Options

Trojan Horse Downloader.Agent.BF

Unknown
edited July 2004 in Spyware & Virus Removal
Yo guys,

My com has been infected by Trojan Horse Downloader.Agent.BF. Below is the log file from hijack this. Any guys can help me on this? My OS is windows 2000.

Logfile of HijackThis v1.98.0
Scan saved at 8:11:18 AM, on 7/13/2004
Platform: Windows 2000 SP2 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\regsvc.exe
C:\WINDOWS\system32\MSTask.exe
C:\WINDOWS\system32\stisvc.exe
C:\WINDOWS\System32\WBEM\WinMgmt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\msjt.exe
C:\Program Files\Grisoft\AVG6\avgcc32.exe
C:\Program Files\Iomega\Tools\Imgicon.exe
C:\program files\lotus\notes\nminder.exe
C:\WINDOWS\system32\ieuv.exe
C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\WinZip\winzip32.exe
C:\DOCUME~1\MARKSI~1\LOCALS~1\Temp\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://zkchq.dll/index.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zkchq.dll/sp.html#12802
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
R3 - Default URLSearchHook is missing
F0 - system.ini: Shell=
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {FF6D79FE-4452-C373-6850-EFD03145949C} - C:\WINDOWS\d3ru32.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [msjt.exe] C:\WINDOWS\msjt.exe
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
O4 - HKLM\..\RunOnce: [ieuv.exe] C:\WINDOWS\system32\ieuv.exe
O4 - Startup: Notes Minder.lnk = C:\program files\lotus\notes\nminder.exe
O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
O4 - Global Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
O4 - Global Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
O17 - HKLM\System\CCS\Services\Tcpip\..\{BCF40A79-F9C4-4421-BA4C-FF79CCD9171C}: NameServer = 200.0.0.25

Comments

  • R4--N_M4l-3RR4--N_M4l-3R
    edited July 2004
    Any old virus scan program ought to kill it. If you don't have one go to www.free-av.com and download and run anti-vir.
  • marksim
    edited July 2004
    'R4 wrote:
    [N_M4l{3R']Any old virus scan program ought to kill it. If you don't have one go to www.free-av.com and download and run anti-vir.

    Yo pal,

    I have try all kinds of anti virus programs, some can't even detect it. Don think anti-virus program can kill it. Anyway I try with the program you mentioned and sorry it is not effective.

    Anyone can help me further?
  • R4--N_M4l-3RR4--N_M4l-3R
    edited July 2004
    When scanning, make sure you enable the program to scan every single file on your machine. I will keep searching for you. Make sure you are using the newest virus definition file update for the program. Hope all goes well.
  • marksim
    edited July 2004
    ok then, I will try again. then i will post the results..thanx.
  • R4--N_M4l-3RR4--N_M4l-3R
    edited July 2004
    Sorry I can't help you, I hope someone else can.
  • marksim
    edited July 2004
    Yo bro,

    Trythe anti vir you recommended. The virus is not detected. Virus still in my com. Thans for your help tot. Any guys out there can help me?
  • R4--N_M4l-3RR4--N_M4l-3R
    edited July 2004
    marksim wrote:
    Yo bro,

    Trythe anti vir you recommended. The virus is not detected. Virus still in my com. Thans for your help tot. Any guys out there can help me?

    Make sure you are scanning the computer in safe mode. I haven't found a solution yet other than "buy norton" or "buy mcaffe" but I will keep searching.
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited July 2004
    Boot up in Safe Mode and delete these:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://zkchq.dll/index.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {FF6D79FE-4452-C373-6850-EFD03145949C} - C:\WINDOWS\d3ru32.dll
    O4 - HKLM\..\Run: [msjt.exe] C:\WINDOWS\msjt.exe
    O4 - HKLM\..\RunOnce: [ieuv.exe] C:\WINDOWS\system32\ieuv.exe
    O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BCF40A79-F9C4-4421-BA4C-FF79CCD9171C}: NameServer = 200.0.0.25

    While still in Safe Mode delete the following files (if found):

    d3ru32.dll
    msjt.exe (not to be confused with msjet.exe)
    ieuv.exe
    zkchq.dll

    NOTE: Make sure "show hidden files and folders" is enabled. :)
  • marksim
    edited July 2004
    profdlp wrote:
    Boot up in Safe Mode and delete these:

