Rootkit infection (google redirect)

vjmure · May 12, 2010

Ran Antivirus, malwarebytes, PC Doctor; found a bunch of stuff, but did NOT fix the issue.

Followed instructions on this page http://forums.malwarebytes.org/index.php?showtopic=9573 (I'm infected, what do i do now).

Here are the logs. Side note; the "Defogger" did NOT ask me to reboot; but i did anyway????? Not sure if that is an issue.

Here is the DDS.txt.

Also, attached is the "attach.txt", "ark.txt" and malware bytes log....

ANY HELP IS IMMENSELY APPRECIATED! Thanks - Vjmure

DDS (Ver_10-03-17.01) - NTFSx86

Run by vjmure at 18:57:01.28 on Mon 05/10/2010

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.447 [GMT -4:00]

AV: CA Anti-Virus *On-access scanning enabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\casc.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Documents and Settings\vjmure\Desktop\dds.com

C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/

mStart Page = hxxp://www.google.com

uInternet Connection Wizard,ShellNext = iexplore

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

mRun: [CAVRID] "c:\program files\ca\etrust internet security suite\etrust ez antivirus\CAVRID.exe"

mRun: [cctray] c:\program files\ca\ca internet security suite\casc.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [iSTray] "c:\program files\spyware doctor\pctsTray.exe"

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\spywar~1.lnk - c:\program files\spyware doctor\pctsGui.exe

IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL

LSP: c:\windows\system32\VetRedir.dll

Trusted Zone: aetna.com\xtranet

Trusted Zone: aetna.com\xtranet6

Trusted Zone: aetna.com\xtranetx

Trusted Zone: ameritrade.com\research

Trusted Zone: ameritrade.com\wwws

Trusted Zone: cnn.com\politicalticker.blogs

Trusted Zone: cnn.com\sportsillustrated

Trusted Zone: cnn.com\www

Trusted Zone: equifax.com\www.econsumer

Trusted Zone: facebook.com\apps

Trusted Zone: facebook.com\www

Trusted Zone: fannation.com\www

Trusted Zone: garmin.com\www8

Trusted Zone: nawsrc.org\www

Trusted Zone: tdameritrade.com\www

Trusted Zone: toysrus.com\www

Trusted Zone: usana.com\www

Trusted Zone: weather.com\www

Trusted Zone: youtube.com\www

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/3/9/8/398422c0-8d3e-40e1-a617-af65a72a0465/LegitCheckControl.cab

DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {6D2EF4B4-CB62-4C0B-85F3-B79C236D702C} - hxxp://www.facebook.com/controls/contactx.dll

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148152187781

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

Notify: PFW - UmxWnp.Dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll

============= SERVICES / DRIVERS ===============

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [2009-6-8 108024]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-4-28 218592]

R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2009-4-1 73720]

R1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\vet-filt.sys [2009-9-11 26352]

R1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\vet-rec.sys [2009-9-11 21104]

R1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\vetefile.sys [2009-9-11 739696]

R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\vetfddnt.sys [2009-9-11 21488]

R1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2009-9-11 161008]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2010-4-28 112592]

R2 CAISafe;CAISafe;c:\program files\ca\etrust internet security suite\etrust ez antivirus\isafe.exe [2007-1-7 144696]

R2 ccSchedulerSVC;CA Common Scheduler Service;c:\program files\ca\ca internet security suite\ccschedulersvc.exe [2009-9-11 128240]

R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2010-4-28 366840]

R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2010-4-28 1142224]

R2 UmxAgent;HIPS Event Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2009-4-1 875000]

R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2009-6-15 760664]

R2 UmxPol;HIPS Policy Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2009-4-1 207352]

R2 VETMSGNT;VET Message Service;c:\program files\ca\etrust internet security suite\etrust ez antivirus\vetmsg.exe [2007-1-7 292080]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2009-4-1 205304]

R3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\veteboot.sys [2009-9-11 133520]

S2 KillTheHooker;KillTheHooker;\??\c:\docume~1\vjmure\locals~1\temp\temporary directory 1 for tdl3%20razor[1].zip\tdl3 razor\tizerbruteforceex.sys --> c:\docume~1\vjmure\locals~1\temp\temporary directory 1 for tdl3%20razor[1].zip\tdl3 razor\TizerBruteForceEx.sys [?]

S3 3dfxvs;3dfxvs;c:\windows\system32\drivers\3dfxvsm.sys [2008-7-20 148352]

S3 memchek;memchek;\??\c:\windows\system32\memchek.sys --> c:\windows\system32\memchek.sys [?]

S4 iWinTrusted;iWinTrusted;c:\program files\iwin games\iWinTrusted.exe [2009-6-4 78104]

=============== Created Last 30 ================

2010-05-10 22:51:18 0 ----a-w- c:\documents and settings\vjmure\defogger_reenable

2010-05-09 04:05:24 0 d-----w- c:\program files\Trend Micro

2010-05-09 02:17:08 0 d-----w- C:\RotInHell

2010-05-08 13:57:41 0 d-----w- c:\program files\ESET

2010-05-08 13:53:55 73728 ----a-w- c:\windows\system32\javacpl.cpl

2010-05-08 13:53:55 411368 ----a-w- c:\windows\system32\deployJava1.dll

2010-05-08 13:04:11 14336 -c--a-w- c:\windows\system32\dllcache\asyncmac.sys

2010-05-08 13:04:11 14336 ----a-w- c:\windows\system32\drivers\asyncmac.sys

2010-05-08 12:30:32 0 d-sha-r- C:\cmdcons

2010-04-29 00:45:05 882 ----a-w- c:\windows\RegSDImport.xml

2010-04-29 00:45:05 879 ----a-w- c:\windows\RegISSImport.xml

2010-04-29 00:45:05 767952 ----a-w- c:\windows\BDTSupport.dll

2010-04-29 00:45:04 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-04-29 00:45:04 131 ----a-w- c:\windows\IDB.zip

2010-04-29 00:45:04 1152444 ----a-w- c:\windows\UDB.zip

2010-04-29 00:45:03 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-04-29 00:45:03 1652688 ----a-w- c:\windows\PCTBDCore.dll

2010-04-29 00:43:02 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2010-04-29 00:43:02 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-04-29 00:42:57 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-04-29 00:42:57 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2010-04-29 00:42:57 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2010-04-29 00:42:57 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-04-29 00:42:47 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat

2010-04-29 00:42:47 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys

2010-04-29 00:42:32 0 d-----w- c:\program files\common files\PC Tools

2010-04-29 00:42:31 0 d-----w- c:\program files\Spyware Doctor

2010-04-29 00:42:31 0 d-----w- c:\docume~1\alluse~1\applic~1\PC Tools

2010-04-27 10:49:03 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys

2010-04-27 10:49:03 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys

2010-04-27 10:49:00 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys

2010-04-27 10:49:00 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys

2010-04-27 10:48:58 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys

2010-04-27 10:48:58 8192 ----a-w- c:\windows\system32\drivers\changer.sys

2010-04-27 10:46:25 59904 -c--a-w- c:\windows\system32\dllcache\atmarpc.sys

2010-04-27 10:46:25 59904 ----a-w- c:\windows\system32\drivers\atmarpc.sys

2010-04-27 10:43:23 93184 --sha-r- c:\windows\system32\oledlga.dll

==================== Find3M ====================

2010-05-08 12:16:39 96512 ----a-w- c:\windows\system32\drivers\atapi.sys

2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-03-11 12:38:54 832512 ----a-w- c:\windows\system32\wininet.dll

2010-03-11 12:38:52 78336 ----a-w- c:\windows\system32\ieencode.dll

2010-03-11 12:38:51 17408 ----a-w- c:\windows\system32\corpol.dll

2010-03-09 11:09:18 430080 ----a-w- c:\windows\system32\vbscript.dll

2010-02-24 14:16:06 181632 ------w- c:\windows\system32\MpSigStub.exe

2010-02-16 14:08:49 2146304 ----a-w- c:\windows\system32\ntoskrnl.exe

2010-02-16 13:25:04 2024448 ----a-w- c:\windows\system32\ntkrnlpa.exe

2010-02-12 04:33:11 100864 ----a-w- c:\windows\system32\6to4svc.dll

2005-06-07 23:47:39 774144 ----a-w- c:\program files\RngInterstitial.dll

2008-11-09 04:37:09 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008110820081109\index.dat

============= FINISH: 18:58:10.64 ===============

vjmure · May 12, 2010

here are attachments....

ark.txt

Attach.txt

mbam_log_2010_05_11__01_09_49_.txt

vjmure · May 12, 2010

Last attachment ...

( i would have added attachments to the original, but machine froze....)

defogger_disable.log renamed defogger_disable.txt

defogger_disable.txt

Maniac · May 12, 2010

Hello vjmure! Welcome to MalwareBytes' Anti-Malware Forums!

My name is Borislav and I will be glad to help you solve your problems with malware. Before we begin, please note the following:

The process of cleaning your system may take some time, so please be patient.
Stay with the topic until I tell you that your system is clean. Missing symptoms does not mean that everything is okay.
Instructions that I give are for your system only!
If you don't know or can't understand something please ask.
Do not install or uninstall any software or hardware, while work on.

Step 1:

Please, uninstall the following applications:

Adobe Reader 9.1

You can read, how to this in:

Step 2:

Launch Malwarebytes' Anti-Malware
Go to "Update" tab and select "Check for Updates". If an update is found, it will download and install the latest version.
Go to "Scanner" tab and select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

In your next reply, please include these log(s) in this sequence:

MalwareBytes' Anti-Malware log
a new fresh DDS log only

vjmure · May 12, 2010

Borislav,

Thank you immensely for helping me out on this.

I did the following:

1- Uninstalled Adobe Reader 9.1 (through ctl panel)

2- updated, and ran, Malwarebytes. It found zero infections. Report below.

3- Ran DDS- log below.

Quick question; what should i do with my machine during this process? Should i leave it on? Shut it off? Could i check email, use internet etc?

Thanks

V

Malwarebytes Log:

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4094

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.11

5/12/2010 5:22:13 PM

mbam-log-2010-05-12 (17-22-13).txt

Scan type: Quick scan

Objects scanned: 140875

Time elapsed: 10 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

DDS Log:

DDS (Ver_10-03-17.01) - NTFSx86

Run by vjmure at 17:23:41.10 on Wed 05/12/2010

Internet Explorer: 7.0.5730.11

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.433 [GMT -4:00]

AV: CA Anti-Virus *On-access scanning enabled* (Updated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

C:\WINDOWS\system32\svchost -k rpcss

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k NetworkService

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

C:\WINDOWS\system32\svchost.exe -k LocalService

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\ISafe.exe

C:\Program Files\CA\CA Internet Security Suite\ccschedulersvc.exe

C:\WINDOWS\system32\svchost.exe -k hpdevmgmt

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Microsoft LifeCam\MSCamS32.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

C:\Program Files\CA\eTrust Internet Security Suite\eTrust EZ Antivirus\VetMsg.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\casc.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\internet explorer\iexplore.exe

C:\Documents and Settings\vjmure\Desktop\dds.com

C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.bing.com/