5 Trojans keep taking me to partypoker.com  Need help cleaning out

system · 2007-06-21T03:18:03.000Z

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
“C:\Program Files\QuickTime\qttask.exe” -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

Contents of the ‘Scheduled Tasks’ folder
2007-05-14 12:29:00 C:\WINDOWS\tasks\Easy Internet Sign-up.job
2007-06-20 01:22:41 C:\WINDOWS\tasks\MP Scheduled Scan.job

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-19 20:21:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe???|?p??? ???B???hLC? ???

scanning hidden files …

Completion time: 2007-06-19 20:26:31 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-19 20:25

--- E O F ---

(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\cayjqija.dll
C:\WINDOWS\system32\ewscknwt.dll
C:\WINDOWS\system32\gjidsoiv.dll
C:\WINDOWS\system32\kimmrbbf.dll
C:\WINDOWS\system32\ajiqjyac.ini
C:\WINDOWS\system32\twnkcswe.ini
C:\WINDOWS\system32\viosdijg.ini
C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\klnmp.bak2
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32\klnmp.tmp
C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\klnmp.bak2
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32\klnmp.tmp
C:\WINDOWS\system32\klnmp.bak1
C:\WINDOWS\system32\klnmp.bak2
C:\WINDOWS\system32\klnmp.ini2
C:\WINDOWS\system32\klnmp.tmp
C:\WINDOWS\system32\opnmmml.dll
C:\WINDOWS\system32\pmnlk.dll

- - POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe
C:\WINDOWS\svhost.exe

((((((((((((((((((((((((( Files Created from 2007-05-20 to 2007-06-20 )))))))))))))))))))))))))))))))

system · 2007-06-21T03:21:02.000Z

brenda31 post:23:

I believe this is the correct combofix log

ComboFix 07-06-18.2
“Brenda Mayorga” - 2007-06-19 20:01:22 - Service Pack 2 NTFS

No, that one has yesterday’s date …

system · 2007-06-21T03:21:55.000Z

This is what I got when I tried to upload the file to virustotal

0 bytes size received / Se ha recibido un archivo vacio

system · 2007-06-21T03:26:07.000Z

That is the only log I see, except for one called ComboFix-quarantined files, but it has yesterday’s date.

Should I rerun the ComboFix and HiJackThis again in that order?

system · 2007-06-21T03:26:20.000Z

brenda31 post:26:

This is what I got when I tried to upload the file to virustotal

0 bytes size received / Se ha recibido un archivo vacio

OK, we’re going to get rid of that one too but give me a little time with the HJT log.

In the mean time see if you can find the most recent ComboFix log.

EDIT:

brenda31 post:27:

Should I rerun the ComboFix and HiJackThis again in that order?

Just ComboFix this time, but delete the old log first.

system · 2007-06-21T03:40:40.000Z

There was a program file created on 19 June related to a program called NirCmd. Here is a description

http://www.nirsoft.net/utils/nircmd.html

Are you aware of this program on your computer?

EDIT: Your HJT log looks good.

system · 2007-06-21T04:01:11.000Z

I’ve ran combofix twice and cannot find the log. I did delete yesterday’s.
I only find the combofix quarantined files.


2007-06-17 00:21      38400    --a------    C:\Qoobox\Quarantine\C\WINDOWS\svhost.exe.vir
2007-06-17 00:46      285273    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir
2007-06-17 00:49      1808184    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak1.vir
2007-06-17 00:49      62516    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kimmrbbf.dll.vir
2007-06-17 00:51      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gjidsoiv.dll.vir
2007-06-17 01:37      921779    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\viosdijg.ini.vir
2007-06-18 00:58      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cayjqija.dll.vir
2007-06-18 00:59      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ajiqjyac.ini.vir
2007-06-18 13:53      1811116    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.tmp.vir
2007-06-19 00:54      1813276    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak2.vir
2007-06-19 02:30      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ewscknwt.dll.vir
2007-06-19 19:59      901924    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\twnkcswe.ini.vir
2007-06-19 20:10      1812605    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.ini2.vir
2007-06-19 20:12      104    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 074F-92BD
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---Program Files
    |   |   \---Common Files
    |   \---WINDOWS
    |       |   svhost.exe.vir
    |       |   
    |       \---system32
    |               ajiqjyac.ini.vir
    |               cayjqija.dll.vir
    |               ewscknwt.dll.vir
    |               gjidsoiv.dll.vir
    |               kimmrbbf.dll.vir
    |               klnmp.bak1.vir
    |               klnmp.bak2.vir
    |               klnmp.ini2.vir
    |               klnmp.tmp.vir
    |               pmnlk.dll.vir
    |               twnkcswe.ini.vir
    |               viosdijg.ini.vir
    |               
    \---Registry_backups

system · 2007-06-21T04:06:20.000Z

I have found at least 3 combofix quarantined file logs, here’s the second log.


2007-06-17 00:21      38400    --a------    C:\Qoobox\Quarantine\C\WINDOWS\svhost.exe.vir
2007-06-17 00:46      285273    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir
2007-06-17 00:49      1808184    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak1.vir
2007-06-17 00:49      62516    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kimmrbbf.dll.vir
2007-06-17 00:51      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gjidsoiv.dll.vir
2007-06-17 01:37      921779    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\viosdijg.ini.vir
2007-06-18 00:58      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cayjqija.dll.vir
2007-06-18 00:59      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ajiqjyac.ini.vir
2007-06-18 13:53      1811116    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.tmp.vir
2007-06-19 00:54      1813276    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak2.vir
2007-06-19 02:30      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ewscknwt.dll.vir
2007-06-19 19:59      901924    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\twnkcswe.ini.vir
2007-06-19 20:10      1812605    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.ini2.vir
2007-06-19 20:12      104    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 074F-92BD
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---Program Files
    |   |   \---Common Files
    |   \---WINDOWS
    |       |   svhost.exe.vir
    |       |   
    |       \---system32
    |               ajiqjyac.ini.vir
    |               cayjqija.dll.vir
    |               ewscknwt.dll.vir
    |               gjidsoiv.dll.vir
    |               kimmrbbf.dll.vir
    |               klnmp.bak1.vir
    |               klnmp.bak2.vir
    |               klnmp.ini2.vir
    |               klnmp.tmp.vir
    |               pmnlk.dll.vir
    |               twnkcswe.ini.vir
    |               viosdijg.ini.vir
    |               
    \---Registry_backups

system · 2007-06-21T04:17:57.000Z

Hmmm. Not sure what’s causing that.

It doesn’t look like anything else is going into quarantine so let’s get rid of kwinlodt.exe

Open OTMoveIt again and past this into the left pane

C:\WINDOWS\system32\kwinlodt.exe

Then click the move it button and post the results.

Any thoughts on NirCmd?

How is the computer running now? Are there anymore trojan alerts or explorer redirects?

system · 2007-06-21T04:25:54.000Z

File/Folder C:\WINDOWS\system32\kwinlodt.exe not found.

Created on 06-20-2007 23:24:19

As far as the NIRCmd does that have anything to do with the button on my laptop that lets me mute the sound with one touch or raise or lower the volume with the buttons at the top of the laptop?

system · 2007-06-21T04:36:20.000Z

I don’t believe so, but let’s leave it for now but in a state where it can’t run.

Navigate to the file and rename it from kwinlodt.exe to kwinlodt.old. You can work with the computer for a day or so and, if everything still functions as you expect, we will remove it at that point.

Other than this one questionable file I don’t see anything else in the logs. Are the symptoms gone now?

system · 2007-06-21T04:38:05.000Z

The computer has ran better, I have not been redirected to any other sites. This morning I did have one Trojan alert, although I cannot remember which one it was.

system · 2007-06-21T04:42:32.000Z

brenda31 post:35:

This morning I did have one Trojan alert, although I cannot remember which one it was.

Do you remember if that was before or after the SuperAntiSpyware scans?

system · 2007-06-21T04:47:07.000Z

I believe it was after and it was only one that popped up. Should I run the spyware again?

system · 2007-06-21T04:48:27.000Z

If you right click the avast a-icon, then click avast! log viewer, does the detection show up in the warnings section?

system · 2007-06-21T04:50:49.000Z

I have also ran a file search kwinlodt.exe so that I can rename it to kwinlodt.old however it did not turn up.

system · 2007-06-21T04:58:10.000Z

OK, that’s fine.

Let’s take a look from one more direction. Download and scan with the free version of AVG AntiSpyware (sassin44 mentioned this one early on and its very good). Quarantine any detections and post the log. I will meet you back here tomorrow.

http://free.grisoft.com/doc/20/lng/us/tpl/v5

system · 2007-06-21T05:04:12.000Z

I have opened up the log viwer and it shows

6/20/2007 01:01 System 2032 Sign of WIN32:Agent HZS[Trj] has been found in "C:\SYSTEMVOLUMEINFORMATION_RESTORE{D5341F9C-33FZ-43CF-8BD2-1AE937C9BA1B}\RP208\A0041500.EXE"file.

there are also some listed viruses for 6/19/2007 should i list those?

system · 2007-06-21T05:05:48.000Z

Yes, please list them.

system · 2007-06-21T06:46:41.000Z

AVG Anti-Spyware - Scan Report

Created at: 01:43 2007-06-21
Scan result:

C:_OTMoveIt\MovedFiles\WINDOWS\poolsv.exe → Downloader.VB.aya : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@112.2o7[2].txt → TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@2o7[1].txt → TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ads.addynamix[1].txt → TrackingCookie.Addynamix : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@advertising[1].txt → TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@atdmt[2].txt → TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@bluestreak[1].txt → TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@connextra[2].txt → TrackingCookie.Connextra : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@doubleclick[1].txt → TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@fastclick[1].txt → TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ehg-myspaceinc.hitbox[2].txt → TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@hitbox[2].txt → TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@searchportal.information[1].txt → TrackingCookie.Information : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@mediaplex[2].txt → TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@www.myaffiliateprogram[1].txt → TrackingCookie.Myaffiliateprogram : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@perf.overture[1].txt → TrackingCookie.Overture : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ads.pointroll[1].txt → TrackingCookie.Pointroll : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@questionmarket[1].txt → TrackingCookie.Questionmarket : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@realmedia[1].txt → TrackingCookie.Realmedia : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@toplist[1].txt → TrackingCookie.Toplist : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@trafficmp[1].txt → TrackingCookie.Trafficmp : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@tribalfusion[2].txt → TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@zedo[1].txt → TrackingCookie.Zedo : No action taken.

::Report end

Announcements