My Computer Online Scan - Virus/Trojan

May 19, 2009 at 11:38:58
Specs: Windows XP
Hi. A few days ago I started receiving popups saying "My Computer Online Scan". I know enough about computers to realise that this was the start/midst of an attack by trojions or viruses.
I run AVG Free and do daily updates and daily scans. I immediately ran a full scan and AVG found several intrusions. I asked AVG to clean these but it would have been too simple, it
was unable to heal them. I disabled System Restore to make sure stored viruses were deleted
and ran the scan again. Again it was able to find some intrusions but unable to heal.

I started doing some research and found this forum with other similar posts which seemed to
receive good advice, in particular from Jabuck. Therefore I have posted here in the hope that someone can assist.

In preparation I have downloaded Malwares Anti-Malware and am running a scan at present. I
will post the LogFile when it is completed.

Many thanks in advance.


See More: My Computer Online Scan - Virus/Trojan

Report •


#1
May 19, 2009 at 11:40:09
Hi. Malware has now finished and here are the results:

Malwarebytes' Anti-Malware 1.36
Database version: 2148
Windows 5.1.2600 Service Pack 3

19/05/2009 19:07:08
mbam-log-2009-05-19 (19-06-55).txt

Scan type: Quick Scan
Objects scanned: 82760
Time elapsed: 9 minute(s), 58 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 1
Registry Keys Infected: 12
Registry Values Infected: 7
Registry Data Items Infected: 2
Folders Infected: 4
Files Infected: 24

Memory Processes Infected:
C:\WINDOWS\ld08.exe (Worm.Koobface) -> No action taken.
c:\WINDOWS\pp09.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\system32\SYS32DLL.exe (Worm.KoobFace) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\xagkf32.dll (Password.Stealer) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{7c7efe99-c71f-48b8-8cc8-ba506ca76a33} (Password.Stealer) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{7c7efe99-c71f-48b8-8cc8-ba506ca76a33} (Password.Stealer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7c7efe99-c71f-48b8-8cc8-ba506ca76a33} (Password.Stealer) -> No action taken.
HKEY_CLASSES_ROOT\fe345.fe345mgr (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\fe345.fe345mgr.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{f7d09218-46d7-4d3d-9b7f-315204cd0836} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{5e5efa8f-9f53-418e-b78e-44866667a404} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{46b35542-a3cf-4cca-9c0b-259db2fff078} (Trojan.Banker) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{e63648f7-3933-440e-b4f6-a8584dd7b7eb} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5e5efa8f-9f53-418e-b78e-44866667a404} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{46b35542-a3cf-4cca-9c0b-259db2fff078} (Trojan.Banker) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5e5efa8f-9f53-418e-b78e-44866667a404} (Trojan.FakeAlert) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysfbtray (Worm.KoobFace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pp (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Worm.Koobface) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastia (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastia (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SYS32DLL (Worm.KoobFace) -> No action taken.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
C:\WINDOWS\system32\twain_32 (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\218538 (Trojan.BHO) -> No action taken.
C:\WINDOWS\system32\lowsec (Stolen.Data) -> No action taken.
C:\WINDOWS\system32\mac32 (Stolen.Data) -> No action taken.

Files Infected:
C:\WINDOWS\system32\xagkf32.dll (Password.Stealer) -> No action taken.
C:\Documents and Settings\Cameron\Local Settings\Temporary Internet Files\Content.IE5\LHTCYQZB\6244[1].exe (Trojan.Dropper) -> No action taken.
C:\WINDOWS\system32\twain_32\local.ds (Backdoor.Bot) -> No action taken.
C:\WINDOWS\system32\twain_32\user.ds (Backdoor.Bot) -> No action taken.
C:\WINDOWS\freddy43.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft2668f44.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft2692f44.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft3165f44.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft3189f44.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft3190f44.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\t55ft3250f44.dat (Worm.KoobFace) -> No action taken.
c:\WINDOWS\pp09.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\ld08.exe (Worm.Koobface) -> No action taken.
C:\WINDOWS\Temp\wpv961242666207.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\st_1241587271.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\st_1241605727.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\st_1241898353.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\st_1241916781.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\st_1242578826.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\st_1242597254.exe (Backdoor.Bot) -> No action taken.
C:\WINDOWS\pp08.exe (Worm.KoobFace) -> No action taken.
C:\WINDOWS\9g2234wesdf3dfgjf23 (Worm.KoobFace) -> No action taken.
C:\WINDOWS\f23567.dat (Worm.KoobFace) -> No action taken.
C:\WINDOWS\system32\SYS32DLL.exe (Worm.KoobFace) -> No action taken.


Report •

#2
May 19, 2009 at 11:44:20
Sorry, I should also say that I have now told it to remove all infections so please ignore the "no action taken" tags. It did require a reboot on completion.

However, when I now try and go on to the internet it cannot seem to connect. My wireless network connects but no web pages open. When I open up my page (which is google.co.uk) the taskbar at the bottom left says "connecting to site 127.0.0.1" and it then goes to "waiting for dnserror" or something like that.
Has Malware removed something required for internet to work correctly?


Report •

#3
May 19, 2009 at 11:44:32
Hi,
Can you please post your AVZ log:

1) To create the logfile, download AVZ by clicking HERE. Please save this file to your desktop or "My Documents" folder.

2) Next, unpack the file to a new folder using the Compressed (zipped) folders wizard built into Windows XP/Vista, or a zip utility of your choice.

3) Once you have unpacked the contents of the zip archive, please launch the file AVZ.exe by double clicking on it or right clicking and selecting Open.
Note: If you are running Windows vista launch AVZ.exe by right clicking and selecting Run as Administrator

You should now see the main window of the AVZ utility. Please navigate to File->Custom Scripts. Copy the script below by using the keyboard shortcut CTRL+C or the corresponding option via right click.

begin
ExecuteStdScr(3);
RebootWindows(true);
end.

Paste the script into the execution window by using CTRL+V keyboard shortcut, or the "paste" option via the right click menu. Click on Run to run the script, the PC will reboot. After the reboot the LOG subfolder is created in the folder with AVZ, with a file called virusinfo_syscure.zip inside. Upload that file to rapidshare.com and paste the link here.

Image Tutorial

--------------------------------------------
To Private Message me Click Here


Report •

Related Solutions

#4
May 19, 2009 at 12:01:58
Hi again...in anticipation of lots of helpful replies I have also ran HijackThis and below is the logfile. I have not asked it to take any action yet.


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:26, on 19/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Documents and Settings\Cameron\Desktop\tools.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O1 - Hosts: 82.146.46.170 myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 82.146.46.170 www.myonlineaccounts2.abbeynational.co.uk
O1 - Hosts: 82.146.46.170 online.lloydstsb.co.uk
O1 - Hosts: 82.146.46.170 www.online.lloydstsb.co.uk
O1 - Hosts: 82.146.46.170 online-business.lloydstsb.co.uk
O1 - Hosts: 82.146.46.170 www.online-business.lloydstsb.co.uk
O1 - Hosts: 82.146.46.170 online-offshore.lloydstsb.com
O1 - Hosts: 82.146.46.170 www.online-offshore.lloydstsb.com
O1 - Hosts: 82.146.46.170 abbeyinternational.com
O1 - Hosts: 82.146.46.170 www.abbeyinternational.com
O1 - Hosts: 82.146.46.170 ibank.cahoot.com
O1 - Hosts: 82.146.46.170 www.ibank.cahoot.com
O1 - Hosts: 82.146.46.170 home.ybonline.co.uk
O1 - Hosts: 82.146.46.170 www.home.ybonline.co.uk
O1 - Hosts: 82.146.46.170 home.cbonline.co.uk
O1 - Hosts: 82.146.46.170 www.home.cbonline.co.uk
O1 - Hosts: 82.146.46.170 mybank.alliance-leicester.co.uk
O1 - Hosts: 82.146.46.170 www.mybank.alliance-leicester.co.uk
O1 - Hosts: 82.146.46.170 mybusinessbank.co.uk
O1 - Hosts: 82.146.46.170 www.mybusinessbank.co.uk
O1 - Hosts: 82.146.46.170 mybankoffshore.alil.co.im
O1 - Hosts: 82.146.46.170 www.mybankoffshore.alil.co.im
O1 - Hosts: 82.146.46.170 ibank.internationalbanking.barclays.com
O1 - Hosts: 82.146.46.170 www.ibank.internationalbanking.barclays.com
O1 - Hosts: 82.146.46.170 welcome27.co-operativebank.co.uk
O1 - Hosts: 82.146.46.170 www.welcome27.co-operativebank.co.uk
O1 - Hosts: 82.146.46.170 welcome23.smile.co.uk
O1 - Hosts: 82.146.46.170 www.welcome23.smile.co.uk
O1 - Hosts: 82.146.46.170 egg.com
O1 - Hosts: 82.146.46.170 www.egg.com
O1 - Hosts: 82.146.46.170 new.egg.com
O1 - Hosts: 82.146.46.170 www.new.egg.com
O1 - Hosts: 82.146.46.170 moneybookers.com
O1 - Hosts: 82.146.46.170 www.moneybookers.com
O1 - Hosts: 82.146.46.170 inscape.com
O1 - Hosts: 82.146.46.170 www.inscape.com
O1 - Hosts: 82.146.46.170 bankcardservices.co.uk
O1 - Hosts: 82.146.46.170 www.bankcardservices.co.uk
O1 - Hosts: 82.146.46.170 alliance-leicester.co.uk
O1 - Hosts: 82.146.46.170 www.alliance-leicester.co.uk
O1 - Hosts: 82.146.46.170 cahoot.com
O1 - Hosts: 82.146.46.170 www.cahoot.com
O1 - Hosts: 82.146.46.170 icicibank.co.uk
O1 - Hosts: 82.146.46.170 www.icicibank.co.uk
O1 - Hosts: 82.146.46.170 natwest.com
O1 - Hosts: 82.146.46.170 www.natwest.com
O1 - Hosts: 82.146.46.170 nwolb.com
O1 - Hosts: 82.146.46.170 www.nwolb.com
O1 - Hosts: 82.146.46.170 mbna.co.uk
O1 - Hosts: 82.146.46.170 www.mbna.co.uk
O1 - Hosts: 82.146.46.170 businesscreditcardsonline.co.uk
O1 - Hosts: 82.146.46.170 www.businesscreditcardsonline.co.uk
O1 - Hosts: 82.146.46.170 capitaloneonline.co.uk
O1 - Hosts: 82.146.46.170 www.capitaloneonline.co.uk
O1 - Hosts: 82.146.46.170 welcome26.co-operativebank.co.uk
O1 - Hosts: 82.146.46.170 www.welcome26.co-operativebank.co.uk
O1 - Hosts: 82.146.46.170 welcome22.smile.co.uk
O1 - Hosts: 82.146.46.170 www.welcome22.smile.co.uk
O1 - Hosts: 82.146.46.170 service.citicards.co.uk
O1 - Hosts: 82.146.46.170 www.service.citicards.co.uk
O1 - Hosts: 82.146.46.170 citibank.co.uk
O1 - Hosts: 82.146.46.170 www.citibank.co.uk
O1 - Hosts: 82.146.46.170 scotwest.co.uk
O1 - Hosts: 82.146.46.170 www.scotwest.co.uk
O1 - Hosts: 82.146.46.170 secure.scotwest.co.uk
O1 - Hosts: 82.146.46.170 www.secure.scotwest.co.uk
O1 - Hosts: 82.146.46.170 partnerandaffinitycards.co.uk
O1 - Hosts: 82.146.46.170 www.partnerandaffinitycards.co.uk
O1 - Hosts: 82.146.46.170 esavingsaccount.co.uk
O1 - Hosts: 82.146.46.170 www.esavingsaccount.co.uk
O1 - Hosts: 82.146.46.170 firstdirect.com
O1 - Hosts: 82.146.46.170 www.firstdirect.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: 790151 helper - {22186AA4-E2A6-45E8-BF4F-5C103C0458B0} - C:\WINDOWS\system32\790151\790151.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} (AccountTracking Profile Manager Class) - https://moneymanager.egg.com/Pinsafe/accounttracking.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr0...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...
O16 - DPF: {FE8FE5F0-E1EE-4ACD-81E0-2A6CFECB8431} (ePenClientSpec.ucEPenClientspec) - http://downloads.exam2score.com/ePe...
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: TomTomHOMEService - TomTom - C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe

--
End of file - 11769 bytes


Report •

#5
May 19, 2009 at 12:04:05
Thanks for Hijack this log but i also need AVZ log from Response Number 3.

--------------------------------------------
To Private Message me Click Here


Report •

#6
May 19, 2009 at 12:55:27
Hi, Sorry for delay, haven't used AVZ before.
Hopefully this should be link to file you requested:

http://rapidshare.com/files/2349232...

Cameron


Report •

#7
May 19, 2009 at 13:14:12
Run this script in AVZ same way as before. Your computer will reboot.


begin
SetAVZGuardStatus(True);
SearchRootkit(true, true);
 DelBHO('{7C7EFE99-C71F-48b8-8CC8-BA506CA76A33}');
 DelBHO('{22186AA4-E2A6-45E8-BF4F-5C103C0458B0}');
 QuarantineFile('magks32.dll','');
 QuarantineFile('C:\WINDOWS\system32\790151\790151.dll','');
 QuarantineFile('lpaxtj.sys','');
 QuarantineFile('C:\WINDOWS\system32\magks32.dll','');
 DeleteFile('C:\WINDOWS\system32\magks32.dll');
 DeleteFile('lpaxtj.sys');
 DeleteFile('C:\WINDOWS\system32\790151\790151.dll');
 DeleteFile('magks32.dll');
BC_ImportAll;
ExecuteSysClean;
 ExecuteRepair(13);
 ExecuteRepair(14);
 ExecuteRepair(15);
BC_Activate;
RebootWindows(true);
end.

After your reboot follow these steps:

Attach a Combofix log, please review and follow these instructions carefully.

Download it here -> http://download.bleepingcomputer.co...

Before Saving it to Desktop, please rename it to something like 123.exe to stop malware from disabling it.

Now, please make sure no other programs are running, close all other windows and pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) until after the scanning and removal process has taken place.

Please double click on the file you downloaded. Follow the onscreen prompts to start the scan. Once the scanning process has started please DO NOT click on the Combofix window or attempt to use your computer as this can cause the scanning process to stall. It may take a while to complete scanning and this is normal.

You will be disconnected from the internet and your desktop icons/toolbars will disappear during scanning, do not worry, this is normal and it will be restored after scanning has completed.

Combofix will create a logfile and display it after your computer has rebooted. Usually located in c:\combofix.txt, please attach it to your next post.

--------------------------------------------
To Private Message me Click Here


Report •

#8
May 19, 2009 at 13:17:23
Thank you for all of your help so far Neoark, I am going to try and do this now. Due to the time in the UK I'm not sure I will get to post the results this evening so please bear with me and I will post the results in the next 24hours.

Many thanks


Report •

#9
May 20, 2009 at 12:06:15
Evening...ran combofix as suggested and below are the results of the logfile:

ComboFix 09-05-19.04 - Cameron 20/05/2009 19:58.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.502.168 [GMT 1:00]
Running from: c:\documents and settings\Cameron\Desktop\combo.exe.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Cameron\Application Data\wiaserva.log
c:\windows\system32\dz1.txt
c:\windows\system32\inform.dat
c:\windows\system32\wbem\grpconv.exe

.
((((((((((((((((((((((((( Files Created from 2009-04-20 to 2009-05-20 )))))))))))))))))))))))))))))))
.

2009-05-20 18:53 . 2009-05-20 18:54 -------- d-----w C:\123.exe
2009-05-19 19:42 . 2009-05-19 19:42 34304 ----a-w c:\windows\system32\xagkf32.dll
2009-05-18 18:46 . 2009-05-18 18:46 -------- d-----w c:\documents and settings\Cameron\Application Data\Malwarebytes
2009-05-18 18:46 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-18 18:46 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-18 18:46 . 2009-05-18 18:46 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-18 18:46 . 2009-05-18 18:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-18 17:17 . 2009-05-19 17:43 -------- d-----w c:\windows\system32\790151
2009-05-17 19:07 . 2009-05-18 05:11 -------- d-----w c:\documents and settings\Cameron\Application Data\HouseCall 6.6
2009-04-21 19:19 . 2009-04-21 19:19 -------- d-----w c:\program files\iPod
2009-04-21 19:19 . 2009-04-21 19:19 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-21 19:19 . 2009-04-21 19:19 -------- d-----w c:\program files\iTunes

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-09 19:48 . 2009-01-31 09:03 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-09 19:48 . 2008-06-05 19:27 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-04-21 19:19 . 2008-04-04 14:47 -------- d-----w c:\program files\Common Files\Apple
2009-03-19 15:32 . 2008-01-29 11:01 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-06 14:22 . 2004-08-04 12:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-05 23:59 . 2009-03-21 16:46 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-03-05 23:59 . 2008-04-04 14:47 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-03-03 00:18 . 2004-08-04 12:00 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 12:00 78336 ----a-w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\TomTomHOMERunner.exe" [2009-04-08 251240]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-19 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-03-22 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-03-22 126976]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-05 98394]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-05 688218]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-09 1947928]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShCut.exe [2005-01-07 61952]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-04-26 544768]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableProfileQuota"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-09 19:48 11952 ----a-w c:\windows\system32\avgrsstx.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\Vuze\\Azureus.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [05/06/2008 20:27 325896]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [31/01/2009 10:03 298776]
R2 TomTomHOMEService;TomTomHOMEService;c:\program files\TomTom HOME 2\TomTomHOMEService.exe [08/04/2009 11:38 92008]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{2E1A9DE4-ADA0-4501-A46E-6633CDB01654}]
rundll32 magks32.dll,InitO
.
Contents of the 'Scheduled Tasks' folder