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://zkchq.dll/index.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = res://C:\WINDOWS\zkchq.dll/sp.html#12802
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = res://zkchq.dll/index.html#12802
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = c:\windows\SYSTEM\blank.htm
    R3 - Default URLSearchHook is missing
    O2 - BHO: (no name) - {FF6D79FE-4452-C373-6850-EFD03145949C} - C:\WINDOWS\d3ru32.dll
    O4 - HKLM\..\Run: [msjt.exe] C:\WINDOWS\msjt.exe
    O4 - HKLM\..\RunOnce: [ieuv.exe] C:\WINDOWS\system32\ieuv.exe
    O10 - Broken Internet access because of LSP provider 'osmim.dll' missing
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BCF40A79-F9C4-4421-BA4C-FF79CCD9171C}: NameServer = 200.0.0.25

    While still in Safe Mode delete the following files (if found):

    d3ru32.dll
    msjt.exe (not to be confused with msjet.exe)
    ieuv.exe
    zkchq.dll

    NOTE: Make sure "show hidden files and folders" is enabled. :)

    ok pal, i will try and post the outcome... thanx for advise..
  • marksim
    edited July 2004
    below this the log for now. pls advise

    Logfile of HijackThis v1.98.0
    Scan saved at 10:31:41 AM, on 7/14/2004
    Platform: Windows 2000 SP2 (WinNT 5.00.2195)
    MSIE: Internet Explorer v5.00 SP2 (5.00.2920.0000)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG6\avgserv.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\WINDOWS\system32\regsvc.exe
    C:\WINDOWS\system32\MSTask.exe
    C:\WINDOWS\system32\stisvc.exe
    C:\WINDOWS\System32\WBEM\WinMgmt.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ieuv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG6\avgcc32.exe
    C:\Program Files\Iomega\Tools\Imgicon.exe
    C:\program files\lotus\notes\nminder.exe
    C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\WINDOWS\system32\nethy32.exe
    C:\PROGRA~1\WinZip\winzip32.exe
    C:\DOCUME~1\MARKSI~1\LOCALS~1\Temp\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://go.compaq.com/1Q00CDT/0409/bl8.asp
    R3 - Default URLSearchHook is missing
    F0 - system.ini: Shell=
    F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\Userinit.exe,
    O2 - BHO: (no name) - {C726D36D-9BDF-0383-F849-161DD3B7B85F} - C:\WINDOWS\system32\nethy32.dll
    O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [AVG_CC] C:\Program Files\Grisoft\AVG6\avgcc32.exe /startup
    O4 - HKLM\..\Run: [nethy32.exe] C:\WINDOWS\system32\nethy32.exe
    O4 - Startup: Notes Minder.lnk = C:\program files\lotus\notes\nminder.exe
    O4 - Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Startup: reminder-ScanSoft Product Registration.lnk = C:\Program Files\Caere\OmniPagePro90\EREG\REMIND32.EXE
    O4 - Global Startup: Iomega Startup Options.lnk = C:\Program Files\Iomega\Tools\IMGSTART.EXE
    O4 - Global Startup: Iomega Disk Icons.lnk = C:\Program Files\Iomega\Tools\IMGICON.EXE
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O8 - Extra context menu item: Download with Star Downloader - C:\Program Files\Star Downloader\sdie.htm
    O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
    O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx
    O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx
    O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BCF40A79-F9C4-4421-BA4C-FF79CCD9171C}: NameServer = 200.0.0.25
  • profdlpprofdlp The Holy City Of Westlake, Ohio
    edited July 2004
    We still have the ieuv business, and a new one (nethy32.dll) that is also no good. This is not unusual; lots of time these lousy things just (re)generate a random file name.

    Turn OFF System Restore, boot in Safe Mode, and delete these:
    C:\WINDOWS\system32\ieuv.exe
    C:\WINDOWS\system32\nethy32.exe
    O2 - BHO: (no name) - {C726D36D-9BDF-0383-F849-161DD3B7B85F} - C:\WINDOWS\system32\nethy32.dll
    O4 - HKLM\..\Run: [nethy32.exe] C:\WINDOWS\system32\nethy32.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{BCF40A79-F9C4-4421-BA4C-FF79CCD9171C}: NameServer = 200.0.0.25

    Make sure you find and delete these files in your C:Windows\System32 folder:

    ieuv.exe
    nethy32.exe

    Hang on, you're almost out of the woods. :)
  • marksim
    edited July 2004
    Finally, kill the virus already....

    Got to kill it in safe mode, i tried to kill an *.exe file, but it wouldn't allowed me to do so. But I use trojan remover to delete the file...and its gone.

    Total software used for this virus: Spybot, Hijackthis, Trojan remover, adware, buster. This is really a virus that can make you go nuts...

    Thanx alot pals for all your help and advise!!
Sign In or Register to comment.