Looking for some assistance

deadhorse · November 27, 2008

Hello,

I've recently been asked to help clean an infected system. It looks like the original infection came through a careless web-surfer via Antivirus 2009 trojan. Spybot found (amongst more benign infections) a pretty big virtumonde infection, and MWB keeps finding Trojan.Agent, Trojan.Vundo, and Trojan.BHO components. Oddly, both utilites clean the infections, but there is one registry entry (Trojan.Agent, as seen in MWB log) that does not seem to be properly cleaned by MWB. It claims it successfully cleans it, but the same entry appears in concurrent scans. The invasive results of the trojan inevitably appear a few days later along with all of the same infections, presumably let back in by some active missed element of the infection. I couldn't find an explicitly similar case to use for reference, so I was hoping I too could receive some attention from the generous veterans who respond here.

A sincere thank you in advance.

Here are the logs:

Malwarebytes' Anti-Malware 1.30

Database version: 1421

Windows 5.1.2600 Service Pack 2

11/26/2008 10:41:03 PM

mbam-log-2008-11-26 (22-40-59).txt

Scan type: Quick Scan

Objects scanned: 62268

Time elapsed: 6 minute(s), 32 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\japudekiyu (Trojan.Agent) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

****

ANALYSIS: 2008-11-26 23:08:54

PROTECTIONS: 1

MALWARE: 30

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Symantec Antivirus Corporate Edition 10.1 No Yes

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@trafficmp[2].txt

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@doubleclick[1].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@atdmt[1].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@247realmedia[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@tribalfusion[1].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@mediaplex[1].txt

00149104 Cookie/Date TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@date[2].txt

00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@revenue[1].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@com[1].txt

00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@azjmp[2].txt

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@perf.overture[1].txt

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@apmebf[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@serving-sys[2].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@bs.serving-sys[1].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@www.burstbeacon[1].txt

00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@cdfreaks[2].txt

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@server.iad.liveperson[1].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@advertising[1].txt

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@statse.webtrendslive[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@ads.pointroll[1].txt

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@overture[2].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@realmedia[2].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@questionmarket[1].txt

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@go[2].txt

00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@searchportal.information[2].txt

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@target[1].txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@atwola[2].txt

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@citi.bridgetrack[1].txt

00456116 Adware/Antivirus2009 Adware No 0 Yes No C:\Documents and Settings\Deadhorse User\Local Settings\Temporary Internet Files\Content.IE5\4T2JKTY7\freescan[1].htm

01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\Deadhorse User\Cookies\deadhorse user@enhance[1].txt

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location V:

;===============================================================================

================================================================================

=

===================

No C:\Documents and Settings\Deadhorse User\Desktop\HJTInstall.exe V:

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description V:

;===============================================================================

================================================================================

=

===================

182048 HIGH MS07-069 V:

176382 HIGH MS07-057 V:

170906 HIGH MS07-045 V:

164913 HIGH MS07-033 V:

160623 HIGH MS07-027 V:

150253 HIGH MS07-016 V:

141030 HIGH MS06-072 V:

137568 HIGH MS06-067 V:

133386 MEDIUM MS06-064 V:

126083 HIGH MS06-042 V:

120823 MEDIUM MS06-030 V:

120818 HIGH MS06-025 V:

120814 HIGH MS06-021 V:

117384 MEDIUM MS06-018 V:

114664 HIGH MS06-013 V:

108744 MEDIUM MS06-008 V:

93395 HIGH MS05-051 V:

93454 MEDIUM MS05-049 V:

;===============================================================================

================================================================================

=

===================

****

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:10:15 PM, on 11/26/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\fxssvc.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: (no name) - {c6c66a76-c1d4-4671-8592-b46970253635} - C:\WINDOWS\system32\tiledovo.dll (file missing)

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

O4 - HKLM\..\Run: [iAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

O4 - HKLM\..\Run: [broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Acrobat Speed Launch] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe"

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [ECenter] C:\Dell\E-Center\EULALauncher.exe

O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe

O4 - HKLM\..\Run: [japudekiyu] Rundll32.exe "C:\WINDOWS\system32\hohazevu.dll",s

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

O4 - HKUS\S-1-5-19\..\Run: [japudekiyu] Rundll32.exe "C:\WINDOWS\system32\hohazevu.dll",s (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [japudekiyu] Rundll32.exe "C:\WINDOWS\system32\hohazevu.dll",s (User 'NETWORK SERVICE')

O4 - Global Startup: Digital Line Detect.lnk = ?

O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab

O18 - Filter hijack: text/html - {cafd7589-d6a4-4881-a631-5a4e970615a1} - (no file)

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL dogsbh.dll C:\WINDOWS\system32\togubiza.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Broadcom ASF IP and SMBIOS Mailbox Monitor (ASFIPmon) - Broadcom Corporation - C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: Intel® Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 9645 bytes

1972vet · November 27, 2008

Greetings deadhorse and Welcome to our forums,

While I am looking over your log, would you please do us the favor of uploading a file for us?

Please locate the following file indicated in Bold text:

C:\WINDOWS\system32\hohazevu.dll

...and compress it to a zipped folder.

To "Zip" a file, right-click on it and select Send To-->Compressed (zipped) Folder. The zipped folder will be created in the same location as the original.

Next, please start a "New Topic" Here. Name the topic "hohazevu.dll for 1972vet" and use the UPLOAD button (at the bottom of the reply window) to upload the file that you just compressed to a zipped folder. Please linclude a link there to this original thread you started here in the HJT forum. Thanks!

***Edit Added***

Kindly do the same (zip and upload) for the following files indicated in Bold text:

C:\PROGRAM FILES\Google\GOOGLE~2\GOEC62~1.DLL dogsbh.dll

C:\WINDOWS\system32\togubiza.dll

deadhorse · November 27, 2008

1972vet,

These files do not seem to be present in the directories listed. Hidden files are visable as are protected operating system files. I have not run any scans, antivirus software, or removal tools since making those logs last night. What am I missing?

Thank you

deadhorse

While I am looking over your log, would you please do us the favor of uploading a file for us?
Please locate the following files indicated in Bold text:
C:\WINDOWS\system32\hohazevu.dll
C:\PROGRAM FILES\Google\GOOGLE~2\GOEC62~1.DLL dogsbh.dll
C:\WINDOWS\system32\togubiza.dll

1972vet · November 27, 2008

Download GMER Antirootkit and uzip it to a folder that you create such as C:\Gmer\: http://www.gmer.net/gmer.zip

Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver .
Double-click Gmer.exe to run the program.
When the program opens, click the ">>>" Tab
Click the "Autostart" Tab
Click the Scan button
When the scan is finished, click Copy to save the Autostart log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Save the log and post it in your next reply.
Close Gmer
Open a command prompt (Start | run |type cmd and hit Enter)
- Type or paste the following to unload the Gmer driver:
- net stop gmer
- Hit Enter
- Exit the command prompt.
[*]Re-enable Active Protection.

deadhorse · November 28, 2008

Here is that log:

GMER 1.0.14.14536 - http://www.gmer.net

Autostart scan 2008-11-27 21:20:26

Windows 5.1.2600 Service Pack 2

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems@Windows = %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,3072,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon@Userinit = C:\WINDOWS\system32\userinit.exe,

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ >>>

igfxcui@DLLName = igfxdev.dll

NavLogon@DLLName = C:\WINDOWS\system32\NavLogon.dll

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows@AppInit_DLLs = C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL dogsbh.dll C:\WINDOWS\system32\togubiza.dll

HKLM\SYSTEM\CurrentControlSet\Services\ >>>

aawservice@ = "C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"

ASFIPmon@ = "C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service

ccEvtMgr@ = "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"

ccSetMgr@ = "C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe"

DefWatch@ = "C:\Program Files\Symantec AntiVirus\DefWatch.exe"

Fax@ = %systemroot%\system32\fxssvc.exe

IAANTMON@ = C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

SPBBCSvc@ = "C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe"

Symantec AntiVirus@ = "C:\Program Files\Symantec AntiVirus\Rtvscan.exe"

wltrysvc@ = %SystemRoot%\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Run >>>

@IgfxTrayC:\WINDOWS\system32\igfxtray.exe = C:\WINDOWS\system32\igfxtray.exe

@HotKeysCmdsC:\WINDOWS\system32\hkcmd.exe = C:\WINDOWS\system32\hkcmd.exe

@PersistenceC:\WINDOWS\system32\igfxpers.exe = C:\WINDOWS\system32\igfxpers.exe

@SunJavaUpdateSched"C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" = "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

@IAAnotif"C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" = "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"

@Broadcom Wireless Manager UIC:\WINDOWS\system32\WLTRAY.exe = C:\WINDOWS\system32\WLTRAY.exe

@SoundMAXPnPC:\Program Files\Analog Devices\Core\smax4pnp.exe = C:\Program Files\Analog Devices\Core\smax4pnp.exe

@Acrobat Assistant 8.0"C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

@ /*file not found*/ = /*file not found*/

@Acrobat Speed Launch"C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe" = "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe"

@Google Desktop Search"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup = "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

@ECenterC:\Dell\E-Center\EULALauncher.exe = C:\Dell\E-Center\EULALauncher.exe

@PDVDDXSrv"C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" = "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"

@ccApp"C:\Program Files\Common Files\Symantec Shared\ccApp.exe" = "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

@vptrayC:\PROGRA~1\SYMANT~1\VPTray.exe = C:\PROGRA~1\SYMANT~1\VPTray.exe

@japudekiyuRundll32.exe "C:\WINDOWS\system32\hohazevu.dll",s = Rundll32.exe "C:\WINDOWS\system32\hohazevu.dll",s

HKCU\Software\Microsoft\Windows\CurrentVersion\Run >>>

@swgC:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe = C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

@AdobeUpdaterC:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe = C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved >>>

@{42071714-76d4-11d1-8b24-00a0c9068ff3} /*Display Panning CPL Extension*/deskpan.dll /*file not found*/ = deskpan.dll /*file not found*/

@{596AB062-B4D2-4215-9F74-E9109B0A8153} /*Previous Versions Property Page*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll

@{9DB7A13C-F208-4981-8353-73CC61AE2783} /*Previous Versions*/%SystemRoot%\system32\twext.dll = %SystemRoot%\system32\twext.dll

@{00E7B358-F65B-4dcf-83DF-CD026B94BFD4} /*Autoplay for SlideShow*/(null) =

@{692F0339-CBAA-47e6-B5B5-3B84DB604E87} /*Extensions Manager Folder*/%SystemRoot%\system32\extmgr.dll = %SystemRoot%\system32\extmgr.dll

@{BDEADF00-C265-11D0-BCED-00A0C90AB50F} /*Web Folders*/C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL = C:\Program Files\Common Files\Microsoft Shared\Web Folders\MSONSEXT.DLL

@{0006F045-0000-0000-C000-000000000046} /*Microsoft Office Outlook Custom Icon Handler*/C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL = C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL

@{00020D75-0000-0000-C000-000000000046} /*Microsoft Office Outlook Desktop Icon Handler*/C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL = C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL

@{42042206-2D85-11D3-8CFF-005004838597} /*Microsoft Office HTML Icon Handler*/C:\Program Files\Microsoft Office\Office12\msohevi.dll = C:\Program Files\Microsoft Office\Office12\msohevi.dll

@{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} /*Microsoft Office Metadata Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

@{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} /*Microsoft Office Thumbnail Handler*/C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll

@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} /*Adobe.Acrobat.ContextMenu*/C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll = C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll

@{BDA77241-42F6-11d0-85E2-00AA001FE28C} /*LDVP Shell Extensions*/C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ >>>

Adobe.Acrobat.ContextMenu@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll

LDVPMenu@{BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ >>>

Adobe.Acrobat.ContextMenu@{D25B2CAB-8A9A-4517-A9B2-CB5F68A5A802} = C:\Program Files\Adobe\Acrobat 8.0\Acrobat Elements\ContextMenu.dll

LDVPMenu@{BDA77241-42F6-11d0-85E2-00AA001FE28C} = C:\Program Files\Common Files\Symantec Shared\SSC\vpshell2.dll

MBAMShlExt@{57CE581A-0CB6-4266-9CA0-19364C90A0B3} = C:\Program Files\Malwarebytes' Anti-Malware\mbamext.dll

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects >>>

@{53707962-6F74-2D53-2644-206D7942484F}C:\PROGRA~1\SPYBOT~1\SDHelper.dll = C:\PROGRA~1\SPYBOT~1\SDHelper.dll

@{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll = C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll

@{AA58ED58-01DD-4d91-8333-CF10577473F7}c:\program files\google\googletoolbar2.dll = c:\program files\google\googletoolbar2.dll

@{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll = C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

@{c6c66a76-c1d4-4671-8592-b46970253635}C:\WINDOWS\system32\tiledovo.dll /*file not found*/ = C:\WINDOWS\system32\tiledovo.dll /*file not found*/

HKCU\Control Panel\Desktop@SCRNSAVE.EXE = C:\WINDOWS\system32\ssmypics.scr

HKLM\Software\Microsoft\Internet Explorer\Main >>>

@Default_Page_URLhttp://www.dell.com = http://www.dell.com

@Start Pagehttp://www.dell.com = http://www.dell.com

@Local Page%SystemRoot%\system32\blank.htm = %SystemRoot%\system32\blank.htm

HKCU\Software\Microsoft\Internet Explorer\Main >>>

@Default_Page_URLwww.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731 = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731

@Start Pagehttp://www.google.com/ = http://www.google.com/

@Local PageC:\WINDOWS\system32\blank.htm = C:\WINDOWS\system32\blank.htm

1972vet · November 28, 2008

Let's make certain first that you did perform a proper search for the previously requested files:

To make sure you can view all files:

* Click Start.

* Open My Computer.

* Select the Tools menu and click Folder Options.

* Select the View Tab.

* Under the Hidden files and folders heading select

Show hidden files and folders.

* Uncheck the Hide protected operating system files

(recommended) option.

* Click Yes to confirm.

* Click OK.

Then click start-->search

When the search window opens, click the "All files and folders" link from the left pane.

Then, enter the file name in the "all or part of the file name" box at the top. Scroll down to the "Look in" box and click the drop down arrow. Select your Local Hard Drive. Scroll down a bit more and click the "More advanced options". Make sure these three are checked:

Search system folders

Search hidden files and folders

Search subfolders

Then click the Search button at the bottom.

Next, please uninstall the following software:

GoogleDesktopNetwork3.dll Identified in browser crash issues

java jre1.6.0_05 This is an out of date version...we will download the updated version later

Acrobat 8.0 This is an out of date version (and exploited)...we will download the updated version later

Google Desktop Search Identified in browser crash issues

GoogleToolbarNotifier Identified in browser crash issues

Now we need to back up the registry...Please copy the text in the code box below into a blank Notepad and save it to your Desktop. Save it as Regbackup.bat and change the "Save as type:" to All Files

@echo off:: variablesset drive=C:\Backupset backupcmd=xcopy /s /c /d /e /h /i /r /y
echo ### Backing up the Registry...if not exist "%drive%\Registry" mkdir "%drive%\Registry"if exist "%drive%\Registry\regbackup.reg" del "%drive%\Registry\regbackup.reg"regedit /e "%drive%\Registry\regbackup.reg"echo Backup Complete!@pause

Double-Click that .bat file and allow it to run. Press any key when finished.

This script copies the registry to the directory defined in the %drive% variable, or "C:\Backup". If the script is run multiple times, it will only rewrite if the source files are newer...so please (for now) be certain to run this batch file just once. It will create subdirectories as necessary, and it will retain file attributes. It can copy system and hidden files.

You can keep this batch file if you like, and use it in the future to backup the registry but be advised, as of now, this backup will contain entries from malicious software. Once we get you cleaned up, you can run the batch again and create a newer "saved" copy of your backed up registry without the malicious entries.

Next, please reboot the computer into Safe mode.

Once in safe mode and logged on as "Administrator", please continue with the instructions below:

Next, please copy the data in the code box below into notepad and save it as deletereg.reg

Set File type to "all files"

REGEDIT4
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\japudekiyu]

Double-click that file and confirm you want to merge it with the registry.

Reboot the computer. Please post back a fresh HijackThis log and and let us know if you are still unable to view the previously requested files. Thanks!

1972vet · December 5, 2008

Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.

Other members who need assistance please start your own topic in a new thread. Thanks!

The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.

deadhorse · December 16, 2008

Here is the HJT log following your instructions. The previously requested files are not present, but I suspect by now other entries may be in their place. The system32 folder seems like it has a -lot- of suspicious files in it with the same randomly-generated naming structure, both dlls and executables, many hidden.

Please advise and thank you again for re-opening this topic.

deadhorse

*****

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:31:49 PM, on 12/14/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\hkcmd.exe

C:\WINDOWS\system32\igfxpers.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe

C:\WINDOWS\system32\WLTRAY.exe

C:\Program Files\Analog Devices\Core\smax4pnp.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\PROGRA~1\SYMANT~1\VPTray.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe

C:\Program Files\Symantec AntiVirus\DefWatch.exe

C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\WINDOWS\system32\fxssvc.exe

C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=0080731

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {c6c66a76-c1d4-4671-8592-b46970253635} - C:\WINDOWS\system32\zeholuva.dll (file missing)