What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed]Virtumonde

7 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
hi!

i'm seeking the solution for this malware for a long time. the last shot that i made was following this thread:

http://forums.tomcoyote.org/How_Remove_Vun…elp_t57816.html

i'm putting here the Hijackthis log.



Logfile of HijackThis v1.99.1
Scan saved at 13:21:35, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\Documents and Settings\Roberto\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\tmp3.tmp.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\geeeec.dll",forkonce
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\migice.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\migice.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\vturoop.dll
O20 - Winlogon Notify: migice - C:\WINDOWS\SYSTEM32\migice.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Arquivos de programas\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe



Vundofix did not removed any files.

Thanks for the help!
Post #2
Hello riwai and welcome to the TomCoyote Forums

My name is Trevuren and I will be helping you with your problem.


Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #3
hi Trevuren! thanks for the answer!

since the posting of the thread, i tried to erase "C:\WINDOWS\system32\migice.dll", and it returned with another name. and i saw that this file is random.

here goes the combofix and hijack logs.



ComboFix 07-08-06.5 - "MARCOS" 2007-08-06 14:48:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.482 [GMT -3:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\MARCOS\DADOSD~1\tmp1.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp3.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp6.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp8.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp9.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmpB.tmp.exe
C:\WINDOWS\system32\dnb87f4b44.dat
C:\WINDOWS\system32\gPhcan.dll
C:\WINDOWS\system32\pmkhf.exe
C:\WINDOWS\system32\ssqpp.exe
C:\WINDOWS\system32\tmp3.tmp.dll
C:\WINDOWS\system32\tmp8.tmp.dll
C:\WINDOWS\system32\tmpB.tmp.dll


((((((((((((((((((((((((( Files Created from 2007-07-06 to 2007-08-06 )))))))))))))))))))))))))))))))


2007-08-06 14:52 105,428 –a—— C:\WINDOWS\system32\awvvv.exe
2007-08-06 14:42 131,421 –a—— C:\WINDOWS\awurst.dll
2007-08-06 14:19 d——– C:\!KillBox
2007-08-06 13:28 d——– C:\Arquivos de programas\Trend Micro
2007-08-06 12:31 d——– C:\WINDOWS\CSC
2007-08-06 04:09 d——– C:\DOCUME~1\MARCOS\DADOSD~1\Lavasoft
2007-08-06 04:07 7,680 –a—— C:\WINDOWS\system32\drivers\RKL66.tmp.sys
2007-08-06 04:06 229,888 –a—— C:\fhexdump.dll
2007-08-06 03:34 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-06 03:34 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-06 03:34 43,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-06 03:34 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2007-08-05 17:05 d——– C:\WINDOWS\pss
2007-08-05 16:52 d——– C:\DOCUME~1\MARCOS\.housecall6.6
2007-08-04 21:57 d——– C:\VundoFix Backups
2007-08-04 20:41 56 –a—— C:\WINDOWS\system32\migice.dll
2007-08-04 20:35 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-04 20:26 131,448 –a—— C:\WINDOWS\khihee.dll
2007-08-04 10:21 78,428 –a—— C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2E.tmp.exe
2007-08-04 10:21 124,624 –a—— C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2C.tmp.exe
2007-08-04 02:31 13,380 –a—— C:\WINDOWS\system32\vturoop.dll
2007-08-03 21:30 84,992 –a—— C:\WINDOWS\WebAssist.dll
2007-08-03 20:28 d——– C:\Arquivos de programas\VideoLAN
2007-08-03 20:21 21,764 –a—— C:\WINDOWS\system32\CoreAAC-uninstall.exe
2007-08-03 20:16 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\Media Player Classic
2007-08-03 20:15 d——– C:\Arquivos de programas\XP Codec Pack
2007-08-03 19:42 d——– C:\Arquivos de programas\GSpot
2007-08-03 18:37 d——– C:\Arquivos de programas\ffdshow
2007-08-01 20:04 852,992 –a—— C:\WINDOWS\system32\WinUpdate.cmd
2007-08-01 20:04 852,992 –a—— C:\WINDOWS\oba.exe
2007-08-01 03:19 d——– C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macrovision
2007-08-01 03:18 d——– C:\Arquivos de programas\Arquivos comuns\Macromedia Shared
2007-07-22 12:23 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\.Torrent Swapper
2007-07-22 12:22 d——– C:\Arquivos de programas\Swapper
2007-07-19 16:03 d——– C:\Arquivos de programas\Flash Optimizer
2007-07-19 15:28 d——– C:\Arquivos de programas\Liatro
2007-07-19 15:05 d——– C:\Arquivos de programas\Eltima Software
2007-07-06 21:17 d——– C:\program files


