What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Virtumonde malvare I think?

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I've used spy bot multiple times to erase it but it always comes back on my laptop. the anti virus has no effect, it doesn't even find it (NAV07) I think windows is updated with SP2. Thanks for your help. Very much appreciated.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:22:10, on 24.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programfiler\Internet Explorer\iexplore.exe
C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Programfiler\Symantec\LiveUpdate\ALuNotify.exe
C:\WINDOWS\system32\rsvp.exe
C:\WINDOWS\explorer.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = ###### you, you ####### ######!! hahaha
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkkkj.exe
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [f4baa897] rundll32.exe "C:\WINDOWS\system32\jgcjdywt.dll",b
O4 - HKLM\..\Run: [ALUAlert] C:\Programfiler\Symantec\LiveUpdate\ALuNotify.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download Links As… - file://C:\WINDOWS\system32\page.htm
O8 - Extra context menu item: Download Target(s) As… - file://C:\WINDOWS\system32\link.htm
O8 - Extra context menu item: Download with GetRight Pro - C:\Programfiler\GetRight\GRdownload.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Programfiler\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programfiler\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english…an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/res…scbase4009.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de…e/HPDEXAXO.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\FELLES~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 7454 bytes
Post #2
Hello Rine and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem. It appears likely that your system has been infected with a Vundo trojan file infector. This trojan renames legitimate startup executables and replaces them with malware. We will attempt to reverse the process but please be advised that most often, there are programs that can not be salvaged and will need to be reinstalled.

Please print out or copy this page to Notepad. Make sure to download all the required tools to your desktop before starting. If there is anything that you do not understand, ask your question(s) before proceeding with the fixes.

A. Tools to download:
  • Right click HERE and Save As (in IE it's "Save Target As") in order to download DelDomains.inf to your desktop.
  • Download SDFix and save it to your Desktop.
  • Download ComboFix and save it to your desktop.

**Note: In the event you already have SDFix and/or ComboFix, these are new versions that I need you to download. It is important that they are saved directly to your desktop**


B. Running the Tools


1. Run DelDomains:

Right click DelDomains.inf and select: Install (no need to restart)
Note: This will remove all entries in the "Trusted Zone" and "Ranges" also.


Very Important!

Before running SDFix and ComboFix:
  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with both SDFix and ComboFix and remove some of their embedded files which may cause "unpredictable results".
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Also, make sure you are physically disconnected from the Internet (unplug the cable) after downloading the programs but before running the files.


2. Run SDFix:

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Now reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually
  • Instead of Windows loading as normal, the Advanced Options Menu should appear
  • Select the first option, to run Windows in Safe Mode, then press Enter
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  • Finally, copy the content of Report.txt to Notepad and Save it to your Desktop as you will be asked to post it later on.


3. Run ComboFix:

WARNING:
  • IF you have not already done so ComboFix will disconnect your machine from the Internet when it starts.
  • Do not re-connect your machine back to the Internet until ComboFix has completely finished.
  • If there is no Internet connection when Combofix has completely finished, just restart your computer to restore the connection.

Double-click on combofix.exe and follow the prompts. When finished, it will produce a report for you.


**Note: Do not mouseclick comboFix's window while it's running. That may cause it to stall**


C. After ComboFix has finished its run:
  • Restart/re-enable all the programs that you disabled before running the tools.
  • Physically reconnect to the internet.

D. Posting Logs/Reports:
  • Report.txt
  • C:\ComboFix.txt
  • A new HijackThis log run after all the tools have been run.
Post #3 last edited
First of all, thank you so much for helping me out! It looks like its working good now. Here are the logs! Keep up the good work!

But I do have another question for you. When I wanted to disable NIS, it didn't work. I suspect that the virus had killed one of the processes? And what AV program would you recommend? I have loads of friends who recommend NOD32. Is that the best one? I don't trust NIS anymore as I got this shitty virus with it, and it didn't even find it…. It looks to me as all the AV scanners find different viruses? Is that so?


SDFix: Version 1.131

Run by [removed] on 25.01.2008 at 00:56

Microsoft Windows XP [Versjon 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\system32\NTSpool.exe - Deleted





Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\explorer.exe
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 01:12:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programfiler\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:f9,2a,1a,e0,ec,6a,22,a0,8a,e5,e0,91,92,d8,d3,9d,98,a1,9e,8a,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,44,38,a1,7b,65,f6,a5,9f,24,1f,16,de,f8,f7,3e,02,ca,..
"khjeh"=hex:a6,bc,fc,65,a1,57,fc,f1,c3,4d,84,b0,26,76,b2,c9,3f,5a,1d,a2,3a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4a,7a,c2,27,e0,fd,a0,f8,dc,0c,66,74,94,90,20,c3,55,37,a8,e2,19,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Programfiler\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:f9,2a,1a,e0,ec,6a,22,a0,8a,e5,e0,91,92,d8,d3,9d,98,a1,9e,8a,7e,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,44,38,a1,7b,65,f6,a5,9f,24,1f,16,de,f8,f7,3e,02,ca,..
"khjeh"=hex:a6,bc,fc,65,a1,57,fc,f1,c3,4d,84,b0,26,76,b2,c9,3f,5a,1d,a2,3a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:4a,7a,c2,27,e0,fd,a0,f8,dc,0c,66,74,94,90,20,c3,55,37,a8,e2,19,..

scanning hidden registry entries …

scanning hidden files …


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programfiler\\MSN Messenger\\msnmsgr.exe"="C:\\Programfiler\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Programfiler\\MSN Messenger\\livecall.exe"="C:\\Programfiler\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Programfiler\\uTorrent\\uTorrent.exe"="C:\\Programfiler\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\Programfiler\\Skype\\Phone\\Skype.exe"="C:\\Programfiler\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programfiler\\MSN Messenger\\msnmsgr.exe"="C:\\Programfiler\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Programfiler\\MSN Messenger\\livecall.exe"="C:\\Programfiler\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 20 Jan 2008 1,073,292 ..SH. — "C:\WINDOWS\system32\dykktgou.tmp"
Thu 7 Dec 2006 122,880 A..H. — "C:\WINDOWS\system32\NTSecurity.exe"
Sat 29 Dec 2007 4,348 ..SH. — "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Fri 7 Dec 2007 16,138 …H. — "C:\Documents and Settings\Master\Mine dokumenter\Skolestuff\graduation\~WRL0003.tmp"

Finished!
Post #4
ComboFix 08-01-23.1B - Master 2008-01-25 1:29:05.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.245 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Skrivebord\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\byxwtuv.dll
C:\WINDOWS\system32\dykktgou.ini
C:\WINDOWS\system32\dykktgou.ini2
C:\WINDOWS\system32\dykktgou.tmp
C:\WINDOWS\system32\gfggh.ini
C:\WINDOWS\system32\gfggh.ini2
C:\WINDOWS\system32\jgcjdywt.dll
C:\WINDOWS\system32\jkkkj.dll
C:\WINDOWS\system32\jkkkj.ini
C:\WINDOWS\system32\jkkkj.ini2
C:\WINDOWS\system32\lklnn.ini
C:\WINDOWS\system32\lklnn.ini2
C:\WINDOWS\system32\nqtwa.ini
C:\WINDOWS\system32\nqtwa.ini2
C:\WINDOWS\system32\rtbimrcw.ini
C:\WINDOWS\system32\twydjcgj.ini
C:\WINDOWS\system32\wcrmibtr.dll
F:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-25 01:25 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-25 00:52 . 2008-01-25 00:53 d——– C:\WINDOWS\ERUNT
2008-01-24 12:18 . 2008-01-24 12:18 d——– C:\Programfiler\Lavasoft
2008-01-24 11:42 . 2008-01-24 11:42 d——– C:\VundoFix Backups
2008-01-24 01:21 . 2008-01-24 01:21 d——– C:\Programfiler\Trend Micro
2008-01-23 16:22 . 2008-01-23 16:22 d——– C:\WINDOWS\system32\Kaspersky Lab
2008-01-22 13:16 . 2008-01-22 13:22 d——– C:\Programfiler\Windows Live Safety Center
2008-01-21 18:33 . 2008-01-21 18:33 d——– C:\Programfiler\Security Task Manager
2008-01-21 13:16 . 2008-01-22 07:54 416 –a—— C:\WINDOWS\wininit.ini
2008-01-21 00:34 . 2008-01-21 18:19 1,073,472 —hs—- C:\WINDOWS\system32\jtunnlan.ini
2008-01-18 10:41 . 2008-01-18 10:42 339,968 –a—— C:\amdcpuid.exe
2008-01-15 12:12 . 2008-01-15 12:12 5,312 –a—— C:\Downloaded Files
2008-01-09 03:03 . 2008-01-09 03:03 118 –a—— C:\WINDOWS\system32\MRT.INI
2008-01-01 19:03 . 2008-01-01 19:03 d——– C:\Programfiler\Kwyshell
2007-12-25 21:11 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-25 00:08 ——— d—–w C:\Programfiler\MSN Messenger
2008-01-24 23:13 ——— d—–w C:\Programfiler\Fellesfiler\Symantec Shared
2008-01-24 16:58 ——— d—–w C:\Programfiler\Norton Internet Security
2008-01-24 11:17 ——— d—–w C:\Programfiler\Fellesfiler\Wise Installation Wizard
2008-01-23 00:07 ——— d—–w C:\Programfiler\mIRC
2008-01-15 23:56 ——— d—–w C:\Programfiler\DC++
2008-01-09 00:48 ——— d—–w C:\Programfiler\GetRight
2007-12-25 20:10 ——— d—–w C:\Programfiler\Java
2007-12-07 17:12 ——— d—–w C:\Programfiler\TuneUp Utilities 2007
2007-12-05 14:16 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-05 14:16 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-05 14:16 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-12-05 14:16 ——— d—–w C:\Programfiler\Symantec
2007-11-30 22:57 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-11-30 22:57 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-11-30 22:57 279,088 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-11-30 22:57 10,545 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-11-30 22:57 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-11-30 22:57 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-11-30 22:57 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
.
—-a-w		   583,048 2008-01-24 21:04:30  C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe
—-a-w		 5,674,352 2008-01-24 19:45:59  C:\Programfiler\MSN Messenger\MsnMsgr .Exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2008-01-25 01:14 5674352]
"SpybotSD TeaTimer"="C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 10:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Symantec PIF AlertEng"="C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-25 01:17 583048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:03 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Device Detector"=DevDetect.exe -autorun

R0 viaagp1;VIA AGP Filter;C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2002-12-26 21:41]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:03]
S3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-08-15 18:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-18 16:55:27 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programfiler\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-20 11:11:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Master.job"
- C:\Programfiler\Norton Internet Security\Norton AntiVirus\Navw32.exek/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 01:48:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 1:54:57 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-25 00:54:54
.
2008-01-09 02:04:17 — E O F —
Post #5
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:19:40, on 25.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programfiler\GetRight\xx2gr.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programfiler\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download Links As… - file://C:\WINDOWS\system32\page.htm
O8 - Extra context menu item: Download Target(s) As… - file://C:\WINDOWS\system32\link.htm
O8 - Extra context menu item: Download with GetRight Pro - C:\Programfiler\GetRight\GRdownload.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Programfiler\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programfiler\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~2\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\FELLES~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programfiler\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 7407 bytes
Post #6
As previously noted, this file infector corrupts startup executables. Our tools attempt to replace these corrupted files with the legitimate versions when one is available. In your case, there is only one program that mustbe uninstalled then reinstalled because their is no replacement file to be found: Spybot. Please do not complete this procedure before your system has been all cleaned up as their could still be remnants of this infection on your system.


A. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File::
C:\WINDOWS\system32\jtunnlan.ini
C:\WINDOWS\system32\MRT.INI

RenV::
—-a-w		   583,048 2008-01-24 21:04:30  C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe
—-a-w		 5,674,352 2008-01-24 19:45:59  C:\Programfiler\MSN Messenger\MsnMsgr .Exe

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"=-

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply after you re-enable all the programs that were disabled during the running of ComboFix:
  • Combofix.txt
  • A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


B. I need you to run the following scan: Eset Online Scanner
  • Place a check mark in the box YES, I accept the Terms Of Use
  • Click the Start button.
  • Now click the Install button.
  • Click Start. The scanner engine will initialize and update.
  • Do Not place a check mark in the box beside Remove found threats.
  • Click the Scan button. The scan will now run, please be patient.
  • When the scan finishes click the Details tab.
  • Copy and paste the contents of the C:\ProgramFiles\EsetOnlineScanner\log.txt into your next reply.
Post #7
ComboFix 08-01-23.1B - Master 2008-01-26 12:48:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.205 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Skrivebord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Master\Skrivebord\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\jtunnlan.ini
C:\WINDOWS\system32\MRT.INI
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\jtunnlan.ini
C:\WINDOWS\system32\MRT.INI

.
((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-25 09:01 . 2008-01-25 09:56 d——– C:\Programfiler\Norton Internet Security
2008-01-25 08:59 . 2008-01-25 09:41 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-25 08:59 . 2008-01-25 09:41 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-01-25 08:59 . 2008-01-25 09:41 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-01-25 08:59 . 2008-01-25 09:41 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-01-25 01:25 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-25 00:52 . 2008-01-25 00:53 d——– C:\WINDOWS\ERUNT
2008-01-24 11:42 . 2008-01-24 11:42 d——– C:\VundoFix Backups
2008-01-24 01:21 . 2008-01-24 01:21 d——– C:\Programfiler\Trend Micro
2008-01-22 13:16 . 2008-01-22 13:22 d——– C:\Programfiler\Windows Live Safety Center
2008-01-21 18:33 . 2008-01-21 18:33 d——– C:\Programfiler\Security Task Manager
2008-01-21 13:16 . 2008-01-22 07:54 416 –a—— C:\WINDOWS\wininit.ini
2008-01-18 10:41 . 2008-01-18 10:42 339,968 –a—— C:\amdcpuid.exe
2008-01-15 12:12 . 2008-01-15 12:12 5,312 –a—— C:\Downloaded Files
2008-01-01 19:03 . 2008-01-01 19:03 d——– C:\Programfiler\Kwyshell

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 11:48 ——— d—–w C:\Programfiler\MSN Messenger
2008-01-26 11:46 ——— d—–w C:\Programfiler\Fellesfiler\Symantec Shared
2008-01-25 11:02 ——— d—–w C:\Programfiler\Fellesfiler\Wise Installation Wizard
2008-01-25 08:41 ——— d—–w C:\Programfiler\Symantec
2008-01-24 16:53 158,208 —-a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
2008-01-23 00:07 ——— d—–w C:\Programfiler\mIRC
2008-01-15 23:56 ——— d—–w C:\Programfiler\DC++
2008-01-09 00:48 ——— d—–w C:\Programfiler\GetRight
2007-12-25 20:10 ——— d—–w C:\Programfiler\Java
2007-12-07 17:12 ——— d—–w C:\Programfiler\TuneUp Utilities 2007
2007-11-30 22:57 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-11-30 22:57 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-11-30 22:57 279,088 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-11-30 22:57 10,545 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-11-30 22:57 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-11-30 22:57 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-11-30 22:57 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-11-07 09:30 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-11-04 18:22 585,728 —-a-w C:\WINDOWS\system32\bsratswf.dll
2007-11-04 18:22 147,456 —-a-w C:\WINDOWS\system32\bsratwmv.dll
2007-11-04 17:27 28,672 —-a-w C:\WINDOWS\system32\lcdmrm.exe
2007-10-30 18:55 625,032 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-30 18:55 242,056 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-10-29 22:45 1,290,752 —-a-w C:\WINDOWS\system32\quartz.dll
.
—-a-w		   583,048 2008-01-24 21:04:30  C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe


((((((((((((((((((((((((((((( snapshot@2008-01-25_ 1.54.35.13 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-25 00:27:13 1,409,024 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 11:48:05 1,409,024 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-25 00:27:14 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-26 11:48:05 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-25 00:27:17 5,894,144 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-26 11:48:05 1,413,120 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-25 00:27:18 184,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-26 11:48:05 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-25 00:27:20 1,413,120 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-26 11:48:05 5,894,144 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-25 00:27:20 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 11:48:06 184,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2008-01-24 20:45 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 10:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Symantec PIF AlertEng"="C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-25 01:17 583048]
"ccApp"="C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" [2007-01-10 06:59 115816]
"osCheck"="C:\Programfiler\Norton Internet Security\osCheck.exe" [2007-01-14 08:11 771704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:03 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Device Detector"=DevDetect.exe -autorun

R0 viaagp1;VIA AGP Filter;C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2002-12-26 21:41]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:03]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-08-15 18:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - APPMGMT
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 19:38:41 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programfiler\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-25 08:16:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Master.job"
- C:\Programfiler\Norton Internet Security\Norton AntiVirus\Navw32.exek/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 12:51:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-26 12:52:41
ComboFix-quarantined-files.txt 2008-01-26 11:52:10
ComboFix2.txt 2008-01-25 00:54:58
.
2008-01-09 02:04:17 — E O F —
Post #8
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:01:35, on 26.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programfiler\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download Links As… - file://C:\WINDOWS\system32\page.htm
O8 - Extra context menu item: Download Target(s) As… - file://C:\WINDOWS\system32\link.htm
O8 - Extra context menu item: Download with GetRight Pro - C:\Programfiler\GetRight\GRdownload.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Programfiler\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programfiler\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\FELLES~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 6835 bytes
Post #9
# version=4 # OnlineScanner.ocx=1.0.0.56 # OnlineScannerDLLA.dll=1, 0, 0, 51 # OnlineScannerDLLW.dll=1, 0, 0, 51 # OnlineScannerUninstaller.exe=1, 0, 0, 49 # vers_standard_module=2824 (20080126) # vers_arch_module=1.063 (20080117) # vers_adv_heur_module=1.060 (20070601) # EOSSerial=b192c4adc0333145bab3c60f17688719 # end=finished # remove_checked=false # unwanted_checked=false # utc_time=2008-01-26 01:21:39 # local_time=2008-01-26 02:21:39 (+0100, Vest-Europa (normaltid)) # country="Norway" # osver=5.1.2600 NT Service Pack 2 # scanned=259652 # found=3 # scan_time=4517 C:\QooBox\Quarantine\catchme2008-01-25_ 14702.80.zip multiple infiltrations 13348E16C8B1A27FD79DF25E42403734 C:\QooBox\Quarantine\catchme2008-01-25_ 14702.80.zip »ZIP »byxwtuv.dll Win32/Adware.Virtumonde application 00000000000000000000000000000000 C:\QooBox\Quarantine\catchme2008-01-25_ 14702.80.zip »ZIP »jkkkj.dll Win32/Adware.Virtumonde.FP application 00000000000000000000000000000000 After I reenabled Norton it gives me an error on the phising protection. But I gues it doesn't matter as I'm going over to NOD32 ?
Post #10
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:
File::
C:\WINDOWS\system32\bsratswf.dll
C:\WINDOWS\system32\bsratwmv.dll
C:\WINDOWS\system32\lcdmrm.exe

RenV::
C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[external image: Posted Image]


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply after you re-enable all the programs that were disabled during the running of ComboFix:
  • Combofix.txt
  • A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.



After running the new script, please tell me how things are running. If all appears normal we will proceed with the final cleanup procedures.
Post #11
ComboFix 08-01-23.1B - Master 2008-01-27 14:31:27.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1044.18.176 [GMT 1:00]
Running from: C:\Documents and Settings\[removed]\Skrivebord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Master\Skrivebord\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\system32\bsratswf.dll
C:\WINDOWS\system32\bsratwmv.dll
C:\WINDOWS\system32\lcdmrm.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\bsratswf.dll
C:\WINDOWS\system32\bsratwmv.dll
C:\WINDOWS\system32\lcdmrm.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-26 13:04 . 2008-01-26 14:21 d——– C:\Programfiler\EsetOnlineScanner
2008-01-25 09:01 . 2008-01-25 09:56 d——– C:\Programfiler\Norton Internet Security
2008-01-25 08:59 . 2008-01-25 09:41 123,952 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-01-25 08:59 . 2008-01-25 09:41 60,800 –a—— C:\WINDOWS\system32\S32EVNT1.DLL
2008-01-25 08:59 . 2008-01-25 09:41 10,740 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-01-25 08:59 . 2008-01-25 09:41 805 –a—— C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-01-25 01:25 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-25 00:52 . 2008-01-25 00:53 d——– C:\WINDOWS\ERUNT
2008-01-24 11:42 . 2008-01-24 11:42 d——– C:\VundoFix Backups
2008-01-24 01:21 . 2008-01-24 01:21 d——– C:\Programfiler\Trend Micro
2008-01-22 13:16 . 2008-01-22 13:22 d——– C:\Programfiler\Windows Live Safety Center
2008-01-21 18:33 . 2008-01-21 18:33 d——– C:\Programfiler\Security Task Manager
2008-01-21 13:16 . 2008-01-22 07:54 416 –a—— C:\WINDOWS\wininit.ini
2008-01-18 10:41 . 2008-01-18 10:42 339,968 –a—— C:\amdcpuid.exe
2008-01-15 12:12 . 2008-01-15 12:12 5,312 –a—— C:\Downloaded Files
2008-01-01 19:03 . 2008-01-01 19:03 d——– C:\Programfiler\Kwyshell

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 13:29 ——— d—–w C:\Programfiler\Fellesfiler\Symantec Shared
2008-01-26 19:37 ——— d—–w C:\Programfiler\DC++
2008-01-26 11:48 ——— d—–w C:\Programfiler\MSN Messenger
2008-01-25 11:02 ——— d—–w C:\Programfiler\Fellesfiler\Wise Installation Wizard
2008-01-25 08:41 ——— d—–w C:\Programfiler\Symantec
2008-01-24 16:53 158,208 —-a-w C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe
2008-01-23 00:07 ——— d—–w C:\Programfiler\mIRC
2008-01-09 00:48 ——— d—–w C:\Programfiler\GetRight
2007-12-25 20:10 ——— d—–w C:\Programfiler\Java
2007-12-07 17:12 ——— d—–w C:\Programfiler\TuneUp Utilities 2007
2007-11-30 22:57 43,696 —-a-w C:\WINDOWS\system32\drivers\srtspx.sys
2007-11-30 22:57 317,616 —-a-w C:\WINDOWS\system32\drivers\srtspl.sys
2007-11-30 22:57 279,088 —-a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspx.cat
2007-11-30 22:57 10,549 —-a-w C:\WINDOWS\system32\drivers\srtspl.cat
2007-11-30 22:57 10,545 —-a-w C:\WINDOWS\system32\drivers\srtsp.cat
2007-11-30 22:57 1,430 —-a-w C:\WINDOWS\system32\drivers\srtspl.inf
2007-11-30 22:57 1,421 —-a-w C:\WINDOWS\system32\drivers\srtspx.inf
2007-11-30 22:57 1,415 —-a-w C:\WINDOWS\system32\drivers\srtsp.inf
2007-11-07 09:30 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-30 18:55 625,032 —-a-w C:\WINDOWS\system32\SymNeti.dll
2007-10-30 18:55 242,056 —-a-w C:\WINDOWS\system32\SymRedir.dll
2007-10-29 22:45 1,290,752 —-a-w C:\WINDOWS\system32\quartz.dll
.
—-a-w		   583,048 2008-01-24 21:04:30  C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc .exe


((((((((((((((((((((((((((((( snapshot@2008-01-25_ 1.54.35.13 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-25 00:27:13 1,409,024 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-27 13:30:57 1,409,024 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-25 00:27:14 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-27 13:30:57 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-25 00:27:17 5,894,144 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-27 13:30:57 1,413,120 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-25 00:27:18 184,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-27 13:30:58 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-25 00:27:20 1,413,120 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-27 13:30:58 5,894,144 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-25 00:27:20 8,192 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-27 13:30:58 184,320 —-a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2007-07-27 14:49:02 196,683 —-a-w C:\WINDOWS\system32\lnod32apiA.dll
+ 2007-07-27 14:49:02 225,355 —-a-w C:\WINDOWS\system32\lnod32apiW.dll
+ 2005-12-05 19:25:22 139,264 —-a-w C:\WINDOWS\system32\lnod32umc.dll
+ 2005-12-05 12:37:10 106,496 —-a-w C:\WINDOWS\system32\lnod32upd.dll
+ 2007-08-02 17:11:28 253,952 —-a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll
+ 2007-08-02 17:11:14 241,664 —-a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll
+ 2007-08-08 15:30:12 19,456 —-a-w C:\WINDOWS\system32\OnlineScannerLang.dll
+ 2007-06-13 10:10:34 77,824 —-a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
+ 2004-12-07 10:11:34 258,352 —-a-w C:\WINDOWS\system32\unicows.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Programfiler\MSN Messenger\MsnMsgr.exe" [2008-01-24 20:45 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 10:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
"Symantec PIF AlertEng"="C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-25 01:17 583048]
"ccApp"="C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe" [2007-01-10 06:59 115816]
"osCheck"="C:\Programfiler\Norton Internet Security\osCheck.exe" [2007-01-14 08:11 771704]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:03 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Programfiler\Fellesfiler\Ahead\Lib\NMBgMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="C:\Programfiler\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"Device Detector"=DevDetect.exe -autorun

R0 viaagp1;VIA AGP Filter;C:\WINDOWS\system32\DRIVERS\viaagp1.sys [2002-12-26 21:41]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-04 00:03]
R3 rtl8180;Realtek RTL8180 Wireless LAN (Mini-)PCI NIC NT Driver;C:\WINDOWS\system32\DRIVERS\RTL8180.SYS [2003-08-15 18:00]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-01-25 19:38:41 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Programfiler\TuneUp Utilities 2007\SystemOptimizer.exe
"2008-01-25 08:16:35 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Master.job"
- C:\Programfiler\Norton Internet Security\Norton AntiVirus\Navw32.exek/TASK:
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 14:34:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 14:35:09
ComboFix-quarantined-files.txt 2008-01-27 13:34:38
ComboFix2.txt 2008-01-26 11:52:42
ComboFix3.txt 2008-01-25 00:54:58
.
2008-01-09 02:04:17 — E O F —
Post #12
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:37:31, on 27.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\svchost.exe
C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe
C:\Programfiler\MSN Messenger\MsnMsgr.Exe
C:\Programfiler\MSN Messenger\usnsvc.exe
C:\Programfiler\Internet Explorer\IEXPLORE.EXE
C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\rsvp.exe
C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\explorer.exe
C:\Programfiler\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hardware.no/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koblinger
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programfiler\Fellesfiler\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Programfiler\Fellesfiler\Symantec Shared\coShared\Browser\1.5\NppBho.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} - C:\Programfiler\GetRight\xx2gr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programfiler\Fellesfiler\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Kwyshell MidpX BHO - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O3 - Toolbar: Kwyshell MidpX - {EBE9E2B5-B526-48BC-AD46-687263EDCB0E} - C:\Programfiler\Kwyshell\MidpX\JadInvoker\MidpInvoker.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [ccApp] "C:\Programfiler\Fellesfiler\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Programfiler\Norton Internet Security\osCheck.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Programfiler\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKAL TJENESTE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETTVERKSTJENESTE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Download Links As… - file://C:\WINDOWS\system32\page.htm
O8 - Extra context menu item: Download Target(s) As… - file://C:\WINDOWS\system32\link.htm
O8 - Extra context menu item: Download with GetRight Pro - C:\Programfiler\GetRight\GRdownload.htm
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Link to &MidpX - C:\Programfiler\Kwyshell\MidpX\JadInvoker\Extent\jad_wrap.htm
O8 - Extra context menu item: Open with GetRight Pro Browser - C:\Programfiler\GetRight\GRbrowse.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programfiler\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Programfiler\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programfiler\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase4009.cab
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\FELLES~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Programfiler\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Programfiler\Norton Internet Security\isPwdSvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~2\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Programfiler\Fellesfiler\Ahead\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Programfiler\Fellesfiler\Symantec Shared\AppCore\AppSvc32.exe

–
End of file - 7189 bytes

Everything appears to be normal now, except the norton phising problem. Should I just fix that problem from the symantec home page?
Post #15

Should I just fix that problem from the symantec home page?


Yes, if you are able to.


Congratulations, your logs look CLEAN

There are a few things you must do once you system is completely clean:

Time for some housekeeping
  • A. Please DELETE the following folder and all its content from your system: C:\SDFix

    B. Go to [external image: Posted Image] -> Run -> copy/paste in the following single line command & click OK


    combofix /u



    [external image: Posted Image]

    This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points.

    Now that your system is clean, to help protect your computer in the future I recommend that you follow these steps and use the following free programs:

    • Microsoft Windows Update - http://www.windowsupdate.com
      Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
    • SpywareBlaster to help prevent spyware from installing in the first place.
        Install & update SpywareBlaster with the latest definitions.
        After you have updated, click the button - enable protection for all unprotected items
    • IE-SpyAd - IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. An installation tutorial is available here.

    • MVPS HOST FILE
      The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites form serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer.
      • Download Host.zip to your desktop.
      • From your Desktop right-click (hosts.zip) and select:
        Extract All from the menu.
      • Click Next, click Next, select the option:
        "Show Extracted files", click Finish
      • This will open the newly created hosts folder on your Desktop.
      • Double-click on the included mvps.bat file, this will rename the existing HOSTS file to HOSTS.MVP, then it will copy the included updated HOSTS file to the correct location on your machine.
      • Once updated you should see another prompt that the task was completed.
    • ANTIVIRUS SOFTWARE
      It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. It is imperative that you update your antivirus software at least once a week (even more if you wish). If you do not update your antivirus software then it will not be able to catch new malware that may have come out.

      Do not install more than one AntiVirus program because they will conflict with each other.

    • FIREWALL
      Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here

      Do not install more than one firewall program because they will conflict with each other.

    Scan here http://secunia.com/software_inspector/ for out of date & vulnerable common applications on your computer

    Here are some additional utilities that will further enhance your safety.
    • http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)

    • http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. While Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.

    • http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.

    • http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.

      ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.

      NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.


    In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI