[Resolved] Dropper.Agent.GIT Warnings, now errors on startup - HJ

Hi Dan, Kaspersky scan is underway. I just wanted to give you the heads up that the link didnt work- it looks like the site automatically kicked me to the USA site and there seems to be a problem with the online scan there. If you switch to the global site (using the dropdown in the header) and then click 'Free Virus Scan' it goes no problem.

Obviously this is only an issue for folks in the USA but hopefully this info may help someone else….the online scan doesnt appear to be the easiest thing to find on the site

Ill post logs once the scan is complete.

Again, thanks for your help.

Here is the Kaspersky Log, looks like virtumonde is still around (Fresh HJT to follow): ——————————————————————————- KASPERSKY ONLINE SCANNER REPORT Saturday, January 05, 2008 9:56:34 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 6/01/2008 Kaspersky Anti-Virus database records: 502987 ——————————————————————————- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: A:\ C:\ D:\ Scan Statistics: Total number of scanned objects: 84833 Number of viruses found: 1 Number of infected objects: 1 Number of suspicious objects: 0 Duration of the scan process: 02:30:07 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\075806024a6a76b3b26b10ece4c3ebf4_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\637254c75e2776d653fdfc879acefce9_1dce0e75-1303-433a-bfc1-6b582bd25551 Object is locked skipped C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\cert8.db Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\history.dat Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\key3.db Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\parent.lock Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\search.sqlite Object is locked skipped C:\Documents and Settings\Matt\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\urlclassifier2.sqlite Object is locked skipped C:\Documents and Settings\Matt\Cookies\INDEX.DAT Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\Cache\_CACHE_001_ Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\Cache\_CACHE_002_ Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\Cache\_CACHE_003_ Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Application Data\Mozilla\Firefox\Profiles\bhep780q.default\Cache\_CACHE_MAP_ Object is locked skipped C:\Documents and Settings\Matt\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Matt\Local Settings\History\History.IE5\MSHist012008010520080106\index.dat Object is locked skipped C:\Documents and Settings\Matt\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped C:\Documents and Settings\Matt\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Matt\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Matt\UserData\index.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP907\A0212510.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.diu skipped C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP910\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\Sti_Trace.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WIADEBUG.LOG Object is locked skipped C:\WINDOWS\WIASERVC.LOG Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped Scan process completed.

Okay I believe the AWF infection is pretty much cleared up. The file that Kaspersky found is in your restore points, and we'll clear those out at the end.

Please double-click the FindAWF icon once again
This time we are going to remove some folders.

As instructed, press any key to continue.
Use the following option: Press 3 then Enter to remove bak folders

A text file opens called: folders.txt
Click below the line and paste the following list of folders in the code box to be removed:

C:\WINDOWS\bak
C:\Program Files\iTunes\bak
C:\Program Files\QuickTime\bak
C:\WINDOWS\SYSTEM32\bak
C:\Program Files\Intel\Modem Event Monitor\bak
C:\WINDOWS\SYSTEM32\dla\bak
C:\Program Files\Common Files\Real\Update_OB\bak
C:\Program Files\Common Files\Sonic\Update Manager\bak
C:\Program Files\Java\j2re1.4.2_03\bin\bak

Next, close and click Yes to save the changes.

When done with the above, FindAWF automatically runs a new scan and opens a new log that you need to post.
Please provide the new FindAWF log in your reply.


Update Java Runtime:

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 3.

• Go to http://java.sun.com/javase/downloads/index.jsp
• Click on the link named Java Runtime Environment (JRE) 6 Update 3
• Click on the radio button to Accept License Agreement
• Click on Windows Offline Installation, Multi-language and save the downloaded file to your hard disk
• Go to Start => Control Panel => Add or Remove Programs
• Uninstall all old versions of Java (Java 2 Runtime Environment, JRE or JSE)
• Reboot your computer
• Delete the folder C:\Program Files\Java if present
• Install the new version by running the newly-downloaded file, and follow the on-screen instructions.
• Reboot your computer

Post a new Hijackthis log also.