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 04:07 ——— d——– C:\Arquivos de programas\Soulseek
2007-08-06 03:34 ——— d——– C:\Arquivos de programas\Winamp
2007-08-06 00:08 ——— d——– C:\Arquivos de programas\GetRight
2007-08-02 00:18 134 –a—— C:\autoexec.bat
2007-08-01 03:18 ——— d–h—– C:\Arquivos de programas\InstallShield Installation Information
2007-07-22 00:19 ——— d——– C:\Arquivos de programas\GbPlugin
2007-06-26 23:16 292 –a—— C:\mediamp3.dat
2007-06-26 23:12 ——— d——– C:\Arquivos de programas\MP3 Player Utilities 4.05
2007-06-24 21:07 1885184 –a—— C:\WINDOWS\scla12.exe
2007-06-10 20:53 ——— d——– C:\Arquivos de programas\IVT Corporation
2007-06-09 13:05 ——— d——– C:\Arquivos de programas\QuickTime
2007-06-07 16:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe
2007-06-07 00:57 ——— d——– C:\Arquivos de programas\Total Video Converter
2007-05-19 10:48 49586 –a—— C:\WINDOWS\system32\perfc016.dat
2007-05-19 10:48 347294 –a—— C:\WINDOWS\system32\perfh016.dat
2007-05-16 12:13 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 12:13 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 12:13 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 12:13 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 12:13 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 12:13 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5ddd9b4a-b8b7-4bd4-b92f-977873c8956d}]
2007-08-06 14:52 92702 –a—— C:\WINDOWS\system32\jgpapi.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-08-04 10:03 84992 –a—— C:\WINDOWS\WebAssist.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 12:31]
"EPSON Stylus C67 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.exe" [2005-01-25 04:00]
"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" []
"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2007-06-09 13:01]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

C:\Documents and Settings\MARCOS\Menu Iniciar\Programas\Inicializar\
Scanner Utilities.lnk - C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE [2007-05-08 06:00:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [2007-03-06 10:00 222376]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\WINDOWS\Downloaded Program Files\gbiehCef.dll [2007-03-07 11:09 219456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgpapi]
jgpapi.dll 2007-08-06 14:52 92702 C:\WINDOWS\system32\jgpapi.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\vturoop.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"GbpSv"=2 (0x2)
"SoundMAX Agent Service (default)"=2 (0x2)

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R2 Av260cn;Av260cn;C:\WINDOWS\system32\drivers\Av260cn.sys
R2 Av260cnb;Av260cnb;C:\WINDOWS\system32\drivers\Av260cnb.sys
R2 Av260cnd;Av260cnd;C:\WINDOWS\system32\drivers\Av260cnd.sys
R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
S3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 USB_RNDIS;USB Remote NDIS Network Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S4 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe


Contents of the 'Scheduled Tasks' folder
2007-08-06 03:00:00 C:\WINDOWS\Tasks\At1.job
2007-08-04 12:00:30 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 13:00:30 C:\WINDOWS\Tasks\At11.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At12.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 16:00:00 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 17:00:00 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 18:01:19 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 19:00:30 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 20:00:00 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 21:00:00 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 04:00:00 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 22:00:35 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 23:00:30 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 00:01:08 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 01:00:30 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 02:00:00 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 05:00:00 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 06:00:00 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 07:00:03 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 08:00:30 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 09:00:31 C:\WINDOWS\Tasks\At7.job
2007-08-04 10:00:30 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 11:00:30 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\M3XIl4n1.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-06 14:52:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

C:\WINDOWS\system32\dnb87f4b44.dat
C:\WINDOWS\system32\jgpapi.dll

scan completed successfully
hidden files: 2

**************************************************************************

Completion time: 2007-08-06 14:53:42 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-06 14:53
C:\ComboFix2.txt … 2007-08-04 20:42

— E O F —





Logfile of HijackThis v1.99.1
Scan saved at 14:57:13, on 6/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\WINDOWS\system32\svchost.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RunDll32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Arquivos de programas\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Roberto\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5ddd9b4a-b8b7-4bd4-b92f-977873c8956d} - C:\WINDOWS\system32\jgpapi.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\jgpapi.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\jgpapi.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\vturoop.dll
O20 - Winlogon Notify: jgpapi - C:\WINDOWS\SYSTEM32\jgpapi.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe




Thanks again!
Post #4
You have some new infections on your machine that we must submit for analysis. Please do the following to submit the files and copy the link from the analysis forum and paste it back into your topic here.


Download Suspicious File Packer from here.

Unzip it to your desktop. Open it and copy and paste in this list of files below in the Quotebox.
When it has created the archive on your desktop please upload that to the forum here.

C:\WINDOWS\system32\jgpapi.dll
c:\windows\system32\vturoop.dll



Here are the directions for uploading the file:
  • Click "New Topic"
  • Fill in the needed details
  • Post a link to your thread here. http://forums.tomcoyote.org/Virtumonde_t81989.html#entry392435
  • Use the following as the title for your post: "Files for Tony Klein"
  • Click the "Browse" button and Navigate to the file on your computer.
  • When the file is listed in the window click "Post" to upload the file.
  • Take note of the link to your topic and come right back here to Post it
  • We will resume our cleaning when reception of the files has been acknowledged by Tony

Thanks for your cooperation. You are helping us fight these infections by submitting the files.

Be sure you post the link to this thread in that topic.
Post #5
Yeah, i did it the files thing, but i can't find the 'browse' button. is it in the window at the new topic, or is it in the browser itself?
Post #6
Fair enough. They have slightly changed their website:

Go here to submit: http://www.thespykiller.co.uk/

Click on the Topic "Uploads" which will take you to a new page.

Locate and click on the "New Topic Tab" which will open a page similar to the ones here when you post a reply.

You will find the "Browse button" near the bottom of the page. The other instructions should be OK.


Trevuren
Post #8
It looks fine. I will be back later tonight with a fix for your problem. Supper time for me and the wife says "Now"!! Trevuren
Post #10
Please download this file - combofix.exe by sUBs
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log.
Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

Regards,

Trevuren
Post #11
ComboFix 07-08-07.4 - "MARCOS" 2007-08-07 0:10:02.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.506 [GMT -3:00]


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\MARCOS\DADOSD~1\tmp1.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp3.tmp.exe
C:\DOCUME~1\MARCOS\DADOSD~1\tmp4.tmp.exe
C:\WINDOWS\system32\awvvv.exe
C:\WINDOWS\system32\dnb87f4b44.dat
C:\WINDOWS\system32\jgpapi.dll
C:\WINDOWS\system32\tmp3.tmp.dll
C:\WINDOWS\system32\tmp4.tmp.dll


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-07 00:08 131,421 –a—— C:\WINDOWS\urpomj.dll
2007-08-06 22:04 78,541 –a—— C:\DOCUME~1\Marcos_2\DADOSD~1\tmp3.tmp.exe
2007-08-06 21:51 124,774 –a—— C:\DOCUME~1\Marcos_2\DADOSD~1\tmp1.tmp.exe
2007-08-06 21:46 d——– C:\spoolerlogs
2007-08-06 14:42 131,421 –a—— C:\WINDOWS\awurst.dll
2007-08-06 14:19 d——– C:\!KillBox
2007-08-06 13:28 d——– C:\Arquivos de programas\Trend Micro
2007-08-06 12:31 d——– C:\WINDOWS\CSC
2007-08-06 04:09 d——– C:\DOCUME~1\MARCOS\DADOSD~1\Lavasoft
2007-08-06 04:07 7,680 –a—— C:\WINDOWS\system32\drivers\RKL66.tmp.sys
2007-08-06 04:06 229,888 –a—— C:\fhexdump.dll
2007-08-06 03:34 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-06 03:34 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-06 03:34 43,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-06 03:34 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2007-08-05 17:05 d——– C:\WINDOWS\pss
2007-08-05 16:52 d——– C:\DOCUME~1\MARCOS\.housecall6.6
2007-08-04 21:57 d——– C:\VundoFix Backups
2007-08-04 20:41 56 –a—— C:\WINDOWS\system32\migice.dll
2007-08-04 20:35 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-04 20:26 131,448 –a—— C:\WINDOWS\khihee.dll
2007-08-04 10:21 124,624 –a—— C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2C.tmp.exe
2007-08-03 21:30 84,992 –a—— C:\WINDOWS\WebAssist.dll
2007-08-03 20:28 d——– C:\Arquivos de programas\VideoLAN
2007-08-03 20:21 21,764 –a—— C:\WINDOWS\system32\CoreAAC-uninstall.exe
2007-08-03 20:16 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\Media Player Classic
2007-08-03 20:15 d——– C:\Arquivos de programas\XP Codec Pack
2007-08-03 19:42 d——– C:\Arquivos de programas\GSpot
2007-08-03 18:37 d——– C:\Arquivos de programas\ffdshow
2007-08-01 20:04 852,992 –a—— C:\WINDOWS\system32\WinUpdate.cmd
2007-08-01 20:04 852,992 –a—— C:\WINDOWS\oba.exe
2007-08-01 03:19 d——– C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macrovision
2007-08-01 03:18 d——– C:\Arquivos de programas\Arquivos comuns\Macromedia Shared
2007-07-22 12:23 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\.Torrent Swapper
2007-07-22 12:22 d——– C:\Arquivos de programas\Swapper
2007-07-19 16:03 d——– C:\Arquivos de programas\Flash Optimizer
2007-07-19 15:28 d——– C:\Arquivos de programas\Liatro
2007-07-19 15:05 d——– C:\Arquivos de programas\Eltima Software


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 15:47 ——— d——– C:\Arquivos de programas\Soulseek
2007-08-06 03:34 ——— d——– C:\Arquivos de programas\Winamp
2007-08-06 00:08 ——— d——– C:\Arquivos de programas\GetRight
2007-08-02 00:18 134 –a—— C:\autoexec.bat
2007-08-01 03:18 ——— d–h—– C:\Arquivos de programas\InstallShield Installation Information
2007-07-22 00:19 ——— d——– C:\Arquivos de programas\GbPlugin
2007-06-26 23:16 292 –a—— C:\mediamp3.dat
2007-06-26 23:12 ——— d——– C:\Arquivos de programas\MP3 Player Utilities 4.05
2007-06-24 21:07 1885184 –a—— C:\WINDOWS\scla12.exe
2007-06-10 20:53 ——— d——– C:\Arquivos de programas\IVT Corporation
2007-06-09 13:05 ——— d——– C:\Arquivos de programas\QuickTime
2007-06-07 16:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe
2007-06-07 00:57 ——— d——– C:\Arquivos de programas\Total Video Converter
2007-05-19 10:48 49586 –a—— C:\WINDOWS\system32\perfc016.dat
2007-05-19 10:48 347294 –a—— C:\WINDOWS\system32\perfh016.dat
2007-05-16 12:13 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 12:13 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 12:13 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 12:13 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 12:13 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 12:13 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
2007-08-04 10:03 84992 –a—— C:\WINDOWS\WebAssist.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 12:31]
"EPSON Stylus C67 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.exe" [2005-01-25 04:00]
"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" []
"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2007-06-09 13:01]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

C:\Documents and Settings\MARCOS\Menu Iniciar\Programas\Inicializar\
Scanner Utilities.lnk - C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE [2007-05-08 06:00:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [2007-03-06 10:00 222376]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\WINDOWS\Downloaded Program Files\gbiehCef.dll [2007-03-07 11:09 219456]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\windows\system32\vturoop.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"GbpSv"=2 (0x2)
"SoundMAX Agent Service (default)"=2 (0x2)

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R2 Av260cn;Av260cn;C:\WINDOWS\system32\drivers\Av260cn.sys
R2 Av260cnb;Av260cnb;C:\WINDOWS\system32\drivers\Av260cnb.sys
R2 Av260cnd;Av260cnd;C:\WINDOWS\system32\drivers\Av260cnd.sys
R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
S3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 USB_RNDIS;USB Remote NDIS Network Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S4 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe


Contents of the 'Scheduled Tasks' folder
2007-08-07 03:00:00 C:\WINDOWS\Tasks\At1.job
2007-08-04 12:00:30 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 13:00:30 C:\WINDOWS\Tasks\At11.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At12.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 16:00:00 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 17:00:00 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 18:00:00 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 19:00:00 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 20:00:00 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 21:00:00 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 04:00:00 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 22:00:35 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 23:00:30 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 00:01:08 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 01:00:00 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 02:00:00 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 05:00:00 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 06:00:00 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 07:00:03 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 08:00:30 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 09:00:31 C:\WINDOWS\Tasks\At7.job
2007-08-04 10:00:30 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 11:00:30 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\M3XIl4n1.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 00:13:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 0:14:27 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-07 00:14
C:\ComboFix2.txt … 2007-08-06 14:53
C:\ComboFix3.txt … 2007-08-04 20:42

— E O F —




Logfile of HijackThis v1.99.1
Scan saved at 00:15:02, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\cmd.exe
C:\ComboFix\vfind.cfexe
C:\Arquivos de programas\internet explorer\iexplore.exe
C:\Documents and Settings\Roberto\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\WebAssist.dll
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: c:\windows\system32\vturoop.dll
O20 - Winlogon Notify: WgaLogon - WgaLogon.dll (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe
Post #12
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\urpomj.dll
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp3.tmp.exe
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp1.tmp.exe
C:\WINDOWS\awurst.dll
C:\fhexdump.dll
C:\WINDOWS\system32\drivers\RKL66.tmp.sys
C:\WINDOWS\system32\migice.dll
C:\WINDOWS\khihee.dll
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2C.tmp.exe
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\system32\WinUpdate.cmd
C:\WINDOWS\oba.exe
C:\WINDOWS\scla12.exe
C:\WINDOWS\system32\perfc016.dat
C:\WINDOWS\system32\perfh016.dat
c:\windows\system32\vturoop.dll
C:\WINDOWS\system32\jgpapi.dll

Folder::
C:\!KillBox

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jgpapi]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WgaLogon]


3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.
Post #13
Done. Here's the logs that you've asked for.


ComboFix 07-08-07.4 - "MARCOS" 2007-08-07 2:52:44.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1046.18.509 [GMT -3:00]
Command switches used :: C:\Documents and Settings\Roberto\programas\CFScript.txt

FILE::
C:\WINDOWS\urpomj.dll
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp3.tmp.exe
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp1.tmp.exe
C:\WINDOWS\awurst.dll
C:\fhexdump.dll
C:\WINDOWS\system32\drivers\RKL66.tmp.sys
C:\WINDOWS\system32\migice.dll
C:\WINDOWS\khihee.dll
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2C.tmp.exe
C:\WINDOWS\WebAssist.dll
C:\WINDOWS\system32\WinUpdate.cmd
C:\WINDOWS\oba.exe
C:\WINDOWS\scla12.exe
C:\WINDOWS\system32\perfc016.dat
C:\WINDOWS\system32\perfh016.dat
c:\windows\system32\vturoop.dll
C:\WINDOWS\system32\jgpapi.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\!KillBox
C:\!KillBox\Logs\kb.log
C:\!KillBox\migice.dll
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp1.tmp.exe
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp2C.tmp.exe
C:\DOCUME~1\Marcos_2\DADOSD~1\tmp3.tmp.exe
C:\fhexdump.dll
C:\WINDOWS\awurst.dll
C:\WINDOWS\khihee.dll
C:\WINDOWS\oba.exe
C:\WINDOWS\scla12.exe
C:\WINDOWS\system32\drivers\RKL66.tmp.sys
C:\WINDOWS\system32\migice.dll
C:\WINDOWS\system32\perfc016.dat
C:\WINDOWS\system32\perfh016.dat
C:\WINDOWS\system32\WinUpdate.cmd
C:\WINDOWS\urpomj.dll
C:\WINDOWS\WebAssist.dll


((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))


2007-08-06 21:46 d——– C:\spoolerlogs
2007-08-06 13:28 d——– C:\Arquivos de programas\Trend Micro
2007-08-06 12:31 d——– C:\WINDOWS\CSC
2007-08-06 04:09 d——– C:\DOCUME~1\MARCOS\DADOSD~1\Lavasoft
2007-08-06 03:34 9,464 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-08-06 03:34 9,336 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-08-06 03:34 43,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-08-06 03:34 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2007-08-05 17:05 d——– C:\WINDOWS\pss
2007-08-05 16:52 d——– C:\DOCUME~1\MARCOS\.housecall6.6
2007-08-04 21:57 d——– C:\VundoFix Backups
2007-08-04 20:35 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-03 20:28 d——– C:\Arquivos de programas\VideoLAN
2007-08-03 20:21 21,764 –a—— C:\WINDOWS\system32\CoreAAC-uninstall.exe
2007-08-03 20:16 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\Media Player Classic
2007-08-03 20:15 d——– C:\Arquivos de programas\XP Codec Pack
2007-08-03 19:42 d——– C:\Arquivos de programas\GSpot
2007-08-03 18:37 d——– C:\Arquivos de programas\ffdshow
2007-08-01 03:19 d——– C:\DOCUME~1\ALLUSE~1\DADOSD~1\Macrovision
2007-08-01 03:18 d——– C:\Arquivos de programas\Arquivos comuns\Macromedia Shared
2007-07-22 12:23 d——– C:\DOCUME~1\Marcos_2\DADOSD~1\.Torrent Swapper
2007-07-22 12:22 d——– C:\Arquivos de programas\Swapper
2007-07-19 16:03 d——– C:\Arquivos de programas\Flash Optimizer
2007-07-19 15:28 d——– C:\Arquivos de programas\Liatro
2007-07-19 15:05 d——– C:\Arquivos de programas\Eltima Software


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-07 02:51 ——— d——– C:\Arquivos de programas\Soulseek
2007-08-06 03:34 ——— d——– C:\Arquivos de programas\Winamp
2007-08-06 00:08 ——— d——– C:\Arquivos de programas\GetRight
2007-08-02 00:18 134 –a—— C:\autoexec.bat
2007-08-01 03:18 ——— d–h—– C:\Arquivos de programas\InstallShield Installation Information
2007-07-22 00:19 ——— d——– C:\Arquivos de programas\GbPlugin
2007-06-26 23:16 292 –a—— C:\mediamp3.dat
2007-06-26 23:12 ——— d——– C:\Arquivos de programas\MP3 Player Utilities 4.05
2007-06-10 20:53 ——— d——– C:\Arquivos de programas\IVT Corporation
2007-06-09 13:05 ——— d——– C:\Arquivos de programas\QuickTime
2007-06-07 16:10 20480 –a—— C:\WINDOWS\system32\ac3config.exe
2007-06-07 00:57 ——— d——– C:\Arquivos de programas\Total Video Converter
2007-05-16 12:13 86528 –a–c— C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 12:13 85504 –a–c— C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 12:13 683520 –a–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 12:13 683520 –a—— C:\WINDOWS\system32\inetcomm.dll
2007-05-16 12:13 510976 –a–c— C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 12:13 1314816 –a–c— C:\WINDOWS\system32\dllcache\msoe.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe" [2007-04-20 12:31]
"EPSON Stylus C67 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.exe" [2005-01-25 04:00]
"Adobe Photo Downloader"="C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" []
"SunJavaUpdateSched"="C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"QuickTime Task"="C:\Arquivos de programas\QuickTime\qttask.exe" [2007-06-09 13:01]
"Adobe Reader Speed Launcher"="C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"mmtask"="c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Arquivos de programas\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

C:\Documents and Settings\MARCOS\Menu Iniciar\Programas\Inicializar\
Scanner Utilities.lnk - C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE [2007-05-08 06:00:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E37CB5F0-51F5-4395-A808-5FA49E399008}"= C:\WINDOWS\Downloaded Program Files\gbiehuni.dll [2007-03-06 10:00 222376]
"{E37CB5F0-51F5-4395-A808-5FA49E399003}"= C:\WINDOWS\Downloaded Program Files\gbiehCef.dll [2007-03-07 11:09 219456]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"GbpSv"=2 (0x2)
"SoundMAX Agent Service (default)"=2 (0x2)

