Hjt Log -- Hope You Can Advise[RESOLVED]

ballardea · November 16, 2008

HJT Log -- Hope you can advise

Hijacked by Antispyware 2009 and maybe others?

Machine is Dell 4100, XP SP3. Using Firefox 3 and McAfee Security Center from Comcast.

Problem first surfaced early Nov with new browser tabs going to Antispyware2009 pages and installer message etc.

On 11/11, the machine was totally hijacked -- any links were rederected to shopping pages, couldn't connect to any security or help sites, etc.

Was able to find a message from this site with the technique of downloading on another machine and renaming the exe file. Successfully did that for Malwarebytes' Anti-Malware, SpybotSD and Ad-Aware -- so thanks VERY much for that!!

HJT log is below, others are here to for reference.

Any advice most appreciated<

/eab

Logs -- Malwarebytes' Anti-Malware

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:

H:\Documents and Settings\EAB Personal\Local Settings\Temp\TDSS7737.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

H:\Documents and Settings\EAB Personal\Local Settings\Temp\TDSS775f.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

Logs -- SpybotSD

RegistryPatrol: [sBI $214F9A5D] Executable (File, fixed)

H:\Program Files\RegistryPatrol3.0\RegistryPatrol.exe

RegistryPatrol: [sBI $3AC3468C] Configuration file (File, fixed)

H:\WINDOWS\system32\RPVersion.ini

RegistryPatrol: [sBI $63C72677] Program directory (Directory, fixed)

H:\Program Files\RegistryPatrol3.0\

Microsoft.Windows.ActiveDesktop: [sBI $377029D9] User settings (Registry change, fixed)

HKEY_USERS\S-1-5-21-1275210071-1677128483-854245398-1004\Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoHTMLWallPaper

Microsoft.WindowsSecurityCenter.AntiVirusOverride: [sBI $3604910C] Settings (Registry change, fixed)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride

---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:48:40 PM, on 11/15/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

H:\WINDOWS\System32\smss.exe

H:\WINDOWS\system32\winlogon.exe

H:\WINDOWS\system32\services.exe

H:\WINDOWS\system32\lsass.exe

H:\WINDOWS\system32\svchost.exe

H:\WINDOWS\System32\svchost.exe

H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

H:\WINDOWS\Explorer.EXE

H:\Program Files\McAfee.com\Agent\mcagent.exe

H:\Program Files\Messenger\msmsgs.exe

H:\WINDOWS\system32\spoolsv.exe

H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

H:\Program Files\McAfee\VirusScan\McShield.exe

H:\Program Files\McAfee\MPF\MPFSrv.exe

H:\WINDOWS\system32\nvsvc32.exe

H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

H:\Program Files\aargh3\Aargh3.exe

H:\Program Files\Mozilla Firefox\firefox.exe

O4 - HKLM\..\Run: [mcagent_exe] H:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "H:\Program Files\aargh1\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [MSMSGS] "H:\Program Files\Messenger\msmsgs.exe" /background

O8 - Extra context menu item: &Download All with FlashGet - H:\Program Files\FlashGet\jc_all.htm

O8 - Extra context menu item: &Download with FlashGet - H:\Program Files\FlashGet\jc_link.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Program Files\FlashGet\FlashGet.exe (file missing)

O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Program Files\FlashGet\FlashGet.exe (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - {3CA1D406-30D8-4DBC-8EE6-0E2C05F78864} - (no file) (HKCU)

O15 - Trusted Zone: http://*.mcafee.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1132879973183

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1127092276723

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - H:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - H:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - H:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - H:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - h:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - H:\Program Files\McAfee\VirusScan\McShield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - H:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - H:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe

--

End of file - 4310 bytes

Rorschach112 · November 16, 2008

Hello

Download ComboFix from one of these locations:

Link 1

Link 2

Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

ballardea · November 17, 2008

Thanks much -- here's the ComboFix log file -- what's next?

ComboFix 08-11-16.02 - EAB Personal 2008-11-16 18:44:17.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.88 [GMT -5:00]

Running from: h:\documents and settings\EAB Personal\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_TDSSSERV.SYS

-------\Service_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))

.

2008-11-15 13:54 . 2008-11-15 16:48 <DIR> d-------- h:\program files\aargh3

2008-11-15 13:46 . 2008-11-16 10:53 <DIR> d-------- h:\program files\aargh2

2008-11-15 13:46 . 2008-11-15 14:00 <DIR> d-------- h:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2008-11-15 11:39 . 2008-11-15 11:39 <DIR> d-------- h:\documents and settings\EAB Personal\Application Data\Malwarebytes

2008-11-15 10:53 . 2008-11-15 10:54 <DIR> d-------- h:\program files\aargh1

2008-11-15 10:53 . 2008-10-22 16:10 38,496 --a------ h:\windows\system32\drivers\mbamswissarmy.sys

2008-11-15 10:53 . 2008-10-22 16:10 15,504 --a------ h:\windows\system32\drivers\mbam.sys

2008-11-14 21:07 . 2008-11-14 21:07 <DIR> d-------- h:\program files\Microsoft Windows OneCare Live

2008-11-14 20:57 . 2008-11-14 20:57 <DIR> d-------- h:\documents and settings\All Users\Application Data\Malwarebytes

2008-11-11 18:10 . 2008-11-14 20:56 <DIR> d-------- h:\program files\Spybot - Search & Destroy

2008-11-11 17:43 . 2008-11-11 17:44 1,393 --a------ h:\windows\imsins.BAK

2008-11-11 17:39 . 2008-09-04 12:15 1,106,944 -----c--- h:\windows\system32\dllcache\msxml3.dll

2008-11-11 17:39 . 2008-10-24 06:21 455,296 -----c--- h:\windows\system32\dllcache\mrxsmb.sys

2008-11-11 15:39 . 2008-11-11 15:39 <DIR> d-------- h:\program files\Lavasoft

2008-11-11 15:39 . 2008-11-11 15:40 <DIR> d-------- h:\documents and settings\All Users\Application Data\Lavasoft

2008-11-11 15:38 . 2008-11-11 15:38 <DIR> d-------- h:\program files\Common Files\Wise Installation Wizard

2008-11-11 06:36 . 2004-08-04 07:00 4,224 --a------ h:\windows\system32\drivers\beep.sys

2008-11-11 06:36 . 2004-08-04 07:00 4,224 --a--c--- h:\windows\system32\dllcache\beep.sys

2008-11-11 06:20 . 2008-11-11 06:20 19,132 --a------ h:\program files\Common Files\mepasixe.sys

2008-11-11 06:20 . 2008-11-11 06:20 17,948 --a------ h:\windows\odohico.exe

2008-11-11 06:20 . 2008-11-11 06:20 17,584 --a------ h:\windows\system32\igil._dl

2008-11-11 06:20 . 2008-11-11 06:20 15,883 --a------ h:\program files\Common Files\xosumidiw.scr

2008-11-11 06:20 . 2008-11-11 06:20 15,659 --a------ h:\documents and settings\All Users\Application Data\edasola.dll

2008-11-11 06:20 . 2008-11-11 06:20 14,811 --a------ h:\documents and settings\All Users\Application Data\vatokul.scr

2008-11-11 06:20 . 2008-11-11 06:20 14,696 --a------ h:\windows\system32\bevezetuf.db

2008-11-11 06:20 . 2008-11-11 06:20 13,785 --a------ h:\windows\system32\arol._sy

2008-11-11 06:20 . 2008-11-11 06:20 13,136 --a------ h:\windows\yxaxequd.db

2008-11-11 06:20 . 2008-11-11 06:20 11,579 --a------ h:\documents and settings\All Users\Application Data\emiq.bin

2008-11-11 06:20 . 2008-11-11 06:20 11,133 --a------ h:\windows\ufycu.pif

2008-10-24 17:48 . 2008-10-15 11:34 337,408 -----c--- h:\windows\system32\dllcache\netapi32.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2008-11-16 02:17 --------- d-----w h:\program files\IrfanView

2008-10-24 11:21 455,296 ----a-w h:\windows\system32\drivers\mrxsmb.sys

2008-10-13 14:57 --------- d-----w h:\documents and settings\All Users\Application Data\McAfee

2008-10-13 14:56 --------- d-----w h:\documents and settings\EAB Personal\Application Data\McAfee

2008-10-12 17:55 --------- d-----w h:\documents and settings\EAB Personal\Application Data\Skype

2008-09-30 01:56 --------- d-----w h:\program files\IObit

2008-04-12 13:29 120,969 ----a-w h:\documents and settings\EAB Personal\cc_20080412_0929.reg

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MSMSGS"="h:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"mcagent_exe"="h:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]

"NvCplDaemon"="h:\windows\system32\NvCpl.dll" [2006-10-22 7700480]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"MaxRecentDocs"= 10 (0xa)

"ForceClassicControlPanel"= 1 (0x1)

"NoBandCustomize"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.I420"= i263_32.drv

"vidc.i263"= i263_32.drv

"msacm.imc"= imc32.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"h:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"h:\\Program Files\\Skype\\Phone\\Skype.exe"=

R3 SMC1211;SMC EZ Card 10/100 PCI (SMC1211 Series) NT 5.0 Driver;h:\windows\system32\DRIVERS\SMC1211.SYS [2001-07-11 23153]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{268c907c-08da-11dd-b1a2-00e02995ee9a}]

\Shell\AutoRun\command - e:\_private\IRS_PROPERTY_UNAUTHORIZED_USE_PROHIBITED.cmd

\Shell\irs\command - e:\_private\IRS_PROPERTY_UNAUTHORIZED_USE_PROHIBITED.cmd

.

Contents of the 'Scheduled Tasks' folder

2008-11-11 h:\windows\Tasks\AppleSoftwareUpdate.job

- h:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]

2008-05-11 h:\windows\Tasks\McDefragTask.job

- h:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

.

- - - - ORPHANS REMOVED - - - -

HKLM-Run-Malwarebytes Anti-Malware (reboot) - h:\program files\aargh1\mbam.exe

.

------- Supplementary Scan -------

.

FireFox -: Profile - h:\documents and settings\EAB Personal\Application Data\Mozilla\Firefox\Profiles\vg7a7h1n.default\

FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official

FF -: plugin - h:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-11-16 18:51:41

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

h:\program files\Lavasoft\Ad-Aware\aawservice.exe

h:\progra~1\McAfee\MSC\mcmscsvc.exe

h:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe

h:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe

h:\program files\McAfee\VirusScan\Mcshield.exe

h:\program files\McAfee\MPF\MpfSrv.exe

h:\windows\system32\nvsvc32.exe

h:\progra~1\McAfee.com\Agent\mcagent.exe

h:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe

h:\progra~1\McAfee\MSC\mcuimgr.exe

.

**************************************************************************

.

Completion time: 2008-11-16 18:54:29 - machine was rebooted

ComboFix-quarantined-files.txt 2008-11-16 23:54:18

Pre-Run: 3,703,758,848 bytes free

Post-Run: 3,763,376,128 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

h:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home" /fastdetect

145 --- E O F --- 2008-11-11 22:45:31

Rorschach112 · November 17, 2008

Hello

Open notepad and copy/paste the text in the quotebox below into it:

http://www.besttechie.net/forums/index.php?showtopic=14957&hl=

Collect::
h:\program files\Common Files\mepasixe.sys
h:\windows\odohico.exe
h:\windows\system32\igil._dl
h:\program files\Common Files\xosumidiw.scr
h:\documents and settings\All Users\Application Data\edasola.dll
h:\documents and settings\All Users\Application Data\vatokul.scr
h:\windows\system32\bevezetuf.db
h:\windows\system32\arol._sy
h:\windows\yxaxequd.db
h:\documents and settings\All Users\Application Data\emiq.bin
h:\windows\ufycu.pif

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{268c907c-08da-11dd-b1a2-00e02995ee9a}]

Suspect::

Save this as CFScript.txt

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you. Post that log in your next reply.

**Note**

When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.

Ensure you are connected to the internet and click OK on the message box.
A browser will open.
Simply follow the instructions to copy/paste/send the requested file.

ballardea · November 17, 2008

Sent the CF zip file to bleepingcomputer. Below is latest log file

/eab

-----------------------------

ComboFix 08-11-16.04 - EAB Personal 2008-11-16 20:33:08.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.147 [GMT -5:00]

Running from: h:\documents and settings\EAB Personal\Desktop\ComboFix.exe

Command switches used :: h:\documents and settings\EAB Personal\Desktop\CFScript.txt

* Created a new restore point

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

h:\documents and settings\All Users\Application Data\edasola.dll

h:\documents and settings\All Users\Application Data\emiq.bin

h:\documents and settings\All Users\Application Data\vatokul.scr

h:\program files\Common Files\mepasixe.sys

h:\program files\Common Files\xosumidiw.scr

h:\windows\odohico.exe

h:\windows\system32\arol._sy

h:\windows\system32\bevezetuf.db

h:\windows\system32\igil._dl

h:\windows\ufycu.pif

h:\windows\yxaxequd.db

.

((((((((((((((((((((((((( Files Created from 2008-10-17 to 2008-11-17 )))))))))))))))))))))))))))))))