Vundo and MS Juan Infection

grapejoos · July 15, 2008

Hello,

This is (thankfully) my first time posting, but I got a Vundo infection and I can't seem to get rid of it. Will post MBAM, Panda, and Hijack this logs below. Any help is appreciated. The MBAM log is not showing an infection at the moment but one will return at some point; I will post a log reflecting the infection when that happens if helpful.

Before stumbling on this site I also tried VundoFix and VirtumundoBegone and neither found an infection.

Any help is appreciated. Thanks.

Malwarebytes' Anti-Malware 1.20

Database version: 945

Windows 5.1.2600 Service Pack 2

12:13:51 PM 7/15/2008

mbam-log-7-15-2008 (12-13-51).txt

Scan type: Quick Scan

Objects scanned: 46234

Time elapsed: 6 minute(s), 25 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

grapejoos · July 15, 2008

Here is the Panda log:

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-07-14 21:48:36

PROTECTIONS: 1

MALWARE: 18

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Symantec Antivirus Corporate Edition 10.0 No Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00048371 Trj/Citifraud.A Virus/Trojan No 1 Yes No Archive Folders\Inbox\Customer notice: your CitiBank account [Fri, 06 Aug 2004 16:21:05 +0400]

00048371 Trj/Citifraud.A Virus/Trojan No 1 Yes No Personal Folders\Inbox\Customer notice: your CitiBank account [Fri, 06 Aug 2004 16:21:05 +0400]

00048371 Trj/Citifraud.A Virus/Trojan No 1 Yes No Archive Folders\Inbox\Customer notice: your CitiBank account [Fri, 06 Aug 2004 16:21:05 +0400]

00048371 Trj/Citifraud.A Virus/Trojan No 1 Yes No Personal Folders\Inbox\Customer notice: your CitiBank account [Fri, 06 Aug 2004 16:21:05 +0400]

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\eMusic\eMusic Download Manager\Profiles\1hgmugav.default\cookies.txt[.trafficmp.com/]

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\macbook\Application Data\Mozilla\Firefox\Profiles\vqr69n5f.default\cookies.txt[.doubleclick.net/]

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Cookies\jason@atdmt[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\macbook\Application Data\Mozilla\Firefox\Profiles\vqr69n5f.default\cookies.txt[.atdmt.com/]

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\eMusic\eMusic Download Manager\Profiles\1hgmugav.default\cookies.txt[.fastclick.net/]

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Cookies\jason@tribalfusion[1].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.tribalfusion.com/]

00160284 Cookie/Findwhat TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Cookies\jason@findwhat[1].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.com.com/]

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Cookies\jason@com[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\macbook\Application Data\Mozilla\Firefox\Profiles\vqr69n5f.default\cookies.txt[ad.yieldmanager.com/]

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\eMusic\eMusic Download Manager\Profiles\1hgmugav.default\cookies.txt[ad.yieldmanager.com/]

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.serving-sys.com/]

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.bs.serving-sys.com/]

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.ads.pointroll.com/]

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.questionmarket.com/]

00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\macbook\Application Data\Mozilla\Firefox\Profiles\vqr69n5f.default\cookies.txt[.adrevolver.com/]

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.go.com/]

00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\jason\Application Data\Mozilla\Firefox\Profiles\qbxi3yyy.default\cookies.txt[.ads.addynamix.com/]

02907323 Trj/Downloader.TAG Virus/Trojan No 0 Yes No F:\game systems\DS R4\r4 disc\imgview0.6 for R4\misc\攋懝IPK僼傽僀儖廋暅僣乕儖.exe

03074964 Trj/CI.A Virus/Trojan No 0 Yes No E:\download\bittorrent\Remote.Administrator.Radmin.v3.0.FULL\Remote.Administrator.Radmin.v3.0.FULL\FIX - Read Informations\Famatech.Radmin.Server.3.0.Trial.Stop.and.Tray.Icon.Remove\R3GOD.DLL

03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\Documents and Settings\All Users\Documents\Remote.Administrator.Radmin.v3.0.FULL.zip[Remote.Administrator.Radmin.v3.0.

FULL/FIX - Read Informations/Famatech.Radmin.Server.3.0.Trial.Stop.and.Tray.Icon.Remove/R3GOD.DLL]

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location

;===============================================================================

================================================================================

=

===================

No C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\SGE8Y7KQ\0902[1].dll

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

grapejoos · July 15, 2008

Here is the Hijackthis Log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:55:32 AM, on 7/15/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PeerGuardian2\pg2.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\My Book\WD Backup\uBBMonitor.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wuauclt.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)

O2 - BHO: (no name) - {3AE25886-BB19-4156-BBA7-F420F4B48A2B} - C:\WINDOWS\system32\iifgHxWm.dll (file missing)

O2 - BHO: {92cc7d5f-5d50-4d6b-a654-c94cf3e1bd54} - {45db1e3f-c49c-456a-b6d4-05d5f5d7cc29} - C:\WINDOWS\system32\vtfahv.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: (no name) - {B6F4CF56-A1E3-4655-8DE8-142A98C97892} - C:\WINDOWS\system32\ssqPhFWQ.dll (file missing)

O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE

O4 - HKLM\..\Run: [TCASUTIEXE] TCAUDIAG -on

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [statusClient] C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe /auto

O4 - HKLM\..\Run: [TomcatStartup] C:\Program Files\Hewlett-Packard\Toolbox2.0\hpbpsttp.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [Windows Media Connect 2] "C:\Program Files\Windows Media Connect 2\WMCCFG.exe" /StartQuiet

O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

O4 - HKLM\..\Run: [HP Software Update] c:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [CloneCDTray] "C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe" /s

O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [startCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKCU\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1

O4 - HKCU\..\Run: [ATI Remote Control] "C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe

O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: WD Backup Monitor.lnk = C:\Program Files\My Book\WD Backup\uBBMonitor.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\dtv\EXPLBAR.DLL

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Radmin Server V3 (RServer3) - Unknown owner - C:\WINDOWS\system32\rserver30\RServer3.exe (file missing)

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--

End of file - 10514 bytes

grapejoos · July 15, 2008

If it is helpful, this is my first MBAM log, before anything was removed....

Malwarebytes' Anti-Malware 1.20

Database version: 945

Windows 5.1.2600 Service Pack 2

5:16:59 PM 7/13/2008

mbam-log-7-13-2008 (17-16-59).txt

Scan type: Full Scan (C:\|D:\|E:\|F:\|G:\|H:\|)

Objects scanned: 220254

Time elapsed: 2 hour(s), 46 minute(s), 0 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 3

Registry Keys Infected: 11

Registry Values Infected: 6

Registry Data Items Infected: 1

Folders Infected: 0

Files Infected: 27

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\mpkelegd.dll (Trojan.Vundo) -> Unloaded module successfully.

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PMTVABSR\3077ahntdksr[1].dll (Trojan.Pakes) -> Unloaded module successfully.

C:\WINDOWS\system32\awtsSlMc.dll (Trojan.Vundo) -> Unloaded module successfully.

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{856d6b51-da6d-4739-8dec-45a415801393} (Trojan.Pakes) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{856d6b51-da6d-4739-8dec-45a415801393} (Trojan.Pakes) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{fe27e908-4c06-4bae-88a0-655d0ce752cb} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{fe27e908-4c06-4bae-88a0-655d0ce752cb} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\awtsslmc (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\revo uninstaller (Rogue.Installer) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b855234b (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{fe27e908-4c06-4bae-88a0-655d0ce752cb} (Trojan.Vundo) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\iifghxwm -> Delete on reboot.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\iifgHxWm.dll_old (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\mWxHgfii.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mWxHgfii.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mpkelegd.dll (Trojan.Vundo) -> Delete on reboot.

C:\WINDOWS\system32\dgelekpm.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\uwwoyjge.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\egjyowwu.ini (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\PMTVABSR\3077ahntdksr[1].dll (Trojan.Pakes) -> Delete on reboot.

C:\WINDOWS\system32\awtsSlMc.dll (Trojan.Vundo) -> Delete on reboot.

C:\Documents and Settings\jason\Desktop\revosetup.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\Program Files\VS Revo Group\Revo Uninstaller\uninst.exe (Rogue.Installer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066076.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066080.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066082.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066084.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066085.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066089.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066097.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066105.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066106.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066111.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP727\A0066116.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP728\A0068156.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{CFBD5C93-64E1-4186-A4CE-B9CE68061660}\RP728\A0068157.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

E:\backup\install these\winrar_v3.51\CORE10k.EXE (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\BMbb6610d7.xml (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\BMbb6610d7.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

JeanInMontana · July 15, 2008

When did you run the HJT scan? That always needs to be last after a scan with any removal tool. Please update MBAM and run a quick scan again with it, post the log and a new HJT log.

grapejoos · July 15, 2008

Thanks so much for the help, and apologies for the out-of-sequence logs. Here is a new MBAM scan (after updating), HJT log will follow in next post:

Malwarebytes' Anti-Malware 1.20

Database version: 957

Windows 5.1.2600 Service Pack 2

7:11:18 PM 7/15/2008

mbam-log-7-15-2008 (19-11-18).txt

Scan type: Quick Scan

Objects scanned: 45502

Time elapsed: 7 minute(s), 39 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 1

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

grapejoos · July 15, 2008

And here is the new HJT log:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:12:56 PM, on 7/15/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\SOUNDMAN.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Hewlett-Packard\Toolbox2.0\Apache Tomcat 4.0\webapps\Toolbox\StatusClient\StatusClient.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\ATI Multimedia\main\ATIDtct.EXE

C:\Program Files\Hewlett-Packard\Toolbox2.0\Javasoft\JRE\1.3.1\bin\javaw.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\PeerGuardian2\pg2.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\My Book\WD Backup\uBBMonitor.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE