Infected DLL files

View previous topic View next topic Go down

Infected DLL files

Post by Relco on Sun Apr 26, 2009 12:45 pm

Its been a few days that i have been infected. I usually get redirects when browsing the internet, pop ups and my computer is just a bit slower. Spyware doctor has been giving me warnings that various DLL files are trying to send information off my computer, which i have been blocking.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:35:25 PM, on 4/26/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Advanced System Optimizer\startUp manager.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: 82.98.231.89 url.adtrgt.com
O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - C:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {e563148f-ca57-4c49-83a9-975481f4e94d} - C:\WINDOWS\system32\pozimadu.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [TrayServer] C:\Program Files\MAGIX\Movie_Edit_Pro_14_PLUS_Download_version\TrayServer.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [togorutabi] Rundll32.exe "C:\WINDOWS\system32\sojamuli.dll",s
O4 - HKLM\..\Run: [CPM3be3ee30] Rundll32.exe "c:\windows\system32\yasasoya.dll",a
O4 - HKLM\..\Run: [38d0ddac] rundll32.exe "C:\WINDOWS\system32\lakayepo.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Startup Manager] "C:\Program Files\Advanced System Optimizer\startUp manager.exe"
O4 - HKCU\..\Run: [IDMan] C:\Program Files\Internet Download Manager\IDMan.exe /onboot
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Samsung.PCSync] C:\Program Files\Samsung\Samsung PC Studio 7\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')
O8 - Extra context menu item: Append to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - [You must be registered and logged in to see this link.] Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Download all links with IDM - C:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - C:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - C:\Program Files\Internet Download Manager\IEExt.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Edit with Altova X&MLSpy - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.7.0\bin\ssv.dll
O9 - Extra button: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra 'Tools' menuitem: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - [You must be registered and logged in to see this link.]
O20 - AppInit_DLLs: C:\WINDOWS\system32\zokelika.dll c:\windows\system32\yasasoya.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: eXist Native XML Database (eXist) - Unknown owner - C:\Program Files\eXist\tools\wrapper\bin\wrapper.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: MCPop3 Service (MCPop3) - Macallan Applications - C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
O23 - Service: MCSmtp Service (MCSmtp) - Macallan Applications - C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: ThreatFire - PC Tools - C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 12321 bytes

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Belahzur on Sun Apr 26, 2009 1:01 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O1 - Hosts: 82.98.231.89 url.adtrgt.com
    O1 - Hosts: 82.98.231.89 googleads2.gdoubleclick.net
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: (no name) - {e563148f-ca57-4c49-83a9-975481f4e94d} - C:\WINDOWS\system32\pozimadu.dll (file missing)
    O4 - HKLM\..\Run: [togorutabi] Rundll32.exe "C:\WINDOWS\system32\sojamuli.dll",s
    O4 - HKLM\..\Run: [CPM3be3ee30] Rundll32.exe "c:\windows\system32\yasasoya.dll",a
    O4 - HKLM\..\Run: [38d0ddac] rundll32.exe "C:\WINDOWS\system32\lakayepo.dll",b
    O20 - AppInit_DLLs: C:\WINDOWS\system32\zokelika.dll c:\windows\system32\yasasoya.dll
    O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll
    O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\yasasoya.dll


  • Press "Fix Checked"
  • Close Hijack This.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Infected DLL files

Post by Relco on Sun Apr 26, 2009 1:28 pm

Malwarebytes' Anti-Malware 1.36
Database version: 2043
Windows 5.1.2600 Service Pack 3

4/26/2009 2:14:34 PM
mbam-log-2009-04-26 (14-14-34).txt

Scan type: Quick Scan
Objects scanned: 87871
Time elapsed: 3 minute(s), 3 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 7
Registry Values Infected: 6
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 32

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\lakayepo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zokelika.dll (Trojan.Vundo.H) -> Delete on reboot.
c:\WINDOWS\system32\yasasoya.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sojamuli.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e563148f-ca57-4c49-83a9-975481f4e94d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{e563148f-ca57-4c49-83a9-975481f4e94d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\dslcnnct (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cpm3be3ee30 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\togorutabi (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{ec43e3fd-5c60-46a6-97d7-e0b85dbdd6c4} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ssodl (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Manager (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ForceClassicControlPanel (Hijack.ControlPanelStyle) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\zokelika.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\zokelika.dll -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Trojan.Vundo.H) -> Data: c:\windows\system32\yasasoya.dll -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\boheyuje.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ejuyehob.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jaguwuyi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\iyuwugaj.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\jefosodi.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\idosofej.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lakayepo.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\opeyakal.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\liwinise.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\esiniwil.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sutesuji.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ijusetus.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\yasasoya.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\sojamuli.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\zokelika.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\gavomiwi.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\hofegope.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\muwuhare.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nipujija.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\perapola.dll.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\piditupu.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayogoga.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rayohupo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sigowoto.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sihivubo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tavuhefo.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tomuzipu.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\witagita.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\woyohipo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\yamanewa.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Advanced System Optimizer\startUp manager.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vuwizodi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Relco on Sun Apr 26, 2009 1:29 pm

i performed a second search and 0 files were detected
does this mean im now clean??

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Belahzur on Sun Apr 26, 2009 1:39 pm


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Save the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Infected DLL files

Post by Relco on Sun Apr 26, 2009 1:47 pm

DDS (Ver_09-03-16.01) - NTFSx86
Run by Administrator at 14:45:18.50 on Sun 04/26/2009
Internet Explorer: 8.0.6001.18241 BrowserJavaVersion: 1.7.0
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.972 [GMT 1:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCPop3.exe
C:\Program Files\Macallan\Macallan Mail Solution\MCSmtp.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Download Manager\IDMan.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Spyware Doctor\TFEngine\TFService.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
BHO: IDMIEHlprObj Class: {0055c089-8582-441b-a0bf-17b458c2a3a8} - c:\program files\internet download manager\IDMIECC.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.7.0\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: FlashFXP Helper for Internet Explorer: {e5a1691b-d188-4419-ad02-90002030b8ee} - c:\progra~1\flashfxp\IEFlash.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [nodenable] c:\program files\eset\nodenable.exe
uRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
uRun: [Uniblue RegistryBooster 2] c:\program files\uniblue\registrybooster 2\RegistryBooster.exe /S
mRun: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\stsystra.exe
mRun: [IntelZeroConfig] c:\program files\intel\wireless\bin\ZCfgSvc.exe
mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\cli.exe" runtime -Delay
mRun: [TrayServer] c:\program files\magix\movie_edit_pro_14_plus_download_version\TrayServer.exe
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
dRun: [Samsung.PCSync] c:\program files\samsung\samsung pc studio 7\PcSync2.exe /NoDialog
dRun: [IDMan] c:\program files\internet download manager\IDMan.exe /onboot
dRunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
uPolicies-explorer: NoResolveTrack = 1 (0x1)
uPolicies-explorer: NoInstrumentation = 1 (0x1)
uPolicies-explorer: NoSMMyPictures = 1 (0x1)
uPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
mPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1)
mPolicies-system: DisableCAD = 1 (0x1)
dPolicies-explorer: NoSMHelp = 1 (0x1)
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
dPolicies-explorer: NoResolveTrack = 1 (0x1)
dPolicies-explorer: NoInstrumentation = 1 (0x1)
dPolicies-explorer: NoSMMyPictures = 1 (0x1)
dPolicies-explorer: NoSMConfigurePrograms = 1 (0x1)
IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Download all links with IDM - c:\program files\internet download manager\IEGetAll.htm
IE: Download FLV video content with IDM - c:\program files\internet download manager\IEGetVL.htm
IE: Download with IDM - c:\program files\internet download manager\IEExt.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: Edit with Altova X&MLSpy - c:\program files\altova\xmlspy2008\spy.htm
IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2008\spy.htm
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBC} - c:\program files\java\jre1.7.0\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0017-0000-0000-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
Notify: AtiExtEvent - Ati2evxx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
20 ===============

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Relco on Sun Apr 26, 2009 1:48 pm

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\dwu1mk3w.default\
FF - component: c:\documents and settings\administrator\application data\idm\idmmzcc2\components\idmmzcc.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava11.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava12.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava13.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava14.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjava32.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npjpi170.dll
FF - plugin: c:\program files\java\jre1.7.0\bin\npoji610.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin2.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin3.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin4.dll
FF - plugin: c:\program files\pure codec\plugins\npqtplugin5.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nppl3260.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nprjplug.dll
FF - plugin: c:\program files\pure codec\real\netscape6\nprpjplug.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-17 64160]
R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-4-18 130424]
R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2009-4-18 51520]
R0 TfSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2009-4-18 38208]
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2009-4-18 159600]
R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-2-6 727720]
R2 MCPop3;MCPop3 Service;c:\program files\macallan\macallan mail solution\MCPop3.exe [2008-8-16 1302528]
R2 MCSmtp;MCSmtp Service;c:\program files\macallan\macallan mail solution\MCSmtp.exe [2008-8-16 1212416]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-4-18 348752]
R2 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-4-18 1095560]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-4-26 38496]
R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2009-4-18 64392]
R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2009-4-18 33088]
R3 ThreatFire;ThreatFire;c:\program files\spyware doctor\tfengine\tfservice.exe service --> c:\program files\spyware doctor\tfengine\TFService.exe service [?]
S2 EFix33;Nod32 AV;c:\windows\regedit.exe [2008-4-14 146432]
S2 eXist;eXist Native XML Database;c:\program files\exist\tools\wrapper\bin\wrapper.exe [2008-11-24 204800]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2008-11-2 1527900]
S3 nmwcdsa;Samsung USB Phone Parent;c:\windows\system32\drivers\nmwcdsa.sys [2008-10-16 135680]
S3 nmwcdsac;Samsung USB Generic;c:\windows\system32\drivers\nmwcdsac.sys [2008-10-16 8320]
S3 nmwcdsacj;Samsung USB Port;c:\windows\system32\drivers\nmwcdsacj.sys [2008-10-16 12288]
S3 nmwcdsacm;Samsung USB Modem;c:\windows\system32\drivers\nmwcdsacm.sys [2008-10-16 12288]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-1-26 280344]
S4 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951632]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\microsoft visual studio 8\common7\ide\remote debugger\x86\msvsmon.exe [2005-9-23 2799808]

=============== Created Last 30 ================

2009-04-26 14:10 --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-04-26 14:10 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-26 14:10 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-26 14:10 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-04-26 14:10 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-04-26 13:35 --d----- c:\program files\Trend Micro
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\vorehuye.dll
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\lugapeda.exe
2009-04-25 17:41 2,713 ---sh--- c:\windows\system32\yasabetu.dll
2009-04-24 01:02 1,398,310 ---sh--- c:\windows\system32\uguziwub.ini
2009-04-23 01:02 121 ---sh--- c:\windows\system32\avevubuf.ini
2009-04-22 13:01 121 ---sh--- c:\windows\system32\itibuver.ini
2009-04-21 13:01 121 ---sh--- c:\windows\system32\avihimip.ini
2009-04-21 01:00 121 ---sh--- c:\windows\system32\etolaweh.ini
2009-04-20 01:00 121 ---sh--- c:\windows\system32\ahidoviv.ini
2009-04-19 13:00 121 ---sh--- c:\windows\system32\adunojol.ini
2009-04-19 01:03 1,400,655 ---sh--- c:\windows\system32\awekotuz.ini
2009-04-18 10:33 38,208 a------- c:\windows\system32\drivers\TfSysMon.sys
2009-04-18 10:33 33,088 a------- c:\windows\system32\drivers\TfNetMon.sys
2009-04-18 10:33 12,608 a------- c:\windows\system32\drivers\TfKbMon.sys
2009-04-18 10:33 51,520 a------- c:\windows\system32\drivers\TfFsMon.sys
2009-04-18 10:30 --d----- c:\windows\system32\oobe
2009-04-18 10:30 --d----- c:\windows\srchasst
2009-04-18 10:30 --d----- c:\windows\system32\xircom
2009-04-18 10:30 --d----- c:\program files\common files\speechengines
2009-04-18 10:30 --d----- c:\windows\system32\inetsrv
2009-04-18 10:30 --d----- c:\windows\system32\ime
2009-04-18 10:30 --d----- c:\program files\msn gaming zone
2009-04-18 10:19 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-04-18 10:18 130,424 a------- c:\windows\system32\drivers\PCTCore.sys
2009-04-18 10:18 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-04-18 10:18 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-04-18 10:18 --d----- c:\program files\common files\PC Tools
2009-04-18 10:18 --d----- c:\program files\Spyware Doctor
2009-04-18 10:18 --d----- c:\docume~1\alluse~1\applic~1\PC Tools
2009-04-18 10:18 --d----- c:\docume~1\admini~1\applic~1\PC Tools
2009-04-18 01:00 1,400,642 ---sh--- c:\windows\system32\erajozez.ini
2009-04-17 14:57 15,688 a------- c:\windows\system32\lsdelete.exe
2009-04-17 14:15 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-04-17 14:14 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-17 14:14 --d----- c:\program files\Lavasoft
2009-04-16 19:30 676,224 a------- c:\windows\system32\OGACheckControl.dll
2009-04-06 16:34 --d----- c:\docume~1\admini~1\applic~1\WinShell
2009-04-06 16:34 --d----- c:\program files\WinShell
2009-04-06 16:12 --d----- c:\docume~1\admini~1\applic~1\WinEdt
2009-04-06 16:11 --d----- c:\program files\WinEdt Team
2009-04-06 13:08 --d----- c:\docume~1\alluse~1\applic~1\MiKTeX
2009-04-06 13:01 --d----- c:\program files\MiKTeX 2.7
2009-04-06 12:44 --d----- C:\tex
2009-04-06 12:22 38,297 a------- c:\windows\system32\testpostprinter
2009-04-06 12:21 13,492 a------- c:\windows\system32\defprtr2.ppd
2009-04-03 18:21 --d----- C:\New Folder (2)
2009-04-03 18:20 --d----- C:\Setup
2009-03-30 20:09 --d----- c:\documents and settings\administrator\.eclipse
2009-03-29 23:12 --d----- C:\tc
2009-03-29 22:54 --d----- c:\program files\CVS Suite
2009-03-29 22:54 --d----- c:\program files\common files\March Hare Software Ltd

==================== Find3M ====================

2009-04-26 13:10 51,712 a--sh--- c:\windows\system32\gijiyeli.exe
2009-04-25 22:05 189,072 a------- c:\windows\system32\PnkBstrB.exe
2009-04-25 21:01 138,920 ac------ c:\windows\system32\drivers\PnkBstrK.sys
2009-04-25 13:28 98,304 a------- c:\windows\DUMP3846.tmp
2009-04-24 01:02 87,552 a--sh--- c:\windows\system32\yujolisa.dll
2009-04-23 13:47 98,304 a------- c:\windows\DUMP3c3d.tmp
2009-04-23 02:17 98,304 a------- c:\windows\DUMP41eb.tmp
2009-04-23 01:01 88,576 a--sh--- c:\windows\system32\mapagomu.dll
2009-04-22 13:01 88,576 a--sh--- c:\windows\system32\dekevimi.dll
2009-04-22 01:01 88,576 a--sh--- c:\windows\system32\yopufuju.dll
2009-04-22 01:01 51,200 a--sh--- c:\windows\system32\gujayiwo.exe
2009-04-21 13:01 87,552 a--sh--- c:\windows\system32\yinesuyi.dll
2009-04-21 13:01 50,688 a--sh--- c:\windows\system32\dagubawe.exe
2009-04-21 01:00 87,040 a--sh--- c:\windows\system32\sofefujo.dll
2009-04-20 13:00 87,040 a--sh--- c:\windows\system32\huwifibe.dll
2009-04-20 01:00 87,040 a--sh--- c:\windows\system32\jubateya.dll
2009-04-19 13:00 87,040 a--sh--- c:\windows\system32\kozewepu.dll
2009-04-19 01:03 87,040 a--sh--- c:\windows\system32\forareri.dll
2009-04-18 00:59 87,040 a--sh--- c:\windows\system32\yiyobuye.dll
2009-04-17 12:59 87,552 a--sh--- c:\windows\system32\wilawape.dll
2009-03-02 02:56 4,608 a------- c:\windows\system32\w95inf32.dll
2009-03-02 02:56 2,272 a------- c:\windows\system32\w95inf16.dll
2009-02-28 19:15 75,064 a------- c:\windows\system32\PnkBstrA.exe
2008-12-11 00:43 22,328 a------- c:\docume~1\admini~1\applic~1\PnkBstrK.sys
2008-11-02 02:26 75 -c-shr-- c:\windows\ICMET20.BIN

============= FINISH: 14:45:56.

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Belahzur on Sun Apr 26, 2009 2:14 pm

Still some vundo to get rid of.

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\windows\system32\vorehuye.dll
    c:\windows\system32\lugapeda.exe
    c:\windows\system32\yasabetu.dll
    c:\windows\system32\uguziwub.ini
    c:\windows\system32\avevubuf.ini
    c:\windows\system32\itibuver.ini
    c:\windows\system32\avihimip.ini
    c:\windows\system32\etolaweh.ini
    c:\windows\system32\ahidoviv.ini
    c:\windows\system32\adunojol.ini
    c:\windows\system32\awekotuz.ini
    c:\windows\system32\erajozez.ini
    c:\windows\system32\gijiyeli.exe
    c:\windows\DUMP3846.tmp
    c:\windows\system32\yujolisa.dll
    c:\windows\DUMP3c3d.tmp
    c:\windows\DUMP41eb.tmp
    c:\windows\system32\mapagomu.dll
    c:\windows\system32\dekevimi.dll
    c:\windows\system32\yopufuju.dll
    c:\windows\system32\gujayiwo.exe
    c:\windows\system32\yinesuyi.dll
    c:\windows\system32\dagubawe.exe
    c:\windows\system32\sofefujo.dll
    c:\windows\system32\huwifibe.dll
    c:\windows\system32\jubateya.dll
    c:\windows\system32\kozewepu.dll
    c:\windows\system32\forareri.dll
    c:\windows\system32\yiyobuye.dll
    c:\windows\system32\wilawape.dll
    C:\Documents and Settings\Administrator\Desktop\dds.scr


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Infected DLL files

Post by Relco on Sun Apr 26, 2009 2:34 pm

========== FILES ==========
LoadLibrary failed for c:\windows\system32\vorehuye.dll
c:\windows\system32\vorehuye.dll NOT unregistered.
c:\windows\system32\vorehuye.dll moved successfully.
c:\windows\system32\lugapeda.exe moved successfully.
LoadLibrary failed for c:\windows\system32\yasabetu.dll
c:\windows\system32\yasabetu.dll NOT unregistered.
c:\windows\system32\yasabetu.dll moved successfully.
c:\windows\system32\uguziwub.ini moved successfully.
c:\windows\system32\avevubuf.ini moved successfully.
c:\windows\system32\itibuver.ini moved successfully.
c:\windows\system32\avihimip.ini moved successfully.
c:\windows\system32\etolaweh.ini moved successfully.
c:\windows\system32\ahidoviv.ini moved successfully.
c:\windows\system32\adunojol.ini moved successfully.
c:\windows\system32\awekotuz.ini moved successfully.
c:\windows\system32\erajozez.ini moved successfully.
c:\windows\system32\gijiyeli.exe moved successfully.
c:\windows\DUMP3846.tmp moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yujolisa.dll
c:\windows\system32\yujolisa.dll NOT unregistered.
c:\windows\system32\yujolisa.dll moved successfully.
c:\windows\DUMP3c3d.tmp moved successfully.
c:\windows\DUMP41eb.tmp moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\mapagomu.dll
c:\windows\system32\mapagomu.dll NOT unregistered.
c:\windows\system32\mapagomu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\dekevimi.dll
c:\windows\system32\dekevimi.dll NOT unregistered.
c:\windows\system32\dekevimi.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yopufuju.dll
c:\windows\system32\yopufuju.dll NOT unregistered.
c:\windows\system32\yopufuju.dll moved successfully.
c:\windows\system32\gujayiwo.exe moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yinesuyi.dll
c:\windows\system32\yinesuyi.dll NOT unregistered.
c:\windows\system32\yinesuyi.dll moved successfully.
c:\windows\system32\dagubawe.exe moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\sofefujo.dll
c:\windows\system32\sofefujo.dll NOT unregistered.
c:\windows\system32\sofefujo.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\huwifibe.dll
c:\windows\system32\huwifibe.dll NOT unregistered.
c:\windows\system32\huwifibe.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\jubateya.dll
c:\windows\system32\jubateya.dll NOT unregistered.
c:\windows\system32\jubateya.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\kozewepu.dll
c:\windows\system32\kozewepu.dll NOT unregistered.
c:\windows\system32\kozewepu.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\forareri.dll
c:\windows\system32\forareri.dll NOT unregistered.
c:\windows\system32\forareri.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yiyobuye.dll
c:\windows\system32\yiyobuye.dll NOT unregistered.
c:\windows\system32\yiyobuye.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\wilawape.dll
c:\windows\system32\wilawape.dll NOT unregistered.
c:\windows\system32\wilawape.dll moved successfully.
C:\Documents and Settings\Administrator\Desktop\dds.scr moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04262009_153347

Relco
Novice
Novice

Posts Posts : 6
Joined Joined : 2009-04-26
OS OS : Windows XP
Points Points : 27798
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Infected DLL files

Post by Belahzur on Sun Apr 26, 2009 2:39 pm

We can remove OTMoveIt now.

  • Please double-click OTMoveIt3.exe to run it again.
  • Press the green CleanUp! button.
  • Press Yes cleanup process prompt, do the same for the reboot prompt.
How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245049
# Likes # Likes : 1

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum