Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Log from Combofix. (Vondu.gen)


  • Please log in to reply

#1
Thecharmed

Thecharmed

    New Member

  • Member
  • Pip
  • 1 posts
Hello!

I've had the virus Vondu.gen in my laptop (vista) and it has been giving me a [bleep].
I ran Combofix and thought I'd post the log in here if someone could help me analyze it to see if the virus is gone?



Very thankful for your help :)

/Thecharmed


ComboFix 08-07-04.6 - Eva 2008-07-06 1:08:34.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1053.18.282 [GMT 2:00]
Running from: C:\Users\Eva\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Windows\Downloaded Program Files\setup.inf

.
((((((((((((((((((((((((( Files Created from 2008-06-05 to 2008-07-05 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-05 23:08 --------- d-----w C:\Program Files\ESET
2008-07-05 20:42 --------- d-----w C:\Program Files\Windows Live Safety Center
2008-07-05 19:18 --------- d-----w C:\ProgramData\Avira
2008-07-05 19:14 512,096 ----a-w C:\Windows\system32\drivers\amon.sys
2008-07-05 19:14 298,104 ----a-w C:\Windows\System32\imon.dll
2008-07-05 19:14 15,424 ----a-w C:\Windows\system32\drivers\nod32drv.sys
2008-07-04 22:02 --------- d-----w C:\Program Files\Sim File Maid 2
2008-07-04 20:27 --------- d-----w C:\Program Files\EA GAMES
2008-07-04 17:05 45,056 ----a-w C:\Windows\System32\acovcnt.exe
2008-07-04 16:12 0 ----a-w C:\ntuser.dat
2008-07-04 07:27 --------- d-----w C:\Program Files\LEGO Software
2008-07-04 07:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-04 07:24 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-07-04 07:24 --------- d-----w C:\Program Files\AVS4YOU
2008-07-02 18:30 --------- d-----w C:\Program Files\A8GSdsApp
2008-06-29 09:12 --------- d-----w C:\ProgramData\AVS4YOU
2008-06-28 21:04 --------- d-----w C:\Program Files\SOFTWIN
2008-06-26 20:22 --------- d-----w C:\Program Files\Sony
2008-06-26 20:21 --------- d-----w C:\Program Files\Vstplugins
2008-06-26 17:06 --------- d-----w C:\Program Files\THQ
2008-06-26 17:05 --------- d-----w C:\Users\Eva\AppData\Roaming\InstallShield
2008-06-23 14:51 --------- d-----w C:\Program Files\Nordic Softsales
2008-06-21 09:13 --------- d-----w C:\Program Files\Betsson Poker
2008-06-15 09:19 --------- d-----w C:\Program Files\Maxis
2008-06-14 09:29 --------- d-----w C:\Program Files\SpeedFan
2008-06-05 17:22 --------- d-----w C:\Program Files\Ubi Soft
2008-05-27 17:10 --------- d-----w C:\Users\Eva\AppData\Roaming\Systenance
2008-05-27 17:05 2,560 ----a-w C:\Windows\_MSRSTRT.EXE
2008-05-27 16:46 --------- d-----w C:\ProgramData\Microsoft Help
2008-05-23 12:42 --------- d-----w C:\Users\Eva\AppData\Roaming\Publish Providers
2008-05-23 12:38 --------- d-----w C:\Users\Eva\AppData\Roaming\Sony
2008-05-23 12:34 --------- d-----w C:\Program Files\Sony Setup
2008-05-21 15:18 --------- d-----w C:\ProgramData\phenomedia
2008-05-13 20:07 --------- d-----w C:\ProgramData\Lavasoft
2008-05-13 20:06 --------- d-----w C:\Program Files\Lavasoft
2008-05-13 20:05 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-10 19:54 --------- d-----w C:\Users\Eva\AppData\Roaming\mIRC
2006-11-02 12:50 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2006-11-02 14:35 1196032]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 21:35 90112]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-11-17 13:53 171464]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 14:36 201728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 11:31 630784]
"ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 17:27 61440]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-23 07:27 815104]
"ASUSTPE"="C:\Windows\system32\ASUSTPE.exe" [2006-12-13 00:06 106496]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 19:30 517768]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-10-19 21:16 286720]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-05 21:14 949376]
"RtHDVCpl"="RtHDVCpl.exe" [2007-02-15 11:07 4390912 C:\Windows\RtHDVCpl.exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2008-01-13 14:07:06 118784]

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\Windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Camera ScreenSaver]
--a------ 2007-10-18 19:21 37232 C:\Windows\ASScrProlog.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ASUS Screen Saver Protector]
--a------ 2007-10-18 19:21 33136 C:\Windows\ASScrPro.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--a------ 2007-03-26 20:42 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-26 21:12 161328 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerForPhone]
--a------ 2007-01-16 00:17 778240 C:\Program Files\PowerForPhone\PowerForPhone.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 07:28 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
--a------ 2007-10-18 18:41 1006264 C:\Program Files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{AD257559-67CB-419A-988C-064E5B8A8F39}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0D0B7190-50F9-4D4B-9027-7E1346101DB5}"= Profile=Public|C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{E099F628-F5D9-40F9-A227-9262DC8F0252}"= Disabled:C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"TCP Query User{3F81FB4C-C4C3-470F-A15D-6972F576BB2E}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{ADABEF65-0A47-4190-8512-893FE63BE0D9}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{CACCC67C-045A-4BBC-8701-921E78274938}C:\\program files\\mirc\\mirc.exe"= UDP:C:\program files\mirc\mirc.exe:mIRC
"UDP Query User{56B7A122-22B9-4562-82C3-DC22788D95FB}C:\\program files\\mirc\\mirc.exe"= TCP:C:\program files\mirc\mirc.exe:mIRC
"TCP Query User{C7E6FEB9-E85C-4626-8F3E-6D3F502236A3}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{81866429-B2CF-4537-90FB-41F38ED03CAE}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{F2C8454E-DE71-4621-8745-CAF16A22D385}C:\\program files\\dc++\\dcplusplus.exe"= UDP:C:\program files\dc++\dcplusplus.exe:DC++
"UDP Query User{2E8A0363-D818-4065-91E3-7ED93206F99E}C:\\program files\\dc++\\dcplusplus.exe"= TCP:C:\program files\dc++\dcplusplus.exe:DC++
"TCP Query User{B645A11A-1EDE-4DAB-AE77-D3BF097A348A}C:\\users\\eva\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= UDP:C:\users\eva\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe
"UDP Query User{A4A12411-F3C0-4FE5-B2F4-66A4C29F6A61}C:\\users\\eva\\appdata\\local\\yahoo!\\messenger for vista\\yahoo.messenger.ymapp.exe"= TCP:C:\users\eva\appdata\local\yahoo!\messenger for vista\yahoo.messenger.ymapp.exe:yahoo.messenger.ymapp.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\Windows\System32\StkCSrv.exe [2007-02-07 20:44]
R3 Atc002;NDIS Miniport Driver for Attansic L2 Fast Ethernet Controller;C:\Windows\system32\DRIVERS\L260x86.sys [2006-12-13 20:00]
R3 RTSTOR;USB Mass Storage Device;C:\Windows\system32\drivers\RTSTOR.SYS [2007-01-11 03:18]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\Windows\system32\Drivers\StkCMini.sys [2007-02-13 14:41]
S3 s816bus;Sony Ericsson Device 816 driver (WDM);C:\Windows\system32\DRIVERS\s816bus.sys [2007-06-19 09:51]
S3 s816mdfl;Sony Ericsson Device 816 USB WMC Modem Filter;C:\Windows\system32\DRIVERS\s816mdfl.sys [2007-06-19 09:51]
S3 s816mdm;Sony Ericsson Device 816 USB WMC Modem Driver;C:\Windows\system32\DRIVERS\s816mdm.sys [2007-06-19 09:51]
S3 s816mgmt;Sony Ericsson Device 816 USB WMC Device Management Drivers (WDM);C:\Windows\system32\DRIVERS\s816mgmt.sys [2007-06-19 09:51]
S3 s816nd5;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (NDIS);C:\Windows\system32\DRIVERS\s816nd5.sys [2007-06-19 09:51]
S3 s816obex;Sony Ericsson Device 816 USB WMC OBEX Interface;C:\Windows\system32\DRIVERS\s816obex.sys [2007-06-19 09:51]
S3 s816unic;Sony Ericsson Device 816 USB Ethernet Emulation SEMCMR7 (WDM);C:\Windows\system32\DRIVERS\s816unic.sys [2007-06-19 09:51]

*Newly Created Service* - CATCHME

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {6173A4FC-D42D-69A6-52CA-A30496389760} /qb
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-06 01:12:26
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-06 1:13:37
ComboFix-quarantined-files.txt 2008-07-05 23:13:33

Det går inte att hitta meddelandetexten för meddelandenumret 0x2379 i meddelandefilen för Application.
Post-Run: 22,549,262,336 byte ledigt

151 --- E O F --- 2007-11-19 14:42:08

Attached Files


Edited by Thecharmed, 05 July 2008 - 05:29 PM.

  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP