Yet another Malware issue - infected registry

Mister · December 31, 2008

I know that this topic has been done to death, and I am sorry for the admins who have to help another sucker with malware on their computer. But I'm having a lot of trouble.

When using Mozilla Firefox, I get pop ups with IE. I had this problem about 6 months ago as well. I rebooted the comp in safe mode, disabled system restore, ran SuperAntiSpyware, MBAM, and HiJackthis. It did the trick. I then went on to install Sygate and Avast for protection.

I still have all of that (except avast, which I swapped for avivir), and after downloading something for a game (which I know is dumb), I have the same issue again.

I did the same as last time, however, it doesn't work anymore. I got updates on SAS, ran SAS, MBAM in safe mode and normally, and have ran hijackthis. However, everytime I run and delete things, they come back up. After some research, I think this is it...

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll

O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll

I can't seem to get rid of this! Every time HJ deletes it, it comes back up! I will attach my Hijackthis log, and MBAM and SAS as well (when I find them...).

Thanks in advance.

Peace,

Matt

Mister · December 31, 2008

I know that this topic has been done to death, and I am sorry for the admins who have to help another sucker with malware on their computer. But I'm having a lot of trouble.
When using Mozilla Firefox, I get pop ups with IE. I had this problem about 6 months ago as well. I rebooted the comp in safe mode, disabled system restore, ran SuperAntiSpyware, MBAM, and HiJackthis. It did the trick. I then went on to install Sygate and Avast for protection.
I still have all of that (except avast, which I swapped for avivir), and after downloading something for a game (which I know is dumb), I have the same issue again.
I did the same as last time, however, it doesn't work anymore. I got updates on SAS, ran SAS, MBAM in safe mode and normally, and have ran hijackthis. However, everytime I run and delete things, they come back up. After some research, I think this is it...
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll
I can't seem to get rid of this! Every time HJ deletes it, it comes back up! I will attach my Hijackthis log, and MBAM and SAS as well (when I find them...).
Thanks in advance.
Peace,
Matt

"Upload failed. You are not permitted to upload this type of file!" (it's a text file)

I can't upload it! I don't know why! I'll just copy and paste. Sorry.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:59:54 PM, on 12/30/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Sygate\SPF\smc.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

C:\WINDOWS\system32\RevoTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe

C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [smcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [RevoTaskbarApp] C:\WINDOWS\system32\RevoTask.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [CPM6b5d72f2] Rundll32.exe "c:\windows\system32\sokodewu.dll",a

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKCU\..\Run: [HydraVisionDesktopManager] "C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe"

O4 - HKCU\..\Run: [jamtray] C:/Program Files/Jaman Player/jamtray.exe

O4 - Global Startup: M-Audio Revolution Control Panel Launcher.lnk = C:\Program Files\M-Audio Revolution\RevoTask.exe

O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab

O20 - AppInit_DLLs: c:\windows\system32\sokodewu.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll

O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\sokodewu.dll

O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe

O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

--

End of file - 4806 bytes

Mister · December 31, 2008

MBAM log

mbam_log_12_30_2008__23_34_55_.txt

Mister · December 31, 2008

I am so sorry for all these posts, I'm terrible in forums. I could only upload the MBAM text file, not this one or the Hijack this. Sorry

SUPERAntiSpyware Scan Log

http://www.superantispyware.com

Generated 12/30/2008 at 11:57 PM

Application Version : 4.15.1000

Core Rules Database Version : 3691

Trace Rules Database Version: 1667

Scan type : Quick Scan

Total Scan Time : 00:10:58

Memory items scanned : 331

Memory threats detected : 0

Registry items scanned : 329

Registry threats detected : 6

File items scanned : 5238

File threats detected : 1

Unclassified.Unknown Origin

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler#{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}

HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}

HKCR\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InprocServer32

HKCR\CLSID\{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}\InprocServer32#ThreadingModel

C:\WINDOWS\SYSTEM32\SOKODEWU.DLL

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad#SSODL

HKCR\CLSID\{EC43E3FD-5C60-46A6-97D7-E0B85DBDD6C4}

Mister · December 31, 2008

Another reply before I hit the hay....

I've been hitting some of the other threads with problems similar to mine. So I did some of the things Admins recommended for other people. I ran REGEDIT and scrolled to HKEY_CLASSES_ROOT\CSLID\EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4\ and deleted it (with it's subkeys) in safe mode, to no avail. When I restarted it was right there again. This thing is being a royal pain (the pop ups aren't too terrible, I get one about every 5 minutes, I just hate being infected), I am almost positive that this is where the source of the problem is. Any help would be appreciated.

Peace,

Matt

nosirrah · December 31, 2008

Malwarebytes' Anti-Malware 1.25

Database version: 1062

you need to update MBAM , this is many months out of date and almost 1000 definition updates out of date

Mister · December 31, 2008

Malwarebytes' Anti-Malware 1.25
Database version: 1062
you need to update MBAM , this is many months out of date and almost 1000 definition updates out of date

Thanks for the reply. I'm updating now and will repost with new scans.

Mister · December 31, 2008

Malwarebytes' Anti-Malware 1.25
Database version: 1062
you need to update MBAM , this is many months out of date and almost 1000 definition updates out of date

I updated, ran MBAM in safe mode and ran a hijackthis log. I don't see the infected registry anymore, and so far, no pop ups.

Good sir, now I see why they call you a deity!

I will post back if anything happens!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:39:51 AM, on 12/31/2008