Recurrent malware/trojan: Poyboyifenu, zegofadu, dll trouble

[glue78]

I became infected after receiving a false email and stupidly opening it despite my doubts! Anyway, I got hold of Malwarebytes anti-malware, hijack this, spybot -s&D and even purchased Kaspersky internet security suite 2009. After weeks of trying to remove remaining viruses/trojans/malware I have given up. I seem to be able to get a clean slate - i.e. all programs not seeming to flag anything up and report no infections, but on the next reboot they are back. The one in particular that i seem unable to remove completely is trojan.vundo.h and the names poboyifenu and zegofadu keep appearing. Resident Teatimer in spybot blocks changes to my registry about every 5 seconds, and when i start up i get the message: Unable to locate specified module "c:\WINDOWS\system32\zegofadu".

I attempted getting my PC clean and then turning off system restore (as I had seen on other threads) but after a second reboot, the problem(s) were back! I have also tried running the programs in safe mode and although this has more success removing at time of scan, in the end the results seems the same.

I am running Windows XP Professional x64 edition

Below is the log from hijackthis:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:42:13, on 25/03/2009

Platform: Windows 2003 SP2 (WinNT 5.02.3790)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\Program Files (x86)\Java\jre6\bin\jqs.exe

C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe

C:\WINDOWS\vsnp2std.exe

C:\Program Files (x86)\ASUS\GamerOSD\GamerOSD.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files (x86)\ASUS\SmartDoctor\SmartDoctor.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\SysWOW64\ctfmon.exe

C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

C:\PROGRA~2\MOZILL~1\FIREFOX.EXE

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {1f97bf24-ac6b-4026-a9bb-db955c56360f} - C:\WINDOWS\SysWow64\pepilose.dll (file missing)

O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ievkbd.dll

O2 - BHO: {18caa19f-9ccc-b7c9-e264-1e281d934c66} - {66c439d1-82e1-462e-9c7b-ccc9f91aac81} - C:\WINDOWS\SysWow64\sqgrhk.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll

O4 - HKLM\..\Run: [bVRPLiveUpdate] C:\Program Files (x86)\Avanquest update\Engine\Setup.exe -s /PATCH,/SRCUPDATEC:\DOCUME~1\ALLUSE~1\APPLIC~1\SONYER~1\SONYER~1\LIVEUP~1\LISTOF~1.DAT

O4 - HKLM\..\Run: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe"

O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files (x86)\ASUS\SmartDoctor\SmartDoctor.exe /start

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O8 - Extra context menu item: Add to Banner Ad Blocker - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\ie_banner_deny.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\SCIEPlgn.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - ESC Trusted Zone: http://runonce.msn.com

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1230916804531

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files (x86)\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\WINDOWS\system32\lewabenu.dll C:\WINDOWS\system32\kemituba.dll C:\PROGRA~2\KASPER~1\KASPER~1\mzvkbd.dll C:\PROGRA~2\KASPER~1\KASPER~1\adialhk.dll sqgrhk.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe (file missing)

O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe

O23 - Service: Kaspersky Internet Security (AVP) - Kaspersky Lab - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing)

O23 - Service: Event Log (Eventlog) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)

O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - C:\WINDOWS\System32\lsass.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - C:\WINDOWS\system32\imapi.exe (file missing)

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files (x86)\Java\jre6\bin\jqs.exe

O23 - Service: MagicTuneEngine - Unknown owner - C:\Program Files (x86)\MagicTune Premium\MagicTuneEngine.exe

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe (file missing)

O23 - Service: Net Logon (Netlogon) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Plug and Play (PlugPlay) - Unknown owner - C:\WINDOWS\system32\services.exe (file missing)

O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe (file missing)

O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - C:\WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Virtual Disk Service (vds) - Unknown owner - C:\WINDOWS\System32\vds.exe (file missing)

O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - C:\WINDOWS\System32\vssvc.exe (file missing)

O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

--

End of file - 8326 bytes

Here is the Malwarebytes log file (lastest performed)

Malwarebytes' Anti-Malware 1.34

Database version: 1895

Windows 5.2.3790 Service Pack 2

25/03/2009 15:45:36

mbam-log-2009-03-25 (15-45-36).txt

Scan type: Quick Scan

Objects scanned: 80746

Time elapsed: 2 minute(s), 19 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Here is an example from the Resident Teatimer from Spybot S&D

25/03/2009 15:45:15 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:20 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:27 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:32 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:38 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:43 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:48 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:53 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:45:58 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:46:03 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:46:09 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:46:14 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:46:19 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

25/03/2009 15:46:24 Denied (based on user blacklist) value "poboyifenu" (new data: "Rundll32.exe "C:\WINDOWS\system32\zegofadu.dll",s") added in System Startup global entry!

Please help me resolve these issues, Many thanks, Luke (glue78)

[GT500]

Please follow these instructions (skipping any steps you are unable to complete) for posting in our Malware Removal - HijackThis Logs forum. If you cannot follow any of those steps, then please create a new topic in that forum explaining what happened when you tried to run each of the tools in the instructions, and the expert who helps you will be able to suggest steps to take to get the tools working.

[GT500]

Also, please upload the following file to our UploadNET.

C:\WINDOWS\system32\zegofadu.dll

[glue78]

Also, please upload the following file to our UploadNET.

C:\WINDOWS\system32\zegofadu.dll

I cannot find the file listed above - so unable to upload

[nosirrah]

It is likely a hidden/system file GT500 , this family of vundo uses this trick .

If you can either adapt the collection script to catch this (and all the other dlls mentioned in appinit) or have the user make hidden/system shown .

If I get some free time ill try to take this myself but it does not look good currently .

[SpySentinel]

To upload that file to MBAM,

1. Go to Start->Run and type in notepad and hit OK.

2. Then copy and paste the content of the following codebox into Notepad:

MD "%USERPROFILE%"\desktop\malware

xcopy "C:\WINDOWS\system32\zegofadu.dll" "%USERPROFILE%"\desktop\malware /c /q /r /h /y

Attrib -s -r -h "%USERPROFILE%"\desktop\malware\*.*

3. Save the file as Run.bat. Make sure to save it with the quotation marks.

4. Double click Run.bat.

5. Please go to this thread

http://www.malwarebytes.org/forums/index.php?showforum=55

and create a new topic

6. Attach the Malware folder on your desktop to the topic then post it, so we can analyze those files to include in Malwarebytes' detection.