Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Virtumondo / vundo still in the system?


  • Please log in to reply

#1
zam72

zam72

    New Member

  • Member
  • Pip
  • 1 posts
I followed your instructions about cleaning stystem from vundo/virtumondo etc. trojans. However,
I don't understand a thing of these log files :whistling: . Is the system now clean or not? :blink:
Thanks in advance! :help:

VBG log


[08/17/2006, 23:36:28] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\Sami Niemelä\Työpöytä\VirtumundoBeGone.exe" )
[08/17/2006, 23:36:39] - Detected System Information:
[08/17/2006, 23:36:39] - Windows Version: 5.1.2600, Service Pack 2
[08/17/2006, 23:36:39] - Current Username: Sami Niemelä (Admin)
[08/17/2006, 23:36:39] - Windows is in NORMAL mode.
[08/17/2006, 23:36:39] - Searching for Browser Helper Objects:
[08/17/2006, 23:36:39] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/17/2006, 23:36:39] - BHO 2: {0A87E45F-537A-40B4-B812-E2544C21A09F} (SpywareBlock Class)
[08/17/2006, 23:36:39] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[08/17/2006, 23:36:39] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/17/2006, 23:36:39] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[08/17/2006, 23:36:39] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[08/17/2006, 23:36:39] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/17/2006, 23:36:39] - BHO 5: {8109959f-27a5-48f1-bd33-d2059fa1ead5} ()
[08/17/2006, 23:36:39] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/17/2006, 23:36:39] - Checking for HKLM\...\Winlogon\Notify\imaadcz
[08/17/2006, 23:36:39] - Found: HKLM\...\Winlogon\Notify\imaadcz - This is probably Virtumundo.
[08/17/2006, 23:36:39] - Assigning {8109959f-27a5-48f1-bd33-d2059fa1ead5} MSEvents Object
[08/17/2006, 23:36:39] - BHO list has been changed! Starting over...
[08/17/2006, 23:36:39] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/17/2006, 23:36:39] - BHO 2: {0A87E45F-537A-40B4-B812-E2544C21A09F} (SpywareBlock Class)
[08/17/2006, 23:36:39] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[08/17/2006, 23:36:39] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/17/2006, 23:36:39] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[08/17/2006, 23:36:39] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[08/17/2006, 23:36:39] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/17/2006, 23:36:39] - BHO 5: {8109959f-27a5-48f1-bd33-d2059fa1ead5} (MSEvents Object)
[08/17/2006, 23:36:39] - ALERT: Found MSEvents Object!
[08/17/2006, 23:36:39] - BHO 6: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/17/2006, 23:36:39] - Finished Searching Browser Helper Objects
[08/17/2006, 23:36:39] - *** Detected MSEvents Object
[08/17/2006, 23:36:40] - Trying to remove MSEvents Object...
[08/17/2006, 23:36:41] - Terminating Process: IEXPLORE.EXE
[08/17/2006, 23:38:04] - Terminating Process: RUNDLL32.EXE
[08/17/2006, 23:38:04] - Disabling Automatic Shell Restart
[08/17/2006, 23:38:04] - Terminating Process: EXPLORER.EXE
[08/17/2006, 23:38:05] - Suspending the NT Session Manager System Service
[08/17/2006, 23:38:05] - Terminating Windows NT Logon/Logoff Manager
[08/17/2006, 23:38:06] - Re-enabling Automatic Shell Restart
[08/17/2006, 23:38:06] - File to disable: C:\WINDOWS\system32\imaadcz.dll
[08/17/2006, 23:38:06] - Removing HKLM\...\Browser Helper Objects\{8109959f-27a5-48f1-bd33-d2059fa1ead5}
[08/17/2006, 23:38:06] - Removing HKCR\CLSID\{8109959f-27a5-48f1-bd33-d2059fa1ead5}
[08/17/2006, 23:38:06] - Adding Kill Bit for ActiveX for GUID: {8109959f-27a5-48f1-bd33-d2059fa1ead5}
[08/17/2006, 23:38:06] - Deleting ATLEvents/MSEvents Registry entries
[08/17/2006, 23:38:06] - Removing HKLM\...\Winlogon\Notify\imaadcz
[08/17/2006, 23:38:06] - Searching for Browser Helper Objects:
[08/17/2006, 23:38:06] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (AcroIEHlprObj Class)
[08/17/2006, 23:38:06] - BHO 2: {0A87E45F-537A-40B4-B812-E2544C21A09F} (SpywareBlock Class)
[08/17/2006, 23:38:06] - BHO 3: {53707962-6F74-2D53-2644-206D7942484F} ()
[08/17/2006, 23:38:06] - WARNING: BHO has no default name. Checking for Winlogon reference.
[08/17/2006, 23:38:07] - Checking for HKLM\...\Winlogon\Notify\SDHelper
[08/17/2006, 23:38:07] - Key not found: HKLM\...\Winlogon\Notify\SDHelper, continuing.
[08/17/2006, 23:38:07] - BHO 4: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[08/17/2006, 23:38:07] - BHO 5: {AA58ED58-01DD-4d91-8333-CF10577473F7} (Google Toolbar Helper)
[08/17/2006, 23:38:07] - Finished Searching Browser Helper Objects
[08/17/2006, 23:38:07] - Finishing up...
[08/17/2006, 23:38:07] - A restart is needed.
[08/17/2006, 23:38:19] - Attempting to Restart via STOP error (Blue Screen!)

Hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 23:59:00, on 17.8.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe
C:\Program Files\Norman\NPF\NPFSVICE.EXE
C:\Norman\Bin\Zanda.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Norman\bin\NJEEVES.EXE
C:\Norman\Nvc\BIN\NVCSCHED.EXE
C:\Norman\Nvc\bin\nvcoas.exe
C:\Norman\Nvc\BIN\nipsvc.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\system32\UMonit.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Power Manager\PM.exe
C:\Norman\bin\ZLH.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norman\NPF\NPFMSG.EXE
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Norman\Nvc\BIN\NIP.EXE
C:\Program Files\Trillian\trillian.exe
C:\Norman\Nvc\bin\cclaw.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sami Niemelä\Työpöytä\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Linkit
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher 2006\SCActiveBlock.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [High Definition Audio -ominaisuussivun pikakuvake] HDAShCut.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [UMonit] C:\WINDOWS\system32\UMonit.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [PowerManager] C:\Program Files\Power Manager\PM.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Norman ZANDA] C:\Norman\bin\ZLH.EXE /LOAD /SPLASH
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SpyCatcher Reminder] "C:\Program Files\SpyCatcher 2006\SpyCatcher.exe" reminder
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: NPF Messenger.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher 2006\Protector.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Vie Microsoft E&xceliin - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Oheistiedot - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @c:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://downloadcente...trolLite_EN.cab
O16 - DPF: {4E8A3661-FB5B-4AEF-BF60-B0E9712FAE49} (Silverwire Image Uploader 3.0 Control) - http://htmlupload.si...geUploader3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1155761360875
O20 - AppInit_DLLs: interceptor.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MSSQL$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlservr.exe" -sMICROSOFTSMLBIZ (file missing)
O23 - Service: Norman API-hooking helper (NipSvc) - Unknown owner - C:\Norman\Nvc\BIN\nipsvc.exe
O23 - Service: Norman NJeeves - Unknown owner - C:\Norman\bin\NJEEVES.EXE
O23 - Service: Norman Type-R - Unknown owner - C:\Program Files\Norman\NPF\NPFSVICE.EXE
O23 - Service: Norman ZANDA - Unknown owner - C:\Norman\Bin\Zanda.exe
O23 - Service: Norman Virus Control on-access component (nvcoas) - Norman ASA - C:\Norman\Nvc\bin\nvcoas.exe
O23 - Service: Norman Virus Control Scheduler (NVCScheduler) - Norman Data Defense Systems - C:\Norman\Nvc\BIN\NVCSCHED.EXE
O23 - Service: SQLAgent$MICROSOFTSMLBIZ - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTSMLBIZ\Binn\sqlagent.EXE" -i MICROSOFTSMLBIZ (file missing)
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP