Viruses in system32 folder

system · 2007-04-18T02:39:32.000Z

Yep - they’re free.

But before you do that, will you do me one favor? I would like to check one more thing.

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
When VundoFix re-opens, click the Scan for Vundo button.
Once it’s done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from “Click the
Scan for Vundo button.” when VundoFix appears at reboot.

A log will be produced which you can post in your next response.

system · 2007-04-18T02:41:20.000Z

Steven6767 post:70:

I went to install the service pack 1a and it says my product key is invalid? I don’t want to get to technical with this like call them up and everything to get a new product key. Is there any way to get a quick fix, without a valid key?

I don’t know of a way around this. If the key is valid contacting them shouldn’t be a problem. If not, well …

Lisandro · 2007-04-18T02:42:41.000Z

Steven6767 post:69:

Haha yea, the sp’s are free to update right?

If your Windows copy is legit… yes you can apply them… without it, you won’t be able…

system · 2007-04-18T02:43:25.000Z

Ok, i’ll do the vundofix in a second. I guess I could try to e-mail them, or I could just get SP2 from one of my friends.

system · 2007-04-18T02:45:25.000Z

Ill run VFix now and i’ll be back on in a minute ;D

Lisandro · 2007-04-18T02:46:06.000Z

Steven6767 post:74:

I could just get SP2 from one of my friends.

You’ll need a legit key again… or to crack your system (or installation CD).

system · 2007-04-18T02:54:00.000Z

I ran vundo but no files came up. Is that bad or good?

system · 2007-04-18T02:56:09.000Z

That’s very good

Polonus asked about a fresh hjt log and Tech an online scan. If you’re not completely fed up with us …

Well, if you tell me your computer is running better and the firewall isn’t driving you crazy with connection attempts I’m good with that.

system · 2007-04-18T02:58:18.000Z

Haha, ok well im gonna go then, i’ll keep trying to get SP2, hopefully i’ll get it soon. But for now i’ll keep my computer on lockdown

system · 2007-04-18T02:59:33.000Z

Sorry - edited in a little extra above.

Is the computer running well now? And the firewall is at peace?

system · 2007-04-18T03:03:41.000Z

Yea the firewalla is doing fine I guess, for games online games its a pain in the butt, but it’s fine once I let them through. Yea, I’ll get the Hjt log, and the online scan done tommorow, i’ll reply with the results. Thanks for all the help, I think my computer would have crashed by now if it wasn’t for you haha.

system · 2007-04-18T03:06:02.000Z

You’re welcome.

I’ll take a look at your log tomorow but I think your just fine now.

system · 2007-04-18T03:06:16.000Z

My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.

system · 2007-04-18T03:07:13.000Z

Ok i’ll talk to you later.

system · 2007-04-18T03:07:20.000Z

Steven6767 post:83:

My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.

You didn’t like those?

system · 2007-04-19T21:14:31.000Z

Sorry for not replying, I’ll get everything done tonight (hopefully) so we can be done with this , unless my brother steals the computer for a while.

system · 2007-04-20T19:03:11.000Z

Ok, i’ve finally finished everything, my computer acording to the scan is clean, and heres the Hjt log.

Logfile of HijackThis v1.99.1
Scan saved at 4:01:01 AM, on 4/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM..\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized
O4 - HKLM..\Run: [COMODO Firewall Pro] “C:\Program Files\Comodo\Firewall\CPF.exe” /background
O4 - HKCU..\Run: [msnmsgr] “C:\Program Files\MSN Messenger\msnmsgr.exe” /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

essexboy · 2007-04-20T21:10:08.000Z

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

system · 2007-04-20T21:52:34.000Z

I know i’m hoping to get it soon 8)

system · 2007-04-21T02:54:15.000Z

essexboy post:88:

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

We already got rid of the file with SDFix but it’s still registered as a service. It used to read

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe /start

Running “sc delete Microsoft IEUpdater2” from the command line didn’t unregistered it. Should it be “sc delete ieupdater2” instead?

Announcements