Hi all,
Is there anyone knows exactly what this worm does to system/network? I've been searching online and only found Conficker of variation A-E, no information about Conficker.M.. and is there any cure for it?
For previous variation of 'Conficker', Microsoft support had suggested Malicious Software Removal Tools and Windows update. I have done so but it haven't solve the issue.
The symptoms are as follow:
1. System cannot run windows update. The error message as follow appeared:
<<Internet Explorer - Security Warning
Windows has found a problem with this file.
Name: wuweb_site.cab?12487504178
Publisher: Unknown Publisher>>
2. Domain user accounts are constantly being locked out automatically.
Please help. Thanks!
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
F-secure removal tool can help for this
check below link
http://www.f-secure.com/we
download F-Downadup tool
start u r computer in safe mode with networking > unplug network cable.
and run the tool. ( dont forget to read readme.txt or help file from tool which have special command to disinfect the work like f-downadup.exe -d)
Hi Jonvee and xtreminator,
Thanks for your replies and sorry for my late response. I can remove Conficker.M remotely by using bdtools(network), but not all can be remove remotely, some others I need to remove it using single PC removal tool... just that it only remove it for a while, then the Conficker.M keep coming back over and over again.
As for the second solution(f-secure), I'll update with you a bit later since I'm still working on it. Thanks!
Hi Jonvee and xtreminator,
Thanks for your replies and sorry for my late response. I can remove Conficker.M remotely by using bdtools(network), but not all can be remove remotely, some others I need to remove it using single PC removal tool... just that it only remove it for a while, then the Conficker.M keep coming back over and over again.
As for the second solution(f-secure), I'll update with you a bit later since I'm still working on it. Thanks!
Ok thanks. If you are not successful with the second solution(f-secure) may i suggest you try running Combofix. Download ComboFix and save to your Desktop >
http://download.bleepingco
Before using ComboFix please disable any realtime Anti-virus, Anti-spyware, Shields, etc. that you may have running.
Also it may be necessary to rename ComboFix.exe to Combo-Fix.exe (for example), before saving it to your desktop. If you have difficulties downloading it, try downloading to another computer, then into a USB memory stick (or equivalent). Rename it and connect to all the infected machines, as appropriate.
Double click "combofix.exe" and follow the prompts.
When it's finished it will have produced a Logfile, probably at C:\ComboFix.txt.
You could post that log together with a HijackThis log, in a reply for us.
Please do not mouseclick Combofix's window while it is running, because it may stall. It is absolutely normal for you to see a blue screen with flashing cursor, and this can last for up to 30 mins.
Ideally ComboFix should be run in normal mode, although it will work in safe mode.
Thanks for the suggestion. I have run ComboFix on one of the infected PC.
The content of the ComboFix.txt is as follow:
ComboFix 09-08-10.06 - latiffahw 12/08/2009 16:03.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18
Running from: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((
.
C:\ARK8.tmp
c:\recycler\S-1-5-21-16752
c:\windows\Installer\1d51d
.
((((((((((((((((((((((((( Files Created from 2009-07-12 to 2009-08-12 ))))))))))))))))))))))))))
.
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-12 05:20 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-06-18 02:45 . 2009-06-15 08:50 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 06:38 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager Data
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 389497 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 127347 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 1761655 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 348532 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
R2 LockServ;LockServ;c:\acer\
S2 jvlrngukc;Microsoft Task;c:\windows\system32\s
S2 upocvzmq;Driver Windows;c:\windows\system3
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-12 16:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\ac3acm
c:\windows\system32\lameAC
c:\windows\system32\igfxde
.
Completion time: 2009-08-12 16:10
ComboFix-quarantined-files
Pre-Run: 20,335,386,624 bytes free
Post-Run: 25,195,130,880 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
169
While HJT log is as follow:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:13:00, on 12/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Acer\Empowering Technology\ePerformance\Me
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Acer\LANScope Agent\awServ.exe
C:\Acer\Empowering Technology\eLock\LockServ.
