Options

IE Hi-Jacked

Unknown
edited April 2007 in Spyware & Virus Removal
Hi,
Any time I google anything to do with finances I get redirected to other financial sites rather than getting my search results. I ran Vundofix and it removed 6.3.19 and it removed many files but I must have something different. Below is a copy of my hi-jack log. Any help will be appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 9:47:55 AM, on 4/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\svcbces.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0F8FA17B-B8A1-40EF-B892-89EA2F804EC4} - C:\WINDOWS\system32\lyaqmutl.dll
O2 - BHO: (no name) - {1D6DE43E-3BB0-44A3-A73D-1D8690FC1C46} - C:\WINDOWS\system32\wrjmoona.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {8B84B029-981C-4E84-9538-8B835D6E2E7a} - C:\WINDOWS\system32\lyaqmutl.dll
O2 - BHO: (no name) - {A75F0B75-B535-4174-8444-FFAFBFE23C88} - C:\WINDOWS\system32\jkhhh.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D3EC2D21-01A8-4050-8867-638895D77F86} - C:\WINDOWS\system32\mljgh.dll (file missing)
O2 - BHO: (no name) - {E44527F6-1296-4A84-B67D-A6CEA6ED4B69} - C:\WINDOWS\system32\mljifda.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Simple Star PhotoShow Media Manager] C:\PROGRA~1\SIMPLE~1\PHOTOS~1\data\xtras\mssysmgr.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Principia Online Update.lnk = C:\Program Files\Morningstar\Principia\Schedupd.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Terminal Shadow Copy (tscbces) - Unknown owner - C:\WINDOWS\system32\svcbces.exe

Comments

  • VekaVeka Finland
    edited April 2007
    Hi knoltee. I'll check your log. Meanwhile, please find VundoFix's log ( usually: C:\vundofix.txt ) and post it here. Thank you. :)
  • knoltee
    edited April 2007
    Here is vundofix.txt Thank you.


    Beginning removal...
    VundoFix V6.3.17
    Checking Java version...
    Sun Java not detected
    Scan started at 8:11:30 AM 4/4/2007
    Listing files found while scanning....
    C:\WINDOWS\system32\gxeheryy.dll
    C:\WINDOWS\system32\hhhkj.bak1
    C:\WINDOWS\system32\hhhkj.bak2
    C:\WINDOWS\system32\hhhkj.ini
    C:\WINDOWS\system32\hhhkj.ini2
    C:\WINDOWS\system32\hhhkj.tmp
    C:\WINDOWS\system32\jkhhh.dll
    Beginning removal...
    Attempting to delete C:\WINDOWS\system32\gxeheryy.dll
    C:\WINDOWS\system32\gxeheryy.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hhhkj.bak1
    C:\WINDOWS\system32\hhhkj.bak1 Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hhhkj.bak2
    C:\WINDOWS\system32\hhhkj.bak2 Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hhhkj.ini
    C:\WINDOWS\system32\hhhkj.ini Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hhhkj.ini2
    C:\WINDOWS\system32\hhhkj.ini2 Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hhhkj.tmp
    C:\WINDOWS\system32\hhhkj.tmp Has been deleted!
    Attempting to delete C:\WINDOWS\system32\jkhhh.dll
    C:\WINDOWS\system32\jkhhh.dll Has been deleted!
    Performing Repairs to the registry.
    Done!
    VundoFix V6.3.17
    Checking Java version...
    Sun Java not detected
    Scan started at 8:39:18 AM 4/4/2007
    Listing files found while scanning....

    VundoFix V6.3.19
    Checking Java version...
    Sun Java not detected
    Scan started at 8:43:55 AM 4/4/2007
    Listing files found while scanning....
    C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\awtqqqq.dll
    C:\WINDOWS\system32\awtsq.dll
    C:\WINDOWS\system32\epytjtgj.dll
    C:\WINDOWS\system32\etwwhmpe.dll
    C:\WINDOWS\system32\gebxwut.dll
    C:\WINDOWS\system32\gxeheryy.dll
    C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\hlwstxfp.ini
    C:\WINDOWS\system32\jkhfc.dll
    C:\WINDOWS\system32\jkkli.dll
    C:\WINDOWS\system32\ljjheed.dll
    C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\mljifda.dll
    C:\WINDOWS\system32\mljjgge.dll
    C:\WINDOWS\system32\mljkhgg.dll
    C:\WINDOWS\system32\mlljk.dll
    C:\WINDOWS\system32\nnnonkh.dll
    C:\WINDOWS\system32\pfxtswlh.dll
    C:\WINDOWS\system32\qlsuhiun.dll
    C:\WINDOWS\system32\qomljjg.dll
    C:\WINDOWS\system32\tuvvwwx.dll
    C:\WINDOWS\system32\urqqrqp.dll
    C:\WINDOWS\system32\vtuts.dll
    C:\WINDOWS\system32\vtututq.dll
    Beginning removal...
    Attempting to delete C:\WINDOWS\system32\awtqqqq.dll
    C:\WINDOWS\system32\awtqqqq.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\awtsq.dll
    C:\WINDOWS\system32\awtsq.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\epytjtgj.dll
    C:\WINDOWS\system32\epytjtgj.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\etwwhmpe.dll
    C:\WINDOWS\system32\etwwhmpe.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\gebxwut.dll
    C:\WINDOWS\system32\gebxwut.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hgjlm.bak1
    C:\WINDOWS\system32\hgjlm.bak1 Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hgjlm.ini
    C:\WINDOWS\system32\hgjlm.ini Has been deleted!
    Attempting to delete C:\WINDOWS\system32\hlwstxfp.ini
    C:\WINDOWS\system32\hlwstxfp.ini Has been deleted!
    Attempting to delete C:\WINDOWS\system32\jkhfc.dll
    C:\WINDOWS\system32\jkhfc.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\jkkli.dll
    C:\WINDOWS\system32\jkkli.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\ljjheed.dll
    C:\WINDOWS\system32\ljjheed.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\mljgh.dll
    C:\WINDOWS\system32\mljgh.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\mljifda.dll
    C:\WINDOWS\system32\mljifda.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\mljjgge.dll
    C:\WINDOWS\system32\mljjgge.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\mljkhgg.dll
    C:\WINDOWS\system32\mljkhgg.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\mlljk.dll
    C:\WINDOWS\system32\mlljk.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\nnnonkh.dll
    C:\WINDOWS\system32\nnnonkh.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\pfxtswlh.dll
    C:\WINDOWS\system32\pfxtswlh.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\qlsuhiun.dll
    C:\WINDOWS\system32\qlsuhiun.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\qomljjg.dll
    C:\WINDOWS\system32\qomljjg.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\tuvvwwx.dll
    C:\WINDOWS\system32\tuvvwwx.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\urqqrqp.dll
    C:\WINDOWS\system32\urqqrqp.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\vtuts.dll
    C:\WINDOWS\system32\vtuts.dll Has been deleted!
    Attempting to delete C:\WINDOWS\system32\vtututq.dll
    C:\WINDOWS\system32\vtututq.dll Has been deleted!
    Performing Repairs to the registry.
    Done!
    VundoFix V6.3.19
    Checking Java version...
    Sun Java not detected
    Scan started at 9:09:20 AM 4/4/2007
    Listing files found while scanning....
    No infected files were found.
  • VekaVeka Finland
    edited April 2007
    PRINT OUT THESE INSTRUCTIONS OR SAVE THEM WITH NOTEPAD


    Please submit the following file to one of these online file scanners.

    C:\WINDOWS\system32\svcbces.exe This will produce a report after the scan is complete, please copy and paste those results in your next post.

    ~~~~~~~~~~~~

    Run HijackThis and click Do a system scan only. Check the boxes next to all the entries listed below.

    O2 - BHO: (no name) - {0F8FA17B-B8A1-40EF-B892-89EA2F804EC4} - C:\WINDOWS\system32\lyaqmutl.dll
    O2 - BHO: (no name) - {1D6DE43E-3BB0-44A3-A73D-1D8690FC1C46} - C:\WINDOWS\system32\wrjmoona.dll
    O2 - BHO: (no name) - {8B84B029-981C-4E84-9538-8B835D6E2E7a} - C:\WINDOWS\system32\lyaqmutl.dll
    O2 - BHO: (no name) - {A75F0B75-B535-4174-8444-FFAFBFE23C88} - C:\WINDOWS\system32\jkhhh.dll (file missing)
    O2 - BHO: (no name) - {D3EC2D21-01A8-4050-8867-638895D77F86} - C:\WINDOWS\system32\mljgh.dll (file missing)
    O2 - BHO: (no name) - {E44527F6-1296-4A84-B67D-A6CEA6ED4B69} - C:\WINDOWS\system32\mljifda.dll (file missing)

    Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot into safe mode.
    • If the computer is running, shut down Windows, and then turn off the power
    • Wait 30 seconds, and then turn the computer on
    • Start tapping the F8 key
    • The Windows Advanced Options Menu appears
    • Ensure that the Safe Mode option is selected
    • Press Enter. The computer then begins to start in Safe mode
    • Login on your usual account
    Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these files (if present):

    C:\WINDOWS\system32\lyaqmutl.dll
    C:\WINDOWS\system32\wrjmoona.dll
    C:\WINDOWS\system32\lyaqmutl.dll

    After that, Reboot in normal mode.
    ~~~~~~~~~~~~

    Rename HijackThis.exe to Scanner.exe and post fresh HJT log.
  • knoltee
    edited April 2007
    I think that file svcbces.exe is the problem. I cannot find it in c:\windows\system32 and I am displaying hidden files (doesn't show up in dir svcbces.exe /ah). Here are the results.

    Logfile of HijackThis v1.99.1
    Scan saved at 2:46:22 PM, on 4/4/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\system32\svcbces.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Principia Online Update.lnk = C:\Program Files\Morningstar\Principia\Schedupd.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Terminal Shadow Copy (tscbces) - Unknown owner - C:\WINDOWS\system32\svcbces.exe
  • VekaVeka Finland
    edited April 2007
    So you cannot submit the file svcbces.exe in the online file scanner? Have you tried though?
  • knoltee
    edited April 2007
    No, I cannot submit that file. I have booted into safe mode, ran HJT, and tried to fix it there. The reference just keeps coming back.
  • VekaVeka Finland
    edited April 2007
    Please rename HijackThis.exe to Scanner.exe and post fresh HJT log.
  • knoltee
    edited April 2007
    Here it is. I will try to send that file again.

    Logfile of HijackThis v1.99.1
    Scan saved at 7:33:49 AM, on 4/5/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Symantec AntiVirus\DefWatch.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\PROGRA~1\SYMANT~1\VPTray.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\WINDOWS\system32\svcbces.exe
    C:\Program Files\Hijackthis\HijackThis.exe
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: Principia Online Update.lnk = C:\Program Files\Morningstar\Principia\Schedupd.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
    O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
    O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: Terminal Shadow Copy (tscbces) - Unknown owner - C:\WINDOWS\system32\svcbces.exe

    I was able to send the file to VirusTotal. Here are their results.

    STATUS: FINISHEDComplete scanning result of "svcbces.exe", received in VirusTotal at 04.04.2007, 22:09:40 (CET).
    Antivirus Version Update Result
    AhnLab-V3 2007.4.5.0 04.04.2007 no virus found
    AntiVir 7.3.1.48 04.04.2007 TR/Crypt.ULPM.Gen
    Authentium 4.93.8 04.03.2007 no virus found
    Avast 4.7.936.0 04.04.2007 no virus found
    AVG 7.5.0.447 04.04.2007 no virus found
    BitDefender 7.2 04.04.2007 no virus found
    CAT-QuickHeal 9.00 04.04.2007 no virus found
    ClamAV devel-20070312 04.04.2007 no virus found
    DrWeb 4.33 04.04.2007 no virus found
    eSafe 7.0.15.0 04.04.2007 suspicious Trojan/Worm
    eTrust-Vet 30.7.3540 04.04.2007 no virus found
    Ewido 4.0 04.04.2007 no virus found
    FileAdvisor 1 04.04.2007 no virus found
    Fortinet 2.85.0.0 04.04.2007 no virus found
    F-Prot 4.3.1.45 04.04.2007 no virus found
    F-Secure 6.70.13030.0 04.04.2007 no virus found
    Ikarus T3.1.1.3 04.04.2007 no virus found
    Kaspersky 4.0.2.24 04.04.2007 no virus found
    McAfee 5001 04.04.2007 W32/Sdbot.worm.gen.g
    Microsoft 1.2405 04.04.2007 no virus found
    NOD32v2 2168 04.04.2007 no virus found
    Norman 5.80.02 04.04.2007 no virus found
    Panda 9.0.0.4 04.04.2007 Suspicious file
    Prevx1 V2 04.04.2007 no virus found
    Sophos 4.16.0 03.30.2007 Mal/HckPk-A
    Sunbelt 2.2.907.0 04.03.2007 no virus found
    Symantec 10 04.04.2007 no virus found
    TheHacker 6.1.6.085 04.04.2007 no virus found
    VBA32 3.11.3 04.04.2007 no virus found
    VirusBuster 4.3.7:9 04.04.2007 Worm.SdBot.Gen.30
    Webwasher-Gateway 6.0.1 04.04.2007 Trojan.Crypt.ULPM.Gen

    I am using SAV corp 9.0 and they don't recognize this virus yet.
Sign In or Register to comment.