Viruses in system32 folder

Lisandro · 2007-04-18T02:46:06.000Z

Steven6767 post:74:

I could just get SP2 from one of my friends.

You’ll need a legit key again… or to crack your system (or installation CD).

system · 2007-04-18T02:54:00.000Z

I ran vundo but no files came up. Is that bad or good?

system · 2007-04-18T02:56:09.000Z

That’s very good

Polonus asked about a fresh hjt log and Tech an online scan. If you’re not completely fed up with us …

Well, if you tell me your computer is running better and the firewall isn’t driving you crazy with connection attempts I’m good with that.

system · 2007-04-18T02:58:18.000Z

Haha, ok well im gonna go then, i’ll keep trying to get SP2, hopefully i’ll get it soon. But for now i’ll keep my computer on lockdown

system · 2007-04-18T02:59:33.000Z

Sorry - edited in a little extra above.

Is the computer running well now? And the firewall is at peace?

system · 2007-04-18T03:03:41.000Z

Yea the firewalla is doing fine I guess, for games online games its a pain in the butt, but it’s fine once I let them through. Yea, I’ll get the Hjt log, and the online scan done tommorow, i’ll reply with the results. Thanks for all the help, I think my computer would have crashed by now if it wasn’t for you haha.

system · 2007-04-18T03:06:02.000Z

You’re welcome.

I’ll take a look at your log tomorow but I think your just fine now.

system · 2007-04-18T03:06:16.000Z

My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.

system · 2007-04-18T03:07:13.000Z

Ok i’ll talk to you later.

system · 2007-04-18T03:07:20.000Z

Steven6767 post:83:

My computer I think is running a lot better, especially without all those annoying virus popups every 5 seconds.

You didn’t like those?

system · 2007-04-19T21:14:31.000Z

Sorry for not replying, I’ll get everything done tonight (hopefully) so we can be done with this , unless my brother steals the computer for a while.

system · 2007-04-20T19:03:11.000Z

Ok, i’ve finally finished everything, my computer acording to the scan is clean, and heres the Hjt log.

Logfile of HijackThis v1.99.1
Scan saved at 4:01:01 AM, on 4/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Comodo\Firewall\CPF.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Comodo\Firewall\cmdagent.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\PnkBstrA.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\WgaTray.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM..\Run: [!AVG Anti-Spyware] “C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe” /minimized
O4 - HKLM..\Run: [COMODO Firewall Pro] “C:\Program Files\Comodo\Firewall\CPF.exe” /background
O4 - HKCU..\Run: [msnmsgr] “C:\Program Files\MSN Messenger\msnmsgr.exe” /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab55762.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O20 - AppInit_DLLs:
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - C:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\System32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\System32\PnkBstrB.exe

essexboy · 2007-04-20T21:10:08.000Z

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

system · 2007-04-20T21:52:34.000Z

I know i’m hoping to get it soon 8)

system · 2007-04-21T02:54:15.000Z

essexboy post:88:

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe (file missing)

NASTY Trojan Backdoor QGB

I would recommend before trying to kill this getting updated to SP1 otherwise you will be continually getting re-infected

We already got rid of the file with SDFix but it’s still registered as a service. It used to read

O23 - Service: ieupdater2 (Microsoft IEUpdater2) - Unknown owner - C:\ie_updater.exe /start

Running “sc delete Microsoft IEUpdater2” from the command line didn’t unregistered it. Should it be “sc delete ieupdater2” instead?

essexboy · 2007-04-21T11:49:02.000Z

Microsoft IEUpdater2

You should be able to delete this via HJT or failing that do it manually through the control panel

Delete an NT Service

[*] Open HiJackThis
[*] Click on the “Config…” button on the bottom right
[*] Click on the tab “Misc Tools”
[*] click on “delete an NT service”
[*] Copy and paste this in: Microsoft IEUpdater2
[*] Click “ok”, then reboot

Open control panel select Administration tools
Select services
Scroll down to the required service
Double click and set to STOP
Then in the drop down box set to DISABLE

system · 2007-04-21T21:14:34.000Z

Ok i’ll do that tonight ;D

system · 2007-04-21T21:25:53.000Z

Alrighty, everything went smoothly, it deleted and everything. Is everything good now? I’m supposed to be getting one of the sp’s soon.

essexboy · 2007-04-21T21:41:50.000Z

Hot to trot should be able to go direct to SP2

system · 2007-04-21T23:10:07.000Z

What?

Announcements