C:\WINDOWS\system32\lyncus
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchos
C:\WINDOWS\system32\wbem\w
C:\Program Files\CyberLink\PowerDVD\P
C:\Program Files\Java\jre1.5.0_06\bin
C:\WINDOWS\system32\SysMon
C:\Acer\Empowering Technology\eDataSecurity\e
C:\WINDOWS\SkyTel.EXE
C:\Acer\LANScope Agent\awtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtr
C:\WINDOWS\system32\hkcmd.
C:\Acer\Empowering Technology\eLock\Monitor\L
C:\WINDOWS\system32\igfxpe
C:\Program Files\Picasa2\PicasaMediaD
C:\WINDOWS\system32\ctfmon
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-F
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-D
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-3
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-D
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\P
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IM
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PI
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TI
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TI
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMon
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\e
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\L
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAge
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AdminWorks Tray] "C:\Acer\LANScope Agent\awtray.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [ImageItEncrypt] C:\WINDOWS\system32\ImageI
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobs
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaD
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {6414512B-B978-451D-A0D8-F
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS2\Services\T
O17 - HKLM\System\CS3\Services\T
O17 - HKLM\System\CS4\Services\T
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: Lync USB Auditor Service (LyncUSBServ) - Lync Software Pty Ltd - C:\WINDOWS\system32\lyncus
--
End of file - 7755 bytes
Thanks for the suggestion. I have run ComboFix on one of the infected PC.
The content of the ComboFix.txt is as follow:
ComboFix 09-08-10.06 - latiffahw 12/08/2009 16:03.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18
Running from: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((
.
C:\ARK8.tmp
c:\recycler\S-1-5-21-16752
c:\windows\Installer\1d51d
.
((((((((((((((((((((((((( Files Created from 2009-07-12 to 2009-08-12 ))))))))))))))))))))))))))
.
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-12 05:20 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-06-18 02:45 . 2009-06-15 08:50 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-16 06:38 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager Data
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 389497 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 127347 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 1761655 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-18 00:00 . 2009-06-04 23:56 348532 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
R2 LockServ;LockServ;c:\acer\
S2 jvlrngukc;Microsoft Task;c:\windows\system32\s
S2 upocvzmq;Driver Windows;c:\windows\system3
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-12 16:09
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(700)
c:\windows\system32\ac3acm
c:\windows\system32\lameAC
c:\windows\system32\igfxde
.
Completion time: 2009-08-12 16:10
ComboFix-quarantined-files
Pre-Run: 20,335,386,624 bytes free
Post-Run: 25,195,130,880 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
169
While HJT log is as follow:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:13:00, on 12/08/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.e
C:\WINDOWS\system32\winlog
C:\WINDOWS\system32\servic
C:\WINDOWS\system32\lsass.
C:\WINDOWS\system32\svchos
C:\WINDOWS\System32\svchos
C:\WINDOWS\system32\spools
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Acer\Empowering Technology\ePerformance\Me
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Acer\LANScope Agent\awServ.exe
C:\Acer\Empowering Technology\eLock\LockServ.
C:\WINDOWS\system32\lyncus
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchos
C:\WINDOWS\system32\wbem\w
C:\Program Files\CyberLink\PowerDVD\P
C:\Program Files\Java\jre1.5.0_06\bin
C:\WINDOWS\system32\SysMon
C:\Acer\Empowering Technology\eDataSecurity\e
C:\WINDOWS\SkyTel.EXE
C:\Acer\LANScope Agent\awtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtr
C:\WINDOWS\system32\hkcmd.
C:\Acer\Empowering Technology\eLock\Monitor\L
C:\WINDOWS\system32\igfxpe
C:\Program Files\Picasa2\PicasaMediaD
C:\WINDOWS\system32\ctfmon
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThi
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R1 - HKLM\Software\Microsoft\In
R0 - HKLM\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\In
R1 - HKCU\Software\Microsoft\Wi
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-F
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D
O2 - BHO: Ask Toolbar BHO - {F0D4B231-DA4B-4daf-81E4-D
O3 - Toolbar: Acer eDataSecurity Management - {5CBE3B7C-1E47-477e-A7DD-3
O3 - Toolbar: Ask Toolbar - {F0D4B239-DA4B-4daf-81E4-D
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\P
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IM
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PI
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TI
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TI
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin
O4 - HKLM\..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMon
O4 - HKLM\..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\e
O4 - HKLM\..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\L
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAge
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AdminWorks Tray] "C:\Acer\LANScope Agent\awtray.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtr
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpe
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [ImageItEncrypt] C:\WINDOWS\system32\ImageI
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobs
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaD
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe
O4 - Startup: Microsoft Office Outlook 2003.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-0
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-0
O16 - DPF: {6414512B-B978-451D-A0D8-F
O16 - DPF: {6E32070A-766D-4EE6-879C-D
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\Software\..\Telephony
O17 - HKLM\System\CCS\Services\T
O17 - HKLM\System\CS1\Services\T
O17 - HKLM\System\CS2\Services\T
O17 - HKLM\System\CS3\Services\T
O17 - HKLM\System\CS4\Services\T
O23 - Service: Memory Check Service (AcerMemUsageCheckService)
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AdminWorks Agent X6 (AWService) - OSA Technologies Inc., An Avocent Company - C:\Acer\LANScope Agent\awServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver
O23 - Service: LockServ - Unknown owner - C:\Acer\Empowering Technology\eLock\LockServ.
O23 - Service: Lync USB Auditor Service (LyncUSBServ) - Lync Software Pty Ltd - C:\WINDOWS\system32\lyncus
--
End of file - 7755 bytes
From your HJT log you can Fix this>
R1 - HKCU\Software\Microsoft\Wi
You probably know this IP or Domain (172.17.125.1} ? If you don't you can 'fix' it >
O17 - HKLM\System\CCS\Services\T
Working on your CF log but it'll take a while ...
After closer inspection of the CF log have found what appears to be further infection.
Please run combofix again on that same infected PC, using the following script >>
1. Open Notepad.
2. Copy & paste all text between the lines below, into Notepad window:
==========================
File::
c:\windows\system32\vvifyc
c:\program files\Movie Maker\vvifycbk.dll
Registry::
[-HKEY_LOCAL_MACHINE\Syste
"ServiceDll"="c:\windows\s
[-HKEY_LOCAL_MACHINE\Syste
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
==========================
3. Now Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt just created into ComboFix.exe. This will re-start ComboFix, & hopefully the problem is removed.
5. Finally, please attach the newComboFix logfile.
Hi, here's the logfile after I follow the instructions given:
ComboFix 09-08-10.06 - latiffahw 18/08/2009 8:58.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.
Running from: c:\documents and settings\latiffahw\Desktop
Command switches used :: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\program files\Movie Maker\vvifycbk.dll"
"c:\windows\system32\vvify
.
((((((((((((((((((((((((( Files Created from 2009-07-18 to 2009-08-18 ))))))))))))))))))))))))))
.
2009-08-12 08:12 . 2009-08-12 08:12 -------- d-----w- c:\program files\Trend Micro
2009-08-12 07:59 . 2009-08-12 08:10 -------- d-s---w- C:\Combo-Fix
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-13 00:56 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
+ 2009-08-12 23:54 . 2009-08-12 23:54 16384 c:\windows\temp\Perflib_Pe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com.my/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-18 09:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2696)
c:\windows\system32\MSNCHA
c:\windows\system32\sysenv
c:\windows\system32\Crypto
c:\windows\system32\MFC71U
c:\windows\system32\iefram
c:\windows\system32\OneX.D
c:\windows\system32\eapppr
c:\windows\system32\WPDShS
c:\windows\system32\Portab
c:\windows\system32\Portab
.
Completion time: 2009-08-18 9:03
ComboFix-quarantined-files
ComboFix2.txt 2009-08-12 08:10
Pre-Run: 25,198,206,976 bytes free
Post-Run: 25,162,502,144 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
172
Thanks.
Hi, here's the logfile after I follow the instructions given:
ComboFix 09-08-10.06 - latiffahw 18/08/2009 8:58.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.
Running from: c:\documents and settings\latiffahw\Desktop
Command switches used :: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
"c:\program files\Movie Maker\vvifycbk.dll"
"c:\windows\system32\vvify
.
((((((((((((((((((((((((( Files Created from 2009-07-18 to 2009-08-18 ))))))))))))))))))))))))))
.
2009-08-12 08:12 . 2009-08-12 08:12 -------- d-----w- c:\program files\Trend Micro
2009-08-12 07:59 . 2009-08-12 08:10 -------- d-s---w- C:\Combo-Fix
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-13 00:56 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
+ 2009-08-12 23:54 . 2009-08-12 23:54 16384 c:\windows\temp\Perflib_Pe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com.my/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-18 09:01
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(2696)
c:\windows\system32\MSNCHA
c:\windows\system32\sysenv
c:\windows\system32\Crypto
c:\windows\system32\MFC71U
c:\windows\system32\iefram
c:\windows\system32\OneX.D
c:\windows\system32\eapppr
c:\windows\system32\WPDShS
c:\windows\system32\Portab
c:\windows\system32\Portab
.
Completion time: 2009-08-18 9:03
ComboFix-quarantined-files
ComboFix2.txt 2009-08-12 08:10
Pre-Run: 25,198,206,976 bytes free
Post-Run: 25,162,502,144 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
172
Thanks.
Now that you have run ComboFix, could you confirm whether you can now run windows update, and are the Domain User accounts still being locked out?
If you are still having a problem, it may well be related to the vvifycbk.dll file. As it's proving difficult to remove would you try running this additional script on the same infected PC and reporting back please?
1. Open Notepad.
2. Copy & paste all text between the lines below, into Notepad window:
==========================
File::
c:\windows\system32\vvifyc
c:\program files\Movie Maker\vvifycbk.dll
Registry::
[-HKEY_LOCAL_MACHINE\Syste
"ServiceDll"="-
[-HKEY_LOCAL_MACHINE\Syste
"ServiceDll"="-
==========================
3. Now Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt just created into ComboFix.exe. This will re-start ComboFix.
5. Finally, please attach the newComboFix logfile.
If that doesn't do the trick would you like to consider posting your question in more than one zone? You could click on this link to select "Asking Questions", then see Step 3: Select One or More Zones >
http://www.experts-exchang
Here you are able to select or deselect any zone. Most questions can be posted in three zones.
Recommend you try this one first >
http://www.experts-exchang
Will continue to monitor and investigate further, & wait for your report back ...
Hi, the Domain User accounts still locked out automatically. After second time running it with script you've given, the WORM\Conficker.M seems not coming back anymore but another variant of conficker appeared, which is WORM\Conficker.Z.30. For Windows Update, the previous error message did not appear anymore but still cannot go through the update as the following message appear:
--------------------------
Files required to use Microsoft Update are no longer registered or installed on your computer. To continue:
- Register or reinstall the files for me now (Recommended)
- Let me read about more steps that might be required to solve the problem.
I continued with the first option and the following error occur:
Error number: 0x8007041D
The website has encountered a problem and cannot display display the page you are trying to view.
--------------------------
Our Active Directory server also infected with conficker. Is it safe to run ComboFix on it?
Here is the new ComboFix log from the same infected PC:
==========================
ComboFix 09-08-10.06 - latiffahw 20/08/2009 11:27.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18
Running from: c:\documents and settings\latiffahw\Desktop
Command switches used :: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
.
- REDUCED FUNCTIONALITY MODE -
FILE ::
"c:\program files\Movie Maker\vvifycbk.dll"
"c:\windows\system32\vvify
.
((((((((((((((((((((((((( Files Created from 2009-07-20 to 2009-08-20 ))))))))))))))))))))))))))
.
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-13 00:56 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-08-12 08:12 . 2009-08-12 08:12 -------- d-----w- c:\program files\Trend Micro
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
+ 2009-08-19 23:57 . 2009-08-19 23:57 16384 c:\windows\temp\Perflib_Pe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
R2 LockServ;LockServ;c:\acer\
S2 jvlrngukc;Microsoft Task;c:\windows\system32\s
S2 upocvzmq;Driver Windows;c:\windows\system3
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com.my/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-20 11:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3220)
c:\windows\system32\MSNCHA
c:\windows\system32\sysenv
c:\windows\system32\Crypto
c:\windows\system32\MFC71U
c:\windows\system32\iefram
c:\windows\system32\OneX.D
c:\windows\system32\eapppr
c:\windows\system32\WPDShS
c:\windows\system32\Portab
c:\windows\system32\Portab
.
Completion time: 2009-08-20 11:28
ComboFix-quarantined-files
ComboFix2.txt 2009-08-20 03:21
ComboFix3.txt 2009-08-18 01:03
ComboFix4.txt 2009-08-12 08:10
Pre-Run: 25,473,261,568 bytes free
Post-Run: 25,451,413,504 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
175
==========================
Thanks!
Hi, the Domain User accounts still locked out automatically. After second time running it with script you've given, the WORM\Conficker.M seems not coming back anymore but another variant of conficker appeared, which is WORM\Conficker.Z.30. For Windows Update, the previous error message did not appear anymore but still cannot go through the update as the following message appear:
--------------------------
Files required to use Microsoft Update are no longer registered or installed on your computer. To continue:
- Register or reinstall the files for me now (Recommended)
- Let me read about more steps that might be required to solve the problem.
I continued with the first option and the following error occur:
Error number: 0x8007041D
The website has encountered a problem and cannot display display the page you are trying to view.
--------------------------
Our Active Directory server also infected with conficker. Is it safe to run ComboFix on it?
Here is the new ComboFix log from the same infected PC:
==========================
ComboFix 09-08-10.06 - latiffahw 20/08/2009 11:27.4.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18
Running from: c:\documents and settings\latiffahw\Desktop
Command switches used :: c:\documents and settings\latiffahw\Desktop
AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-F
FW: COMODO Firewall Pro *enabled* {043803A3-4F86-4ef6-AFC5-F
.
- REDUCED FUNCTIONALITY MODE -
FILE ::
"c:\program files\Movie Maker\vvifycbk.dll"
"c:\windows\system32\vvify
.
((((((((((((((((((((((((( Files Created from 2009-07-20 to 2009-08-20 ))))))))))))))))))))))))))
.
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 21:42 1306624 ------w- c:\windows\system32\dllcac
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\msxml6
2009-07-30 02:45 . 2008-04-13 14:57 79872 ------w- c:\windows\system32\dllcac
2009-07-30 02:43 . 2009-07-30 02:45 -------- d-----w- c:\windows\ServicePackFile
.
((((((((((((((((((((((((((
.
2009-08-13 00:56 . 2009-06-16 06:38 -------- d-----w- c:\program files\Vehicle Fleet Manager
2009-08-12 08:12 . 2009-08-12 08:12 -------- d-----w- c:\program files\Trend Micro
2009-07-30 02:46 . 2005-11-27 12:42 86327 ----a-w- c:\windows\pchealth\helpct
2009-07-07 01:00 . 2009-07-07 01:00 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:40 . 2009-07-02 08:40 7680 ----a-w- c:\documents and settings\latiffahw\Applica
2009-07-02 08:17 . 2009-07-02 08:17 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 05:37 . 2009-06-26 01:02 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 01:40 . 2009-06-26 01:39 -------- d-----w- c:\program files\K-Lite Codec Pack
2009-06-26 01:33 . 2009-06-26 01:33 -------- d-----w- c:\documents and settings\latiffahw\Applica
2009-06-26 00:23 . 2005-11-27 13:06 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-22 03:40 . 2009-01-21 06:20 60 ----a-w- c:\windows\wpd99.drv
2009-06-22 03:40 . 2009-01-21 06:20 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-05-27 23:59 . 2009-02-25 05:23 75096 ----a-w- c:\windows\system32\driver
2009-05-27 23:59 . 2009-06-04 23:56 401783 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2009-05-27 23:59 . 2009-06-04 23:56 180599 ----a-w- c:\documents and settings\All Users\Application Data\Avira\AntiVir PersonalEdition Classic\TEMP\AVUPDATE_4a28
2008-02-21 06:48 . 2008-02-21 06:48 1689638 ----a-w- c:\program files\pdemoh.exe
2008-02-21 06:41 . 2008-02-21 06:41 1139254 ----a-w- c:\program files\wintwins23.exe
2007-08-24 08:14 . 2007-08-24 08:14 4291 ----a-w- c:\program files\blogsofnote.blogspot
2007-08-13 06:45 . 2007-08-13 06:45 1606064 ----a-w- c:\program files\googletalk-setup.exe
.
((((((((((((((((((((((((((
.
+ 2009-08-19 23:57 . 2009-08-19 23:57 16384 c:\windows\temp\Perflib_Pe
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\Softwar
"{0579B4B6-0293-4d73-B02D-
[HKEY_CLASSES_ROOT\clsid\{
[HKEY_LOCAL_MACHINE\~\Brow
2009-03-07 03:00 66912 ----a-w- c:\program files\AskSBar\SrchAstt\1.b
[HKEY_CURRENT_USER\SOFTWAR
"MSMSGS"="c:\program files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\SOFTWA
"LaunchApp"="Alaunch" [X]
"ntiMUI"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-12 45056]
"RemoteControl"="c:\progra
"IMJPMIG8.1"="c:\windows\I
"MSPY2002"="c:\windows\sys
"PHIME2002ASync"="c:\windo
"PHIME2002A"="c:\windows\s
"SunJavaUpdateSched"="c:\p
"Acer Empowering Technology Monitor"="c:\windows\syste
"eDataSecurity Loader"="c:\acer\Empowerin
"eLockMonitor"="c:\acer\Em
"eRecoveryService"="c:\ace
"AdminWorks Tray"="c:\acer\LANScope Agent\awtray.exe" [2006-04-18 1301504]
"igfxtray"="c:\windows\sys
"igfxhkcmd"="c:\windows\sy
"igfxpers"="c:\windows\sys
"ImageItEncrypt"="c:\windo
"Synchronization Manager"="c:\windows\syste
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaD
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" - c:\windows\system32\HdAShC
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-04-24 1448960]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-04 16206848]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2005-06-06 544768]
c:\documents and settings\Administrator\Sta
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
c:\documents and settings\latiffahw\Start Menu\Programs\Startup\
Microsoft Office Outlook 2003.lnk - c:\windows\Installer\{91CA
[HKEY_LOCAL_MACHINE\softwa
"dontdisplaylockeduserid"=
[HKEY_LOCAL_MACHINE\softwa
"NoWelcomeScreen"= 1 (0x1)
[HKEY_LOCAL_MACHINE\softwa
"UpdatesDisableNotify"=dwo
"AntiVirusOverride"=dword:
[HKLM\~\services\sharedacc
"%windir%\\system32\\sessm
"%windir%\\Network Diagnostic\\xpnetdiag.exe"
[HKLM\~\services\sharedacc
"9999:UDP"= 9999:UDP:AdminWorks UDP Port
"2804:TCP"= 2804:TCP:AdminWorks TCP Port
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22
R2 eLock2BurnerLockDriver;eLo
R2 eLock2FSCTLDriver;eLock2FS
R2 LockServ;LockServ;c:\acer\
S2 jvlrngukc;Microsoft Task;c:\windows\system32\s
S2 upocvzmq;Driver Windows;c:\windows\system3
S3 PortRW;PortRW;c:\windows\s
HKEY_LOCAL_MACHINE\SOFTWAR
jvlrngukc
upocvzmq
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com.my/
uInternet Connection Wizard,ShellNext = hxxp://global.acer.com/
uInternet Settings,ProxyOverride = 127.0.0.1;localhost;*.loca
uInternet Settings,ProxyServer = isa2006.grandperfect.com:8
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFIC
LSP: c:\program files\Microsoft Firewall Client\wspwsp.dll
TCP: {820483FB-23FF-4C81-9947-5
FF - ProfilePath - c:\documents and settings\latiffahw\Applica
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: network.proxy.http - isa2006.grandperfect.com
FF - prefs.js: network.proxy.http_port - 8080
FF - prefs.js: network.proxy.type - 1
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\Java\jre1.5.0_06\bin
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAskSBr.d
.
**************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-20 11:27
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\windows\s
--
[HKEY_LOCAL_MACHINE\System
"ServiceDll"="c:\program files\Movie Maker\vvifycbk.dll"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'explorer.exe'(3220)
c:\windows\system32\MSNCHA
c:\windows\system32\sysenv
c:\windows\system32\Crypto
c:\windows\system32\MFC71U
c:\windows\system32\iefram
c:\windows\system32\OneX.D
c:\windows\system32\eapppr
c:\windows\system32\WPDShS
c:\windows\system32\Portab
c:\windows\system32\Portab
.
Completion time: 2009-08-20 11:28
ComboFix-quarantined-files
ComboFix2.txt 2009-08-20 03:21
ComboFix3.txt 2009-08-18 01:03
ComboFix4.txt 2009-08-12 08:10
Pre-Run: 25,473,261,568 bytes free
Post-Run: 25,451,413,504 bytes free
Current=3 Default=3 Failed=1 LastKnownGood=4 Sets=1,2,3,4
175
==========================
Thanks!
I am not sure what stage you are at but having had to deal with this virus at a large school I can tell you the best tool to help with this is this one:
http://www.sophos.com/prod
Also if you want to stop it spreading use a group policy and apply the settings I have attached to disable the task scheduler service, remove permissions allowing anyone/thing to create a task.
Policy used attached you will need to rename it to .htm
Hi gpitd, thanks.
An initial check of your ComboFix log seems to show an improvement, but i'll continue to study it ...
Meanwhile, the suggestion from demazter looks promising ..
However, *if* between us we are still unable to clean your infected machine, and clean your Active Directory server, may i suggest you still copy this question to the HijackThis forum for additional help; there are some excellent people there, particularly rpggamergirl:
http://www.experts-exchang
demazter: Thanks for the suggestion, we still running sophos on some of our machines using the standalone version and saw it can detect and clean the malware. May I ask how the network version work? Can it be run on any machine in the network and clean other pc from there? I have tried to install it but not sure how to run the software after that.
Jonvee: I'll post my question to HijackThis forum as you suggested. Meanwhile we've decided to focus more on curing our servers first. Attached is HijackThis log from one of our server which is also infected and the print screen of the log from avast antivirus. Thanks.
Avast warning log
This entry can be fixed with HijackThis as can the entries i've stated below, but they're likely to "regenerate" >>
R1 - HKCU\Software\Microsoft\Wi
If you do not know this IP or Domain, you can fix this entry>
O17 - HKLM\System\CCS\Services\T
There are also a number of "023 - Servive: ..... Unknown owner - C:\WINDOWS\system32\xxxxx.
Therefore i recommend you run ComboFix on this server, as well as investigating demazter's suggestion >
Business Accounts
Answer for Membership
by: JonveePosted on 2009-07-30 at 23:00:17ID: 24986614
No mention of Conficker.M but this package removes Conficker from PCs in a Network >
"Remove Downadup(or Conficker) from infected computers":
http://www.bdtools.net/