Murraym33 Posted January 3, 2009 ID:44445 Share Posted January 3, 2009 Hi there, I've had this Trojan.Vundo.H for a little while, not sure why I haven't seeked help sooner but even with Malwarebytes I run the scan and remove it and as soon as I boot up again its back. Here is my Hijack This Log, it says MSIE: Internet Explorer, but I use Firefox?Logfile of Trend Micro HijackThis v2.0.2Scan saved at 16:37:41, on 03/01/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: NormalRunning processes:H:\WINDOWS\System32\smss.exeH:\WINDOWS\system32\winlogon.exeH:\WINDOWS\system32\services.exeH:\WINDOWS\system32\lsass.exeH:\WINDOWS\system32\svchost.exeH:\WINDOWS\System32\svchost.exeH:\WINDOWS\system32\spoolsv.exeH:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeH:\Program Files\Belkin\F5D7051\WLService.exeH:\Program Files\Belkin\F5D7051\WLanCfgG.exeH:\Program Files\Bonjour\mDNSResponder.exeH:\Program Files\Kontiki\KService.exeH:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeH:\WINDOWS\system32\tcpsvcs.exeH:\WINDOWS\system32\slserv.exeH:\WINDOWS\system32\svchost.exeH:\WINDOWS\Explorer.EXEH:\WINDOWS\SOUNDMAN.EXEH:\WINDOWS\system32\VTTimer.exeH:\Program Files\SyncroSoft\Pos\H2O\cledx.exeH:\Program Files\Java\jre1.6.0_07\bin\jusched.exeH:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exeH:\WINDOWS\system32\RunDll32.exeH:\Program Files\iTunes\iTunesHelper.exeH:\Program Files\Microsoft Office\Office12\GrooveMonitor.exeH:\WINDOWS\system32\rundll32.exeH:\WINDOWS\system32\ctfmon.exeH:\Program Files\Messenger\msmsgs.exeH:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exeH:\Program Files\uTorrent\uTorrent.exeH:\Program Files\TomTom HOME 2\HOMERunner.exeH:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeH:\WINDOWS\System32\svchost.exeH:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exeH:\Program Files\iPod\bin\iPodService.exeH:\Program Files\Common Files\Teleca Shared\Generic.exeH:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exeH:\Program Files\Mozilla Firefox\firefox.exeH:\Program Files\Windows Live\Messenger\usnsvc.exeH:\Documents and Settings\Murray\My Documents\Firefox Downloads\HiJackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: (no name) - {0cade8a3-23d7-44ec-b3d8-100087c8789e} - H:\WINDOWS\system32\yatehaje.dll (file missing)O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - H:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: {b2688f73-0d69-32aa-dac4-42c19be25e9b} - {b9e52eb9-1c24-4cad-aa23-96d037f8862b} - H:\WINDOWS\system32\kczilb.dllO3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - H:\Program Files\Orbitdownloader\GrabPro.dllO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [VTTimer] VTTimer.exeO4 - HKLM\..\Run: [4oD] "H:\Program Files\Kontiki\KHost.exe" -allO4 - HKLM\..\Run: [NBKeyScan] "H:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"O4 - HKLM\..\Run: [NeroFilterCheck] "H:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"O4 - HKLM\..\Run: [sony Ericsson PC Suite] "H:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptionsO4 - HKLM\..\Run: [H2O] H:\Program Files\SyncroSoft\Pos\H2O\cledx.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [REGSHAVE] H:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [RemoteControl] H:\Program Files\ASUS\ASUS Remote\RemoteControlAppl.exeO4 - HKLM\..\Run: [AudCtrl] RunDll32 AudCtrl.dll,RCMonitorO4 - HKLM\..\Run: [updReg] H:\WINDOWS\UpdReg.EXEO4 - HKLM\..\Run: [CTStartup] H:\Program Files\Creative\Splash Screen\CTEaxSpl.EXE /runO4 - HKLM\..\Run: [AppleSyncNotifier] H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exeO4 - HKLM\..\Run: [iTunesHelper] "H:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "H:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [GrooveMonitor] "H:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"O4 - HKLM\..\Run: [kehuvugevo] Rundll32.exe "H:\WINDOWS\system32\hayeluze.dll",sO4 - HKLM\..\Run: [000000af] rundll32.exe "H:\WINDOWS\system32\sufokiyu.dll",bO4 - HKLM\..\Run: [CPM37b6f935] Rundll32.exe "h:\windows\system32\niwofuzu.dll",aO4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "H:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttrayO4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [indxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "H:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [RssReader] "H:\Program Files\RssReader\RssReader.exe"O4 - HKCU\..\Run: [uTorrent] "H:\Program Files\uTorrent\uTorrent.exe"O4 - HKCU\..\Run: [TomTomHOME.exe] "H:\Program Files\TomTom HOME 2\HOMERunner.exe"O4 - HKCU\..\Run: [iMC] H:\Program Files\FriendFinder\FriendFinder Messenger 4\imc.exeO4 - HKCU\..\Run: [kdx] H:\Program Files\Kontiki\KHost.exe -allO4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-19\..\Run: [kehuvugevo] Rundll32.exe "H:\WINDOWS\system32\hayeluze.dll",s (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')O4 - Global Startup: ASUSO4 - Global Startup: ExifLauncher2.lnk = H:\Program Files\FinePixViewer\QuickDCF2.exeO8 - Extra context menu item: &Download by Orbit - res://H:\Program Files\Orbitdownloader\orbitmxt.dll/201O8 - Extra context menu item: &Grab video by Orbit - res://H:\Program Files\Orbitdownloader\orbitmxt.dll/204O8 - Extra context menu item: Do&wnload selected by Orbit - res://H:\Program Files\Orbitdownloader\orbitmxt.dll/203O8 - Extra context menu item: Down&load all by Orbit - res://H:\Program Files\Orbitdownloader\orbitmxt.dll/202O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - H:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - H:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLLO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exeO15 - Trusted Zone: *.amaena.comO15 - Trusted Zone: *.antimalwareguard.comO15 - Trusted Zone: *.antispyexpert.comO15 - Trusted Zone: *.avsystemcare.comO15 - Trusted Zone: *.gomyhit.comO15 - Trusted Zone: *.imageservr.comO15 - Trusted Zone: *.imagesrvr.comO15 - Trusted Zone: *.onerateld.comO15 - Trusted Zone: *.safetydownload.comO15 - Trusted Zone: *.spyguardpro.comO15 - Trusted Zone: *.storageguardsoft.comO15 - Trusted Zone: *.trustedantivirus.comO15 - Trusted Zone: *.virusremover2008.comO15 - Trusted Zone: *.virusschlacht.comO15 - Trusted Zone: *.amaena.com (HKLM)O15 - Trusted Zone: *.antimalwareguard.com (HKLM)O15 - Trusted Zone: *.antispyexpert.com (HKLM)O15 - Trusted Zone: *.avsystemcare.com (HKLM)O15 - Trusted Zone: *.gomyhit.com (HKLM)O15 - Trusted Zone: *.imageservr.com (HKLM)O15 - Trusted Zone: *.imagesrvr.com (HKLM)O15 - Trusted Zone: *.onerateld.com (HKLM)O15 - Trusted Zone: *.safetydownload.com (HKLM)O15 - Trusted Zone: *.spyguardpro.com (HKLM)O15 - Trusted Zone: *.storageguardsoft.com (HKLM)O15 - Trusted Zone: *.trustedantivirus.com (HKLM)O15 - Trusted Zone: *.virusremover2008.com (HKLM)O15 - Trusted Zone: *.virusschlacht.com (HKLM)O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cabO16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cabO16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC...bin/AvSniff.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cabO16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1195659070936O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cabO16 - DPF: {E862C832-3A5F-4CEB-BFAA-167B22010A71} (InfosFinder2.InfosFinder) - http://support.packardbell.com/files/activ...nfosFinder2.CABO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cabO18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - H:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dllO20 - AppInit_DLLs: lmmmtc.dll kczilb.dll h:\windows\system32\kewevuro.dll H:\WINDOWS\system32\lipoyiya.dll H:\WINDOWS\system32\loviheti.dll h:\windows\system32\botajida.dll h:\windows\system32\niwofuzu.dll h:\windows\system32\yegusaso.dllO21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - h:\windows\system32\niwofuzu.dllO22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - h:\windows\system32\niwofuzu.dllO23 - Service: Apple Mobile Device - Apple Inc. - H:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Belkin High-Speed Mode Wireless G USB Driver (Belkin High-Speed Mode Wireless G USB Network Adapter Service) - Unknown owner - H:\Program Files\Belkin\F5D7051\WLService.exeO23 - Service: Bonjour Service - Apple Inc. - H:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - H:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: iPod Service - Apple Inc. - H:\Program Files\iPod\bin\iPodService.exeO23 - Service: KService - Kontiki Inc. - H:\Program Files\Kontiki\KService.exeO23 - Service: MBAMService - Malwarebytes Corporation - H:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeO23 - Service: NBService - Nero AG - H:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - H:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - H:\Program Files\WinPcap\rpcapd.exeO23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\Win32\RpcDataSrv.exeO23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - H:\Program Files\SiSoftware\SiSoftware Sandra Lite XIIc\RpcSandraSrv.exeO23 - Service: SmartLinkService (SLService) - Smart Link - H:\WINDOWS\SYSTEM32\slserv.exe--End of file - 13319 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 4, 2009 Root Admin ID:44531 Share Posted January 4, 2009 Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.Please download JavaRa and unzip it to your desktop.***Please close any instances of Internet Explorer (or other web browser) before continuing!***Double-click on JavaRa.exe to start the program.From the drop-down menu, choose English and click on Select.JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.A logfile will pop up. Please save it to a convenient location.Update Java RuntimeThe most current version of Sun Java is: Java Runtime Environment (JRE) 6 Update 11.Go to http://java.sun.com/javase/downloads/index.jspGo to Java Runtime Environment (JRE) 6 Update 11 about half way down the page and click on the Download button.In Platform box choose Windows.Check the box to Accept License Agreement and click Continue.Click on Windows Offline Installation, click on the link under it which says jre-6u11-windows-i586-p.exe and save the downloaded file to your desktop.Install the new version by running the newly-downloaded file with the java icon which will be on your desktop, and follow the on-screen instructions.Uncheck the Toolbar button (unless you want the toolbar)Please run the followingStart HJT and do a Scan Only and place a check mark on the following entriesO2 - BHO: (no name) - {0cade8a3-23d7-44ec-b3d8-100087c8789e} - H:\WINDOWS\system32\yatehaje.dll (file missing)O2 - BHO: {b2688f73-0d69-32aa-dac4-42c19be25e9b} - {b9e52eb9-1c24-4cad-aa23-96d037f8862b} - H:\WINDOWS\system32\kczilb.dllO4 - HKLM\..\Run: [kehuvugevo] Rundll32.exe "H:\WINDOWS\system32\hayeluze.dll",sO4 - HKLM\..\Run: [000000af] rundll32.exe "H:\WINDOWS\system32\sufokiyu.dll",bO4 - HKLM\..\Run: [CPM37b6f935] Rundll32.exe "h:\windows\system32\niwofuzu.dll",aO4 - HKCU\..\Run: [uTorrent] "H:\Program Files\uTorrent\uTorrent.exe"O4 - HKUS\S-1-5-19\..\Run: [kehuvugevo] Rundll32.exe "H:\WINDOWS\system32\hayeluze.dll",s (User 'LOCAL SERVICE')O15 - Trusted Zone: *.amaena.comO15 - Trusted Zone: *.antimalwareguard.comO15 - Trusted Zone: *.antispyexpert.comO15 - Trusted Zone: *.avsystemcare.comO15 - Trusted Zone: *.gomyhit.comO15 - Trusted Zone: *.imageservr.comO15 - Trusted Zone: *.imagesrvr.comO15 - Trusted Zone: *.onerateld.comO15 - Trusted Zone: *.safetydownload.comO15 - Trusted Zone: *.spyguardpro.comO15 - Trusted Zone: *.storageguardsoft.comO15 - Trusted Zone: *.trustedantivirus.comO15 - Trusted Zone: *.virusremover2008.comO15 - Trusted Zone: *.virusschlacht.comO15 - Trusted Zone: *.amaena.com (HKLM)O15 - Trusted Zone: *.antimalwareguard.com (HKLM)O15 - Trusted Zone: *.antispyexpert.com (HKLM)O15 - Trusted Zone: *.avsystemcare.com (HKLM)O15 - Trusted Zone: *.gomyhit.com (HKLM)O15 - Trusted Zone: *.imageservr.com (HKLM)O15 - Trusted Zone: *.imagesrvr.com (HKLM)O15 - Trusted Zone: *.onerateld.com (HKLM)O15 - Trusted Zone: *.safetydownload.com (HKLM)O15 - Trusted Zone: *.spyguardpro.com (HKLM)O15 - Trusted Zone: *.storageguardsoft.com (HKLM)O15 - Trusted Zone: *.trustedantivirus.com (HKLM)O15 - Trusted Zone: *.virusremover2008.com (HKLM)O15 - Trusted Zone: *.virusschlacht.com (HKLM)O20 - AppInit_DLLs: lmmmtc.dll kczilb.dll h:\windows\system32\kewevuro.dll H:\WINDOWS\system32\lipoyiya.dll H:\WINDOWS\system32\loviheti.dll h:\windows\system32\botajida.dll h:\windows\system32\niwofuzu.dll h:\windows\system32\yegusaso.dllO21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - h:\windows\system32\niwofuzu.dllO22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - h:\windows\system32\niwofuzu.dllThen click on Fix checked then quit HJTMalwarebytes' Anti-MalwareStart MalwareBytes AntiMalware Update Malwarebytes' Anti-Malware Select the Update tabClick Update[*]When the update is complete, select the Scanner tab[*]Select Perform quick scan, then click Scan.[*]When the scan is complete, click OK, then Show Results to view the results.[*]Be sure that everything is checked, and click Remove Selected.[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidently close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtThen RESTART the computer again and AFTER the restart run HJT Scan and save logPost back the NEW MBAM and HJT logs Link to post Share on other sites More sharing options...
Recommended Posts