Virtumonde?

Lisandro · 2007-12-31T19:03:37.000Z

Does this tool help?
http://www.symantec.com/security_response/writeup.jsp?docid=2003-120914-4108-99&tabid=3

essexboy · 2007-12-31T19:13:40.000Z

If you have the “latest” Version of Virtumond you will need to kill all the infected files otherwise it will not go away. sUBs has released a new version of Combofix. I would like you to download and run it. But a word of caution untill it is clean do not reboot your system or any missed will start the whole process all over. The files that are corrupted are recoverable

Download ComboFix from Here or Here to your Desktop.

[*]Double click combofix.exe and follow the prompts.
[*]When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix’s window while its running. That may cause it to stall

Also download but do not use yet

[*]Download RenV.exe by sUBs to your desktop

system · 2008-01-01T16:08:36.000Z

Thanks for your advice. The reports are too big for one post so the Hijakthis log will follow. I should add that I seem to have attracted many viruses over the last week or so, most likely through Limewire. I had hoped that Avast would do the job but clearly not 100%. Hmmm there’s a lesson there I think.

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1457 [GMT 0:00]
Running from: C:\Documents and Settings\Phil Green\My Documents\ComboFix.exe

Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
c:\program files\steam\steam.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\SRN Micro\SOLOSENT.EXE
C:\SRNMIC~1\SOLOSENT.EXE
C:\WINDOWS\Downloaded Program Files\Quarantine
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\Fonts\a.zip
C:\WINDOWS\Fonts\Crack.exe
C:\WINDOWS\Fonts\svchost.exe
C:\Windows\SMINST\RecGuard.exe
C:\WINDOWS\system32\ctfmon.exe.tmp
C:\WINDOWS\system32\drivers\sfsync02.sys
C:\WINDOWS\system32\fccabcd.dll
C:\WINDOWS\system32\geedc(2).dll
C:\WINDOWS\system32\gjjlm.ini
C:\WINDOWS\system32\gjjlm.ini2
C:\WINDOWS\system32\jkkkjjk.dll
C:\WINDOWS\system32\jkklihg.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mljjg.dll
C:\WINDOWS\system32\mljjg.exe
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\qomkjhh.dll
C:\WINDOWS\system32\UpMedia
C:\winlogon.exe
E:\Autorun.inf
C:\WINDOWS\Fonts'

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_SFSYNC02
-------\sfsync02

system · 2008-01-01T16:15:54.000Z

(2 of 3(?)) For future reference is there an easier way of posting files?

((((((((((((((((((((((((( Files Created from 2007-12-01 to 2008-01-01 )))))))))))))))))))))))))))))))
.

2008-01-01 15:13 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 14:52 . 2008-01-01 14:52 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-01 14:52 . 2008-01-01 14:52 d-------- C:\WINDOWS\LastGood.Tmp
2008-01-01 14:52 . 2008-01-01 14:52 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-01 14:52 . 2008-01-01 14:52 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-01 14:52 . 2008-01-01 14:52 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-31 15:37 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2007-12-31 14:07 . 2007-12-04 12:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-31 14:07 . 2007-12-04 14:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-31 14:07 . 2007-12-04 14:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-31 14:07 . 2007-12-04 14:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-31 14:07 . 2007-12-04 14:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-31 14:07 . 2007-12-04 14:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-31 14:06 . 2007-12-04 13:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-31 14:06 . 2004-01-09 09:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-31 10:48 . 2008-01-01 15:17 d-------- C:\SRN Micro
2007-12-30 23:32 . 2007-12-31 10:25 d-------- C:\Program Files\PerformanceTest
2007-12-30 21:50 . 2007-12-31 10:25 d-------- C:\Program Files\AdwareAlert
2007-12-30 21:50 . 2007-12-30 21:50 d-------- C:\Documents and Settings\Phil Green\Application Data\AdwareAlert
2007-12-30 18:16 . 2007-12-30 22:37 d-------- C:\VundoFix Backups
2007-12-30 17:36 . 2007-12-31 10:25 d-------- C:\Program Files\RegistryFix
2007-12-30 17:17 . 2007-12-30 17:17 d-------- C:\Documents and Settings\All Users\Application Data\PCPitstop
2007-12-30 14:09 . 2007-12-30 14:09 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-30 14:09 . 2007-12-30 14:09 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-30 14:07 . 2007-12-31 10:26 d-------- C:\Program Files\QuickTime
2007-12-30 14:06 . 2007-12-31 10:26 d-------- C:\Program Files\Apple Software Update
2007-12-11 19:46 . 2007-12-11 19:46 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 19:46 . 2007-12-11 19:46 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-12-11 19:46 . 2007-12-11 19:46 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-12-11 19:45 . 2007-12-11 19:45 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 19:45 . 2007-12-11 19:45 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-11 19:43 . 2007-12-11 19:43 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-11 10:57 . 2007-12-11 10:57 65,536 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2007-12-11 10:57 . 2007-12-11 10:57 49,152 --a------ C:\WINDOWS\system32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 15:17 --------- d-----w C:\Program Files\Steam
2008-01-01 14:48 --------- d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-12-31 15:37 --------- d-----w C:\Program Files\Java
2007-12-31 11:56 --------- d-----w C:\Program Files\GemMaster
2007-12-31 11:55 251 ----a-w C:\Program Files\wt3d.ini
2007-12-31 11:52 --------- d-----w C:\Program Files\Google
2007-12-31 10:46 --------- d-----w C:\Program Files\LimeWire
2007-12-31 10:25 --------- d-----w C:\Program Files\PCPitstop
2007-12-30 14:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2007-12-11 19:46 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys
2007-11-20 11:09 134 ----a-w C:\n.bat
2007-11-18 15:47 --------- d-----w C:\Program Files\DivX
2007-11-17 12:22 --------- d-----w C:\Program Files\Full Tilt Poker
2007-11-13 14:24 822,272 ----a-w C:\WINDOWS\system32\drivers\BCMWL5.SYS
2007-11-13 14:20 --------- d-----w C:\Program Files\DIFX
2007-11-13 14:01 --------- d-----w C:\Program Files\Hewlett-Packard
2007-11-13 13:55 35,092,648 ----a-w C:\Vista upgrade.exe
2007-11-13 13:51 --------- d–h–w C:\Program Files\InstallShield Installation Information
2007-11-13 13:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 13:22 --------- d-----w C:\Program Files\SystemRequirementsLab
2007-11-07 10:34 --------- d-----w C:\Program Files\PartyGaming
2007-11-06 23:57 --------- d-----w C:\Program Files\Real
2007-11-06 23:57 --------- d-----w C:\Program Files\Common Files\xing shared
2007-11-06 23:57 --------- d-----w C:\Program Files\Common Files\Real
2007-11-05 12:08 --------- d-----w C:\Documents and Settings\Phil Green\Application Data\CyberLink
2007-11-05 12:07 --------- d-----w C:\Program Files\Guild Wars
2007-11-04 18:35 --------- d-----w C:\Program Files\PacificPoker4
2007-11-02 18:05 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-11-02 18:05 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_HpqKbFiltr_01005.Wdf
2007-11-02 18:04 --------- d-----w C:\Documents and Settings\Phil Green\Application Data\InstallShield
2007-11-02 18:03 --------- d-----w C:\Program Files\HP
2007-11-02 14:52 675,579 ----a-w C:\WINDOWS\PROGRAM.exe
2007-11-02 14:52 177,480 ----a-w C:\WINDOWS\distro_SelectRebatesSetup_um1002.exe
.


----a-w            79,224 2008-01-01 14:48:30  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w            81,920 2008-01-01 14:48:21  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           221,184 2007-12-31 15:47:30  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w           185,896 2008-01-01 14:48:23  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w           171,448 2008-01-01 14:48:32  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe
----a-w            40,960 2007-12-31 15:47:26  C:\Program Files\Hewlett-Packard\Default Settings\cpqset .exe
----a-w            49,152 2008-01-01 14:48:22  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w           102,400 2008-01-01 14:48:18  C:\Program Files\HP\QuickPlay\QPService .exe
----a-w            75,520 2007-12-31 14:55:52  C:\Program Files\Java\jre1.5.0_11\bin\jusched .exe
----a-w         1,694,208 2007-12-31 11:55:23  C:\Program Files\Messenger\msmsgs .exe
----a-w         1,266,936 2008-01-01 14:48:37  C:\Program Files\Steam\steam .exe
----a-w         1,015,808 2008-01-01 14:48:17  C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w           102,400 2007-12-31 15:47:31  C:\Program Files\Synaptics\SynTP\SynTPStart .exe
----a-w           204,288 2008-01-01 14:48:33  C:\Program Files\Windows Media Player\WMPNSCFG .exe
----a-w           303,104 2007-12-31 14:51:37  C:\SRN Micro\SOLOCFG .EXE
----a-w            77,824 2008-01-01 14:48:27  C:\SRN Micro\SOLOSENT .EXE
----a-w            64,512 2008-01-01 14:48:11  C:\WINDOWS\ehome\ehtray .exe
----a-w           839,695 2008-01-01 14:48:27  C:\WINDOWS\Fonts\svchost .exe
----a-w         1,187,840 2007-12-31 15:47:30  C:\WINDOWS\SMINST\RecGuard .exe
----a-w            15,360 2008-01-01 14:48:32  C:\WINDOWS\system32\ctfmon .exe

system · 2008-01-01T16:18:03.000Z

(3 of 3)
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2006-03-15 20:00 15360]
“swg”=“C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe”
“WMPNSCFG”=“C:\Program Files\Windows Media Player\WMPNSCFG.exe”
“Steam”=“c:\program files\steam\steam.exe”

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ehTray”=“C:\WINDOWS\ehome\ehtray.exe”
“hpWirelessAssistant”=“C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe” [2006-10-18 09:32 472800]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”
“MsmqIntCert”=“regsvr32 /s mqrt.dll”
“High Definition Audio Property Page Shortcut”=“CHDAudPropShortcut.exe” [2006-07-26 22:44 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]
“SynTPEnh”=“C:\Program Files\Synaptics\SynTP\SynTPEnh.exe”
“QPService”=“C:\Program Files\HP\QuickPlay\QPService.exe”
“QlbCtrl”=“C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe” [2007-09-06 13:47 173360]
“Cpqset”=“C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe”
“RecGuard”=“C:\Windows\SMINST\RecGuard.exe”
“ISUSPM Startup”=“C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe”
“ISUSScheduler”=“C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe”
“SynTPStart”=“C:\Program Files\Synaptics\SynTP\SynTPStart.exe”
“HP Software Update”=“c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe”
“TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe”
“NvCplDaemon”=“C:\WINDOWS\system32\NvCpl.dll” [2006-07-20 20:58 7581696]
“NvMediaCenter”=“C:\WINDOWS\system32\NvMcTray.dll” [2006-07-20 20:58 86016]
“nwiz”=“nwiz.exe” [2006-07-20 20:58 1519616 C:\WINDOWS\system32\nwiz.exe]
“SoloSentry”=“C:\SRNMIC~1\SOLOSENT.EXE”
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe”

[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“C:\WINDOWS\system32\CTFMON.EXE” [2006-03-15 20:00 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-02-06 15:14:00]
HP Pavilion Webcam Tray Icon.lnk - C:\Program Files\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe [2006-11-30 03:25:02]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 16:39:30]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
“InstallVisualStyle”= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
“InstallTheme”= C:\WINDOWS\Resources\Themes\Royale.theme

R3 nvsmu;nvsmu;C:\WINDOWS\system32\DRIVERS\nvsmu.sys [2006-03-05 23:49]
S0 Spssys;Toshiba SPS Service;C:\WINDOWS\system32\drivers\spssys.sys
S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;C:\WINDOWS\system32\Drivers\5U870CAP.sys [2006-06-06 20:39]
S3 MODBDA2;DiBcom MOD3000 TV receiver;C:\WINDOWS\system32\Drivers\modbda2.sys [2006-07-16 06:27]
S3 RIOUNIV;Rio universal USB driver;C:\WINDOWS\system32\Drivers\RIOUNIV.sys [2007-02-25 14:42]

.
Contents of the ‘Scheduled Tasks’ folder
“2007-12-31 10:18:50 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job”

C:\Program Files\AdwareAlert\AdwareAlert .ex
C:\Program Files\AdwareAlert
“2007-12-30 14:07:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job”
C:\Program Files\Apple Software Update\SoftwareUpdate.exe
“2008-01-01 14:52:12 C:\WINDOWS\Tasks\User_Feed_Synchronization-{805A47BE-DB5F-4E09-82A4-199856E9AA86}.job”
C:\WINDOWS\system32\msfeedssync.exe
.

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 15:20:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

.
Completion time: 2008-01-01 15:23:10 - machine was rebooted
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-01 15:23:07
.
2007-11-02 13:48:36 — E O F —

system · 2008-01-01T16:21:06.000Z

(1 of 2)
Logfile of HijackThis v1.99.1
Scan saved at 15:33:11, on 01/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
C:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\RioMSC.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\mqsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\mqtgsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\PROGRA~1\HEWLET~1\Shared\HPQTOA~1.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?wa=wsignin1.0&rpsnv=10&ct=1198088742&rver=4.5.2130.0&wp=MBI&wreply=http:%2F%2Fmail.live.com%2Fdefault.aspx&id=64855
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=pavilion&pf=laptop
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

system · 2008-01-01T16:22:42.000Z

(2 of 2) I hope this means more to you than it does me.

Regards

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe”
O4 - HKLM..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM..\Run: [QPService] “C:\Program Files\HP\QuickPlay\QPService.exe”
O4 - HKLM..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
O4 - HKLM..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM..\Run: [ISUSScheduler] “C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe” -start
O4 - HKLM..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM..\Run: [HP Software Update] c:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM..\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM..\Run: [nwiz] nwiz.exe /installquiet /nodetect
O4 - HKLM..\Run: [SoloSentry] C:\SRNMIC~1\SOLOSENT.EXE
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU..\Run: [Steam] “c:\program files\steam\steam.exe” -silent
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = C:\Program Files\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: PacificPoker4 - {94EDF7B4-4272-4af3-8F8B-4E2F68E225B7} - C:\PROGRA~1\PACIFI~1\pacificpoker.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra ‘Tools’ menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra ‘Tools’ menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=pavilion&pf=laptop
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1193332600968
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1193332853468
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rio MSC Manager (RioMSC) - Digital Networks North America, Inc. - C:\WINDOWS\system32\RioMSC.exe

Lisandro · 2008-01-01T17:23:23.000Z

essexboy post:3:

Download ComboFix from Here or Here to your Desktop.

[*]Double click combofix.exe and follow the prompts.
[*]When finished, it shall produce a log for you.

For me, nothing happens… Does it work on Vista?
It keeps in a blank cmd window of the Administrator.

oldman960 · 2008-01-01T17:33:40.000Z

FAIKi t’s not vista compatable.

essexboy · 2008-01-01T17:39:47.000Z

You have the new version of Vundo

[*]Copy the entire contents of the Code Box below to Notepad.
[*]Name the file as Log.txt (Overwrite the existing one)
[*]Change the Save as Type to All Files
[*]and Save it on the desktop

 ----a-w            79,224 2008-01-01 14:48:30  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w            81,920 2008-01-01 14:48:21  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w           221,184 2007-12-31 15:47:30  C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM .exe
----a-w           185,896 2008-01-01 14:48:23  C:\Program Files\Common Files\Real\Update_OB\realsched .exe
----a-w           171,448 2008-01-01 14:48:32  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe
----a-w            40,960 2007-12-31 15:47:26  C:\Program Files\Hewlett-Packard\Default Settings\cpqset .exe
----a-w            49,152 2008-01-01 14:48:22  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w           102,400 2008-01-01 14:48:18  C:\Program Files\HP\QuickPlay\QPService .exe
----a-w            75,520 2007-12-31 14:55:52  C:\Program Files\Java\jre1.5.0_11\bin\jusched .exe
----a-w         1,694,208 2007-12-31 11:55:23  C:\Program Files\Messenger\msmsgs .exe
----a-w         1,266,936 2008-01-01 14:48:37  C:\Program Files\Steam\steam .exe
----a-w         1,015,808 2008-01-01 14:48:17  C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w           102,400 2007-12-31 15:47:31  C:\Program Files\Synaptics\SynTP\SynTPStart .exe
----a-w           204,288 2008-01-01 14:48:33  C:\Program Files\Windows Media Player\WMPNSCFG .exe
----a-w           303,104 2007-12-31 14:51:37  C:\SRN Micro\SOLOCFG .EXE
----a-w            77,824 2008-01-01 14:48:27  C:\SRN Micro\SOLOSENT .EXE
----a-w            64,512 2008-01-01 14:48:11  C:\WINDOWS\ehome\ehtray .exe
----a-w           839,695 2008-01-01 14:48:27  C:\WINDOWS\Fonts\svchost .exe
----a-w         1,187,840 2007-12-31 15:47:30  C:\WINDOWS\SMINST\RecGuard .exe
----a-w            15,360 2008-01-01 14:48:32  C:\WINDOWS\system32\ctfmon .exe

http://img.photobucket.com/albums/v666/sUBs/RenV.gif

Refering to the picture above, drag Log.txt into RenV.exe and attach the resulting report to your reply.

essexboy · 2008-01-01T17:43:49.000Z

I forgot to add that until this is finished do not reboot or start any other programme unless I say as it will infect/reinfect them

Lisandro · 2008-01-01T17:58:22.000Z

essexboy, any tool to scan my Vista system?

essexboy · 2008-01-01T18:00:08.000Z

What are you looking for ? Anything specific ?

oldman960 · 2008-01-01T18:02:08.000Z

Here Tech, essexboy probaly has more

http://forums.thatcomputerguy.us/index.php?showtopic=21427

system · 2008-01-01T18:03:14.000Z

In my inpatience I’ve experimented with RenV already I looked an another thread.

This is the report created when I followed your instructions above.


Ran on 01/01/2008 - 17:56:08.42

 Entries:                0  (0)
 Directories:            0  Files:             0
 Bytes:                  0  Blocks:            0

Is this confimation everything is correct or should I reboot and restart the process?

essexboy · 2008-01-01T18:12:24.000Z

That shows that the nasties have gone re-run combofix to be sure. But looking good

essexboy · 2008-01-01T18:13:48.000Z

Hi Tech combofix worked on my system but it did take a minute or two to commence work, and then took about 12 minutes to run right through. I am running Vista SP1

system · 2008-01-01T18:21:13.000Z

I can’t thank you enough. Cheers fella.

While I’m on a role is there any software you could recomend, Anti-virus/Anti Spyware/Registry Cleaners that work with Avast?

essexboy · 2008-01-01T18:26:04.000Z

Personal preference for me is Superantispyware as it out performs AVG at every step, plus it has some built in repair tools. Spywareblaster is a must as that passively protects parts of your registry

http://www.superantispyware.com/downloadfile.html?productid=SUPERANTISPYWAREFREE

http://www.javacoolsoftware.com/spywareblaster.html

Lisandro · 2008-01-01T18:43:05.000Z

essexboy post:18:

Hi Tech combofix worked on my system but it did take a minute or two to commence work, and then took about 12 minutes to run right through. I am running Vista SP1

I was impatient… I’ll try again…

essexboy post:14:

What are you looking for ? Anything specific ?

Something that could run on-demand or on-line, side-by-side with avast and check if the system is clean. If avast can’t detect some kinds of malware, what should I run more to be sure I’m clean?

oldman post:15:

Here Tech, essexboy probaly has more
http://forums.thatcomputerguy.us/index.php?showtopic=21427

More? Nothing new… mostly non-Vista compatible…

Announcements