2009-05-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 12:34]

2009-05-20 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-19 20:35]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.co.uk/
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: {4E62C4DE-627D-4604-B157-4B7D6B09F02E} - hxxps://moneymanager.egg.com/Pinsafe/accounttracking.cab
DPF: {FE8FE5F0-E1EE-4ACD-81E0-2A6CFECB8431} - hxxp://downloads.exam2score.com/ePenClientSpec.ocx
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-20 20:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-20 20:02
ComboFix-quarantined-files.txt 2009-05-20 19:02

Pre-Run: 4,117,807,104 bytes free
Post-Run: 4,215,623,680 bytes free

119 --- E O F --- 2009-05-13 18:13


Report •

#10
May 20, 2009 at 13:10:27
Follow these steps in order:

1) Run this script in AVZ:


begin
CreateQurantineArchive('c:\quarantine.zip');
end.

2) A file called quarantine.zip should be created in C:\. Then please zip up C:\qoobox\quarantine and upload both it and C:\quarantine.zip to a filehost such as http://rapidshare.com/ Then, Private Message me the Download link to the uploaded file.

3) Lastly, uninstall Combofix by: pause Antivirus/Sypware programs (http://www.bleepingcomputer.com/forums/topic114351.html Programs to disable) > Start > run > type combofix /u > ok. Or Start > run > type 234 /u > ok.

4) Also, if you use Windows System restore, turn it off > reboot and do a full scan with AVP tool:

Download and run Kaspersky AVP tool:

http://devbuilds.kaspersky-labs.com...

Once you download and start the tool select all the objects/places to be scanned and hit Scan. Fix what it detects and at the end of the scan post screen shot/log of detected items that is fixed and which it could not fix.

Then turn system restore back on, if you wish; this to remove malware from system volume information files. How to turn it off/on: http://support.kaspersky.com/faq/?q... Let me know if your antivirus still detects anything and is unable to get rid of it.

5) Install, update and run full scan with Superantispyware. Attach full scan log, but Please Don't fix anything yet, until the log is reviewed.

--------------------------------------------
To Private Message me Click Here


Report •

#11
May 21, 2009 at 12:18:17
Hi Neoark,
I've tried PM'ing you a few times but I don't know if they've got through, it seems to crash when I hit send.
Just in case, the links to the files you requested are at:

http://rapidshare.com/files/2356973...

http://rapidshare.com/files/2356968...

Many thanks, I shall get on with the AVP scan now.
Cameron


Report •

#12
May 22, 2009 at 11:10:03
Evening,
I ran the scan with Kaspersky, it took several hours but didn't find anything.

This is the link to the screenshot at the end.

http://rapidshare.com/files/2360445...

I'm just running SuperAntiSpyware now. I'll post the results soon.

Cameron


Report •

#13
May 22, 2009 at 12:22:24
Hello again. SuperAntiSpyware only found one thing.

Log file is copied below. Just running a full scan with my most up to date AVG now.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/22/2009 at 07:59 PM

Application Version : 4.26.1002

Core Rules Database Version : 3907
Trace Rules Database Version: 1852

Scan type : Quick Scan
Total Scan Time : 00:23:02

Memory items scanned : 456
Memory threats detected : 0
Registry items scanned : 452
Registry threats detected : 1
File items scanned : 6038
File threats detected : 0

Trojan.RU-PWS/Gen
HKU\S-1-5-21-1454471165-1343024091-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7C7EFE99-C71F-48B8-8CC8-BA506CA76A33}


PS - what other programmes would you recomend using to try and limit/prevent infection in future. I was already running daily updated AVG scans and use windows firewall.

Cameron


Report •

#14
May 22, 2009 at 12:37:53
Seems like virus is gone. In addition you might also want to:

1) Run these http://onecare.live.com/site/en-Us/... & http://onecare.live.com/site/en-Us/...

2) re-run Malwarebyte just to be sure.

3) Scan again with AVG to see if it detects anything.

I would suggest one of with antivirus: kaspersky/Eset/Bitdefender/Norton with Malwarebytes/SuperAntiSpyware.

--------------------------------------------
To Private Message me Click Here


Report •


Ask Question