Hi Dan, AWF went smoothly, here is the log: Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: Sun 01/06/2008 The current time is: 9:03:36.15 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\GRISOFT\AVG7\BAK 09/20/2007 09:29 AM 421,888 avgcc.exe 1 File(s) 421,888 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 579072 Jan 5 2008 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 421888 Sep 20 2007 "C:\Program Files\Grisoft\AVG7\bak\avgcc.exe" end of report updating Java and will post a fresh HJT log when finished. THANKS! Matt

Good…this one is still there. You can use Windows Explorer to manually remove the folder. You already re-installed AVG anyway, this just gets rid of the debris.

C:\Program Files\Grisoft\AVG7\bak

You can also run option 4 on AWF. That should get rid of the 015 in your log.

Double-click the FindAWF icon once again.
Use the following option: Press 4 then Enter to reset domain zones.

When the program returns to the main menu, use the following option:
Press E then Enter to EXIT

Looks good

How's it running? We can clean up Combofix and associated files/folders.

Time for some housekeeping

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  
  
• [external image: Posted Image]

The above procedure will:

• Delete the following:
  • ComboFix and its associated files and folders.
  • VundoFix backups, if present
  • The C:\Deckard folder, if present
  • The C:_OtMoveIt folder, if present
• Reset the clock settings.
• Hide file extensions, if required.
• Hide System/Hidden files, if required.
• Reset System Restore.

If all is well you may want to consider some or all of the following:

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly or set your computer to receive automatic updates. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware

Install SpywareGuard - SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.
A tutorial on installing & using this product can be found here:
Using SpywareGuard to protect your computer from Spyware and Malware

Use IESpy-Ad -
IESpy-Ad will block access to malicious websites so you cannot be redirected to them from an infected site or email. Instructions for set up and use can be found at the website.

Update all of your Anti-Malware programs regularly - Make sure you update all the programs I have listed and the ones you are currently running regularly. Without regular updates you Will Not be protected when new malicious programs are released.

Here is a great link to a post here on securing your PC after an attack.
http://www.geekstogo.com/forum/index.php?a…;page=How_did_I

Hi Dave,

Thanks! ComboFix is uninstalled and everything seems to be running smoothly.

Im currently only running windows firewall, In another post I noticed that you listed a few firewall applications that you liked one of which was very much like Outpost. Was this the Outpost you were talking about: http://www.agnitum.com/products/outpost/ Im kind of skeptical of any russian based security company that Ive never heard of, but if you have more info (or opinions) on this product Id be very interested to hear them.

Again, thanks a ton. You are the man (or dude if you are a Lebowski fan ). Enjoy the snow!

Matt

I don't have much experience with Outpost but I do believe it's good. Some of them have gone from free to either low priced or can be had if you give your email addy to their sponsors, but you'll get spammed like crazy. That one is Sunbelt/Kerio personal firewall. I like it as it's better than the Windows firewall, but doesn't use excessive resources like ZoneAlarm. It is not very intrusive with pop-ups asking what you would like to do every time you surf somewhere new. It was free not long ago but is now 10 bucks. Still worth it in my opinion. Also, we don't really address hardware firewalls here, but if you are behind a router then most of them have firewall protection also, so that with the Windows firewall may be fine. Hope that helps, Dave

Ahh yes…this entry is trying to load it:

F3 - REG:win.ini: load=C:\WINDOWS\system32\vtutq.exe


Let's try a simple fix with HJT on that entry.

Run HijackThis. Hit None of the above, Click Do a System Scan Only. Put a Check in the box on the left side on this:

F3 - REG:win.ini: load=C:\WINDOWS\system32\vtutq.exe

Then close all windows except this one and press Fix checked.

Reboot and see if the error reappears. Also run HJT again and post the log from her user account.

You're welcome, not seeing anything else bad there so that should do it, unless there are any other users….. Dave