SmitFraud.C - Please help remove

FelixDeSouze · January 2008

Hi there, I've only just installed a fresh XP and all of a sudden, poof.. I get this damn virus.

I've going throughthe generic removal procedure but this has not helped.

My HiJackThis script is below, please help.

Thanks in advance!

========================================

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 08:02:11, on 14/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\FelixDeSouze\Desktop\HiJackThis_v2.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200169374734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200174903500
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3539 bytes

Trogan · January 2008

Hello FelixDeSouze,

You are using an old version of HijackThis. Please uninstall "HijackThis" from Add/Remove in Control Panel.

Then, download HJTInstall.exe to your Desktop.

Doubleclick HJTInstall.exe to install it.
By default it will install to C:\Program Files\Trend Micro\HijackThis .
Click on Install.
It will create a HijackThis icon on the desktop.
Once installed, it will launch Hijackthis.
Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
Save the log to a convenient location as you'll need to post it soon.
Don't use the Analyse This button, its findings are dangerous if misinterpreted.
Don't have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Post the HijackThis log back here.

I don't see any indication of an Anti-Virus or Firewall. Let me know if you are using any.

FelixDeSouze · January 2008

Hi there Trogan,

I have AVG antivirus and default Windows firewall on. They do not seem to be getting detected by Windows though for some reason but I have scanned several times using a guide on getting rid of this virus but it obviously hasn't helped.

HJT log below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:46:15, on 15/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1200169374734
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1200174903500
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 3363 bytes

Trogan · January 2008

Hi FelixDeSouze,

You currenty have AVG Anti-Spyware; this is not an Anti-Virus. What you want is AVG Anti-Virus, which you should download from Here.

Also, I don't see any malware in your HijackThis log.

Lets do a scan..

Please do an online scan with Kaspersky WebScanner

Click on Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
- Scan using the following Anti-Virus database:
Extended (if available otherwise Standard)

Scan Options:

Scan Archives
Scan Mail Bases
[*]Click OK
[*]Now under select a target to scan:

SelectMy Computer
[*]This will program will start and scan your system.
[*]The scan will take a while so be patient and let it run.
[*]Once the scan is complete it will display if your system has been infected.

Now click on the Save as Text button:

[*]Save the file to your desktop.
Post the Kaspersky report back here.

FelixDeSouze · January 2008

Oh, DOH! I'll get Antivirus, thanks.

I'm pretty sure I got SmitFraud.C as I've had it before now and it always shows up as the only thing S&D cannot get rid of.

It has stopped me from using Firefox and I get popups gallore in IE so when I do use IE it crashes and I have to restart it.

Will do the scan now and post the report. Thanks!

FelixDeSouze · January 2008

Ok It's infected :P

Here is the Kaspersky report.

--

KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 15, 2008 9:00:36 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/01/2008
Kaspersky Anti-Virus database records: 512262

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
Scan Statistics:
Total number of scanned objects: 134192
Number of viruses found: 1
Number of infected objects: 6
Number of suspicious objects: 0
Duration of the scan process: 02:22:18
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\Working\database_9810_46DC_1046_C0CC\dfsr.db Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\Working\database_9810_46DC_1046_C0CC\fsr.log Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\Working\database_9810_46DC_1046_C0CC\fsrtmp.log Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Messenger\daz_w_uk@hotmail.com\SharingMetadata\Working\database_9810_46DC_1046_C0CC\tmp.edb Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Windows Live Contacts\daz_w_uk@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Application Data\Microsoft\Windows Live Contacts\daz_w_uk@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\History\History.IE5\MSHist012008011520080116\index.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temp\~DF6857.tmp Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temp\~DF69FE.tmp Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temp\~DF97FA.tmp Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temp\~DF9807.tmp Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\FelixDeSouze\My Documents\My Received Files\mirc.zip/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
C:\Documents and Settings\FelixDeSouze\My Documents\My Received Files\mirc.zip ZIP: infected - 1 skipped
C:\Documents and Settings\FelixDeSouze\My Documents\My Received Files\NoNameScript-Original.rar/NoNameScript-Original/mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
C:\Documents and Settings\FelixDeSouze\My Documents\My Received Files\NoNameScript-Original.rar RAR: infected - 1 skipped
C:\Documents and Settings\FelixDeSouze\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\FelixDeSouze\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{D70533E1-56B6-48B1-9D16-5A43B2B15EDD}\RP25\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped
C:\WINDOWS\system32\config\OSession.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\ndistapii.sys Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\=-=-=Software=-=-=\nonamescript\mirc617.exe/data0001.bin Infected: not-a-virus:Client-IRC.Win32.mIRC.617 skipped
G:\=-=-=Software=-=-=\nonamescript\mirc617.exe mIRC: infected - 1 skipped
G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
G:\System Volume Information\_restore{D70533E1-56B6-48B1-9D16-5A43B2B15EDD}\RP4\A0000417.abr Object is locked skipped
G:\System Volume Information\_restore{D70533E1-56B6-48B1-9D16-5A43B2B15EDD}\RP4\A0000422.abr Object is locked skipped
Scan process completed.

Trogan · January 2008

Hi,

Well, Kaspersky only found mIRC, so nothing harmfully there. However, do you know what the following is? Is it for mIRC?

C:\Documents and Settings\FelixDeSouze\My Documents\My Received Files\NoNameScript-Original.rar

Regarding SmitFraud.C, I'll need a log from S&D to check what it is finding...

Open SpyBot, close all browsers, check for problems (run a scan) and fix everything found. Then on the toolbar menu select mode and switch to advanced mode, on the left lower down select tools, and view report, ensure all the options are selected near the bottom except

Uncheck[ ] do not report disabled or known legitimate Items.
uncheck[ ] Include a list of services in report.
Uncheck[ ] Include uninstall list in report.

Now select (near the top) view report.
Press export in the save in box choose a place such as your my documents folder, then in your next post near the bottom select the "browse" button; navigate to and attach or post that report please.

FelixDeSouze · January 2008

Ok, I've done that.. I decided to attach the report as it was rather long..

Should be attached.

Trogan · January 2008

I notice you are using version 1.4. The latest version is 1.5.

Uninstall v1.4, and download v1.5 from Here.

Update and run a Full Scan. Post a report if you can please.

FelixDeSouze · January 2008

Ok, I installed 1.5, it said fixed the problem (but I'm not too sure about it as I've seen it say that before and it doesn't get rid).

Report attached.

Trogan · January 2008

That log looks fine. Is SmitFraud.C still being reported?

FelixDeSouze · January 2008

Yup certainly is.

It says it fixed the problem, but it never does.

the virus has stopped me from using Firefox completely (even if I uninstall and reinstall) and I get popups galore which often crash all the rest of the IE windows.

So frustrating. I've ran like 8 scans and each and everytime I have virus' and it always says they are quarantined/removed but they keep coming back. :'(

Trogan · January 2008

Hi Felix,

The SmitFraud.C findings are mostly likely False Positives.

What type of popups are you getting? What scans have you run, and what things have they found?

Please download ComboFix to your Desktop.

Double click on Combofix.exe & follow the prompts.
When the scan has finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

FelixDeSouze · January 2008

It's casino popups, adverts for iphones, things like that. And still my firefox won't load

lol.

Combofix log below.

--

ComboFix 08-01-17.1 - FelixDeSouze 2008-01-16 22:32:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2651 [GMT 0:00]
Running from: C:\Documents and Settings\FelixDeSouze\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete
.
((((((((((((((((((((((((( Files Created from 2007-12-17 to 2008-01-17 )))))))))))))))))))))))))))))))
.
2008-01-16 22:31 . 2000-08-31 08:00 51,200 --a

C:\WINDOWS\NirCmd.exe
2008-01-16 20:30 . 2008-01-16 20:30 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\vlc
2008-01-16 20:22 . 2008-01-16 20:22 <DIR> d

C:\Program Files\VideoLAN
2008-01-15 18:10 . 2008-01-15 18:10 <DIR> d

C:\WINDOWS\system32\Kaspersky Lab
2008-01-15 18:10 . 2008-01-15 18:10 <DIR> d

C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-15 11:45 . 2008-01-15 11:45 <DIR> d

C:\Program Files\Trend Micro
2008-01-13 18:42 . 2008-01-13 18:42 <DIR> d

C:\Program Files\Driver-Soft
2008-01-13 18:42 . 2004-03-09 16:45 662,288 --a

C:\WINDOWS\system32\MSCOMCT2.OCX
2008-01-13 18:42 . 2004-06-14 14:56 427,864 --a

C:\WINDOWS\system32\XceedZip.dll
2008-01-13 18:39 . 2007-06-05 10:56 44,928 --a

C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-13 18:24 . 2008-01-13 18:24 2,550 --a

C:\WINDOWS\system32\Uninstall.ico
2008-01-13 18:24 . 2008-01-13 18:24 1,406 --a

C:\WINDOWS\system32\Help.ico
2008-01-13 18:18 . 2008-01-17 22:35 932

C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-13 16:11 . 2008-01-15 18:08 <DIR> d

C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 15:24 . 2008-01-16 08:18 404 --a

C:\WINDOWS\wininit.ini
2008-01-13 14:37 . 2008-01-13 14:37 <DIR> d

C:\Program Files\Lavasoft
2008-01-13 14:37 . 2008-01-13 14:37 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\Lavasoft
2008-01-13 14:37 . 2008-01-16 07:57 <DIR> d

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-13 11:20 . 2008-01-13 19:38 <DIR> d

C:\Program Files\SUPERAntiSpyware
2008-01-13 11:20 . 2008-01-13 19:38 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\SUPERAntiSpyware.com
2008-01-13 11:20 . 2008-01-13 11:20 <DIR> d

C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-13 11:08 . 2007-07-30 19:19 271,224 --a

C:\WINDOWS\system32\mucltui.dll
2008-01-13 11:08 . 2007-07-30 19:19 30,072 --a

C:\WINDOWS\system32\mucltui.dll.mui
2008-01-13 10:50 . 2008-01-13 10:50 86,144 --a

C:\WINDOWS\system32\drivers\ndistapii.sys
2008-01-13 10:45 . 2008-01-13 10:45 <DIR> d

C:\Documents and Settings\All Users\Application Data\UDL
2008-01-13 10:40 . 2006-05-08 02:00 75,264 --a

C:\WINDOWS\system32\E_FLBBOE.DLL
2008-01-13 10:40 . 2006-04-19 02:00 62,976 --a

C:\WINDOWS\system32\E_FD4BBOE.DLL
2008-01-13 10:40 . 2004-09-10 20:12 49,152 --a

C:\WINDOWS\system32\E_DCINST.DLL
2008-01-13 10:40 . 2004-08-03 23:08 31,616 --a

C:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-13 10:40 . 2004-08-03 23:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-01-13 10:40 . 2004-08-03 23:01 25,856 --a

C:\WINDOWS\system32\drivers\usbprint.sys
2008-01-13 10:40 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-13 10:39 . 2008-01-13 10:44 <DIR> d

C:\Program Files\EPSON
2008-01-13 10:39 . 2008-01-13 10:39 <DIR> d

C:\Documents and Settings\All Users\Application Data\EPSON
2008-01-13 10:39 . 2008-01-13 10:39 27 --a

C:\WINDOWS\CDE SPR360DEFGIPS.ini
2008-01-13 00:51 . 2008-01-16 22:31 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\uTorrent
2008-01-12 23:16 . 2008-01-13 00:51 <DIR> d

C:\Program Files\uTorrent
2008-01-12 23:15 . 2008-01-12 23:15 <DIR> d

C:\Program Files\K-Lite Codec Pack
2008-01-12 23:10 . 2008-01-16 20:00 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\Ahead
2008-01-12 23:09 . 2008-01-12 23:09 <DIR> d

C:\Program Files\Nero
2008-01-12 23:09 . 2008-01-12 23:10 <DIR> d

C:\Program Files\Common Files\Ahead
2008-01-12 23:04 . 2008-01-12 23:04 <DIR> d

C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-12 22:53 . 2006-10-26 19:56 32,592 --a

C:\WINDOWS\system32\msonpmon.dll
2008-01-12 22:52 . 2008-01-12 22:52 <DIR> d

C:\Program Files\Microsoft Works
2008-01-12 22:51 . 2008-01-12 22:51 <DIR> d

C:\Program Files\Microsoft.NET
2008-01-12 22:50 . 2008-01-12 22:50 <DIR> d

C:\Program Files\Microsoft Visual Studio 8
2008-01-12 22:49 . 2008-01-12 22:52 <DIR> d

C:\WINDOWS\SHELLNEW
2008-01-12 22:49 . 2008-01-12 23:07 <DIR> d

C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-01-12 22:48 . 2008-01-12 22:48 <DIR> dr-h

C:\MSOCache
2008-01-12 22:47 . 2008-01-13 18:53 <DIR> d

C:\Program Files\DAEMON Tools
2008-01-12 22:42 . 2008-01-12 22:42 682,232 --a

C:\WINDOWS\system32\drivers\sptd.sys
2008-01-12 22:36 . 2008-01-12 22:36 1,158 --a

C:\WINDOWS\mozver.dat
2008-01-12 22:01 . 2008-01-12 22:01 <DIR> d

C:\Documents and Settings\FelixDeSouze\Contacts
2008-01-12 21:58 . 2008-01-12 21:58 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-12 21:56 . 2008-01-12 21:56 0 --a

C:\WINDOWS\nsreg.dat
2008-01-12 21:50 . 2008-01-12 21:50 <DIR> d

C:\Program Files\MSXML 6.0
2008-01-12 21:47 . 2008-01-12 21:58 <DIR> d

C:\Program Files\Windows Live
2008-01-12 21:47 . 2008-01-12 21:58 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-12 21:46 . 2008-01-12 21:46 <DIR> d

C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-12 21:26 . 2008-01-12 22:52 <DIR> d

C:\Program Files\MSBuild
2008-01-12 21:23 . 2008-01-12 21:51 <DIR> d

C:\WINDOWS\system32\XPSViewer
2008-01-12 21:23 . 2008-01-12 21:23 <DIR> d

C:\Program Files\Reference Assemblies
2008-01-12 21:22 . 2006-06-29 13:07 14,048

C:\WINDOWS\system32\spmsg2.dll
2008-01-12 21:20 . 2008-01-12 21:20 <DIR> d

C:\Program Files\Windows Media Connect 2
2008-01-12 21:19 . 2008-01-12 21:19 <DIR> d

C:\WINDOWS\system32\drivers\UMDF
2008-01-12 21:10 . 2008-01-12 21:10 <DIR> d

C:\WINDOWS\system32\URTTemp
2008-01-12 21:01 . 2006-11-13 06:02 288,768

C:\WINDOWS\system32\rhttpaa.dll
2008-01-12 21:01 . 2006-11-13 06:02 116,736

C:\WINDOWS\system32\aaclient.dll
2008-01-12 21:01 . 2006-11-13 06:02 36,352

C:\WINDOWS\system32\tsgqec.dll
2008-01-12 20:45 . 2008-01-12 20:45 <DIR> d

C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-12 20:45 . 2008-01-13 11:08 <DIR> d

C:\Documents and Settings\FelixDeSouze\Application Data\AVG7
2008-01-12 20:45 . 2008-01-15 18:07 <DIR> d

C:\Documents and Settings\All Users\Application Data\avg7
2008-01-12 20:45 . 2008-01-12 20:45 499,712 --a

C:\WINDOWS\system32\msvcp71.dll
2008-01-12 20:45 . 2008-01-12 20:45 348,160 --a

C:\WINDOWS\system32\msvcr71.dll
2008-01-12 20:36 . 2008-01-12 20:36 <DIR> d

C:\Program Files\SigmaTel
2008-01-12 20:36 . 2008-01-13 10:44 <DIR> d--h

C:\Program Files\InstallShield Installation Information
2008-01-12 20:28 . 2006-10-16 16:10 23,856 --a

C:\WINDOWS\system32\spupdsvc.exe
2008-01-12 20:24 . 2007-07-30 19:19 43,352 --a

C:\WINDOWS\system32\wups2.dll
2008-01-12 20:24 . 2007-07-30 19:18 34,136 --a

C:\WINDOWS\system32\wucltui.dll.mui
2008-01-12 20:24 . 2007-07-30 19:19 25,944 --a

C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-01-12 20:24 . 2007-07-30 19:19 25,944 --a

C:\WINDOWS\system32\wuapi.dll.mui
2008-01-12 20:24 . 2007-07-30 19:18 20,312 --a

C:\WINDOWS\system32\wuaueng.dll.mui
2008-01-12 20:22 . 2008-01-12 20:22 <DIR> d--hs---- C:\Documents and Settings\FelixDeSouze\UserData
2008-01-12 20:16 . 2008-01-12 20:16 <DIR> d

C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-01-12 20:15 . 2008-01-12 20:15 <DIR> d

C:\WINDOWS\nview
2008-01-12 20:15 . 2007-12-05 02:53 356,352 --a

C:\WINDOWS\system32\NVUNINST.EXE
2008-01-12 20:15 . 2007-12-05 01:41 356,352 --a

C:\WINDOWS\system32\nvudisp.exe
2008-01-12 20:15 . 2008-01-16 22:27 163,353 --a

C:\WINDOWS\system32\nvapps.xml
2008-01-12 20:15 . 2007-12-05 01:41 17,737 --a

C:\WINDOWS\system32\nvdisp.nvu
2008-01-12 20:07 . 2008-01-12 20:07 <DIR> d

C:\Program Files\Intel
2008-01-12 20:06 . 2008-01-12 20:06 <DIR> d

C:\drvrtmp
2008-01-12 20:06 . 2008-01-12 20:06 <DIR> d

C:\dell
2008-01-12 20:06 . 2005-06-13 12:58 162,816 --a

C:\WINDOWS\system32\drivers\e100b325.sys
2008-01-12 20:06 . 2005-06-13 12:58 162,816 --a--c--- C:\WINDOWS\system32\dllcache\e100b325.sys
2008-01-12 20:06 . 2005-06-15 13:27 126,976 --a

C:\WINDOWS\system32\Prounstl.exe
2008-01-12 20:06 . 2005-06-16 07:48 36,864 --a

C:\WINDOWS\system32\e100bmsg.dll
2008-01-12 20:06 . 2004-10-29 17:01 19,456 --a

C:\WINDOWS\system32\IntelNic.dll
2008-01-12 20:06 . 2005-05-19 07:38 5,178 --a

C:\WINDOWS\system32\e100b325.din
2008-01-12 20:06 . 2003-11-03 18:15 1,902

C:\WINDOWS\system32\SetupBD.din
2008-01-12 20:05 . 2008-01-12 20:05 <DIR> d

C:\Program Files\Common Files\InstallShield
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-05 01:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-12 22:12 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 22:29 165784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 17:20 339968 C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-15 18:08 579072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-15 18:08 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a

2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus Photo R360 Series]
--a

2006-05-29 04:00 139264 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBOE.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
--a

2007-08-24 07:00 33648 C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a

2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a

2007-12-05 01:41 8523776 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a

2007-12-05 01:41 81920 C:\WINDOWS\system32\NvMcTray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a

2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe
R1 ndistapii;ndistapii;C:\WINDOWS\system32\drivers\ndistapii.sys [2008-01-13 10:50]
*Newly Created Service* - HTTPFILTER
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-17 22:35:50
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-17 22:37:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-17 22:37:24

Trogan · January 2008

Hi Felix,

Please do the following...

1. Open Notepad and copy/paste the text in the Quote Box below into it:

File::
C:\WINDOWS\system32\drivers\core.cache.dsk

Save this as CFScript.txt to your Desktop

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

FelixDeSouze · January 2008

Ok, I've done both.

logs attached

I tried deleting the file in safe mode which it did but now its back

--
Added:

Seems to be something other than SmitFraud.C but SmitFraud.C does come up on scans, Hmmmmmmmmmmm.

--
Added:

After some looking on the internet myself as well it seems that this is a farely new threat and I can find but 1 resolve (which didn't work).

I do not fancy formatting (altough I got it 1 hour after formatting last time), but if push comes to shove it will be much quicker to do it :P. Let me know what you think Trogan as this one as stumped a lot of people by the looks of it.

Trogan · January 2008

Hi Felix,

Yes, this seems fairly new. The infection looks to be hiding files.

Lets try this...

1. Please download Deckard's System Scanner (DSS) to your desktop.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
When the scan is complete, a text file will open - Main.txt
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of Main.txt in your thread in the HijackThis Log Help Forum.
A folder, C:\Deckard\System Scanner, will also open. In it will be another text file, Extra.txt.
Please also copy the contents of Extra.txt to your post as well.
Note: some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so.

What DSS will do:
create a new System Restore point in Windows XP and Vista.
clean your Temporary Files, Downloaded Program Files, and Internet Cache Files, and also empty the Recycle Bin on all drives.
check some important areas of your system and produce a report for your analyst to review. DSS automatically runs HijackThis for you, but it will also install and place a shortcut to HijackThis on your desktop if you do not already have HijackThis installed.

2. Please download gmer.zip from Gmer and save it to your desktop.

Right click on gmer.zip and select Extract All....
Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
Click on the Browse button. Click on Desktop. Then click OK.
Click Next. It will start extracting.
Once done, check (tick) the Show extracted files box and click Finish.
Double click on gmer.exe to run it.
Select the Rootkit tab.
On the right hand side, check all the items to be scanned, but leave Show All box unchecked.
Select all drives that are connected to your system to be scanned.
Click on the Scan button.
When the scan is finished, click Copy to save the scan log to the Windows clipboard.
Open Notepad or a similar text editor.
Paste the clipboard contents into the text editor.
Save the Gmer scan log and post it in your next reply.
Close Gmer.
Open Command Prompt by going to Start > Run and type in cmd. Press Enter.
In Command Prompt, type in net stop gmer. Press Enter.
Type in exit to close Command Prompt.

Note: Do not run any programs while Gmer is running.

3. Post the DSS logs, and the GMER log.

FelixDeSouze · January 2008

Scanned, log's attached

the net stop gmer came up saying the server was not running.

Trogan · January 2008

Hi Felix,

Sorry for the delay.

Please do the folllowing...

1. I'd like a file scanned:

Go to VirusTotal
Copy and paste the following file path into the Search Box in the middle of the page:
C:\WINDOWS\System32\Drivers\aqbmczgl.SYS
Now, click on the Send File button
Save a copy of the Anti-Virus results. Post the results in your next reply.

2. Open Notepad and copy/paste the text in the Quote Box below into it:

File::
C:\WINDOWS\system32\drivers\ndistapii.sys

Driver::
ndistapii

Save this as CFScript.txt to your Desktop

Referring to the picture above, drag CFScript.txt into ComboFix.exe

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

3. Please post the VirusTotal results, along with the ComboFix log.

FelixDeSouze · January 2008

Hi Trogan,

No problem mate.. I have given up with the will to live, I literally just formatted.. I'm really grateful for all your help and time.. If you want a forum signature (with man u) then please let me know! Even though I live near liverpool (but I don't like football) I will be happy to make you one!!!

I'm really grateful for your help!

Trogan · January 2008

You're welcome!

This infection, which is new to me, hides other files associated with it, hence its stubbornness to go.

Make sure you get an Anti-Virus and Firewall first, although I'm sure you know that.

Thanks for the signature offer. I'll let you know if I would like one.

FelixDeSouze · January 2008

Yeah! I have installed them! Not a software firewall though, can you suggest a good software firewall?

Sure, I'll be Folding@Home now my PC is clean

Trogan · January 2008

I use Comodo. Give it a try.

There is also Zone Alarm, Sunbelt Kerio PF and Outpost Firewall.

FelixDeSouze · January 2008

Thanks mate, will get Comodo! Not used a software firewalla since Zone Alarm (I don't really like ZoneAlarm tho)

Thanks again!!

Trogan · January 2008

You're welcome!

I'll archive this thread.

SmitFraud.C - Please help remove

Comments