Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Smitfraud issues

Started by ejm93 , Jun 22 2005 04:32 AM

  • Please log in to reply

#16
ejm93
Posted 24 June 2005 - 02:03 PM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
MEMLOW:

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "MEMLOW" 6/24/2005 3:58:53 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\memlow]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\memlow\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000\Control]
"ActiveService"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\memlow]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\memlow\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\memlow\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\memlow\Enum]
"0"="Root\\LEGACY_MEMLOW\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000\Control]
"ActiveService"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memlow]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memlow\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memlow\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\memlow\Enum]
"0"="Root\\LEGACY_MEMLOW\\0000"

draw32

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "draw32" 6/24/2005 4:00:11 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="draw32"

[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"001"="RP9, draw32"

vdnt32

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "vdnt32" 6/24/2005 4:02:25 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vdnt32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vdnt32\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000\Control]
"ActiveService"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdnt32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdnt32\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdnt32\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vdnt32\Enum]
"0"="Root\\LEGACY_VDNT32\\0000"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000\Control]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000\Control]
"ActiveService"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdnt32]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdnt32\Security]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdnt32\Enum]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vdnt32\Enum]
"0"="Root\\LEGACY_VDNT32\\0000"
  • 0

Advertisements

#17
Wizard
Posted 24 June 2005 - 06:07 PM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
I am going to have to make you a regfile to fix all this!

I need you to verify whether you can see these Services!

Click Start>> Click Run>> Type in Services.msc and Click OK!

Scroll the list and look for 2 Services named

vdn32
and
memlow

Post back and let me know if you can see those and if so look above the Display Name and you will see the true name of the Services

Thats what I really need to know!

Edited by Cretemonster, 24 June 2005 - 06:08 PM.

  • 0

#18
ejm93
Posted 25 June 2005 - 12:33 AM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Did that and didn't find those two files there.

I clicked on each one to open the properties/info and still no luck.

Thanks again for all your help!!!

My computer is running bad again (was great yesterday).. can't wait to "have it back!"
  • 0

#19
Michelle
Posted 25 June 2005 - 03:30 AM

Michelle

    Malware Removal Goddess

  • Retired Staff
  • 8,928 posts
Hello ejm93 ;)

I'm just posting the regedit real quick for Cretemonster then I'll be out of the way :tazz:

First, we definitely need you to backup the registry first:

Go to Start > Run - type:

regedit

Click OK.

When you get into the registry, on the leftside, click to highlight My Computer at the top. Then go up to "File > Export" Make sure in that window there is a tick next to "All" under Export Branch. Leave the "Save As Type" as "Registration Files", then save it as backup to a convenient location. Remember where you put it (I don't recommend putting it on the desktop) This is so the registry can be restored to this point should anything be deleted by accident or something else happens. It may take a minute. Just let it go until it's done.

After it's backed up, please download this haxdoor.zip to your desktop:
Unzip it to your desktop.
Double-click haxdoor.reg and when asked if you want to merge with the registry click YES. Then, please reboot your computer.
  • 0

#20
ejm93
Posted 25 June 2005 - 06:12 AM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Done.. here's a new HiJackThis log.. also on reboot, 3 viruses were picked up (usually it's only one in draw32.dll.. this time it was memlow and two other new files.. couldn't be cleaned so were deleted.

Logfile of HijackThis v1.99.1
Scan saved at 8:11:52 AM, on 6/25/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Sonic Shared\cinetray.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} (OCXDownloadChecker Control) - http://se.no-ip.com/...hecker_6100.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1106258708390
O16 - DPF: {894B8712-11F1-48A7-899F-36D6C695D9D8} - http://service.sympa...re/codebaby.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://www.freedom.n...cabs/cssweb.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartph...x/PCAXSetup.cab?
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  • 0

#21
Wizard
Posted 25 June 2005 - 06:18 AM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
Maybe that got it then!

TY bananafanafo for your assistance here!!!

Run the 3 reg searches again and lets see if those keys regenerated!
  • 0

#22
ejm93
Posted 26 June 2005 - 03:52 PM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
MEMLOW:


REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "MEMLOW" 6/26/2005 5:48:18 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

draw32

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "draw32" 6/26/2005 5:50:18 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"001"="draw32"

[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"002"="RP9, draw32"

vdnt32

REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "vdnt32" 6/26/2005 5:51:34 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000\LogConf]
  • 0

#23
Wizard
Posted 26 June 2005 - 05:18 PM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
OK,lets try this again,Michelle has prepared yet another regfile to try!

It will be attached to the post,Download and Extract All Files!

Restart in Safe Mode and Double Click to Execute,Allow it to Merge and Restart!

As much as I hate to ask,Run the Scans again and lets have a look at those and a fresh HijackThis log!

Attached Files


Edited by Cretemonster, 26 June 2005 - 05:19 PM.

  • 0

#24
ejm93
Posted 26 June 2005 - 07:30 PM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
OK.. here you go but, I don't think it's much better...

vdnt32:
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "vdnt32" 6/26/2005 9:22:17 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_VDNT32\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000]
"Service"="vdnt32"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_VDNT32\0000\LogConf]

MEMLOW:
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "MEMLOW" 6/26/2005 9:26:27 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000]
"Service"="memlow"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_MEMLOW\0000\LogConf]

draw32:
REGEDIT4
; RegSrch.vbs © Bill James

; Registry search results for string "draw32" 6/26/2005 9:28:02 PM

; NOTE: This file will be deleted when you close WordPad.
; You must manually save this file to a new location if you want to refer to it again later.
; (If you save the file with a .reg extension, you can use it to restore any Registry changes you make to these values.)


[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"001"="draw32"

[HKEY_USERS\S-1-5-21-854245398-1614895754-725345543-1003\Software\Microsoft\Search Assistant\ACMru\5603]
"002"="RP9, draw32"

HijackThis:
Logfile of HijackThis v1.99.1
Scan saved at 9:29:46 PM, on 6/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
C:\Program Files\Common Files\Sonic Shared\cinetray.exe
C:\Program Files\NetAssistant\bin\mpbtn.exe
C:\Program Files\Brother\Brmfcmon\BrMfcmon.exe
C:\WINDOWS\system32\Brmfrmps.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\Zero Knowledge\Freedom\pkR.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-ca\msntb.dll
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SetDefPrt] C:\Program Files\Brother\Brmfl04a\BrStDvPt.exe
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Freedom] C:\Program Files\Zero Knowledge\Freedom\Freedom.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O4 - Global Startup: NetAssistant.lnk = C:\Program Files\NetAssistant\bin\matcli.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1DB93715-3B60-43EE-93E6-279BB3E1DF76} (OCXDownloadChecker Control) - http://se.no-ip.com/...hecker_6100.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupd...b?1106258708390
O16 - DPF: {894B8712-11F1-48A7-899F-36D6C695D9D8} - http://service.sympa...re/codebaby.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O16 - DPF: {C81B5180-AFD1-41A3-97E1-99E8D254DB98} - http://www.freedom.n...cabs/cssweb.cab
O16 - DPF: {F127B9BA-89EA-4B04-9C67-2074A9DF61FC} (PCUploader Class) - http://www.walmartph...x/PCAXSetup.cab?
O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINDOWS\system32\Brmfrmps.exe" -service (file missing)
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
  • 0

#25
Wizard
Posted 26 June 2005 - 08:37 PM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
Now this is just too weird,something is alive and we just cant see it!

Download Pfind: http://www.bleepingc...files/pfind.php

UNZIP the contents to a permanent folder and Extract all Files!! Important !!
So make sure all those files remain in the same folder.
Don't use it yet!

Doubleclick pfind.bat
It will scan for a while, so please be patient.
Wait till the doswindow closes.

Post the contents of C:\pfind.txt in your next reply!

While you are waiting on my response,Update the MWAV Scan as before and Scan the PC once more and lets see what that shows us!
  • 0

Advertisements

#26
ejm93
Posted 26 June 2005 - 09:26 PM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Going to do MWAV now but, here's the first thing you asked for!! :tazz: (pfind.bat log)

Files found with this application may be legitimate.
Only remove files that you know are malware related.
Checking the C:\WINDOWS folder
C:\WINDOWS\RMAgentOutput.dll: UPX!
C:\WINDOWS\tsc.exe: UPX!
C:\WINDOWS\vsapi32.dll: UPX!t4


Checking the C:\WINDOWS\SYSTEM32 folder
C:\WINDOWS\SYSTEM32\ntdll.dll: .aspack
C:\WINDOWS\SYSTEM32\MP3Source.ax: UPX!


Checking all directories under the C:\WINDOWS\SYSTEM32\drivers folder
C:\WINDOWS\SYSTEM32\Drivers\css-dvp.sys: .aspack


Checking the C:\Documents and Settings\All Users\Start Menu\programs\Startup\ folder



Checking the C:\Documents and Settings\All Users\Application Data folder



Checking the C:\Documents and Settings\Dell Valued Customer\Start Menu\programs\Startup\ folder



Checking the C:\Documents and Settings\Dell Valued Customer\Application Data folder
  • 0

#27
Wizard
Posted 26 June 2005 - 09:51 PM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
When you get a chance,locate this file and send it to me

C:\WINDOWS\RMAgentOutput.dll

Right Click the Desktop and Select New>> Compressed(Zipped)Folder and place a copy of that file in it!

Email the Zipped Folder here>>[email protected]

Delete the Zip folder!
  • 0

#28
ejm93
Posted 27 June 2005 - 05:35 AM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Here's the MWAV Log.. for a while (well, when this all started) I kept getting viruses found (and file couldn't be cleaned so was deleted if I remember correctly) in file names that were JUST like this one.. haven't had them in a few days though.. not sure if that matters or not.. anyways.. here's the only file found:

File C:\System Volume Information\_restore{1CE0F49C-E38B-4D61-BDBE-6A03EB0F5CEF}\RP2\A0000247.exe tagged as not-a-virus:Tool.Win32.Reboot. No Action Taken.
  • 0

#29
Wizard
Posted 27 June 2005 - 12:09 PM

Wizard

    Retired Staff

  • Retired Staff
  • 5,661 posts
OK,looks like I been looking in the Wrong Direction!

Atribune has prepared a fix for a variant of this Infection and it should help us out alot!

First, download HSFix from here
http://www.atribune....loads/HSFix.zip
Unzip and Extract all Files


Restart into SAFE MODE(Tap F8 when restarting)


Open the HSFix folder on your desktop, open it, and double-click "hsfix.bat"

A log will be produced which you can close out of.

Locate and Post the contents of C:/hslog.txt
  • 0

#30
ejm93
Posted 27 June 2005 - 01:00 PM

ejm93

    Member

  • Topic Starter
  • Member
  • PipPip
  • 24 posts
Here you go.. although I made a mistake.. I went to click on the txt file to make sure it was saved before leaving safe mode and I accidentally clicked on the bat file again.. so, the log is empty but, there were 2 files deleted (forget what they were but, if you said their name, I'd remember).. so, here's the log, not sure if it's of any use.. OOPS!! They were under the "deleted services" section.


Horseserver Removal Tool v1.05
by Atri
-
-
1. Registry Fix Started
-
Registry fix complete
-
2. Deleted Services
-
-
3. Finding files Located on system
-
-
4. Deleting files that were found.
-
-
5. Checking for and Removing Winupdate
-
-
-
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP