It’s unfortunate that this has to be my first post, but my machine has been compromised. I’ve read lots in the past couple days, but I’m not confident in exactly what to do. I’m not savvy with registry related processes and system files, so if anybody could make some suggestions for me, I would really appreciate it.
Here’s what Hijack brought up:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:13:32 PM, on 09/02/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
There’s quite a few files in my avast! chest as well. Some are from awhile back, others I found in the last 48 hours. Last night, I found probably 10 or so Trojan warnings in a Boot Time scan. I deleted a couple that I couldn’t confirm anywhere, and then decided to wait an see what was posted here.
I’m also using Security Task Manager, and I can see hidden processes that have no valid identification and match some of the .dll files sitting in the chest. These processes cannot be terminated, despite the location of their corresponding files having been changed.
Just looking for direction on identifying anymore problems, types of software to use in repairing and cleaning, identifying false positives (if any), etc… Thank you to anyone for your time and insight into helping me deal with this. I know this is probaly the umpteenth time some of you have addressed this.
K, I’ll shut-up now.
An analysis of your HJT log did not detect any active process of a firewall on your system.
What firewall are you using, if any?
This one is very bad and related to a Vundo infection …
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\iifGvsRh.dll (file missing)
[Must be fixed! Unnecessary (deactivated) entry that can be fixed. [random file name] - VirtuMonde/Vundo]
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
[Part of Windows Live Messenger]
O2 - BHO: {efaa7d0a-95d4-d59a-5334-0ab65ac6c3c8} - {8c3c6ca5-6ba0-4335-a95d-4d59a0d7aafe} - C:\WINDOWS\system32\jomkvq.dll (file missing)
[Unknown application. Unnecessary (deactivated) entry that can be fixed.]
O2 - BHO: (no name) - {B482CCBF-DF7D-41E0-8D21-FFC0B62A43EE} - C:\WINDOWS\system32\qoMeCrPH.dll (file missing)
[Unknown application. Unnecessary (deactivated) entry that can be fixed.]
I’m currently running Windows Security Center and it indicates that the firewall is active and working. It is possible that there is something wrong with it?
So, am I to understand that it was unnecessary to move the above two to the chest? How do I fix them?
Thanks, Micky … somehow I forgot to include that one. Well, it was very early morning by then and I was sleepy.
Furias -
I would suggest that you run HJT again, put check marks in the boxes beside the entries I noted plus the one Micky added, and then click the “Fix” button at the bottom.
It is spyware, adware related, I would like to remove this 020 file jomkvq.dll.
These finds are mostly things that are unwanted, generic80 finds, come in combination with SysDaJHv.dl
(malware-spywware), so better fix,
Thanks a lot, all three of you. Sorry I couldn’t reply right away. Had to leave town suddenly. I’ll run HiJack now and let you guys know how it turns out.
Well, everything worked out according to HiJack. The entries you guys pointed out no longer show up after a scan.
I just have 2 final questions:
Is there anything you guys would recommend I install over what I am running now(Windows Security Center and Avast!) that would be a better?
And, What should I do, if anything, with the other files sitting in my Avast! chest?
It’s really great to know there are peeps out there willing to help others out, again, I very much appreciate the time and advice from all of you. Have a good one!
The windows security center (WSC), isn’t a security application, all it does is report on the status of certain installed security applications, AV, Firewall (and anti-spyware in the case of the Vista version of WSC).
If you haven’t already got this software (freeware), download, install, update and periodically run it.
MalwareBytes Anti-Malware, On-Demand only in free version http://download.bleepingcomputer.com/malwarebytes/mbam-setup.exe, right click on the link and select Save As or Save File (As depending on your browser), save it to a location where you can find it easily later.
Whilst the windows XP firewall is usually good at keeping your ports stealthed (hidden) it provides no outbound protection and you should consider a third party firewall.
Any malware that manages to get past your defences will have free reign to connect to the internet to either download more of the same, pass your personal data (sensitive or otherwise, user names, passwords, keylogger retrieved data, etc.) or open a backdoor to your computer, so outbound protection is essential.
There are many freeware firewalls such as, Comodo (care required now it is a suite not to install the anti-virus element), PCTools Firewall Plus, Jetico, etc. - Zone Alarm free works fine with avast and has a reasonably friendly user interface, however, the free version is becoming bloated with trial ware and is also crippled as far as outbound protection goes In the Program Control, configuration area, the slider will only goes as far as Medium protection, if you want more you have to buy the Pro version.