Whenever I open an Internet Explorer Window another one pops open as well. I have TrendMicro anti-virus and it foun 25 Trojan, 22 of them are TROJ_VUNDO, but could not clean any of them. How can I clean them? Here is the Hijack This log, thanks:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:33 AM, on 12/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\Program Files\lotus\notes\nslsvice
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Intel\Wireless\Bin\E
C:\Program Files\Intel\Wireless\Bin\S
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aol
C:\Program Files\TOSHIBA\ConfigFree\C
C:\WINDOWS\system32\cisvc.
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\DVDRAM
C:\WINDOWS\system32\inetsr
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\nvsvc3
C:\WINDOWS\System32\svchos
C:\PROGRA~1\POWERC~1\pcns.
C:\Program Files\Intel\Wireless\Bin\R
C:\Program Files\Java\jre1.5.0_04\bin
C:\WINDOWS\system32\svchos
c:\TOSHIBA\IVP\swupdate\sw
C:\WINDOWS\system32\ThpSrv
C:\Program Files\TOSHIBA\TME3\Tmesbs3
C:\Program Files\TOSHIBA\TME3\Tmesrv3
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\iTivity\bin\rfbd.exe
C:\Program Files\Viewpoint\Common\Vie
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\GoogleToolbar
C:\WINDOWS\system32\ctfmon
C:\WINDOWS\TEMP\SV429A.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Trend Micro\OfficeScan Client\pccntupd.exe
C:\WINDOWS\system32\cidaem
C:\WINDOWS\system32\cidaem
C:\Program Files\Trend Micro\OfficeScan Client\pccnt.exe
C:\WINDOWS\system32\rundll
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R1 - HKCU\Software\Microsoft\Wi
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-0
O2 - BHO: (no name) - {951e93a1-0b71-4130-93fc-3
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-C
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysr
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKLM\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKLM\..\Run: [004d0017] rundll32.exe "C:\WINDOWS\system32\tehom
O4 - HKLM\..\Run: [CPM037e338b] Rundll32.exe "c:\windows\system32\gidah
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - HKUS\S-1-5-19\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKUS\S-1-5-20\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSC
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSC
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-0
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O10 - Unknown file in Winsock LSP: pl15w2sp.dll
O16 - DPF: {00134F72-5284-44F7-95A8-5
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {30528230-99f7-4bb4-88d8-f
O16 - DPF: {35C3D91E-401A-4E45-88A5-F
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0
O16 - DPF: {8990AFAD-D352-42AC-A72F-A
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-3
O16 - DPF: {B996510E-30C9-4083-ADB9-9
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-D
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-0
O20 - AppInit_DLLs: c:\windows\system32\jomote
O20 - Winlogon Notify: TosBtNP - C:\WINDOWS\SYSTEM32\TosBtN
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aol
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\C
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAM
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\E
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: iTivity Live Support Connector Direct (iTivityODConnector) - Tridia Corporation - C:\Program Files\iTivity\bin\connecto
O23 - Service: iTivity Live Support Connector To IAS (iTivityODConnectToIASConn
O23 - Service: iTivity Live Support Controller (iTivityODController) - Tridia Corporation - C:\Program Files\iTivity\bin\processo
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\Program Files\lotus\notes\nslsvice
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: PowerChute Network Shutdown (PowerChuteNetShut) - APC - C:\PROGRA~1\POWERC~1\pcns.
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\R
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\sw
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs3
O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv3
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: TridiaFTP Server (TridiaFTPServer) - Tridia Corporation - C:\Program Files\iTivity\bin\ftpd.exe
O23 - Service: Tridia Screen Server (tridiavnc) - Tridia Corporation - C:\Program Files\iTivity\bin\rfbd.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\Vie
--
End of file - 13794 bytes
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
I also wanted to note that although we use TrendMicro products on a corporate level, I have had nothing but trouble with them on a personal level. I would highly recommend the free Avast! anti-virus software: http://avast.com or the also free AVG: http://free.avg.com. I have had some minor issues with AVG and the only draw back to Avast is it slows down computer login/startup as it basically won't allow you to do anything until it has had a chance to update.
I would suggest you give your Antivirus solution a go while running in safe mode, this way the trojan will not be active in memory & will be easier to clean up.
you can also try Microsoft Malicious Software removal tool http://www.microsoft.com/d
which includes the latest versions of Vundo in their Database.
also give Malwarebytes antimalware a go
Download Malwarebytes AntiMalware http://www.malwarebytes.or
Install, update online & run a full scan
if the problem persists, we may need to use Combofix
please read the instructions carefully first
http://www.bleepingco
h
I would use Combofix for vundo infections, it's the best one for these infection, or use MalwareBytes also as already suggested. MalwareBytes also removes some vundo variants.
Combofix has a script feature that we can use to remove what's not remove during the first run(which happens often with vundo/conhook infection.
I ran Malwarebytes and it said it removed all infected files. Here is the log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:55:44 PM, on 12/13/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\Program Files\lotus\notes\nslsvice
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\Program Files\Intel\Wireless\Bin\E
C:\Program Files\Intel\Wireless\Bin\S
C:\WINDOWS\system32\spools
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aol
C:\Program Files\TOSHIBA\ConfigFree\C
C:\WINDOWS\system32\cisvc.
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\WINDOWS\system32\DVDRAM
C:\WINDOWS\system32\inetsr
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\WINDOWS\system32\nvsvc3
C:\WINDOWS\System32\svchos
C:\PROGRA~1\POWERC~1\pcns.
C:\Program Files\Intel\Wireless\Bin\R
C:\Program Files\Java\jre1.5.0_04\bin
C:\WINDOWS\system32\svchos
c:\TOSHIBA\IVP\swupdate\sw
C:\WINDOWS\system32\ThpSrv
C:\Program Files\TOSHIBA\TME3\Tmesbs3
C:\Program Files\TOSHIBA\TME3\Tmesrv3
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\iTivity\bin\rfbd.exe
C:\Program Files\Viewpoint\Common\Vie
C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
C:\WINDOWS\TEMP\DB742B.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\cidaem
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\GoogleToolbar
C:\WINDOWS\system32\ctfmon
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R1 - HKCU\Software\Microsoft\Wi
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-7
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-0
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-C
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-C
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-0
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysr
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon
O4 - HKUS\S-1-5-19\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKUS\S-1-5-20\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON
O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSC
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\CTFMON
O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSC
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-0
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-0
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {00134F72-5284-44F7-95A8-5
O16 - DPF: {08D75BB0-D2B5-11D1-88FC-0
O16 - DPF: {08D75BC1-D2B5-11D1-88FC-0
O16 - DPF: {17492023-C23A-453E-A040-C
O16 - DPF: {30528230-99f7-4bb4-88d8-f
O16 - DPF: {35C3D91E-401A-4E45-88A5-F
O16 - DPF: {5EFE8CB1-D095-11D1-88FC-0
O16 - DPF: {8990AFAD-D352-42AC-A72F-A
O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-3
O16 - DPF: {B996510E-30C9-4083-ADB9-9
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-D
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1
O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-0
O20 - AppInit_DLLs: c:\windows\system32\jomote
O20 - Winlogon Notify: TosBtNP - C:\WINDOWS\SYSTEM32\TosBtN
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aol
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\C
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAM
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\E
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: iTivity Live Support Connector Direct (iTivityODConnector) - Tridia Corporation - C:\Program Files\iTivity\bin\connecto
O23 - Service: iTivity Live Support Connector To IAS (iTivityODConnectToIASConn
O23 - Service: iTivity Live Support Controller (iTivityODController) - Tridia Corporation - C:\Program Files\iTivity\bin\processo
O23 - Service: Lotus Notes Single Logon - IBM Corp - C:\Program Files\lotus\notes\nslsvice
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc3
O23 - Service: OfficeScanNT Personal Firewall (OfcPfwSvc) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\OfcPfwSvc.exe
O23 - Service: PowerChute Network Shutdown (PowerChuteNetShut) - APC - C:\PROGRA~1\POWERC~1\pcns.
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\R
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\sw
O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv
O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs3
O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv3
O23 - Service: OfficeScanNT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: TridiaFTP Server (TridiaFTPServer) - Tridia Corporation - C:\Program Files\iTivity\bin\ftpd.exe
O23 - Service: Tridia Screen Server (tridiavnc) - Tridia Corporation - C:\Program Files\iTivity\bin\rfbd.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\Vie
--
End of file - 12655 bytes
Looks better. Except for this portion: O20 - AppInit_DLLs: c:\windows\system32\jomote
You need to run the VUNDOFIX portion of those directions or run ComboFix, either one should take care of the rest of the problem. How is the machine running.
Hijackthis is still showing the vundo/conhook files, whether the infection is still active or not since running MalwareBytes, hijackthis log can't tell us.
Can you show us the MalwareBytes log so we'll know what has been deleted?
I would try combofix, but that's up to you.
O4 - HKUS\S-1-5-19\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O4 - HKUS\S-1-5-20\..\Run: [yogehevuda] Rundll32.exe "C:\WINDOWS\system32\duvap
O20 - AppInit_DLLs: c:\windows\system32\jomote
The Internet works fine now, here is the Malware Log, before and after:
Before:
Malwarebytes' Anti-Malware 1.31
Database version: 1497
Windows 5.1.2600 Service Pack 2
12/13/2008 3:27:43 PM
mbam-log-2008-12-13 (15-27-43).txt
Scan type: Quick Scan
Objects scanned: 78762
Time elapsed: 11 minute(s), 6 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 5
Registry Keys Infected: 6
Registry Values Infected: 5
Registry Data Items Infected: 5
Folders Infected: 0
Files Infected: 67
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
C:\WINDOWS\system32\tehoma
c:\WINDOWS\system32\gidahu
C:\WINDOWS\system32\duvapa
C:\WINDOWS\system32\rurisu
C:\WINDOWS\system32\seyile
Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_CLASSES_ROOT\CLSID\{9
HKEY_CLASSES_ROOT\CLSID\{e
HKEY_CURRENT_USER\SOFTWARE
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SOFTWAR
HKEY_LOCAL_MACHINE\SYSTEM\
HKEY_LOCAL_MACHINE\SOFTWAR
Folders Infected:
(No malicious items detected)
Files Infected:
C:\WINDOWS\system32\fozehu
C:\WINDOWS\system32\akuhez
C:\WINDOWS\system32\gavulo
C:\WINDOWS\system32\ewoluv
C:\WINDOWS\system32\gigijo
C:\WINDOWS\system32\omojig
C:\WINDOWS\system32\hujepa
C:\WINDOWS\system32\akapej
C:\WINDOWS\system32\kiyitu
C:\WINDOWS\system32\ehutiy
C:\WINDOWS\system32\lirote
C:\WINDOWS\system32\uyetor
C:\WINDOWS\system32\lizate
C:\WINDOWS\system32\afetaz
C:\WINDOWS\system32\lobofe
C:\WINDOWS\system32\unefob
C:\WINDOWS\system32\numonu
C:\WINDOWS\system32\ijunom
C:\WINDOWS\system32\pimimo
C:\WINDOWS\system32\osomim
C:\WINDOWS\system32\riveso
C:\WINDOWS\system32\ogosev
C:\WINDOWS\system32\rohoke
C:\WINDOWS\system32\ukekoh
C:\WINDOWS\system32\setunu
C:\WINDOWS\system32\edunut
C:\WINDOWS\system32\tehoma
C:\WINDOWS\system32\ekamoh
C:\WINDOWS\system32\tulago
C:\WINDOWS\system32\azogal
C:\WINDOWS\system32\tuteme
C:\WINDOWS\system32\ipemet
C:\WINDOWS\system32\vunoge
C:\WINDOWS\system32\unegon
C:\WINDOWS\system32\yesile
C:\WINDOWS\system32\ayelis
C:\WINDOWS\system32\zomuhi
C:\WINDOWS\system32\uwihum
C:\WINDOWS\system32\zoyulo
C:\WINDOWS\system32\uloluy
C:\WINDOWS\system32\duvapa
c:\WINDOWS\system32\gidahu
C:\WINDOWS\system32\rurisu
C:\WINDOWS\system32\seyile
C:\WINDOWS\system32\av.dat
C:\WINDOWS\system32\fenefe
C:\WINDOWS\system32\fenoza
C:\WINDOWS\system32\fisibe
C:\WINDOWS\system32\gijoye
C:\WINDOWS\system32\guwuki
C:\WINDOWS\system32\kenaho
C:\WINDOWS\system32\piwihi
C:\WINDOWS\system32\siguzu
C:\WINDOWS\system32\sotuwi
C:\WINDOWS\system32\sowema
C:\WINDOWS\system32\dageno
C:\WINDOWS\system32\dayoya
C:\WINDOWS\Temp\TDSSe8de.t
C:\WINDOWS\Downloaded Program Files\atmgr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\wertyu
C:\WINDOWS\system32\getwn3
C:\WINDOWS\system32\TDSSlx
C:\RECYCLER\ADAPT_Installe
C:\WINDOWS\Temp\TDSSe61f.t
C:\Documents and Settings\cconstantinescu.T
C:\Documents and Settings\cconstantinescu.T
C:\WINDOWS\system32\TDSSkk
After:
Malwarebytes' Anti-Malware 1.31
Database version: 1497
Windows 5.1.2600 Service Pack 2
12/13/2008 3:55:26 PM
mbam-log-2008-12-13 (15-55-26).txt
Scan type: Quick Scan
Objects scanned: 78244
Time elapsed: 9 minute(s), 43 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
(No malicious items detected)
@Admin2\3k,
This is not the first time that you've duplicated other people's comment.
In the future please read the whole thread before posting, or give them credit if you need to mention a tool that has already been suggested.
Pardon me for asking , but how exactly is my answer a duplication of what was posted before me ????
I have no issue with the points reassignment, but I think this is an overstatement, I support users to the best of my Knowledge & I never try to take the credit for a solution I didn't provide , just because I suggested a program among the steps I usually give , ( I am sure most experts have a standard response for the frequently encountered problems) , that means I am duplicating other experts solutions ???.
admin3k,
>>>Pardon me for asking , but how exactly is my answer a duplication of what was posted before me ????<<<
You repeated the suggestion of the same tool, that's the duplication that I mean.
I have seen many of your posts suggesting tools which has already been suggested. Either because you didn't read the whole thread or you just disregard other experts' input.
>>>just because I suggested a program among the steps I usually give , ( I am sure most experts have a standard response for the frequently encountered problems) , that means I am duplicating other experts solutions ???.<<<
You need to tailor your responses to what's already been posted on the thread. You can not just paste your standard reply if it no longer apply because someone else had already suggested one of the tools in your canned.
If you had to add to their suggestions then give them credit, let it known that it has already been suggested.
EE's Help page guidelines clearly says:
"Read previous posts before commenting: It is important to read the entire thread so that you know the current situation. That will keep you from posting a duplicate answer or one that has already been shown not to work. If you basically agree with another comment but have something more to add, remember to give credit for the original suggestion."
http://www.exp
And when you find that an Asker has awarded you all the points which should've been at least shared, then follow my example and don't take advantage of the whole situation.
http://www.exper
Business Accounts
Answer for Membership
by: IdeasUnknownPosted on 2008-12-13 at 08:54:42ID: 23164534
This information has worked for me in the past. Make sure you follow the instructions perfectly. Both methods work, I usually use the VUNDOFIX method, but the Malwarebyte's method works well also.
http://www.bleepingcompute
Once you have run the instructions provided on that site, run another Hijack This log and compare. I have noticed in the log you already posted that you also need to run LSPFix from Cexx.org or the likes: http://www.cexx.org/lspfix
Once you have run both of those you should run a hijack this again and compare again. Please let us know what happens or what you find after doing this.