troj/rustock

View previous topic View next topic Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 8:23 pm

Hi,

I've been silently following this thread because I have the same trojan on my computer. I've tried pretty much everything advised to AARG12 I've tried for days to remove it...Spybot,AntiVir, Avast, Malware....even tried Smitfraud...nothing works. Even the IP the DNS Changer is switching it to is the same so I believe its the exact same problem. I'm running my system with an IP assigned by DHCP. What else can I do to try and remove it?

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 8:31 pm

Split your post off.
Please post a Hijack This log, read here:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 8:45 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:43:47, on 1/8/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Lori\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\1140478692\ee\aolsoftware.exe
C:\WINDOWS\system32\spider.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Documents and Settings\Lori\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8081
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {160dc409-bbd2-4b85-98da-06ce87ea8f86} - C:\WINDOWS\system32\migefore.dll (file missing)
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {36FD5436-8367-4DBE-83B1-C9A5B849FD58} - (no file)
O2 - BHO: (no name) - {451C688C-FF74-4E87-9986-4A3F9D4C633F} - C:\WINDOWS\system32\awtrQJCS.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5B224C4A-6652-4992-A487-A9C87E9D14F4} - C:\WINDOWS\system32\jkkLBqOI.dll (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {5DE18C1E-0836-42D2-82CB-C6C9DADED772} - C:\WINDOWS\system32\ddcDsrqn.dll (file missing)
O2 - BHO: (no name) - {61115D25-83EE-4F08-B633-53A4BC71215B} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: (no name) - {A7C0A4BD-6D86-4519-8D49-E64E0B8E9889} - C:\WINDOWS\system32\iiffFyVN.dll (file missing)
O2 - BHO: (no name) - {BA9241C6-063E-4493-B620-36259625E700} - (no file)
O2 - BHO: (no name) - {D3F901B9-7C4B-4B7D-9836-F21F8E68FDC2} - (no file)
O2 - BHO: (no name) - {E6E212DE-742F-41A6-86DC-C24D63021E97} - C:\WINDOWS\system32\cbXOFwWm.dll (file missing)
O2 - BHO: (no name) - {EA60E099-C8EC-4596-954C-A75AF9FD06C6} - C:\WINDOWS\system32\byXRHyvT.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1140478692\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [AIMPro] "C:\Program Files\AIM\AIM Pro\aimpro.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lori\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - S-1-5-18 Startup: SDK Tray Menu.lnk = ? (User 'SYSTEM')
O4 - S-1-5-18 Startup: Super Finder.lnk = C:\Program Files\FSL\SuperFinder\SuperFinder.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: SDK Tray Menu.lnk = ? (User 'Default user')
O4 - .DEFAULT Startup: Super Finder.lnk = C:\Program Files\FSL\SuperFinder\SuperFinder.exe (User 'Default user')
O4 - Startup: SDK Tray Menu.lnk = ?
O4 - Startup: Super Finder.lnk = C:\Program Files\FSL\SuperFinder\SuperFinder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - ?p=ZCxdm492YYUS
O8 - Extra context menu item: &Yahoo! Search - [You must be registered and logged in to see this link.] Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Yahoo! &Dictionary - [You must be registered and logged in to see this link.] Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - [You must be registered and logged in to see this link.] Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - [You must be registered and logged in to see this link.] Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Lori\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Lori\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe (file missing)
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Odds Maker - b3cab7b9-eb43-46a2-8e15-02cc298dec71 - C:\Documents and Settings\Lori\Start Menu\Programs\Odds Maker\Odds Maker.lnk (HKCU)
O9 - Extra button: Doyles Room - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\DoylesRoomMPP\MPPoker.exe (file missing) (HKCU)
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} (CPlayFirstzenerchiControl Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{DD02E7FB-020A-40F7-A15F-FAC5FD83DB07}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs: ikjukg.dll jyxxpv.dll C:\WINDOWS\system32\gizojegu.dll c:\windows\system32\zosiyaba.dll
O20 - Winlogon Notify: iifCRkHX - C:\WINDOWS\
O20 - Winlogon Notify: vtstt - C:\WINDOWS\system32\vtstt.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - [You must be registered and logged in to see this link.]

--
End of file - 12834 bytes

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 8:50 pm

Hello.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    O2 - BHO: (no name) - {160dc409-bbd2-4b85-98da-06ce87ea8f86} - C:\WINDOWS\system32\migefore.dll (file missing)
    O2 - BHO: (no name) - {36FD5436-8367-4DBE-83B1-C9A5B849FD58} - (no file)
    O2 - BHO: (no name) - {451C688C-FF74-4E87-9986-4A3F9D4C633F} - C:\WINDOWS\system32\awtrQJCS.dll (file missing)
    O2 - BHO: (no name) - {5B224C4A-6652-4992-A487-A9C87E9D14F4} - C:\WINDOWS\system32\jkkLBqOI.dll (file missing)
    O2 - BHO: (no name) - {5DE18C1E-0836-42D2-82CB-C6C9DADED772} - C:\WINDOWS\system32\ddcDsrqn.dll (file missing)
    O2 - BHO: (no name) - {61115D25-83EE-4F08-B633-53A4BC71215B} - (no file)
    O2 - BHO: (no name) - {A7C0A4BD-6D86-4519-8D49-E64E0B8E9889} - C:\WINDOWS\system32\iiffFyVN.dll (file missing)
    O2 - BHO: (no name) - {BA9241C6-063E-4493-B620-36259625E700} - (no file)
    O2 - BHO: (no name) - {D3F901B9-7C4B-4B7D-9836-F21F8E68FDC2} - (no file)
    O2 - BHO: (no name) - {E6E212DE-742F-41A6-86DC-C24D63021E97} - C:\WINDOWS\system32\cbXOFwWm.dll (file missing)
    O2 - BHO: (no name) - {EA60E099-C8EC-4596-954C-A75AF9FD06C6} - C:\WINDOWS\system32\byXRHyvT.dll (file missing)
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
    O9 - Extra button: Odds Maker - b3cab7b9-eb43-46a2-8e15-02cc298dec71 - C:\Documents and Settings\Lori\Start Menu\Programs\Odds Maker\Odds Maker.lnk (HKCU)
    O9 - Extra button: Doyles Room - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\DoylesRoomMPP\MPPoker.exe (file missing) (HKCU)
    O17 - HKLM\System\CCS\Services\Tcpip\..\{DD02E7FB-020A-40F7-A15F-FAC5FD83DB07}: NameServer = 208.67.220.220,208.67.222.222
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
    O20 - AppInit_DLLs: ikjukg.dll jyxxpv.dll C:\WINDOWS\system32\gizojegu.dll c:\windows\system32\zosiyaba.dll
    O20 - Winlogon Notify: iifCRkHX - C:\WINDOWS\
    O20 - Winlogon Notify: vtstt - C:\WINDOWS\system32\vtstt.dll (file missing)
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


  • Press "Fix Checked"
  • Close Hijack This.

Lets run a rootkit scan.

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 9:23 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

Hidden driver "msqpdxserv.sys" found!
ImagePath: \systemroot\system32\drivers\msqpdxwfdmwysb.sys
Driver disabled successfully.

Rootkit scan completed.


Completed script processing.

*******************

Finished! Terminate.

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 9:25 pm

Hello.
We need to use the avenger again.

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Drivers to delete:
msqpdxserv.sys

Files to delete:
c:\windows\system32\drivers\msqpdxwfdmwysb.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
4. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 9:33 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "msqpdxserv.sys" deleted successfully.
File "c:\windows\system32\drivers\msqpdxwfdmwysb.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 9:34 pm

Hello.
The rootkit is gone, lets see what's left.


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Click No for Optional Scan.
  • Save the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 9:39 pm

Here's the DDS for ya =)




DDS (Ver_09-01-07.01) - NTFSx86
Run by Lori at 15:36:14.37 on Thu 01/08/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.510.231 [GMT -6:00]

AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Outdated)
AV: avast! antivirus 4.8.1201 [VPS 080911-0] *On-access scanning disabled* (Outdated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Lori\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uDefault_Page_URL = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyServer = 127.0.0.1:8081
uSearchAssistant = [You must be registered and logged in to see this link.]
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: AOLTBSearch Class: {ea756889-2338-43db-8f07-d1ca6fb9c90d} - c:\program files\aol\aol toolbar 3.0\aoltb.dll
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\program files\yahoo!\common\yiesrvc.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AOL Toolbar Launcher: {7c554162-8cb7-45a4-b8f4-8ea1c75885f9} - c:\program files\aol\aol toolbar 3.0\aoltb.dll
TB: AOL Toolbar: {de9c389f-3316-41a7-809b-aa305ed9d922} - c:\program files\aol\aol toolbar 3.0\aoltb.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\progra~1\yahoo!\common\yhexbmesus.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\lori\local settings\application data\google\update\GoogleUpdate.exe" /c
uRun: [BitTorrent DNA] "c:\program files\dna\btdna.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [HostManager] c:\program files\common files\aol\1140478692\ee\AOLSoftware.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [Corel Photo Downloader] c:\program files\corel\corel photo album 6\MediaDetect.exe
mRun: [AIMPro] "c:\program files\aim\aim pro\aimpro.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\lori\startm~1\programs\startup\sdktra~1.lnk - c:\sun\sdk\jdk\bin\javaw.exe
StartupFolder: c:\docume~1\lori\startm~1\programs\startup\superf~1.lnk - c:\program files\fsl\superfinder\SuperFinder.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\americ~1.lnk - c:\program files\america online 9.0\aoltray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-us\local\search.html
IE: &Search - ?p=ZCxdm492YYUS
IE: &Yahoo! Search - [You must be registered and logged in to see this link.] files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - [You must be registered and logged in to see this link.] files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - [You must be registered and logged in to see this link.] files\yahoo!\Common/ycmap.htm
IE: Yahoo! &SMS - [You must be registered and logged in to see this link.] files\yahoo!\Common/ycsms.htm
IE: {13C1DBF6-7535-495c-91F6-8C13714ED485} - c:\documents and settings\lori\start menu\programs\absolute poker\Absolute Poker.lnk
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {3369AF0D-62E9-4bda-8103-B4C75499B578} - {DE9C389F-3316-41A7-809B-AA305ED9D922} - c:\program files\aol\aol toolbar 3.0\aoltb.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: yahoo.com\www
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
LSA: Notification Packages = scecli c:\windows\system32\gizojegu.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\lori\applic~1\mozilla\firefox\profiles\r5bheriw.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - component: c:\program files\mozilla firefox\components\iamfamous.dll
FF - plugin: c:\documents and settings\lori\application data\mozilla\firefox\profiles\r5bheriw.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\documents and settings\lori\local settings\application data\google\update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\progra~1\yahoo!\common\npyaxmpb.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-7-13 78416]
R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2008-12-13 11840]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-12-13 52032]
R4 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-7-7 611664]
R4 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2008-12-13 68865]
R4 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2008-12-13 151297]
R4 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2008-7-13 20560]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2008-12-15 40840]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2008-12-15 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2008-12-15 81288]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2008-12-15 356920]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2008-12-15 1079176]
S4 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2008-7-13 144760]
S4 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2008-7-13 247160]
S4 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2008-7-13 349560]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-7-11 24652]

============== File Associations ===============

regfile="%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2009-01-08 15:28 0 a------- C:\backup.reg
2009-01-08 15:12 135,168 a------- C:\zip.exe
2009-01-08 15:12 19,286 a------- C:\cleanup.exe
2009-01-08 15:12 574 a------- C:\cleanup.bat
2009-01-08 13:43 1,948 a------- c:\windows\system32\tmp.reg
2009-01-07 02:37 244,232 a------- c:\windows\system32\msflxgrd.ocx
2009-01-06 02:18 55,296 a------- c:\windows\system32\msqpdxyjinrrsc.dll
2009-01-06 02:18 255 a------- C:\autorun.inf
2009-01-06 02:18 --dshr-- C:\resycled
2009-01-05 04:27 --d----- c:\program files\DNA
2009-01-05 04:27 --d----- c:\docume~1\lori\applic~1\DNA
2009-01-03 15:56 54,156 a---h--- c:\windows\QTFont.qfn
2009-01-03 15:56 1,409 a------- c:\windows\QTFont.for
2008-12-23 07:12 --d----- c:\docume~1\alluse~1\applic~1\Launcher
2008-12-23 06:53 --d----- C:\Graboid
2008-12-23 05:15 --d----- c:\docume~1\alluse~1\applic~1\Graboid Inc
2008-12-23 05:15 --d----- c:\docume~1\lori\applic~1\MozillaControl
2008-12-23 04:51 --d----- c:\program files\Mozilla ActiveX Control v1.7.12
2008-12-23 04:50 --d----- c:\program files\VideoLAN
2008-12-23 04:50 --d----- c:\program files\Graboid
2008-12-19 04:28 --d----- c:\program files\IrfanView
2008-12-15 03:02 --d----- c:\program files\FSL
2008-12-15 01:26 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2008-12-15 01:26 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2008-12-15 01:26 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys
2008-12-15 01:26 29,576 a------- c:\windows\system32\drivers\kcom.sys
2008-12-15 01:26 --d----- c:\program files\Spyware Doctor
2008-12-15 01:26 --d----- c:\docume~1\lori\applic~1\PC Tools
2008-12-14 03:12 --d----- c:\program files\MSXML 6.0
2008-12-13 22:02 138,368 -------- c:\windows\system32\dllcache\afd.sys
2008-12-13 21:59 331,776 -------- c:\windows\system32\dllcache\msadce.dll
2008-12-13 21:59 332,800 a------- c:\windows\system32\SET79E.tmp
2008-12-13 21:59 1,106,944 a------- c:\windows\system32\SET798.tmp
2008-12-13 20:05 1,589,605 ---sh--- c:\windows\system32\ehulejig.ini
2008-12-13 15:48 --d----- c:\windows\ERUNT
2008-12-13 15:43 --d----- C:\SDFix
2008-12-13 15:25 --d----- c:\program files\Avira
2008-12-13 15:25 --d----- c:\docume~1\alluse~1\applic~1\Avira
2008-12-13 08:05 1,589,605 ---sh--- c:\windows\system32\usovagag.ini
2008-12-12 19:51 23,434 a------- c:\windows\system32\productregistry
2008-12-12 19:48 --d----- C:\Sun
2008-12-12 19:35 --d----- c:\documents and settings\lori\.SunDownloadManager
2008-12-12 19:18 410,984 a------- c:\windows\system32\deploytk.dll
2008-12-12 19:18 73,728 a------- c:\windows\system32\javacpl.cpl
2008-12-12 01:28 --d----- c:\program files\common files\eSellerate
2008-12-11 18:09 1,623,257 a--sh--- c:\windows\system32\qbfrnqoo.ini
2008-12-11 17:44 1,623,257 a--sh--- c:\windows\system32\vblwecnw.ini
2008-12-11 16:27 --d----- c:\program files\common files\Symantec Shared
2008-12-11 16:27 --d----- c:\program files\Norton PC Checkup
2008-12-10 02:38 38 a------- c:\windows\avisplitter.INI

==================== Find3M ====================

2009-01-04 21:29 3,558 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-11-29 17:58 82,944 a------- c:\windows\system32\IEDFix.C.exe
2008-10-24 05:10 453,632 -------- c:\windows\system32\dllcache\mrxsmb.sys
2008-10-23 07:01 283,648 a------- c:\windows\system32\SET792.tmp
2008-10-23 07:01 283,648 -------- c:\windows\system32\dllcache\gdi32.dll
2008-10-17 02:08 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll
2008-10-16 14:13 1,809,944 a------- c:\windows\system32\dllcache\wuaueng.dll
2008-10-16 14:13 202,776 a------- c:\windows\system32\dllcache\wuweb.dll
2008-10-16 14:12 323,608 a------- c:\windows\system32\dllcache\wucltui.dll
2008-10-16 14:12 561,688 a------- c:\windows\system32\dllcache\wuapi.dll
2008-10-16 14:09 92,696 a------- c:\windows\system32\dllcache\cdm.dll
2008-10-16 14:09 51,224 a------- c:\windows\system32\dllcache\wuauclt.exe
2008-10-16 07:11 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2008-10-16 07:11 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2008-10-15 10:57 332,800 -------- c:\windows\system32\dllcache\netapi32.dll
2008-10-15 01:06 633,632 -------- c:\windows\system32\dllcache\iexplore.exe
2008-10-15 01:04 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2007-05-28 21:50 87,608 a------- c:\docume~1\lori\applic~1\ezpinst.exe
2007-05-28 21:50 47,360 a------- c:\docume~1\lori\applic~1\pcouffin.sys
2008-06-25 02:40 250,965 a--sh--- c:\windows\system32\IOqBLkkj.ini2
2008-07-16 04:02 724,034 a--sh--- c:\windows\system32\mWwFOXbc.ini2
2008-07-13 19:42 715,636 a--sh--- c:\windows\system32\nqrsDcdd.ini2
2008-07-16 16:03 848,613 a--sh--- c:\windows\system32\NVyFffii.ini2
2006-01-09 17:39 221,335 a--sh--- c:\windows\system32\ttstv.bak1
2008-06-28 08:51 652,811 a--sh--- c:\windows\system32\TvyHRXyb.ini2
2006-04-15 05:40 810,039 a--sh--- c:\windows\system32\xbeeg.bak1
2006-04-14 05:40 808,239 a--sh--- c:\windows\system32\xbeeg.bak2

============= FINISH: 15:37:16.25 ===============

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 9:45 pm

Hello.
We need to use the avenger again.

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying


Files to delete:
c:\windows\system32\IOqBLkkj.ini2
c:\windows\system32\mWwFOXbc.ini2
c:\windows\system32\nqrsDcdd.ini2
c:\windows\system32\NVyFffii.ini2
c:\windows\system32\ttstv.bak1
c:\windows\system32\TvyHRXyb.ini2
c:\windows\system32\xbeeg.bak1
c:\windows\system32\xbeeg.bak2
c:\windows\system32\SET792.tmp
c:\windows\system32\IEDFix.C.exe
C:\zip.exe
C:\cleanup.exe
C:\cleanup.bat
c:\windows\system32\tmp.reg
c:\windows\system32\msflxgrd.ocx
c:\windows\system32\msqpdxyjinrrsc.dll
C:\autorun.inf
c:\windows\system32\usovagag.ini
c:\windows\system32\qbfrnqoo.ini
c:\windows\system32\vblwecnw.ini

Folders to delete:
C:\resycled
C:\SDFix
c:\program files\viewpoint

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


3. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avengerís actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
4. Please copy/paste the content of c:\avenger.txt into your reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 9:54 pm

I noticed on startup that it said it couldn't find cleanup.exe to run it...i assume that means theres still pieces of something left?




Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\IOqBLkkj.ini2" deleted successfully.
File "c:\windows\system32\mWwFOXbc.ini2" deleted successfully.
File "c:\windows\system32\nqrsDcdd.ini2" deleted successfully.
File "c:\windows\system32\NVyFffii.ini2" deleted successfully.
File "c:\windows\system32\ttstv.bak1" deleted successfully.
File "c:\windows\system32\TvyHRXyb.ini2" deleted successfully.
File "c:\windows\system32\xbeeg.bak1" deleted successfully.
File "c:\windows\system32\xbeeg.bak2" deleted successfully.
File "c:\windows\system32\SET792.tmp" deleted successfully.
File "c:\windows\system32\IEDFix.C.exe" deleted successfully.
File "C:\zip.exe" deleted successfully.
File "C:\cleanup.exe" deleted successfully.
File "C:\cleanup.bat" deleted successfully.
File "c:\windows\system32\tmp.reg" deleted successfully.
File "c:\windows\system32\msflxgrd.ocx" deleted successfully.
File "c:\windows\system32\msqpdxyjinrrsc.dll" deleted successfully.
File "C:\autorun.inf" deleted successfully.
File "c:\windows\system32\usovagag.ini" deleted successfully.
File "c:\windows\system32\qbfrnqoo.ini" deleted successfully.
File "c:\windows\system32\vblwecnw.ini" deleted successfully.
Folder "C:\resycled" deleted successfully.
Folder "C:\SDFix" deleted successfully.
Folder "c:\program files\viewpoint" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 9:58 pm

Dunno, but it's deleted now.


  • Now open a new notepad file.
  • Input this into the notepad file:

    Windows Registry Editor Version 5.00

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
    "Notification Packages"="scecli"

  • Save this as fix.reg, save it to your desktop.
  • Double click fix.reg to run it.
  • Select yes to the registry merge prompt.


What problems remain?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 10:03 pm

This is what i get when i try and run Fix.reg from my desktop.


C:\Documents and Settings\Lori\Desktop\fix.reg is not a valid Win32 application.

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 10:07 pm

Please download [You must be registered and logged in to see this link.] and save it to your desktop.

  • Double click on it to run.
  • Read the disclaimer and click OK.
  • Click on the Scan button.
  • If it finds faulty file associations, they will appear in red beside a checkbox. If this occurs, just place a checkmark (tick) in the boxes in question.
  • Click the Fix button.


Try the reg fix again.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 10:09 pm

Information was successfully entered. Thanks! =) I'm checking to see if any symptoms remain I'll give you a heads up momentarily.

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 10:13 pm

Please delete DDS.com and avenger.exe from your desktop.
Delete this folder in bold:
C:\Avenger

I see you have Adobe Reader version 6 installed on here, this is old and has holes malware may abuse, we need to close these holes.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

  • Adobe Reader 6

Then download and install version 9 from here:
[You must be registered and logged in to see this link.]


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by RyBrand04 on 8th January 2009, 10:32 pm

It looks clean to me...haven't noticed anything that would make me think otherwise. Thank you so much for your help...It's been pestering me for days and nothing I did would fix it...Appreciate everything

RyBrand04
Novice
Novice

Posts Posts : 9
Joined Joined : 2009-01-08
OS OS : Windows XP
Points Points : 28900
# Likes # Likes : 0

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Belahzur on 8th January 2009, 10:34 pm

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Ad-Aware to remove spyware from your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Solved Re: troj/rustock

Post by Doctor Inferno on 2nd March 2009, 9:56 am

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.


Please be a GeekPolice fan on [You must be registered and logged in to see this link.]



Have we helped you? [You must be registered and logged in to see this link.] | Doctor by day, ninja by night.

Doctor Inferno
Administrator
Administrator

Posts Posts : 12015
Joined Joined : 2007-12-26
Gender Gender : Male
OS OS : Windows 7 Home Premium and Ultimate X64
Protection Protection : Kaspersky PURE and Malwarebytes' Anti-Malware
Points Points : 104610
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top


 
Permissions in this forum:
You cannot reply to topics in this forum