I've been hijacked please help

spoontangclan · March 12, 2009

Hello,

I did something very foolish the other night. I downloaded what I thought was an .mp3 that i found through a google mp3 search. The file was "compressed" with an irar format. So the file i downloaded was artist name - song title.mp3.irar. I then googled around a bit, and found what was disguised as an irar decompression utility called "irar.jar". As soon as I went to open that download, AVG Free 8.0 went nuts, and alerted me that I had like 8 viruses and trojans. It looked as if it quarentined them all and I performed a few full scans w/ AVG and i thought my problems were solved. But i still noticed some strange behavior (sites taking long to load. Sites with ajax components were not submitted data properly). So i tried to download MalwareBytes, and spybot to do some more scans. Neither one would open or install at first. I finally got both of them to install in safe mode, but then neither program would open. I found a link to a batch utility on this forum that changed the filename of the Malwarebytes.exe and that allowed me to open the program, however, when i tried to update the definitions, the download would work, tell me it was going to restart MWB and install the latest definitions, and then nothing would happen. So, I did a full-scan with the old definitons. The MWB log is posted below. Also below, you'll find my Hijack this log. I also followed some advice from this forum, and downloaded Avira Anti-virus which solved 5 or 6 problems.

ps. Sorry i don't have the scan log from AVG or Avira. I had to uninstall AVG and Avira when I tried to use the trial version of Kapersky (which I've now uninstalled and reverted back to AVG).

I hope you guys can help me! Thanks in advance!

==========================================

Logfile of HijackThis v1.99.1

Scan saved at 7:09:19 PM, on 3/12/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Malwarebytes' Anti-Malware\218164740218.exe

C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

C:\Program Files\HijackThis\HijackThis.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Internet Explorer\Iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: (no name) - {E6259B45-C2FC-4C2D-8B3C-9CF57890A826} - c:\windows\system32\ushxkpm.dll (file missing)

O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PlayOn] C:\Program Files\MediaMall\PlayOn.exe

O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Startup: EventGhost.lnk = C:\Program Files\EventGhost\EventGhost.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll

O11 - Options group: [java_sun] Java (Sun)

O16 - DPF: {5d86ddb5-bdf9-441b-9e9e-d4730f4ee499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{DE3261FB-FF0E-4EC1-8387-199183A15128}: NameServer = 68.87.73.242,68.87.71.226

O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)

O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll

O20 - Winlogon Notify: tdgzvhui - ushxkpm.dll (file missing)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - %fystemRoot%\system32\svchost.exe (file missing)

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (javaquickstarterservice) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)

O23 - Service: Automatic Updates (wuauserv) - Unknown owner - %fystemroot%\system32\svchost.exe (file missing)

O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\SNAPST~1\Common\x10nets.exe

==========================================

Malwarebytes' Anti-Malware 1.31

Database version: 1456

Windows 5.1.2600 Service Pack 3

3/12/2009 7:55:08 PM

mbam-log-2009-03-12 (19-55-03).txt

Scan type: Full Scan (C:\|D:\|)

Objects scanned: 222494

Time elapsed: 1 hour(s), 3 minute(s), 29 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt (Trojan.Downloader) -> No action taken.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

spoontangclan · March 13, 2009

So here is some more information about my hijack including a few more symptoms. Periodically while I'm running scans, a dialogue pops up saying that Google Installer (sometimes it's google updater) has encoutered a problem, and it asks me if I want to send an error report.

Also, When I was installing both kapersky and AVG, both installations said I had to shutdown different websites that were open (even though both times I didn't have a browser open).

I just reinstalled Avira Anti-Vir, as described in this thread, and here is that log:

Avira AntiVir Personal

Report file date: Thursday, March 12, 2009 21:43

Scanning for 1295836 virus strains and unwanted programs.

Licensed to: Avira AntiVir PersonalEdition Classic

Serial number: 0000149996-ADJIE-0001

Platform: Windows XP

Windows version: (Service Pack 3) [5.1.2600]

Boot mode: Normally booted

Username: SYSTEM

Computer name: REEDIE-DEN

Version information:

BUILD.DAT : 8.2.0.337 16934 Bytes 11/18/2008 13:05:00

AVSCAN.EXE : 8.1.4.10 315649 Bytes 11/18/2008 13:21:26

AVSCAN.DLL : 8.1.4.0 40705 Bytes 5/26/2008 12:56:40

LUKE.DLL : 8.1.4.5 164097 Bytes 6/12/2008 17:44:19

LUKERES.DLL : 8.1.4.0 12033 Bytes 5/26/2008 12:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 16:30:36

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2/11/2009 01:28:12

ANTIVIR2.VDF : 7.1.2.152 749568 Bytes 3/11/2009 01:28:20

ANTIVIR3.VDF : 7.1.2.163 39424 Bytes 3/12/2009 01:28:21

Engineversion : 8.2.0.114

AEVDF.DLL : 8.1.1.0 106868 Bytes 3/13/2009 01:28:53

AESCRIPT.DLL : 8.1.1.63 364923 Bytes 3/13/2009 01:28:52

AESCN.DLL : 8.1.1.8 127346 Bytes 3/13/2009 01:28:50

AERDL.DLL : 8.1.1.3 438645 Bytes 11/4/2008 18:58:38

AEPACK.DLL : 8.1.3.10 397686 Bytes 3/13/2009 01:28:45

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 3/13/2009 01:28:40

AEHEUR.DLL : 8.1.0.104 1634679 Bytes 3/13/2009 01:28:38

AEHELP.DLL : 8.1.2.2 119158 Bytes 3/13/2009 01:28:31

AEGEN.DLL : 8.1.1.28 336244 Bytes 3/13/2009 01:28:26

AEEMU.DLL : 8.1.0.9 393588 Bytes 10/14/2008 15:05:56

AECORE.DLL : 8.1.6.6 176501 Bytes 3/13/2009 01:28:24

AEBB.DLL : 8.1.0.3 53618 Bytes 10/14/2008 15:05:56

AVWINLL.DLL : 1.0.0.12 15105 Bytes 7/9/2008 13:40:05

AVPREF.DLL : 8.0.2.0 38657 Bytes 5/16/2008 14:28:01

AVREP.DLL : 8.0.0.2 98344 Bytes 7/31/2008 17:02:15

AVREG.DLL : 8.0.0.1 33537 Bytes 5/9/2008 16:26:40

AVARKT.DLL : 1.0.0.23 307457 Bytes 2/12/2008 13:29:23

AVEVTLOG.DLL : 8.0.0.16 119041 Bytes 6/12/2008 17:27:49

SQLITE3.DLL : 3.3.17.1 339968 Bytes 1/22/2008 22:28:02

SMTPLIB.DLL : 1.2.0.23 28929 Bytes 6/12/2008 17:49:40

NETNT.DLL : 8.0.0.1 7937 Bytes 1/25/2008 17:05:10

RCIMAGE.DLL : 8.0.0.51 2371841 Bytes 6/12/2008 18:48:07

RCTEXT.DLL : 8.0.52.0 86273 Bytes 6/27/2008 18:34:37

Configuration settings for the scan:

Jobname..........................: Complete system scan

Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp

Logging..........................: low

Primary action...................: repair

Secondary action.................: rename

Scan master boot sector..........: on

Scan boot sector.................: on

Boot sectors.....................: C:, D:,

Process scan.....................: on

Scan registry....................: on

Search for rootkits..............: on

Scan all files...................: All files

Scan archives....................: on

Recursion depth..................: 20

Smart extensions.................: on

Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,

Macro heuristic..................: on

File heuristic...................: medium

Start of the scan: Thursday, March 12, 2009 21:43

Starting search for hidden objects.

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-00000004.dll

[0] Archive type: HIDDEN

[iNFO] The file is not visible.

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-00000004.dll

[DETECTION] Contains recognition pattern of the RKIT/TDss.eyj.65 root kit

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-00000008.dll

[0] Archive type: HIDDEN

[iNFO] The file is not visible.

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-00000008.dll

[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-0000000A.dll

[0] Archive type: HIDDEN

[iNFO] The file is not visible.

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-0000000A.dll

[DETECTION] Contains recognition pattern of the RKIT/TDss.eyj.66 root kit

C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-0000000C.sys

[0] Archive type: HIDDEN

[iNFO] The file is not visible.

--> FIL\\\?\C:\Documents and Settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVSCAN-20090312-214336-1BDAE3F7\AVSCAN-0000000C.sys

[DETECTION] Is the TR/Rootkit.Gen Trojan

The repair of rootkits is only in interactive mode possible!

c:\windows\system32\uacoxtuijwq.dll

[DETECTION]

c:\windows\system32\drivers\uacikkbprrn.sys

[DETECTION]

c:\windows\temp\uac8d61.tmp

[iNFO] The file is not visible.

c:\windows\temp\uacf4cc.tmp

[iNFO] The file is not visible.

c:\windows\system32\uacalmlhlnq.dll

[DETECTION]

[iNFO] No SpecVir entry was found!

c:\windows\system32\uacbavbowaf.dat

[iNFO] The file is not visible.

c:\windows\system32\uacinit.dll

[iNFO] The file is not visible.

c:\windows\system32\uackjppmbco.dll

[iNFO] The file is not visible.

c:\windows\system32\uacrtwswrtg.log

[iNFO] The file is not visible.

c:\windows\system32\uacsworoyig.dll

[DETECTION]

[iNFO] No SpecVir entry was found!

c:\windows\system32\uactepnyswr.dll

[iNFO] The file is not visible.

c:\documents and settings\administrator\local settings\temp\uac5f99.tmp

[iNFO] The file is not visible.

c:\documents and settings\all users\application data\sectaskman\uackjppmbco.dll.q_1bb50_q.ini

[iNFO] The file is not visible.

HKEY_LOCAL_MACHINE\System\ControlSet001\Services\764e1fa9\imagepath