Register   FAQ   Login  

HJT log Dennis





AddThis Social Bookmark Button AddThis Feed Button

       2-spyware forum index -> HijackThis log analysis
Author Message
djmsmit



Joined: 28 Jan 2008
Posts: 4

Post Post subject: HJT log Dennis Reply with quote

Pretty messed up. Vundo, I think. New symptoms today were changed login at startup windows

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:24:59, on 28-1-2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\PackethSvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
c:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
C:\Program Files\CA\eTrust Antivirus\InoRT.exe
C:\Program Files\CA\eTrust Antivirus\InoTask.exe
c:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Dit.exe
C:\WINDOWS\CNYHKey.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\ctfmon .exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\CA\SHARED~1\SCANEN~1\InoDist.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.schmitzl.nl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Koppelingen
O1 - Hosts: 82.99.19.11 download.lavasoft.de.edgesuite.net
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Dit] Dit.exe
O4 - HKLM\..\Run: [ledpointer] CNYHKey.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [Realtime Monitor] C:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [08ac1c2a] rundll32.exe "C:\WINDOWS\system32\cetuwuuo.dll",b
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [iDailyDiary] C:\PROGRA~1\UTILIT~1\IDAILY~1\iDD.exe /LOGMIN
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [BloglinesNotifier] C:\Program Files\Bloglines Notifier\Notifier .exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-541106735-1600523749-893359863-1008\..\Run: [iDailyDiary] C:\PROGRA~1\UTILIT~1\IDAILY~1\iDD.exe /LOGMIN (User '?')
O4 - HKUS\S-1-5-21-541106735-1600523749-893359863-1008\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')
O4 - HKUS\S-1-5-21-541106735-1600523749-893359863-1008\..\Run: [BloglinesNotifier] C:\Program Files\Bloglines Notifier\Notifier .exe (User '?')
O4 - HKUS\S-1-5-21-541106735-1600523749-893359863-1008\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [Spyware Doctor] (User '?')
O4 - HKUS\.DEFAULT\..\Run: [Spyware Doctor] (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open with Scansoft PDF Converter 3.0 - res://C:\Program Files\Utilities\Scansoft PDF\IEShellExt.dll /100
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~1\tools\iesdpb.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus-en/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{5BF57D0A-A871-49FE-9C5E-6362E4695E4D}: NameServer = 192.168.1.1
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Utilities\Foto\Photoshop elements 3.0\PhotoshopElementsFileAgent.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\UTILIT~1\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\UTILIT~1\AVG7\avgupsvc.exe
O23 - Service: CA License Client (CA_LIC_CLNT) - Computer Associates International Inc. - c:\Program Files\CA\SharedComponents\CA_LIC\lic98rmt.exe
O23 - Service: CA License Server (CA_LIC_SRVR) - Computer Associates International Inc. - c:\Program Files\CA\SharedComponents\CA_LIC\lic98rmtd.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\Utilities\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: eTrust Antivirus Admin Server (InoNmSrv) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoNmSrv.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - C:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod-service (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: License Management Service ESD - element5 - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe
O23 - Service: Event Log Watch (LogWatch) - Computer Associates - c:\Program Files\CA\SharedComponents\CA_LIC\LogWatNT.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Virtual NIC Service (PackethSvc) - America Online, Inc. - C:\WINDOWS\system32\PackethSvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools - C:\Program Files\Spyware Doctor\sdhelp.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Unknown owner - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (file missing)
O23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe

--
End of file - 8308 bytes
Mon Jan 28, 2008 7:13 pm
Back to top
djmsmit View user's profile Send private message
 
Bobby



Joined: 03 May 2006
Posts: 218

Post Post subject: Reply with quote

hello there,
i've deleted another topic created by you as it was identical to this one. i wonder if you have tried running anti spyware scan. if you had, try vundo removal as well. and if you hadn't, try anti spyware.
_________________
I reccomend spyware doctor and malware bytes as ultimate protection.
Tue Jan 29, 2008 7:26 am
Back to top
Bobby View user's profile Send private message
 
djmsmit



Joined: 28 Jan 2008
Posts: 4

Post Post subject: Removal Reply with quote

Hi Bobby,

Thanks for your reply. I've been scanning forums for ways to remove Vunda. Used Vundafix a couple of time (removal was temporary), Super Antispyware, AVG spyware, spyware doctor etc. Even tried removing corresponding entries in my hijack report. It all seems to return as soon as I restart. At this moment Vundofix won't even start due to an error messages (RPC server unavailable).

The last couple of days the situation seems to get even worse. The look of the desktop starts to change (background image disappeared) and yesterday a windows login screen appeared (I normally don't use that).

My system is very hard to boot in safe mode. When I try to do this a lot of fast (unreadable) messages appear in the black startup screen followed by two messages stating I can cancel the loading of certain files (.sys). If I don't do that, the system shuts down before completely booting.

Last night I ran Super Antispyware. Very slow process; pc is really slowing down. This morning I found about 65 infections of which many were Vundo. After reboot the mllml.exe process was running again....

Hope you can help.

Thanks.

Dennis
Tue Jan 29, 2008 2:34 pm
Back to top
djmsmit View user's profile Send private message
 
Bobby



Joined: 03 May 2006
Posts: 218

Post Post subject: Reply with quote

hello again,
i see that your situation is more serious than i thought. this infection might be some kind of virus, i suggest you try virus scan as well. i also recommend these safe mode instructions.
_________________
I reccomend spyware doctor and malware bytes as ultimate protection.
Wed Jan 30, 2008 7:31 am
Back to top
Bobby View user's profile Send private message
 
djmsmit



Joined: 28 Jan 2008
Posts: 4

Post Post subject: Viruses Reply with quote

Hi Bobby,

I too think this is a little heavier than just some spyware. I'll try your virus scan and check your safe mode info.

Yesterday I noticed that it's sometimes impossible to install programs or delete them; the Windows installer proces seems damaged and I can't get it to work.

You reckon it might be better to do a recovery (got recovery disc that came with pc and the hard drive holds a partition with files that should set windows back to original - don't know if that works yet) or a disc format? If so, do you you have instructions at hand for doing recovery like that (do's and don'ts)?

Thanks

Dennis
Wed Jan 30, 2008 10:16 am
Back to top
djmsmit View user's profile Send private message
 
Bobby



Joined: 03 May 2006
Posts: 218

Post Post subject: Reply with quote

hi,
sorry i can't give you an advice on recovery versus disc format. if the other methods doesn't work i would format the disc if i were you, but it's your call not mine. please post new hijackthis log under new topic, and HJT Analyzer will give you some tips.
_________________
I reccomend spyware doctor and malware bytes as ultimate protection.
Thu Jan 31, 2008 8:42 am
Back to top
Bobby View user's profile Send private message
 
djmsmit



Joined: 28 Jan 2008
Posts: 4

Post Post subject: Recovery Reply with quote

Hi Bobby,

Situation got hopeless. I successfully ran a recovery that should free me from Vundo - I hope.

Thanks for your help so far!

Dennis
Sat Feb 02, 2008 9:51 am
Back to top
djmsmit View user's profile Send private message
 
Bobby



Joined: 03 May 2006
Posts: 218

Post Post subject: Reply with quote

well at least your computer is clean now. if you need our help in a future - feel free to post Wink
_________________
I reccomend spyware doctor and malware bytes as ultimate protection.
Mon Feb 04, 2008 7:20 am
Back to top
Bobby View user's profile Send private message
 
       2-spyware forum index -> HijackThis log analysis All times are GMT
Page 1 of 1

 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




Recommended software:
Spyware Doctor
(91/100)
Spyware Doctor is a very powerful, but yet highly user-friendly spyware remover, made by PC Tools, reputable computer security experts. This product provides effective and easy-to-manage...
SUPERAntiSpyware
(89/100)
SUPERAntiSpyware is a powerful, highly effective spyware remover introducing advanced parasite detection and removal features along with reliable real-time protection. The program is not...
CounterSpy
(85/100)
CounterSpy is a powerful spyware remover based on revolutionary hybrid engine, which incorporates traditional anti-spyware and advanced antivirus engines. Such combination allows CounterSpy...
Malwarebytes Anti Malware
(75/100)
There are loads of malware removers on the net today and most of them are lightweight applications, which usually means they’re fast and don’t have many features. One such...
Windows Defender
(75/100)
Windows Defender is a free anti-spyware program made by the leading software company to add native spyware protection to its most popular product - the Microsoft Windows operating...
Encyclopedia of parasites: