Drabbad av Virtumonde - min HJT logg

2008-04-03, 23:39 #1

Medlem

Reg: Jan 2006

Inlägg: 235

Rubriken förklarar väl det mesta, har alltså problem med virtumonde och jag har redan kört VundoFix och VirtumundoBegone utan resultat

Hoppas det finns hopp för datorn än, ska lägga mig nu men kollar in igen på kvällen nån gång imorrn.

HJT logg

Logfile of HijackThis v1.99.1
Scan saved at 23:31:04, on 2008-04-03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE
C:\Program\Eset\nod32kui.exe
C:\Program\Repair Registry Pro\RepairRegistryPro.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Comodo\Firewall\cfp.exe
C:\Program\D-Tools\daemon.exe
C:\Program\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program\Logitech\MouseWare\system\em_exec.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
D:\spel\steam\steam.exe
C:\Program\Last.fm\LastFMHelper.exe
C:\Program\Comodo\Firewall\cmdagent.exe
C:\Program\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1053
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: {99b308c9-fb74-a57b-1204-ff251f0d25b7} - {7b52d0f1-52ff-4021-b75a-47bf9c803b99} - C:\WINDOWS\system32\ratmuiwf.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {CF272F79-C5DE-49CB-A1FB-9E865F162AE4} - C:\WINDOWS\system32\xxywUMCv.dll
O4 - HKLM\..\Run: [AtiPTA] C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Repair Registry Pro] C:\Program\Repair Registry Pro\RepairRegistryPro.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program\Comodo\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [f8cbbbcd] rundll32.exe "C:\WINDOWS\system32\pqxrsgvw.dll",b
O4 - HKLM\..\Run: [BMfbf88851] Rundll32.exe "C:\WINDOWS\system32\xhpbbwtm.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\spel\steam\steam.exe" -silent
O4 - Global Startup: Last.fm Helper.lnk = C:\Program\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program\Comodo\Firewall\cmdagent.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe

Citera

2008-04-03, 23:39 #2

Medlem

Reg: Jan 2006

Inlägg: 235

Virtumonde begone logg (fick inte plats med båda loggarna i ett inlägg)

[04/03/2008, 23:25:42] - VirtumundoBeGone v1.5 ( "C:\Documents and Settings\censur\Skrivbord\VirtumundoBeGone.exe" )
[04/03/2008, 23:25:51] - Detected System Information:
[04/03/2008, 23:25:51] - Windows Version: 5.1.2600, Service Pack 2
[04/03/2008, 23:25:51] - Current Username: censur (Admin)
[04/03/2008, 23:25:51] - Windows is in SAFE mode with Networking.
[04/03/2008, 23:25:51] - Searching for Browser Helper Objects:
[04/03/2008, 23:25:51] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/03/2008, 23:25:51] - BHO 2: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[04/03/2008, 23:25:51] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/03/2008, 23:25:51] - BHO 4: {77D3A5B4-CFD1-4046-8909-7CD99A68311F} ()
[04/03/2008, 23:25:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:51] - Checking for HKLM\...\Winlogon\Notify\urqRJBUm
[04/03/2008, 23:25:51] - Found: HKLM\...\Winlogon\Notify\urqRJBUm - This is probably Virtumundo.
[04/03/2008, 23:25:51] - Assigning {77D3A5B4-CFD1-4046-8909-7CD99A68311F} MSEvents Object
[04/03/2008, 23:25:51] - BHO list has been changed! Starting over...
[04/03/2008, 23:25:51] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/03/2008, 23:25:51] - BHO 2: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[04/03/2008, 23:25:51] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/03/2008, 23:25:51] - BHO 4: {77D3A5B4-CFD1-4046-8909-7CD99A68311F} (MSEvents Object)
[04/03/2008, 23:25:51] - ALERT: Found MSEvents Object!
[04/03/2008, 23:25:51] - BHO 5: {7b52d0f1-52ff-4021-b75a-47bf9c803b99} ()
[04/03/2008, 23:25:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:51] - Checking for HKLM\...\Winlogon\Notify\ratmuiwf
[04/03/2008, 23:25:51] - Key not found: HKLM\...\Winlogon\Notify\ratmuiwf, continuing.
[04/03/2008, 23:25:51] - BHO 6: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/03/2008, 23:25:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:51] - No filename found. Continuing.
[04/03/2008, 23:25:51] - BHO 7: {A96C7B5A-7D26-4C45-98A4-9F55B1D19A8F} ()
[04/03/2008, 23:25:51] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:51] - Checking for HKLM\...\Winlogon\Notify\xxywUMCv
[04/03/2008, 23:25:51] - Key not found: HKLM\...\Winlogon\Notify\xxywUMCv, continuing.
[04/03/2008, 23:25:52] - Finished Searching Browser Helper Objects
[04/03/2008, 23:25:52] - *** Detected MSEvents Object
[04/03/2008, 23:25:52] - Trying to remove MSEvents Object...
[04/03/2008, 23:25:53] - Terminating Process: IEXPLORE.EXE
[04/03/2008, 23:25:53] - Terminating Process: RUNDLL32.EXE
[04/03/2008, 23:25:53] - Disabling Automatic Shell Restart
[04/03/2008, 23:25:53] - Terminating Process: EXPLORER.EXE
[04/03/2008, 23:25:53] - Suspending the NT Session Manager System Service
[04/03/2008, 23:25:53] - Terminating Windows NT Logon/Logoff Manager
[04/03/2008, 23:25:53] - Re-enabling Automatic Shell Restart
[04/03/2008, 23:25:53] - File to disable: C:\WINDOWS\system32\urqRJBUm.dll
[04/03/2008, 23:25:54] - Renaming C:\WINDOWS\system32\urqRJBUm.dll -> C:\WINDOWS\system32\urqRJBUm.dll.vir
[04/03/2008, 23:25:54] - File successfully renamed!
[04/03/2008, 23:25:54] - Removing HKLM\...\Browser Helper Objects\{77D3A5B4-CFD1-4046-8909-7CD99A68311F}
[04/03/2008, 23:25:54] - Removing HKCR\CLSID\{77D3A5B4-CFD1-4046-8909-7CD99A68311F}
[04/03/2008, 23:25:54] - Adding Kill Bit for ActiveX for GUID: {77D3A5B4-CFD1-4046-8909-7CD99A68311F}
[04/03/2008, 23:25:54] - Deleting ATLEvents/MSEvents Registry entries
[04/03/2008, 23:25:54] - Removing HKLM\...\Winlogon\Notify\urqRJBUm
[04/03/2008, 23:25:54] - Searching for Browser Helper Objects:
[04/03/2008, 23:25:54] - BHO 1: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (Adobe PDF Reader Link Helper)
[04/03/2008, 23:25:54] - BHO 2: {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} (BitComet Helper)
[04/03/2008, 23:25:54] - BHO 3: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (SSVHelper Class)
[04/03/2008, 23:25:54] - BHO 4: {7b52d0f1-52ff-4021-b75a-47bf9c803b99} ()
[04/03/2008, 23:25:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:54] - Checking for HKLM\...\Winlogon\Notify\ratmuiwf
[04/03/2008, 23:25:54] - Key not found: HKLM\...\Winlogon\Notify\ratmuiwf, continuing.
[04/03/2008, 23:25:54] - BHO 5: {7E853D72-626A-48EC-A868-BA8D5E23E045} ()
[04/03/2008, 23:25:54] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:54] - No filename found. Continuing.
[04/03/2008, 23:25:54] - BHO 6: {A96C7B5A-7D26-4C45-98A4-9F55B1D19A8F} ()
[04/03/2008, 23:25:55] - WARNING: BHO has no default name. Checking for Winlogon reference.
[04/03/2008, 23:25:55] - Checking for HKLM\...\Winlogon\Notify\xxywUMCv
[04/03/2008, 23:25:55] - Key not found: HKLM\...\Winlogon\Notify\xxywUMCv, continuing.
[04/03/2008, 23:25:55] - Finished Searching Browser Helper Objects
[04/03/2008, 23:25:55] - Finishing up...
[04/03/2008, 23:25:55] - A restart is needed.
[04/03/2008, 23:26:06] - Attempting to Restart via STOP error (Blue Screen!)

Citera

2008-04-03, 23:59 #3

Medlem

Reg: Mar 2007

Inlägg: 12 238

http://www.malwarebytes.org/mbam/program/mbam-setup.exe
installera programmet och klicka på scanna när du ser den knappen.
klicka på visa resultat >ta bort markerade, nu visas en logg som du postar

Citera

2008-04-04, 07:53 #4

Medlem

Reg: Jan 2006

Inlägg: 235

Klickade tyvärr okej efter skanningen och startade därmed om datorn men i loggen stod det en del virtumonde filer. Efter omstarten så körde jag mbam igen och då hittade den inga infekterade filer, får inte lägre nåt meddelande från virusprogrammet.

mbam logg

Citera

2008-04-04, 07:55 #5

Medlem

Reg: Jan 2006

Inlägg: 235

slänger in en hjt logg också...

Logfile of HijackThis v1.99.1
Scan saved at 07:54:25, on 2008-04-04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE
C:\Program\Eset\nod32kui.exe
C:\Program\Repair Registry Pro\RepairRegistryPro.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Comodo\Firewall\cfp.exe
C:\Program\D-Tools\daemon.exe
C:\Program\Microsoft Xbox 360 Accessories\XboxStat.exe
C:\Program\Logitech\MouseWare\system\em_exec.exe
C:\Program\MSN Messenger\MsnMsgr.Exe
D:\spel\steam\steam.exe
C:\Program\Last.fm\LastFMHelper.exe
C:\Program\Comodo\Firewall\cmdagent.exe
C:\Program\Eset\nod32krn.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Malwarebytes' Anti-Malware\mbam.exe
C:\Program\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1053
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program\BitComet\tools\BitCometBHO_1.1.6.14.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [AtiPTA] C:\WINDOWS\SYSTEM32\ATIPTAXX.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Program\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Repair Registry Pro] C:\Program\Repair Registry Pro\RepairRegistryPro.exe -s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program\Comodo\Firewall\cfp.exe" -s
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [XboxStat] "C:\Program\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [f8cbbbcd] rundll32.exe "C:\WINDOWS\system32\pqxrsgvw.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\spel\steam\steam.exe" -silent
O4 - Global Startup: Last.fm Helper.lnk = C:\Program\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Unibet Poker - {C53BFCFC-7A54-4627-AEBA-2CD4871FCA97} - C:\Microgaming\Poker\UnibetpokerMPP\MPPoker.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program\Comodo\Firewall\cmdagent.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program\Eset\nod32krn.exe
O23 - Service: RadClock - Unknown owner - C:\WINDOWS\system32\RadClock.exe

Är alla elakheter borta eller är det nåt kvar att oroa sig för?

Citera

2008-04-04, 08:18 #6

Medlem

Reg: Mar 2007

Inlägg: 12 238

den här raden ska bockas för och fixas, kolla sen om filen finns
O4 - HKLM\..\Run: [f8cbbbcd] rundll32.exe "C:\WINDOWS\system32\pqxrsgvw.dll"

det ok vad man kan se i loggen

Citera

2008-04-04, 19:22 #7

Medlem

Reg: Jan 2006

Inlägg: 235

Tackar och bockar nu flyter det på här hemma igen

Citera

Drabbad av Virtumonde - min HJT logg

Skapa ett konto eller logga in för att kommentera

Skapa ett konto

Logga in