJLD1.ldb Object is locked skipped C:\WINDOWS\Internet Logs\IAMDB.RDB Object is locked skipped C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\EventCache\{2DB12984-F43B-454C-A1B9-6BF761EF924A}.bin Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\Temp\hsperfdata_SYSTEM\1972 Object is locked skipped C:\WINDOWS\Temp\ib29 Object is locked skipped C:\WINDOWS\Temp\ib30 Object is locked skipped C:\WINDOWS\Temp\ib31 Object is locked skipped C:\WINDOWS\Temp\ZLT030c3.TMP Object is locked skipped C:\WINDOWS\Temp\ZLT04eaf.TMP Object is locked skipped C:\WINDOWS\wiadebug.log Object is locked skipped C:\WINDOWS\wiaservc.log Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Desktop\OiUninstaller.exe/data0002 Infected: not-a-virus:AdWare.Win32.PurityScan.fk skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Desktop\OiUninstaller.exe/data0003 Infected: not-a-virus:AdWare.Win32.PurityScan.bu skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Desktop\OiUninstaller.exe NSIS: infected - 2 skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temp\chdvct.exe Infected: Trojan.Win32.Agent.aqd skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temp\snapsnet.exe/data0005 Infected: Trojan-Downloader.Win32.VB.awj skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temp\snapsnet.exe NSIS: infected - 1 skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temporary Internet Files\Content.IE5\4BJX4VTW\acdt68[1].exe/data0004 Infected: Trojan-Clicker.Win32.Small.jf skipped C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temporary Internet Files\Content.IE5\4BJX4VTW\acdt68[1].exe NSIS: infected - 1 skipped C:\_OTMoveIt\MovedFiles\Program Files\MSN\hokem43855.dll Infected: not-a-virus:AdWare.Win32.TTC.b skipped C:\_OTMoveIt\MovedFiles\VundoFix Backups\daichmqq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\_OTMoveIt\MovedFiles\VundoFix Backups\gebcddd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped C:\_OTMoveIt\MovedFiles\VundoFix Backups\vtstq.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.fp skipped C:\_OTMoveIt\MovedFiles\VundoFix Backups\ykevpmuh.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.ki skipped C:\_OTMoveIt\MovedFiles\WINDOWS\system32\jkkiihf.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.jp skipped Scan process completed.

I don't see any signs of infection on your latest Kaspersky log, pity I can't have a look at what AVG found.

Your Temp files can be cleared out by doing the following.

• Click Start > Run and type cleanmgr then click OK.
• This will bring up the Disk Cleanup window.
• Check the following entries.
  • Temporary Internet Files.
  • Recycle Bin.
  • Temporary Files.
• Click OK.
• When a prompt pops up click Yes.

I also suspect it may have detected one of the encrypted files from OTMoveIt or HJT, they're safe and can't re-infect you. I don't like to clean them out till the end just in case we've removed something in error. Too late realising you need something after you've deleted it totally.

Your System Restore points are infected as well, but provided you don't do a Restore you can't get re-infected from them. We'll clear them out at the end as well, for pretty much the same reason, better an infected Restore Point than no Restore Point if anything goes awry.

Questions: Can you now access the internet with Front Page?

Are you still having problems accessing the Internet with your PDA?

How do you connect to the Internet with your PDA?

This is what I could find from AVG-the first line was what had come up this morning that I was questioning on the xrun.exe. I had problems this morning accessing the internet while AVG was doing it's thing…so I replied to this thread using my PDA, But I never had my PDA connected to my desktop. I do from time use a blue tooth dongle on my laptop to connect to the internet through my PDA, but never on this desktop. "" "" "Trojan horse Downloader.Agent.MFJ" "C:\Documents and Settings\Honey Bee\Local Settings\Temp\xrun.exe" "6/27/2007 10:16:41 AM" "xrun.exe" "64 KB" "" "" "Trojan horse Generic5.GQ" "C:\_OTMoveIt\MovedFiles\VundoFix Backups\woyhxtay.dll.bad" "6/27/2007 10:16:42 AM" "woyhxtay.dll.bad" "61 KB" "" "" "Trojan horse Downloader.Generic4.WTK" "C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temp\xpre.exe" "6/27/2007 10:16:41 AM" "xpre.exe" "59.5 KB" "" "" "Trojan horse Downloader.Agent.MMC" "C:\_OTMoveIt\MovedFiles\Documents and Settings\Honey Bee\Local Settings\Temp\wr-1-2000219.exe" "6/27/2007 10:16:41 AM" "wr-1-2000219.exe" "30 KB"

oh, I also completed the cleanmgr.

OK, the temp file is just that, temporary. By cleaning out your temp files it should now be gone.

The other files, as I suspected are the ones "moved" by OTMoveIt.

Not fully sure what systems may have been "immobilised" while AVG was doing its scan, could be that AVG was scanning the files that allow access to the internet just as you wanted access, and so they were not able to operate in their usual manner.

I take it you now have full access back?

Lets try running a manual scan with AVG and see if it finds anything this time. Use the settings described below.

First update it to the latest definitions, then.

Run a scan with AVG.

• Click on Scanner
  • Click on the Settings tab, and set the following settings.
    • How to act
    • Click on Recommended actions, and set to Quarantine.
  • How to scan
    • Check all options.
  • Possibly unwanted software.
    • Check all options.
  • Reports
    • Check Automatically generate report after every scan.
    • Uncheck Only if threats were found.
  • What to scan
    • Check Scan every file.
• Click on the Scan tab.
  • Click on Complete System Scan and the scan will begin.
  • When the scan has finished
  • Make sure that Set all elements to: shows Quarantine, if not click on the link and choose Quarantine from the popup menu.
  • At the bottom of the window click on the Apply all Actions button.

Note: Don't save the report before you hit the Apply action button.

Close AVG Anti-Spyware.

AVG will save a report in the following location C:\Program Files\Grisoft\AVG anti-spyware 7.5\Reports

Post the log back here please, along with a new HJT log.

Gor some reason it is not saving a report, even though the setting has been set to save automatically.

Sorry I forgot, for some reason the latest AVG update has some kind of problem with logs, AVG are supposed to be dealing with it and I thought the issue had been resolved, obviously not it seems.

Are you still having problems, and does AVG find anything when you run a scan?

If it does can you note down exactly what it finds, including the file path to any files it finds.

If you're still worried that there's Malware on your computer, do the following.

• Create a folder on your desktop called Sysclean.
• Download Sysclean Package to the folder you made.
• Download Virus Pattern File (Official Pattern Release) to your desktop. This file will be called lptXXX.zip (XXX represents the version number)
• Unzip lptXXX.zip and you'll get the file lpt$vpn.XXX. Read here how to unzip/extract properly.
• Move the lpt$vpn.XXX to the Sysclean folder you created on your desktop.
• Open the sysclean folder and doubleclick sysclean.com.
• Check: Automatically clean or delete detected files.
• Click scan.

Open your sysclean folder and copy and paste the contents of sysclean.log in your next reply please, along with a new HJT log.