Options

Please help. HJT Log.

Unknown
edited January 2008 in Spyware & Virus Removal
Hello.
Yesterday, my computer began acting funny. The taskbar and my desktop kept disappearing and reappearing and I noticed that the taskmanager had far too many svchosts than normal. About two of the SVChosts kept spiking absurdly high. At first, I just thought a restart later would fix it, so I browsed the internet for a while through the taskmanager. After a while it got annoying, so I rebooted.

Unfortunately, the problem didn't go away. The system is really unstable and spyware doctor so far is keeping it running. I tried avast and it didn't pick up anything. I also installed some other programs and at the moment, spyware doctor is keeping it stable. Before, I had to keep running explorer.exe through the taskmanager to show the desktop.

I tried so many things, and nothing is working. Right now I have HJT and killbox ready since it seemed that that's what everyone else was using to fix the problem. After reading a bit, the symptoms seem a bit like acebot, but spyware doctor keeps insisting the problem is virtumonde. I tried using the vundo fix from symantec, but it says that it was not found on my system. O_o

Well, that stuff is probably just a waste of time to you tech guys, so I'll get on with the real business. Here is the log file:

Logfile of HijackThis v1.99.1
Scan saved at 3:40:58 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
C:\Program Files\Belkin\Belkin Wireless Network Utility\WLanCfgG.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr .exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Spyware Doctor\SDTrayApp .exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Ricky\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 124.53.58.21:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F3 - REG:win.ini: load=C:\WINDOWS\system32\mlljk.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {A61EFB1A-F5AA-493B-B5B4-1FA072F54A24} - C:\WINDOWS\system32\mlljk.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.1121.2472\swg.dll
O2 - BHO: (no name) - {CA4F0D8D-5F2B-4F16-838A-8D52249EAB21} - C:\WINDOWS\system32\jkkkifc.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [LexPPS.exe] C:\WINDOWS\system32\lexpps.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\program files\bonjour\mdnsnsp.dll' missing
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v5.cab
O16 - DPF: {7606693A-C18D-4567-AF85-6194FF70761E} (GomWeb Control) - http://app.ipop.co.kr/gom/GomWeb.cab
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: jkkkifc - C:\WINDOWS\SYSTEM32\jkkkifc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: LMIinit - C:\WINDOWS\SYSTEM32\LMIinit.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: Belkin 54g Wireless USB Network Adapter (Belkin 54g Wireless USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\Belkin Wireless Network Utility\WLService.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe

I'd be at a loss of words if anyone could help me. I'm kind of getting desperate at this point. Thanks so very much in advance.

Comments

  • VekaVeka Finland
    edited December 2007
    Hello RRCriswell! I'll check your log and answer ASAP.
  • VekaVeka Finland
    edited January 2008
    I'm afraid that you have a Vundo file infector, but I cannot be sure yet. Vundo file infector is a new variant of Vundo that checks which files run at Windows startup (those O4 entries in your HijackThis log) and tries to infect them.

    I'll need to do an further analysis of your problem.

    Please download ComboFix to your Desktop.
    • Double click on Combofix.exe & follow the prompts.
    • When the scan has finished, it shall produce a log for you. Post that log in your next reply.
    Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • RRCriswell
    edited January 2008
    Wow, so far the symptoms have gone away. Thanks so much!
    Here is the log:

    log.txt


    Sorry I had to post the txt file. For some reason, it kept saying I didn't have permission to put a link in the post... I removed the only link in the log, and it still came up. Anyway, I still see a suspicious task running on the task manager: ThGuard .exe. Whenever I saw the other processes running with spaces after the name before (ProgramName .exe), I figured they were modified or corrupted by the trojan somehow and it was an attempt to make them look normal. Just now I ended the process, but is this something I should worry about?

    Once again, I can't thank you enough for your help!
    log.txt 11.6K
  • VekaVeka Finland
    edited January 2008
    The war is not over. As I thought, it's file infector. :mad:
    1. Download RenV.exe by sUBs to your desktop
    2. Double click on it to run it
    3. It will search your system drive looking for any modified .exe file and will produce a log for you.
    4. Please attach this report to your reply (Do not copy and paste)
  • RRCriswell
    edited January 2008
    Alrighty, here it is:

    Log.txt
  • VekaVeka Finland
    edited January 2008
    Almost done. :cool:
    • Copy the entire contents of the Code Box below to Notepad.
    • Name the file as Log.txt (Overwrite the existing one)
    • Change the Save as Type to All Files
    • and Save it on the desktop
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe 
C:\Program Files\AIM6\aim6 .exe 
C:\Program Files\Alwil Software\Avast4\ashDisp .exe 
C:\Program Files\Common Files\AOL\1136341552\ee\AOLSoftware .exe 
C:\Program Files\Common Files\Real\Update_OB\realsched .exe 
C:\Program Files\DAEMON Tools\daemon .exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifi er .exe 
C:\Program Files\iTunes\iTunesHelper .exe 
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe 
C:\Program Files\Lexmark 1200 Series\lxczbmgr .exe 
C:\Program Files\REGSHAVE\REGSHAVE .EXE 
C:\Program Files\TrojanHunter 5.0\THGuard   .exe 
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe 
C:\WINDOWS\system32\ctfmon .exe
    RenV.gif

    Refering to the picture above, drag Log.txt into RenV.exe and attach the resulting report to your reply.
  • RRCriswell
    edited January 2008
    Wow. That was really neat that someone bothered to make an animation for that, hehe. Here is the new log:

    Log.txt
  • VekaVeka Finland
    edited January 2008
    Thanks! :)


    STEP #1

    It seems that the fix didn't work properly.

    Would you please try again?
    • Copy the entire contents of the Code Box below to Notepad.
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe 
C:\Program Files\AIM6\aim6 .exe 
C:\Program Files\Alwil Software\Avast4\ashDisp .exe 
C:\Program Files\Common Files\AOL\1136341552\ee\AOLSoftware .exe 
C:\Program Files\Common Files\Real\Update_OB\realsched .exe 
C:\Program Files\DAEMON Tools\daemon .exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifi er .exe 
C:\Program Files\iTunes\iTunesHelper .exe 
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe 
C:\Program Files\Lexmark 1200 Series\lxczbmgr .exe 
C:\Program Files\REGSHAVE\REGSHAVE .EXE 
C:\Program Files\TrojanHunter 5.0\THGuard   .exe 
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe 
C:\WINDOWS\system32\ctfmon .exe
    • Name the file as Log.txt (Overwrite the existing one)
    • Change the Save as Type to All Files
    • and Save it on the desktop
    RenV.gif
    Drag Log.txt into RenV.exe as in the pic.

    Note, do not double-click RenV.exe. It should start itself [SIZE=-1]automatically.[/SIZE]


    STEP #2


    Please delete old the ComboFix, and download Combofix from any of the links below, and save it to your desktop.

    Link 1
    Link 2
    Link 3


    **Note: It is important that it is saved directly to your desktop**

    Run ComboFix
    • Double click on Combofix.exe & follow the prompts.
    • When the scan has finished, it shall produce a log for you. Post that log in your next reply.
    Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

     Attach the resulting report of RenV, and post ComboFix log along with a fresh HijackThis log.
  • RRCriswell
    edited January 2008
    Hmmm... I followed the instructions, but the RenV log is still the same:
    Log.txt


    Well, here are the other two you asked for.
    Combofix log:
    log (combofix).txt

    HJT log:
    hijackthis.txt
  • VekaVeka Finland
    edited January 2008
    Weird. :confused:

    Let's try this... reboot into safe mode:

    Restart your computer and as soon as it starts booting up again continuously tap F8.
    A menu should come up where you will be given the option to enter Safe Mode.
    • When there, open Notepad and copy the entire contents of the Code Box below to Notepad
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe 
C:\Program Files\AIM6\aim6 .exe 
C:\Program Files\Alwil Software\Avast4\ashDisp .exe 
C:\Program Files\Common Files\AOL\1136341552\ee\AOLSoftware .exe 
C:\Program Files\Common Files\Real\Update_OB\realsched .exe 
C:\Program Files\DAEMON Tools\daemon .exe 
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifi er .exe 
C:\Program Files\iTunes\iTunesHelper .exe 
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe 
C:\Program Files\Lexmark 1200 Series\lxczbmgr .exe 
C:\Program Files\REGSHAVE\REGSHAVE .EXE 
C:\Program Files\TrojanHunter 5.0\THGuard   .exe 
C:\Program Files\Veoh Networks\Veoh\VeohClient .exe 
C:\WINDOWS\system32\ctfmon .exe
    • Name the file as Log.txt (Overwrite the existing one)
    • Change the Save as Type to All Files
    • and Save it on the desktop
    RenV.gif
    Drag Log.txt into RenV.exe as in the pic.

    Note, do not double-click RenV.exe. It should start itself [SIZE=-1]automatically.

    [/SIZE] Attach the resulting of RenV.
    Hope it works now!
Sign In or Register to comment.