Jump to content

hijack.windowsupdate do not remove

tzrzxr

By tzrzxr
in Resolved Malware Removal Logs

 Share

Recommended Posts

tzrzxr

tzrzxr

Posted
Posted

Hi

I scan my lap with Malwarebytes and remove almost all malware, except this.

the BITS service and wuauserv service, have the "%SystemRoot%" wrong "%fystemRoot%"

I do not have permission to change the keys in registry.

What can I do?

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 16:34:30, on 03-11-2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16827)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe

C:\WINDOWS\system32\IFXSPMGT.exe

C:\WINDOWS\system32\IFXTCS.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\LogMeIn\x86\RaMaint.exe

C:\Program Files\LogMeIn\x86\LogMeIn.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\PROGRA~1\AVG\AVG8\avgam.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Softex\OmniPass\Omniserv.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXE

C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRS_PostInstaller.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\RealVNC\VNC4\WinVNC4.exe

C:\Program Files\AVG\AVG8\avgrsx.exe

C:\Program Files\Softex\OmniPass\OPXPApp.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Infineon\Security Platform Software\PSDrt.exe

C:\Program Files\Infineon\Security Platform Software\SpTna.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

C:\Program Files\LG Software\Battery Miser\batterymiser.exe

C:\Program Files\LG Software\On Screen Display\HotKey.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Softex\OmniPass\scureapp.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\LGDMEBTN.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\LG Software\IP Operator\IP Operator.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\Program Files\LogMeIn\x86\LMIGuardian.exe

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\VM_STI.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRSTrayApp.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\PVSW\Bin\W3DBSMGR.EXE

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Safari\Safari.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\regedit.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: (no name) - *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: AVG Security Toolbar BHO - {a3bc75a2-1f87-4686-aa43-5347d756017c} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O2 - BHO: Google Toolbar Helper - {aa58ed58-01dd-4d91-8333-cf10577473f7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {af69de43-7d58-4638-b6fa-ce66b5ad205d} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe

O4 - HKLM\..\Run: [iAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

O4 - HKLM\..\Run: [batterymiser] "C:\Program Files\LG Software\Battery Miser\batterymiser.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [KeybdUtility] "C:\Program Files\LG Software\On Screen Display\HotKey.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [LG Intelligent Update] "C:\Program Files\lg_swupdate\autoupdate.exe" Gilautouc

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [bluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent

O4 - HKLM\..\Run: [OmniPass] C:\Program Files\Softex\OmniPass\scureapp.exe

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LG Direct Media Button Service] LGDMEBTN.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [iPO3] "C:\Program Files\LG Software\IP Operator\IP Operator.exe" -aUtOsTaRtFrOmReG

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [bigDogPath] C:\WINDOWS\VM_STI.EXE VIMICRO USB PC Camera

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [sRSTrayApp] C:\Program Files\SRS Labs\WOWXT and TSXT Driver\SRSTrayApp.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O4 - HKUS\.DEFAULT\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog (User 'Default user')

O4 - Global Startup: Pervasive.SQL Workgroup Engine.lnk = C:\PVSW\Bin\W3DBSMGR.EXE

O8 - Extra context menu item: e&xport to microsoft excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [java_sun] Java (Sun)

O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/200612...ex/qtplugin.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = faro.xesequipa.pt

O17 - HKLM\Software\..\Telephony: DomainName = faro.xesequipa.pt

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = faro.xesequipa.pt

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = faro.xesequipa.pt

O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = faro.xesequipa.pt

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe

O23 - Service: Bonjour Service (bonjour service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe

O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe

O23 - Service: Servi

Link to post
Share on other sites
tzrzxr

tzrzxr

Posted
  • Author
Posted

Hi Mieke Verburgh

Thank you for yor help

here's the result for WUS_Fix.exe

I tried whit Administrator and also in safe mode and nothing...

"

C:\>cd WUS_Fix

C:\WUS_Fix>fix

C:\WUS_Fix>SWREG ACL "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuaus

erv" /GE:F /Q

C:\WUS_Fix>SWREG ACL "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bits"

/GE:F /Q

C:\WUS_Fix>SWREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuaus

erv" /v "ImagePath" /t REG_EXPAND_SZ /d "%SystemRoot%\system32\svchost.exe -k ne

tsvcs" /f

C:\WUS_Fix>SWREG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Bits"

/v "ImagePath" /t REG_EXPAND_SZ /d "%SystemRoot%\system32\svchost.exe -k netsvc

s" /f

Writing 'ImagePath' with data '%SystemRoot%\system32\svchost.exe -k netsvcs' fai

led.

"

Any more ideas?

Thank's

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

This doesn't open a txt file.

Not sure what happened here...All you had to do is to save WUS_Fix on your desktop and then doubleclick WUS_Fix.exe.

No need for safe mode etc..

Did you get above result instead?, so it opened in a text file? In that case, your association for batchfiles are probably broken.

To fix this, use this regfix: http://www.dougknox.com/xp/fileassoc/batch_file_assoc.zip

unzip and doubleclick the reg inside in order to merge the contents to the registry.

Link to post
Share on other sites
tzrzxr

tzrzxr

Posted
  • Author
Posted
Hi,

This doesn't open a txt file.

Not sure what happened here...All you had to do is to save WUS_Fix on your desktop and then doubleclick WUS_Fix.exe.

No need for safe mode etc..

Did you get above result instead?, so it opened in a text file? In that case, your association for batchfiles are probably broken.

To fix this, use this regfix: http://www.dougknox.com/xp/fileassoc/batch_file_assoc.zip

unzip and doubleclick the reg inside in order to merge the contents to the registry.

Hi,

I do it just like you said, but since nothing changed, I extracted the content of the WUS_Fix.exe to a folder,

inside the folder were to files "swreg.exe" and "fix.bat"

I run the "fix.bat" in a command line to see the action, and copy the result, to post it. It does not create any text file

I also tried to run fix.bat in safe mode command line but the result was the same.

my association for batchfiles are good :)

Any sugestion?

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted
I do it just like you said, but since nothing changed
So malwarebytes is still detecting it?

Have you been tinkering manually in the registry to alter this key? And probably corrupted it instead? Because it's a permission issue here for these keys and WUS_Fix.exe fixes the permissions for them again and sets it back to the default valuedata.

Ofcourse if you have manually tinkered with it, it may explain a lot. In that case, not sure how to help since I don't know either what you have changed in that key there, or if you tinkered with its permissions.

Link to post
Share on other sites
tzrzxr

tzrzxr

Posted
  • Author
Posted
So malwarebytes is still detecting it?

Have you been tinkering manually in the registry to alter this key? And probably corrupted it instead? Because it's a permission issue here for these keys and WUS_Fix.exe fixes the permissions for them again and sets it back to the default valuedata.

Ofcourse if you have manually tinkered with it, it may explain a lot. In that case, not sure how to help since I don't know either what you have changed in that key there, or if you tinkered with its permissions.

I tried, but I don't have permissions. Only "Local administrators" have few permissions on those keys

verify the attached file

post-23925-1257441848_thumb.jpg

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

For the permissions as you see on the right of your screenshot..

Is it possible to check the Full control and Read checkbox there? That should give full permissions again (depending what the special permissions are).

If not, then use the Advanced button (as you have already used in the middle screenshot) and click the edit tab.

There you'll have two rows. a row under Allow and deny. Uncheck everything under deny and check everything under allow.

Then click OK.

Once you have full permission for the key again, you can manually edit the valuedata again and set it to %SystemRoot% again instead of %fystemroot%

Link to post
Share on other sites
tzrzxr

tzrzxr

Posted
  • Author
Posted
Hi,

For the permissions as you see on the right of your screenshot..

Is it possible to check the Full control and Read checkbox there? That should give full permissions again (depending what the special permissions are).

If not, then use the Advanced button (as you have already used in the middle screenshot) and click the edit tab.

There you'll have two rows. a row under Allow and deny. Uncheck everything under deny and check everything under allow.

Then click OK.

Once you have full permission for the key again, you can manually edit the valuedata again and set it to %SystemRoot% again instead of %fystemroot%

Well that is the big problem, I can not change anything, because I don't have permissions and I can not change permisions!

If you could teach me how to change permissions on those reg keys... :)

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Ok, in the second screen, where you have the advanced properties, click the Add button, there click once again the "advanced" button.

There, you'll see on the right: "Find now".

Click that button.

It will give a list of all. From there, select "administrator" (note, the one without s, since Administrators is already in there) and click OK.

A new window should open to set permissions. Check everything under allow. Make sure nothing is checked under deny.

Click apply and OK.

Once you've done that, no need to change/add anything there anymore, just click the "WUS_Fix.exe" again as this will add a "everyone" again as permissions as well and already restores the values of that key too.

You'll have to do the same for the wuauserv key.

Link to post
Share on other sites
tzrzxr

tzrzxr

Posted
  • Author
Posted

Miekie

Thank you for your help in this issue.

I could't fix this computer, it's not my computer, is from a colleague, and I'm not the first person that tried to get the PC clean, so I don't know what others have done. with your instrutions I was able to fix another computer with the same problem, but not this one, so I wil format HDD and install everything on it.

Once again, many thank's for your help.

P.S. - I work in a Xerox Concessionaire, and if you ever have some problem related with printing or print drivers, or anything else related with, don't hesitate in contact me, I will be happy to help.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.

  I accept