R0 BTHidMgr;Bluetooth HID Manager Service;C:\WINDOWS\system32\Drivers\BTHidMgr.sys
R0 gagp30kx;Microsoft Generic AGPv3.0 Filter for K8 Processor Platforms;C:\WINDOWS\system32\DRIVERS\gagp30kx.sys
R2 Av260cn;Av260cn;C:\WINDOWS\system32\drivers\Av260cn.sys
R2 Av260cnb;Av260cnb;C:\WINDOWS\system32\drivers\Av260cnb.sys
R2 Av260cnd;Av260cnd;C:\WINDOWS\system32\drivers\Av260cnd.sys
R2 GbpSv;Gbp Service;C:\Arquivos de programas\GbPlugin\GbpSv.exe
R3 BlueletAudio;Bluetooth Audio Service;C:\WINDOWS\system32\DRIVERS\blueletaudio.sys
R3 BTHidEnum;Bluetooth HID Enumerator;C:\WINDOWS\system32\DRIVERS\vbtenum.sys
R3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
R3 MxlW2k;MxlW2k;C:\WINDOWS\system32\drivers\MxlW2k.sys
R3 ROOTMODEM;Microsoft Legacy Modem Driver;C:\WINDOWS\system32\Drivers\RootMdm.sys
R3 VComm;Virtual Serial port driver;C:\WINDOWS\system32\DRIVERS\VComm.sys
R3 VcommMgr;Bluetooth VComm Manager Service;C:\WINDOWS\system32\Drivers\VcommMgr.sys
S3 BT;Bluetooth PAN Network Adapter;C:\WINDOWS\system32\DRIVERS\btnetdrv.sys
S3 Btcsrusb;Bluetooth USB For Bluetooth Service;C:\WINDOWS\system32\Drivers\btcusb.sys
S3 USB_RNDIS;USB Remote NDIS Network Device Driver;C:\WINDOWS\system32\DRIVERS\usb8023.sys
S4 SoundMAX Agent Service (default);SoundMAX Agent Service;C:\Arquivos de programas\Analog Devices\SoundMAX\SMAgent.exe


Contents of the 'Scheduled Tasks' folder
2007-08-07 03:00:00 C:\WINDOWS\Tasks\At1.job
2007-08-04 12:00:30 C:\WINDOWS\Tasks\At10.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 13:00:30 C:\WINDOWS\Tasks\At11.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At12.job
2007-08-04 00:19:17 C:\WINDOWS\Tasks\At13.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 16:00:00 C:\WINDOWS\Tasks\At14.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 17:00:00 C:\WINDOWS\Tasks\At15.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 18:00:00 C:\WINDOWS\Tasks\At16.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 19:00:00 C:\WINDOWS\Tasks\At17.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 20:00:00 C:\WINDOWS\Tasks\At18.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 21:00:00 C:\WINDOWS\Tasks\At19.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 04:00:00 C:\WINDOWS\Tasks\At2.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 22:00:35 C:\WINDOWS\Tasks\At20.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 23:00:30 C:\WINDOWS\Tasks\At21.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-05 00:01:08 C:\WINDOWS\Tasks\At22.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 01:00:00 C:\WINDOWS\Tasks\At23.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 02:00:00 C:\WINDOWS\Tasks\At24.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-07 05:00:00 C:\WINDOWS\Tasks\At3.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 06:00:00 C:\WINDOWS\Tasks\At4.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-06 07:00:03 C:\WINDOWS\Tasks\At5.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 08:00:30 C:\WINDOWS\Tasks\At6.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 09:00:31 C:\WINDOWS\Tasks\At7.job
2007-08-04 10:00:30 C:\WINDOWS\Tasks\At8.job - C:\WINDOWS\system32\M3XIl4n1.exe
2007-08-04 11:00:30 C:\WINDOWS\Tasks\At9.job - C:\WINDOWS\system32\M3XIl4n1.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-07 02:54:06
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-07 2:54:46
C:\ComboFix-quarantined-files.txt … 2007-08-07 02:54
C:\ComboFix2.txt … 2007-08-07 00:14
C:\ComboFix3.txt … 2007-08-06 14:53

— E O F —




Logfile of HijackThis v1.99.1
Scan saved at 02:55:16, on 7/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Arquivos de programas\GbPlugin\GbpSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Roberto\programas\Spyware.exe.exe

O2 - BHO: Facilitador de Leitor de Link Adobe PDF - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Arquivos de programas\Arquivos comuns\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: G-Buster Browser Defense CEF - {C41A1C0E-EA6C-11D4-B1B8-444553540003} - C:\WINDOWS\Downloaded Program Files\gbiehCef.dll
O2 - BHO: G-Buster Browser Defense Unibanco - {C41A1C0E-EA6C-11D4-B1B8-444553540008} - C:\WINDOWS\Downloaded Program Files\gbiehuni.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\ARQUIV~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [EPSON Stylus C67 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAL.EXE /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Arquivos de programas\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Arquivos de programas\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Arquivos de programas\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Arquivos de programas\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Arquivos de programas\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: Scanner Utilities.lnk = C:\WINDOWS\twain_32\Minipa\ms9600c\SCANER32.EXE
O8 - Extra context menu item: E&xportar para o Microsoft Excel - res://C:\ARQUIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Arquivos de programas\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Pesquisar - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARQUIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Arquivos de programas\Messenger\msmsgs.exe
O14 - IERESET.INF: SEARCH_PAGE_URL=&http://home.microsoft.com/intl/br/access/allinone.asp
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399003} (GbPluginObj Class) - https://imagem.caixa.gov.br/cab/GbPluginCef.cab
O16 - DPF: {E37CB5F0-51F5-4395-A808-5FA49E399008} (GbPluginObj Class) - https://clickbanking.unibanco.com.br/GbPlug…GbPluginUni.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARQUIV~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\ARQUIV~1\Grisoft\AVG7\avgemc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Arquivos de programas\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Gbp Service (GbpSv) - Unknown owner - C:\Arquivos de programas\GbPlugin\GbpSv.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Arquivos de programas\Arquivos comuns\Macromedia Shared\Service\Macromedia Licensing.exe
Post #14
How I could got this Virtumonde trojan? Can i catch from only being using Emule, Soulseek, or programs like this, or only surfing the internet and stuff like that?
Post #15
Vundo can be picked through file sharing, music file sharing, downloading "Spyware Protection Programs" of ill repute. You just have to surf smartly and even then you can pick things up.


A. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

http://forums.tomcoyote.org/Virtumonde_t81989.html#

Collect::
C:\WINDOWS\system32\M3XIl4n1.exe

File:
C:\WINDOWS\Tasks\At10.job 
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job 
C:\WINDOWS\Tasks\At15.job 
C:\WINDOWS\Tasks\At16.job 
C:\WINDOWS\Tasks\At17.job 
C:\WINDOWS\Tasks\At18.job 
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job 
C:\WINDOWS\Tasks\At20.job 
C:\WINDOWS\Tasks\At21.job 
C:\WINDOWS\Tasks\At22.job 
C:\WINDOWS\Tasks\At23.job 
C:\WINDOWS\Tasks\At24.job 
C:\WINDOWS\Tasks\At3.job 
C:\WINDOWS\Tasks\At4.job 
C:\WINDOWS\Tasks\At5.job 
C:\WINDOWS\Tasks\At6.job 
C:\WINDOWS\Tasks\At8.job 
C:\WINDOWS\Tasks\At9.job 

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


5. Additonally, ComboFix will generate the following files on your desktop
  • A zipped file on your desktop called Submit [Date Time].zip
  • And another file named - CF-Submit.htm
6. ComboFix may need to reboot to finish its work. Let it.

7. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

8. Next, a window will popup prompting you to "Submit Files for further analysis". Click "OK"

9. Your system's browser will automatically respond by loading the CF-Submit.htm file and open a window :
  • Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
  • Click on the file to Select it.
  • Submit the file by clicking "OK"
10. Once the file has been submitted, you may DELETE both files on your desktop.

11. Post the following reports/logs into your next reply:
  • Combofix.txt
  • A new HijackThis log.

B. Download Gmer
  • Disconnect from internet and close running programs.
  • There is a small chance this application may crash your computer so save any work you have open.
  • Double click gmer.exe
  • Let the gmer.sys driver load if asked.
  • If it gives you a warning at program start about rootkit activity and asks if you want to run scan…say Ok.
  • If no warning….
  • Click "Rootkit" tab and click "Scan"
  • Once done, click "Copy"
  • Open Notepad and hit "ctrl+v" to paste the log.
  • Reconnect to the internet and post the log back to this thread please.

C. Reports/Logs to produce
  • ComboFix.txt
  • Fresh HijackThis log
  • GMER report

Regards,

Trevuren

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI