Trojan.Downloader - Which Files to Remove?

JeanInMontana · July 18, 2008

Yes tell me symptoms, the problem is vundo. It's stubborn and MBAM team is working hard to get the program to where it can deal with this new version. I was told no tools are getting it, so we have to just keep trying to do it manually and updating MBAM and scanning again.

O20 - Winlogon Notify: enqrkyuu - C:\WINDOWS\SYSTEM32\uyxgnon.dll Did you delete that file? Delete it and the bak one with the same name. Delete it with HJT please.

Update MBAM run a quick scan and new HJT log please.

anonimito · July 19, 2008

And then use File Assassin in MBAM to delete that file C:\WINDOWS\system32\cw9k9s4nfpzv.exe You will find it under the Tools tab. Reboot.

I forgot to mention last night that I wasn't able to accomplish this step. The file you mention is still not found in the system32 folder.

O20 - Winlogon Notify: enqrkyuu - C:\WINDOWS\SYSTEM32\uyxgnon.dll Did you delete that file? Delete it and the bak one with the same name. Delete it with HJT please.

I just deleted the line you mentioned in HJT.

I thought I deleted the .dll file before...I guess it's back now? If you want me to delete it within the system32 folder...I get an error when I try that.

Cannot delete uyxgnon: Access is denied.
Make sure the disk is not full or write-protected and that the file is not currently in use.

Oh...should I delete the zipped file that I attached here as well? I'm not sure if I should or not.

Yes tell me symptoms, the problem is vundo. It's stubborn and MBAM team is working hard to get the program to where it can deal with this new version. I was told no tools are getting it, so we have to just keep trying to do it manually and updating MBAM and scanning again.

Oh wow...that sounds complex. Okay, so the symptoms that I noticed follow, from the beginning:

I first noticed something was wrong when I had been working on paperwork all night and had left my computer on to check various websites for information. At this time, I still had IE6 and the Yahoo Toolbar at the top of my browser. When I checked a website, I noticed that the Yahoo Toolbar showed that I had 2 new emails. So, I clicked the icon on the toolbar to check my email.

It brought up the Yahoo sign-in page. Immediately, I thought that was odd, since...the toolbar had me signed in to show that I had new mail in the first place. To top it off, the username on the sign-in page was already filled in - with a yahoo ID I've never seen before!! I wrote down the ID for future reference.

I signed in normally in a new browser window and noticed that I did not have any new email. I then realized that the toolbar was alerting me to the *other* yahoo ID's new emails.

I tried to sign in once more, and I found the sign-in page with yet another unfamiliar ID signed in, which I also wrote down. This prompted me to close all IE browser windows and check my processes for anything strange.

When I checked my task manager, I saw that firefox.exe was using a lot of my CPU...which set off alarm bells since this computer shouldn't even have firefox on it!! I checked the applications tab and it showed that 2 firefox browser windows were open (with the only evidence of them being within the task manager itself...for on my screen, I only had task manager open) and while one said "My App" the other said "Composing Message" in Yahoo mail or something similar. I knew that I certainly wasn't sending an email in a firefox browser...so I decided that the best thing to do would be to shut down the computer and unplug the internet.

After about a week of leaving my computer off and thinking about the problem, I decided that it wouldn't just fix itself and that I had to turn the computer on again.

I found the avast! antivirus and downloaded that...I ran some scans, and it got rid of a lot of stuff...I don't remember anything in particular, though. Also, whenever I'd open a browser (for the first time), avast! would start ringing its bells and telling me that a virus was found and I followed the suggestions and put the infected files in their "virus chest." I'm not sure if the names of those files would help you or not, but if so, I'd be glad to list them.

Avast! continued to act up every time I opened a browser window for the first time, so I realized that the problem wasn't gone. So I ran a panda scan, and that got rid of something...I don't remember what, though.

Some time later, my windows update came up and I downloaded the update in the hopes that it would help my problem somewhat...and that update included IE7, which I think is safer than IE6, just from noticing the differences while using it recently.

By this time, avast wasn't informing me of any new viruses or the old one it kept finding before, for that matter...

I found Spy Sweeper and used that...it found a few things, but nothing seemed major.

Somehow, I found MBAM and ran a scan...then I posted here, and the rest is documented in this thread.

As for current symptoms, I still periodically notice firefox.exe starting up. When it says that the User Name for that process is "SYSTEM", I don't see any firefox browsers open on the Applications tab, but when it says that the User Name is my user name, then I see the windows open. In that case, it's always the same. 2 windows are open - one that says "My App" and the other which starts out at the "homepage" I guess...its title is simply "t - Mozilla Firefox." It quickly moves to "(1350 unread) Yahoo! Mail - Mozilla Firefox" (the number of unread messages is different every time, but it's always a very large number...I just have 1350 documented with a screencap.) Then it says "Compose Mail - Yahoo! Mail - Mozilla Firefox" and then it changes to "Message Sent - Yahoo! Mail - Mozilla Firefox." Then the process repeats, from Compose Mail onwards.

When this occurs, I end the firefox.exe process (I hate the fact that something is sending viral e-mails using my computer! Gah!) and it usually stays away for a while. How long it's gone varies...sometimes it'll come back within minutes, and other times it waits an hour or more. I tried timing it once...it seemed to come at 5-minute intervals...but that pattern has since stopped.

Very rarely, firefox.exe will be running many times at once, and it's hard to kill those processes. In the case of that, I usually shut down.

Another process I notice is ycommon.exe...but it's only because I think it uses far too much CPU (at times 100%) and it has no real reason to run since I don't use the Yahoo toolbar, messenger, browser, or anything.

Oh, and I'm not sitting and watching my task manager every second I'm online, either. firefox.exe only starts running once I notice my cursor change to the "hourglass/cursor" when it has no reason to (i.e. I haven't clicked anything recently). It never fails. As for ycommon.exe, it starts running whenever I open or close a browser window or tab within the browser. Not sure if that matters or not.

I think that's everything. Sorry it got so wordy...I tend to explain things too much. If any of that didn't make sense, I'd be happy to try to explain it once more.

I have screencaps of my task manager when firefox browsers are running, in the various stages, if that would be of any help. I wish I knew what "My App" meant, though...

Here's the MBAM log you requested:

Malwarebytes' Anti-Malware 1.21

Database version: 966

Windows 5.1.2600 Service Pack 2

10:08:54 PM 7/18/2008

mbam-log-7-18-2008 (22-08-54).txt

Scan type: Quick Scan

Objects scanned: 67504

Time elapsed: 22 minute(s), 33 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

And the HJT scan:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:21:18 PM, on 7/18/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\notepad.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\System32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {3787B284-825E-486C-900D-D57056AED3E5} - c:\windows\system32\uyxgnon.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [MSConfig] "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" /auto

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [AdobeUpdater] "C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: http://www.darrenhayes.com

O15 - Trusted Zone: http://www.pandasecurity.com

O16 - DPF: Yahoo! Euchre - http://download2.games.yahoo.com/games/clients/y/et3_x.cab

O16 - DPF: Yahoo! Pool 2 - http://download2.games.yahoo.com/games/clients/y/poti_x.cab

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1009880923873

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1009880917123

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=23100

O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...335/mcfscan.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: enqrkyuu - C:\WINDOWS\SYSTEM32\uyxgnon.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--

End of file - 7731 bytes

Thanks so much for reading all of that, and for all your time, help, and continued patience.

-EDIT-

I forgot something else that happened. I don't remember how long before the firefox/yahoo thing it was, but whenever I'd go to google, for example, and do a search, the links that came up would be redirected to ad sites (even though I knew they were legit sites). This happened A LOT and was very annoying...I found out that if I double-clicked on the link, it usually took me to where I wanted to go. I think avast! was what got rid of that problem.

Not sure if any of that matters, but I want you to know as much as possible about this, so maybe it'll help us beat this virus!

Thanks again.

JeanInMontana · July 19, 2008

Yes this helps. You must be what we call "rooted" and in a botnet. You need to keep this machine offline as much as possible. Your positive you don't have Firefox installed? We need to use ComboFix. It isn't as scary as it sounds. But delete the version you have and get a new one. The main part of this, is make sure you have the Recovery Console installed. The rest is a matter of clicking the program to run and posting the log to me. We need this done ASAP. Be sure you change all passwords to any place. Notify banks, credit cards etc that your identity has been compromised.

Review this article here how to use ComboFix

Be sure you cover the section on How to install and use the Windows XP Recovery Console and make sure it is installed on your machine. This is important should anything go wrong and we need to recover your PC and not lose all the data.

1. Download this file :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe save it to your desktop.

2. Double click combofix.exe. It will be a red icon with a white X on your desktop.

Follow the prompts you will get a blue cmd prompt screen and a choice to choose Y or N. Choose Y and hit enter.

3. When finished, it shall produce a log for you. This logfile is located at C:\ComboFix.txt.

Post that log and a HiJack log in your next reply

Note:

Do not mouseclick combofix's window while its running. That may cause it to stall.

anonimito · July 20, 2008

Before I do anything ill-advised...I have a few questions.

So for the Recovery Console part...the CD I need is the one for the OS? The disk I found reads:

Operating System
Reinstallation CD
Microsoft Windows XP Home Edition

If it helps, it's black with a bit of white on the top.

Is that the correct disk?

Also, the instructions for CF say that I have to disable all my antivirus, etc. programs and my firewall while I use CF. As far as I know, the only firewall I have is the XP one. Is it necessary to disable it? If so, would I do that just by going into the Network Connections icon in Control Panel and changing the firewall settings to off? Is that all there is to it? I've never done that before, and I want to make sure I do it properly.

So once I'm sure that I have the correct disk for the Recovery Console and that I know how to disable my firewall, I'll be ready to use CF. (I've read all the instructions.)

About firefox...I really don't remember ever installing it. This is a rather old computer, so I may have forgotten...but I only just heard of firefox last fall. I'm attaching a screencap of the only folder where I seem to find firefox so you can see what I see. It just doesn't seem *right* to be where it is...I dunno.

As for being "rooted"...since I'm unfamiliar with what that is, I have a few questions...

First, can this possibly "infect" the other computer in the house which uses the same internet connection? I don't think the computers are officially "networked," but they use the same wireless connection. Out of fear of the problem spreading to my other computer, I've left it off for as long as I've noticed this problem...

Also, with the recovery console and such...if something were to go wrong with CF, would my documents also be recovered? Or should I perform a massive back-up while I still have the chance?

Additionally, you said that I should change my passwords...is that because being rooted means that I have a keylogger? Or are the auto-complete passwords only compromised? This is just out of curiosity. I'll be changing my passwords once I have access to a "clean" computer.

One last question. Would it help at all to PM the Yahoo user ID's that my computer was using to send spam e-mails? I ended up writing down 3 unique ID's. So, if it'd be of any help to someone, I'll gladly PM the ID's to you or whomever handles these things.

Alright, I think that's all my questions for now. It's funny...I've started to run MBAM scans in my dreams! I'll be so relieved once this is over...

Thank you for your continued time, help, and patience.

screencapfirefox1.zip

JeanInMontana · July 20, 2008

Yes!! Backup, always and on a regular basis. It sounds like you have the right CD, I can't be positive without reading what's on it. Try the procedure if it works it was right. Report those Yahoo ID's to Yahoo, don't contact them unless you can walk to their house with a baseball bat. Go to Control Panel > Add Remove Programs If FF is installed it will be there. Being rooted means there is a trojan in the root of your PC's Windows directory. Your not in control of the machine someone else is and therefore all your information on the entire PC has been exposed to them. You should consider doing a total reformat. That is the only way we can be positive your clean. Keep updating and running MBAM. There is no need to zip files with only picture or a text file. You can simply upload them.

anonimito · July 21, 2008

Okay, I'll get to work with the Recovery Console and CF and let you know what happens.

As for the backup, is there a chance that the files I backup will also carry the trojan and just re-infect my computer at a later date, if I do chose to reformat?

I'm also still hesitant about using the other computer...I guess it's better to be safe than sorry?

As for the Yahoo ID's...back when this all started, I did report the first 2 ID's I found to Yahoo, but everything was so automated, I don't think it was ever read by a human being. I even called the tech support...

There's no firefox to be seen in my add/remove programs list. So I guess that proves that the files I found weren't put there by me. Would it be wise to delete that folder (the one I showed you in the latest screencap)? I don't want to make the problem worse...and I guess they could always put it back on my computer without my knowing again...hmm...

I'll run an MBAM scan the next chance I get.

As for zipping files, whenever I didn't, the tool used to attach it to my message told me that the file was too large...so I zipped it.

Thanks again for your help.

JeanInMontana · July 21, 2008

Don't let me know what happens, I need to see that log from ComboFix. Yes, there is a chance you might back up the files containing the malware, since I have no idea what you might back up.

I'm attaching a screen shot of what the FF entry looks like in A/R. If you don't see that delete the file. There are other programs that will take screen shots and save in a format not so large BMP files are always large. MBAM has a new version.

anonimito · July 22, 2008

Don't let me know what happens, I need to see that log from ComboFix. Yes, there is a chance you might back up the files containing the malware, since I have no idea what you might back up.

I'll definitely post the log...I never questioned that. Sorry if I worded that strangely.

I backed up mostly word documents and notepad files...that's really all I have on this computer.

I'll look into the smaller screencap files. Thanks for the tip!

Last night I spent far too much time backing up my computer, but I guess I'll be glad that I did. So tonight is for the Recovery Console and CF. Wish me luck! I'll post as soon as I make progress.

Thanks again for all your time and assistance.

JeanInMontana · July 22, 2008

Keep updating MBAM too and scanning with that. It has a new version and might do the trick.

anonimito · July 22, 2008

Since my last posting, I've installed the Recovery Console and CF.

I also deleted the Mozilla Folder as you suggested. It stayed deleted for a while, but when I rebooted, it was back.

Before running CF, I decided to run a MBAM scan.

It found something!!

Here's the newest log:

Malwarebytes' Anti-Malware 1.22

Database version: 977

Windows 5.1.2600 Service Pack 2

2:57:16 AM 7/22/2008

mbam-log-7-22-2008 (02-57-16).txt

Scan type: Quick Scan

Objects scanned: 67139

Time elapsed: 23 minute(s), 21 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 7

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\uyxgnon.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:

HKEY_CLASSES_ROOT\kxgnahim (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\aeehowdu (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\aeehowdu (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\aeehowdu (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{3787b284-825e-486c-900d-d57056aed3e5} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3787b284-825e-486c-900d-d57056aed3e5} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\enqrkyuu (Trojan.Vundo) -> Delete on reboot.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

c:\WINDOWS\system32\uyxgnon.dll (Trojan.Vundo) -> Delete on reboot.

And here is a new HJT log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:07:24 AM, on 7/22/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\devldr32.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\HPZipm12.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/.../search/ie.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com