5 Trojans keep taking me to partypoker.com  Need help cleaning out

system · 2007-06-21T04:01:11.000Z

I’ve ran combofix twice and cannot find the log. I did delete yesterday’s.
I only find the combofix quarantined files.


2007-06-17 00:21      38400    --a------    C:\Qoobox\Quarantine\C\WINDOWS\svhost.exe.vir
2007-06-17 00:46      285273    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir
2007-06-17 00:49      1808184    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak1.vir
2007-06-17 00:49      62516    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kimmrbbf.dll.vir
2007-06-17 00:51      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gjidsoiv.dll.vir
2007-06-17 01:37      921779    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\viosdijg.ini.vir
2007-06-18 00:58      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cayjqija.dll.vir
2007-06-18 00:59      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ajiqjyac.ini.vir
2007-06-18 13:53      1811116    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.tmp.vir
2007-06-19 00:54      1813276    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak2.vir
2007-06-19 02:30      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ewscknwt.dll.vir
2007-06-19 19:59      901924    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\twnkcswe.ini.vir
2007-06-19 20:10      1812605    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.ini2.vir
2007-06-19 20:12      104    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 074F-92BD
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---Program Files
    |   |   \---Common Files
    |   \---WINDOWS
    |       |   svhost.exe.vir
    |       |   
    |       \---system32
    |               ajiqjyac.ini.vir
    |               cayjqija.dll.vir
    |               ewscknwt.dll.vir
    |               gjidsoiv.dll.vir
    |               kimmrbbf.dll.vir
    |               klnmp.bak1.vir
    |               klnmp.bak2.vir
    |               klnmp.ini2.vir
    |               klnmp.tmp.vir
    |               pmnlk.dll.vir
    |               twnkcswe.ini.vir
    |               viosdijg.ini.vir
    |               
    \---Registry_backups

system · 2007-06-21T04:06:20.000Z

I have found at least 3 combofix quarantined file logs, here’s the second log.


2007-06-17 00:21      38400    --a------    C:\Qoobox\Quarantine\C\WINDOWS\svhost.exe.vir
2007-06-17 00:46      285273    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnlk.dll.vir
2007-06-17 00:49      1808184    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak1.vir
2007-06-17 00:49      62516    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\kimmrbbf.dll.vir
2007-06-17 00:51      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\gjidsoiv.dll.vir
2007-06-17 01:37      921779    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\viosdijg.ini.vir
2007-06-18 00:58      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\cayjqija.dll.vir
2007-06-18 00:59      345    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ajiqjyac.ini.vir
2007-06-18 13:53      1811116    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.tmp.vir
2007-06-19 00:54      1813276    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.bak2.vir
2007-06-19 02:30      124436    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ewscknwt.dll.vir
2007-06-19 19:59      901924    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\twnkcswe.ini.vir
2007-06-19 20:10      1812605    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\klnmp.ini2.vir
2007-06-19 20:12      104    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing
Volume serial number is 074F-92BD
C:\QOOBOX
\---Quarantine
    |   catchme.log
    |   
    +---C
    |   +---Program Files
    |   |   \---Common Files
    |   \---WINDOWS
    |       |   svhost.exe.vir
    |       |   
    |       \---system32
    |               ajiqjyac.ini.vir
    |               cayjqija.dll.vir
    |               ewscknwt.dll.vir
    |               gjidsoiv.dll.vir
    |               kimmrbbf.dll.vir
    |               klnmp.bak1.vir
    |               klnmp.bak2.vir
    |               klnmp.ini2.vir
    |               klnmp.tmp.vir
    |               pmnlk.dll.vir
    |               twnkcswe.ini.vir
    |               viosdijg.ini.vir
    |               
    \---Registry_backups

system · 2007-06-21T04:17:57.000Z

Hmmm. Not sure what’s causing that.

It doesn’t look like anything else is going into quarantine so let’s get rid of kwinlodt.exe

Open OTMoveIt again and past this into the left pane

C:\WINDOWS\system32\kwinlodt.exe

Then click the move it button and post the results.

Any thoughts on NirCmd?

How is the computer running now? Are there anymore trojan alerts or explorer redirects?

system · 2007-06-21T04:25:54.000Z

File/Folder C:\WINDOWS\system32\kwinlodt.exe not found.

Created on 06-20-2007 23:24:19

As far as the NIRCmd does that have anything to do with the button on my laptop that lets me mute the sound with one touch or raise or lower the volume with the buttons at the top of the laptop?

system · 2007-06-21T04:36:20.000Z

I don’t believe so, but let’s leave it for now but in a state where it can’t run.

Navigate to the file and rename it from kwinlodt.exe to kwinlodt.old. You can work with the computer for a day or so and, if everything still functions as you expect, we will remove it at that point.

Other than this one questionable file I don’t see anything else in the logs. Are the symptoms gone now?

system · 2007-06-21T04:38:05.000Z

The computer has ran better, I have not been redirected to any other sites. This morning I did have one Trojan alert, although I cannot remember which one it was.

system · 2007-06-21T04:42:32.000Z

brenda31 post:35:

This morning I did have one Trojan alert, although I cannot remember which one it was.

Do you remember if that was before or after the SuperAntiSpyware scans?

system · 2007-06-21T04:47:07.000Z

I believe it was after and it was only one that popped up. Should I run the spyware again?

system · 2007-06-21T04:48:27.000Z

If you right click the avast a-icon, then click avast! log viewer, does the detection show up in the warnings section?

system · 2007-06-21T04:50:49.000Z

I have also ran a file search kwinlodt.exe so that I can rename it to kwinlodt.old however it did not turn up.

system · 2007-06-21T04:58:10.000Z

OK, that’s fine.

Let’s take a look from one more direction. Download and scan with the free version of AVG AntiSpyware (sassin44 mentioned this one early on and its very good). Quarantine any detections and post the log. I will meet you back here tomorrow.

http://free.grisoft.com/doc/20/lng/us/tpl/v5

system · 2007-06-21T05:04:12.000Z

I have opened up the log viwer and it shows

6/20/2007 01:01 System 2032 Sign of WIN32:Agent HZS[Trj] has been found in "C:\SYSTEMVOLUMEINFORMATION_RESTORE{D5341F9C-33FZ-43CF-8BD2-1AE937C9BA1B}\RP208\A0041500.EXE"file.

there are also some listed viruses for 6/19/2007 should i list those?

system · 2007-06-21T05:05:48.000Z

Yes, please list them.

system · 2007-06-21T06:46:41.000Z

AVG Anti-Spyware - Scan Report

Created at: 01:43 2007-06-21
Scan result:

C:_OTMoveIt\MovedFiles\WINDOWS\poolsv.exe → Downloader.VB.aya : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@112.2o7[2].txt → TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@2o7[1].txt → TrackingCookie.2o7 : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ads.addynamix[1].txt → TrackingCookie.Addynamix : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@advertising[1].txt → TrackingCookie.Advertising : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@atdmt[2].txt → TrackingCookie.Atdmt : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@bluestreak[1].txt → TrackingCookie.Bluestreak : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@connextra[2].txt → TrackingCookie.Connextra : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@doubleclick[1].txt → TrackingCookie.Doubleclick : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@fastclick[1].txt → TrackingCookie.Fastclick : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ehg-myspaceinc.hitbox[2].txt → TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@hitbox[2].txt → TrackingCookie.Hitbox : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@searchportal.information[1].txt → TrackingCookie.Information : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@mediaplex[2].txt → TrackingCookie.Mediaplex : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@www.myaffiliateprogram[1].txt → TrackingCookie.Myaffiliateprogram : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@perf.overture[1].txt → TrackingCookie.Overture : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@ads.pointroll[1].txt → TrackingCookie.Pointroll : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@questionmarket[1].txt → TrackingCookie.Questionmarket : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@realmedia[1].txt → TrackingCookie.Realmedia : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@toplist[1].txt → TrackingCookie.Toplist : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@trafficmp[1].txt → TrackingCookie.Trafficmp : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@tribalfusion[2].txt → TrackingCookie.Tribalfusion : No action taken.
C:\Documents and Settings\Brenda Mayorga\Cookies\brenda mayorga@zedo[1].txt → TrackingCookie.Zedo : No action taken.

::Report end

system · 2007-06-21T11:54:32.000Z

There’s nothing to worry about in the AVG log.

Lets take a quick look at the avast! log from 6/19/07, then we’ll finish things up.

EDIT: Please look once more for C:\WINDOWS\system32\kwinlodt.exe. I’m guessing it was removed in one of the later ComboFix runs but without the full log I don’t know for sure. I want it to be gone.

This time, when you open the explorer window (not internet explorer), at the top of the window click Tools>Folder Options>View. Make sure Show Hidden Files and Folders is checked and Hide Protected Operating System Files is not checked. Then look for the file.

system · 2007-06-21T18:12:18.000Z

I have looked again for C:\WINDOWS\system32\kwinlodt.exe and have not been able to find it.

Here is what avast shows

essexboy · 2007-06-21T18:15:22.000Z

Any thoughts on NirCmd?

Hi Mauserme it is part of combofix

system · 2007-06-21T18:20:40.000Z

This is the second part of the avast log that i’m having trouble posting as a reply.

2007-06-18 00:58 SYSTEM 2024 Sign of “Win32:VBStat-C [Trj]” has been found in “C:\WINDOWS\system32\dshlbhhh.dll” file.
2007-06-18 00:58 SYSTEM 2024 Sign of “Win32:VBStat-C [Trj]” has been found in “C:\WINDOWS\system32\dshlbhhh.dll” file.
2007-06-18 02:01 SYSTEM 2024 Sign of “Win32:VB-TGS [Trj]” has been found in “C:\Documents and Settings\Brenda Mayorga\Local Settings\Temporary Internet Files\Content.IE5\Y94PKDQ7\snapsnet[1].exe” file.
2007-06-18 02:03 SYSTEM 2024 Sign of “Win32:VB-TGS [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\snapsnet.exe” file.
2007-06-18 02:04 SYSTEM 2024 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\Documents and Settings\Brenda Mayorga\Local Settings\Temporary Internet Files\Content.IE5\V7QX137P\wr-1-2000219[1].exe[PECompact]” file.
2007-06-18 02:04 SYSTEM 2024 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\wr-1-2000219.exe[PECompact]” file.
2007-06-18 02:05 SYSTEM 2024 Sign of “Win32:VB-TGS [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\snapsnet.exe” file.
2007-06-18 02:05 SYSTEM 2024 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\wr-1-2000219.exe[PECompact]” file.
2007-06-18 02:06 SYSTEM 2024 Sign of “Win32:Agent-GJD [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\tni32.tmp” file.
2007-06-18 06:33 Brenda Mayorga 2532 Sign of “Win32:Trojan-gen. {Other}” has been found in “C:\Program Files\poolsv\YazzleBundle-1549.exe” file.
2007-06-18 12:21 SYSTEM 2024 Function setifaceUpdatePackages() has failed. Return code is 0x00000003, dwRes is 00000003.
2007-06-18 12:29 SYSTEM 2024 An error has occured while attempting to update. Please check the logs.
2007-06-18 13:33 SYSTEM 2020 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\Documents and Settings\Brenda Mayorga\Local Settings\Temporary Internet Files\Content.IE5\LBCRWB6D\wr-1-0000077[1].exe[UPX]” file.
2007-06-18 13:36 SYSTEM 2020 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\Program Files\svhost\wr-1-0000077.exe[UPX]” file.
2007-06-18 14:00 SYSTEM 2020 Sign of “Win32:VBStat-C [Trj]” has been found in “C:\WINDOWS\system32\dshlbhhh.dll” file.
2007-06-19 00:55 SYSTEM 2020 Sign of “Win32:VBStat-C [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\sqxixlhn.dll” file.
2007-06-19 00:56 SYSTEM 2020 Sign of “Win32:Agent-HZS [Trj]” has been found in “C:\DOCUME~1\BRENDA~1\LOCALS~1\Temp\dqgubvpq.exe” file.
2007-06-19 01:08 Brenda Mayorga 3604 Sign of “Win32:Agent-HZS [Trj]” has been found in “C:\Documents and Settings\Brenda Mayorga\Local Settings\Temp\dqgubvpq.exe” file.
2007-06-19 02:23 Brenda Mayorga 3604 Sign of “Win32:Agent-HDR [Trj]” has been found in “C:\Documents and Settings\Brenda Mayorga\Local Settings\Temp\wr-1-2000219.exe[PECompact]” file.
2007-06-19 03:43 Brenda Mayorga 3604 Sign of “Win32:Trojan-gen. {Other}” has been found in “C:\System Volume Information_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP207\A0040516.exe” file.
2007-06-19 10:48 Brenda Mayorga 3604 Sign of “Win32:VBStat-C [Trj]” has been found in “C:\System Volume Information_restore{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP208\A0041388.dll” file.
2007-06-19 11:02 Brenda Mayorga 3604 Sign of “Win32:Agent-HZS [Trj]” has been found in “C:\WINDOWS\system32\fojtipub.exe” file.
2007-06-20 01:01 SYSTEM 2032 Sign of “Win32:Agent-HZS [Trj]” has been found in “C:\SYSTEM VOLUME INFORMATION_RESTORE{D5341F9C-33F7-43CF-8BD2-1AE937C9BA1B}\RP208\A0041500.EXE” file.

What do you think we should do next? thanks again for all the help!

system · 2007-06-21T18:20:44.000Z

essexboy post:46:

Any thoughts on NirCmd?
Hi Mauserme it is part of combofix

duh !

(and thank you)

system · 2007-06-21T18:49:30.000Z

As far as I can tell your computer is clean at this point. I wanted to see the avast! log to make sure nothing was occurring significantly later than the first ComboFix run since that cleaned most of the problem files. Even though there is one file slightly after that I do not see any indication that a downloader is still at work.

Open OTMoveIt again and click the Clean Up button. This will remove the tools we downloaded and the malware backups.

Next, we will get rid of any remaining, possibly infected restore points and create a clean restore point:

Click Start > All Programs > Accessories > System Tools > System Restore. Fill the radio button to Create a Restore Point and click Next. Give the new restore point a name you will recognize if you need to find it (like Clean Point) and click Create.

Now, click Start > All Programs > Accessories > System Tools > Disk Cleanup. Now click the More Options tab, then click Clean Up in the System Restore section and OK.

After that finishes open Internet Explorer and click Tools>Internet Options>Privacy>Advanced. Make sure the option to reject third party cookies is checked (you may need to check Override Automatic Cookie Handling first). Then click OK>OK. This may help with some of the cookies you’ve been getting.

Finally, you should consider installing a third party firewall. Comodo is my favorite but Zone Alarm and PC Tools Firewall are also good (all 3 are free)

http://filehippo.com/download_comodo/

Keep SuperAntiSpyware and AVG Antispyware on your computer and scan with them from time to time. This will help keep you clean. Spyware Blaster is also a good, passive defense against malware

http://www.javacoolsoftware.com/spywareblaster.html

This is a good time to install it while the computer is clean.

Announcements