Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

win32.trojan.agent.cs - lots of fun for everyone? [CLOSED]

Started by stoutie , Jun 08 2005 09:31 AM

  • This topic is locked This topic is locked

#16
ScHwErV
Posted 15 June 2005 - 07:00 PM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Sure, go right after it.

Let me know what works so I can keep notes for later infections that we run across ;)

ScHwErV :tazz:
  • 0

Advertisements

#17
stoutie
Posted 16 June 2005 - 12:46 AM

stoutie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
:tazz:

Hey ScHwErV - unfortunately still no joy!

1. Tried to delete the 'criminal' file - and it said it was in use by another person or process
2. tried to remove again with killbox & hijack this but still on the system

woe is me?

Thanks for your guidance - appreciated! :tazz: ;) ;)

Logfile of HijackThis v1.99.1
Scan saved at 07:43:57, on 16/06/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\CardReader2.0\OTiReader.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
C:\Program Files\CardReader2.0\CRBroadCasting.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\IAN\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell...gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/broadband
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ntlworld.com/broadband
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Tiscali
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\mfcurl.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [Dell AIO Printer A920] "C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [CRBroadCasting] C:\Program Files\CardReader2.0\CRBroadCasting.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .mov: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O12 - Plugin for .mp3: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.tiscali.co.uk
O16 - DPF: ppctlcab - http://www.pestscan....er/ppctlcab.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft....467&clcid=0x409
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan....r/axscanner.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zone...ctor/WebAAS.cab
O20 - Winlogon Notify: mfcurl - C:\WINDOWS\mfcurl.dll
O23 - Service: AOL Spyware Protection Service (AOLService) - Unknown owner - C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\\aolserv.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: OTi Card Reader Service - Unknown owner - C:\Program Files\CardReader2.0\OTiReader.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\SYSTEM32\ZoneLabs\vsmon.exe
  • 0

#18
ScHwErV
Posted 17 June 2005 - 08:13 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Were not done yet!

Did you try to delete the file in safe mode? It should go in safe mode, if it does not, then you can try Killbox in safe mode. That should do the trick.

ScHwErV :tazz:
  • 0

#19
stoutie
Posted 20 June 2005 - 01:33 PM

stoutie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Hey!

Sorry for the delay in response - but had a few things on my plate recently - most notably were having a mini heat wave in the UK, so been out in the sun!

Any how back now - tried to delete in safe mode, but it came up with the same error message.

I also couldnt find killbox in safe mode - is that usual?

Cheers

Stoutie

I have also loaded Norton Anti-Virus 2005 on the PC, which picks it up but 'helpfully' says it can't do anything!!
  • 0

#20
ScHwErV
Posted 20 June 2005 - 07:56 PM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Were going to try a new approach to this infection. Lets go right after it.

*edit - See below for new instructions

ScHwErV :tazz:

Edited by ScHwErV, 22 June 2005 - 07:54 AM.

  • 0

#21
ScHwErV
Posted 22 June 2005 - 07:53 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Were going to need to add a little extra to that last one. Give this a try.

Lets start off by downloading a few necessary programs.

Download and install Registrar Lite Here
Download and Unzip Process Explorer Here Scroll to the bottom of the page and select your Operating System. Unzip it to its own folder on the desktop so you can find it later.
Download and install Advanced Process Manipulation Here

Now reboot into safe mode.

Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

Begin by opening Registrar Lite.
  • Click Search, then Search Registry.
  • Search for mfcurl and wait for it to finish its search.
  • Leave the search window open and continue on.
Next open Process Explorer.
  • Scroll down in the main window and find winlogon.exe
  • Right click on winlogon.exe and select Suspend
  • Leave Process Explorer open.
Now run HijackThis and put checkmarks in front of these two lines

O2 - BHO: MSEvents Object - {B8B55274-0F9A-41E5-9067-A3539BD9E860} - C:\WINDOWS\mfcurl.dll
O20 - Winlogon Notify: mfcurl - C:\WINDOWS\mfcurl.dll

Do NOT fix them yet

Now open Advanced Process Manipulation.
  • Scroll down in the main window and find c:\windows\explorer.exe
  • Click on the entry and that will display a list of files in the second window.
  • Scroll down the list in the second window and find c:\windows\mfcurl.dll
  • Right click on that entry and select Unload DLL
  • You will now lose your Start Bar and Desktop Icons. This is normal.
  • Leave Advanced Process Manipulation open
Go back to the Registrar Lite search window that we left open.
  • Select all the found items (Click Ctrl+A to select all)
  • Right click on one of the entries.
  • Select Delete selected registry keys and values
  • When prompted click "All"
Back in Advanced Process Manipulation.
  • Scroll down in the main window and find c:\windows\system32\winlogon.exe
  • Click on the entry and that will display a list of files in the second window.
  • Scroll down the list in the second window and find c:\windows\mfcurl.dll
  • Right click on that entry and select Unload DLL
  • You will have to click OK about six times
In HijackThis click Fix checked. You will be prompted you are about to remove a BHO. That's what you want.

Now back in Process Explorer.
  • Find winlogon.exe again.
  • Right click on winlogon.exe and select Resume
  • This should reboot your computer automatically.
After the reboot copy the code below into notepad and save it as getlostvundo.reg (set Filetype to "All Files")

REGEDIT4

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\mfcurl]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[-HKEY_CLASSES_ROOT\CLSID\{B8B55274-0F9A-41E5-9067-A3539BD9E860}]

[-HKEY_CLASSES_ROOT\MSEvents.MSEvents.1]

[-HKEY_CLASSES_ROOT\MSEvents.MSEvents]


[b]Doubleclick the file and confirm you want to merge it with the registry.

After that, post back with a fresh HiJackThis log.

ScHwErV :tazz:
  • 0

#22
stoutie
Posted 29 June 2005 - 02:10 AM

stoutie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Hi - Sorry for the delay - been on vacation for a few days in the sun (rare in the UK).

Went into safe mode, but the screen was blank so I couldnt do anything - no icons/tool bar etc etc

Do I need to do something elkse?

Thanks

S
  • 0

#23
ScHwErV
Posted 29 June 2005 - 06:39 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Nothing at all in safe mode?

ScHwErV :tazz:
  • 0

#24
stoutie
Posted 29 June 2005 - 04:31 PM

stoutie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
nope, all the icons flash up as soon as you go into it, then they disappear into the ether before you have the chance to do anything (i.e. the screen goes black and there is only the 'safe mode' text at either side of the top of the screen!

interesting?

:tazz: ;)
  • 0

#25
ScHwErV
Posted 01 July 2005 - 08:24 PM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
I am not getting very far when asking around for feedback on your problem. This is a new vundo infection that we have not seen much.

One of the experts wants me to give this a try.

Please click Start - Run - then type msconfig. In the startup tab, uncheck everything (just for now). Then reboot into safe mode and see if it comes up.

If that doesnt work, try the fix without safe mode.

ScHwErV :tazz:
  • 0

Advertisements

#26
stoutie
Posted 07 July 2005 - 02:25 PM

stoutie

    Member

  • Topic Starter
  • Member
  • PipPip
  • 15 posts
Hey ScHwErV,

Sorry for the delay in response, but weve had to move out of the family home for a week or so while weve been having some work done on it (I also dont have a computer at work at the moment) - - so its all hectic,

Thanks for sticking with this one and I'll be in touch as soon as I'm back at the ranch!!

Much appreciated - should be mid way through next week if everything goes well!

S :tazz: ;)
  • 0

#27
ScHwErV
Posted 25 July 2005 - 05:36 AM

ScHwErV

    Member 5k

  • Retired Staff
  • 21,285 posts
  • MVP
Due to lack of feedback, this topic has been closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP