Jump to content
mike02

frustrating virtumondo infection

Recommended Posts

MBAM log:

====================================================

Malwarebytes' Anti-Malware 1.30

Database version: 1455

Windows 5.1.2600 Service Pack 2

12/3/2008 1:53:28 PM

mbam-log-2008-12-03 (13-53-28).txt

Scan type: Quick Scan

Objects scanned: 61174

Time elapsed: 7 minute(s), 1 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\RECYCLER\S-1-5-21-3255312543-2886672284-359312215-2873\Dc57.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-3255312543-2886672284-359312215-2873\Dc59.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-3255312543-2886672284-359312215-2873\Dc60.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

====================================================

HijackThis log:

====================================================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:38:33 AM, on 12/4/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\nvsvc32.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\BillP Studios\WinPatrol\WinPatrol.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Launchy\Launchy.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRAM FILES\RUBBER DUCKY\RUBBERDUCKY.EXE

C:\Program Files\Opera\opera.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Vim\vim71\gvim.exe

C:\Program Files\FreeCommander\FreeCommander.exe

C:\WINDOWS\system32\cmd.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\WinMerge\WinMergeU.exe

C:\Program Files\SysInternals\procexp.exe

C:\Program Files\tools\baregrep 3_50a.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://iq-net.aiq.local/avista/login/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://iq-net.avistaadvantage.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://iq-net.aiq.local/avista/login/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O1 - Hosts: 172.29.6.90 ADVAS1

O1 - Hosts: 172.29.6.90 ADVAS2

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [spySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\\SpySweeperUI.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\RunOnce: [spybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://iq-net.avistaadvantage.com

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1219866374983

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1219866368218

O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab

O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://advantageweb/viewer/activeXViewer/activexviewer.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\Software\..\Telephony: DomainName = AIQ.local

O17 - HKLM\System\CCS\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O17 - HKLM\System\CS1\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O17 - HKLM\System\CS2\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O20 - AppInit_DLLs: "C:\WINDOWS\system32\pomawiha.dll"

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE

O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

O23 - Service: Webroot CommAgent Service (WebrootCommAgentService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe

--

End of file - 7160 bytes

====================================================

ESET Online result:

====================================================

This scanner reported no infections.

====================================================

I chose to report ESET instead of Panda because after I ran Panda (which took many hours) I then pressed the wrong key in my browser and lost the results before I could grab them. Let me know if Panda results are still useful to have at this point.

Other notes:

Spybot found 5 virtumonde registry entries but it could remove only 4 out of the 5.

WinPatrol first brought this issue to my attention and it has proved valuable in identifying suspicious resources. It showed no active processes or services that were suspicious (to me) but it did report about a dozen hidden files that were malware (mostly dlls in the \windows\system32 directory). I could delete most of these but there was one file that it could not delete.

WinPatrol also revealed 3 startup tasks that were part of the infection. I could delete 2 out of the 3. The 3rd one immediately regenerated when I attempted to delete it. (And yet I could not identify an active process or service that was doing the regeneration.)

Note that my computer exists in a corporate setting, but there is no one to assist in diagnosis and repair.

Share this post


Link to post
Share on other sites

I believe I have cleansed my system and am posting this followup note in case it is helpful to others.

The key item, as HijackThis shows in the log above, is:

AppInit_DLLs: C:\WINDOWS\system32\pomawiha.dll

Before I ran HijackThis, I found that file among the hidden files that WinPatrol found and attempted to delete it but I could not. I did manage to finally delete it but that did not help--something was clearly still running because whenever I deleted the entry from startup items it came right back. So I was quite puzzled by that.

I ran Spybot again and it again found 5 virtumondo items, and again could not delete 1 of them. It said it could do it on a reboot so I let it try. Upon reboot, I logged in, Spybot ran, and said it found 4 infected items. It did NOT say it fixed anything which left me guessing. Did it do something or not???

HijackThis still showed the above problem so I do not think Spybot did anything. Trudging on: The Info button for the item in HijackThis clearly indicated that just deleting that registry item would not be enough; I would also need to delete the file. Since I had already deleted the file earlier I now let HijackThis delete the registry item. And that cleaned my system!

Rechecking I now have a clean bill of health from HijackThis, Spybot, and Panda.

I am very much a novice at this--are there other things I should be verifying before I can say I am truly clean?

Share this post


Link to post
Share on other sites

My single question still applies:

What else should I look at to confirm that I my system is truly clean?

Thanks!

Share this post


Link to post
Share on other sites

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:02:49 PM, on 12/10/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe

C:\WINDOWS\system32\nvsvc32.exe

c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Launchy\Launchy.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Trillian\trillian.exe

C:\PROGRAM FILES\RUBBER DUCKY\RUBBERDUCKY.EXE

C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe

C:\Program Files\Secunia\PSI\psi.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\TrueCrypt\TrueCrypt.exe

C:\WINDOWS\system32\taskmgr.exe

C:\PROGRA~1\FOXITS~1\FOXITR~1\FOXITR~1.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\Program Files\SysInternals\procexp.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://iq-net

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://iq-net.avistaadvantage.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://iq-net.avistaadvantage.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O1 - Hosts: 172.29.6.90 ADVAS1

O1 - Hosts: 172.29.6.90 ADVAS2

O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Foxit Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll

O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [spySweeperEnterprise] "C:\Program Files\Webroot\Enterprise\Spy Sweeper\\SpySweeperUI.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://iq-net.avistaadvantage.com

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1219866374983

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1219866368218

O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab

O16 - DPF: {C4847596-972C-11D0-9567-00A0C9273C2A} (Crystal Report Viewer Control) - http://advantageweb/viewer/activeXViewer/activexviewer.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\Software\..\Telephony: DomainName = AIQ.local

O17 - HKLM\System\CCS\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O17 - HKLM\System\CS1\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = AIQ.local

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O17 - HKLM\System\CS2\Services\Tcpip\..\{13256694-9ED9-4DF5-9B09-C0E7E46DBDED}: NameServer = 172.28.2.4,10.1.10.100

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = aiq.local,avistaadvantage.com

O23 - Service: DameWare Mini Remote Control (DWMRCS) - DameWare Development LLC - C:\WINDOWS\SYSTEM32\DWRCS.EXE

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe

O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe

O23 - Service: Webroot CommAgent Service (WebrootCommAgentService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\commagent.exe

O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Enterprise\Spy Sweeper\spysweeper.exe

--

End of file - 7180 bytes

Share this post


Link to post
Share on other sites
Guest
This topic is now closed to further replies.

  • Recently Browsing   0 members

    No registered users viewing this page.

×

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.