Help - detected WinSpyKiller trojan last night - referred to this forum

[cjinca]

when i run a search including hidden and sub folders, for combofix nothing comes up.

when i look for 'combo' i get a few files related to kodak and several others labeled combobox and located here: C:\WINDOWS\pchealth\helpctr\System\Remote



[attachment deleted by admin]

[Derek]

do a search for 327882R2FWJFW

[cjinca]

this is the first chance i've had internet connection with this computer since reading your last post. 
I just ran a search with including hidden files and computer found nothing.

we moved this weekend and i don't have internet at new place yet.  but i should be around old service most of the day.

thanks, cj

[Derek]

Download WinPFind3U.exe  to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

• Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
  
  • In the Processes group click Non-Microsoft
    
  • In the Win32 Services group click Non-Microsoft
    
  • In the Driver Services group click Non-Microsoft
    
  • In the Registry group click ALL
    
  • In the Files Created Within group click 90 days Make sure Non-Microsoft only is CHECKED
    
  • In the Files Modified Within group select 90 days Make sure Non-Microsoft only is CHECKED
    
  • In the File String Search group select ALL
    
  in the Additional scans sections please press select all and then unselect event viewer. uncheck non-microsoft only
  
• Now click the Run Scan button on the toolbar.
  
• The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Save that notepad file

Use the Reply button and attach the notepad file here. I will review it when it comes in.

[cjinca]

here is log. derek, i wonder if the fact that this is hard to find has something to do with the last time i ran combo fix, I then did a system restore which 'deleted' an account?  maybe the file(s) in question are associated with account  that was 'deleted'.  just a thought...

[attachment deleted by admin]

[Derek]

look inside these folders and see what they contain and whether there is a version of combofix in there

C:\dj565
C:\Documents and Settings\All Users\Documents\to cj acct
anywhere inside any of the folders you have created on on your desktop

then this will get rid of the left overs from smitfraud fix
WinPFind3 Fix -


Start WinPFind3U. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

Code:

[Unregister Dlls]
[Files/Folders - Created Within 90 days]
NY -> dumphive.exe -> %System32%\dumphive.exe
NY -> IEDFix.exe -> %System32%\IEDFix.exe
NY -> SrchSTS.exe -> %System32%\SrchSTS.exe
NY -> VACFix.exe -> %System32%\VACFix.exe
NY -> VCCLSID.exe -> %System32%\VCCLSID.exe
NY -> WS2Fix.exe -> %System32%\WS2Fix.exe
[Empty Temp Folders]
[Reboot]

The fix should only take a very short time and then you will be asked if you want to reboot. Choose Yes.

when it reboots


Post the following back here:

 the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

[Derek]

and I have worked out where Avira is finding the traces of Combofix & nircmd

it is inside system restore

Turn off system restore by following instructions here
for XP   http://www.thespykiller.co.uk/index.php?page=8
or for Vista http://www.bleepingcomputer.com/tutorials/tutorial143.html

That will purge the restore folder and clear any malware that has been put in there. Then reboot & then re-enable system restore & create a new restore point. Now Empty Recycle bin on desktop

[cjinca]

derek,
in subfolders of 'to cj acct':

when I was given names of malware, i googled them to see what i was dealing with and saved info in the attached documents. all three documents list 'file traces'.  could this be what avira is picking up?

also in a subfolder is pwdgen.rar that i can no longer open.

and also... lots of log reports of various scans that i'd been asked to run. 

i know longer need this 'to cj acct folder' but will not delete it till you say it is okay.
_______
[Files/Folders - Created Within 90 days]
C:\WINDOWS\SYSTEM32\dumphive.exe moved successfully.
C:\WINDOWS\SYSTEM32\IEDFix.exe moved successfully.
C:\WINDOWS\SYSTEM32\SrchSTS.exe moved successfully.
C:\WINDOWS\SYSTEM32\VACFix.exe moved successfully.
C:\WINDOWS\SYSTEM32\VCCLSID.exe moved successfully.
C:\WINDOWS\SYSTEM32\WS2Fix.exe moved successfully.
[Empty Temp Folders]
C:\DOCUME~1\Admin\LOCALS~1\Temp\ -> emptied.
C:\Documents and Settings\Admin\Local Settings\Temporary Internet Files\Content.IE5\ -> emptied
RecycleBin -> emptied.
< End of log >
Created on 03/04/2008 15:35:49
_____

system restore has been reset as well.

computer has been working well.  i do note that when i am either opening an application or moving from 'thing' to the next, the amount of information that seems to be being computed in bottom left corner of screen is much more than in the past.  It used to just be something like, 'connecting to' and then done.  now, a lot of different lines of communication flash up, but too fast for me to read them. 

i am thinking this is something to do with one of the new virus or malware protections and not something malicious???

i will open some applications, surf, etc and try to see what it is that is processing. 

should i try to run avira and see if it runs without picking up those old combofix files?

[attachment deleted by admin]

[Derek]

I have no idea what those odt files files.. where did you get them from

you can delete ANYTHING and EVERYTHING from the scans & logs etc and anything you no longer want

[cjinca]

i googled pesttrap again this morning and i'm pretty sure it is the sunbelt site that i got the info from: http://research.sunbelt-software.com/threatdisplay.aspx?name=PestTrap&threatid=43692

i will go ahead and delete the 'to cj acct' folder. 

avira is picking up the following the warning.  Scan did not stop to ask me how I wanted to handle item like it did in the past:



AntiVir PersonalEdition Classic
Report file date: Thursday, March 06, 2008  10:55

Scanning for 1136109 virus strains and unwanted programs.

Licensed to:      Avira AntiVir PersonalEdition Classic
Serial number:    0000149996-ADJIE-0001
Platform:         Windows XP
Windows version:  (Service Pack 2)  [5.1.2600]
Username:         SYSTEM
Computer name:    D5BTQZC1

Version information:
BUILD.DAT    : 270           15603 Bytes   9/19/2007 13:32:00
AVSCAN.EXE   : 7.0.6.1      290856 Bytes   8/23/2007 22:16:29
AVSCAN.DLL   : 7.0.6.0       49192 Bytes   8/16/2007 21:23:51
LUKE.DLL     : 7.0.5.3      147496 Bytes   8/15/2007 00:32:47
LUKERES.DLL  : 7.0.6.1       10280 Bytes   8/21/2007 21:35:20
ANTIVIR0.VDF : 6.40.0.0    11030528 Bytes   7/18/2007 14:39:16
ANTIVIR1.VDF : 7.0.1.95    3367424 Bytes  12/14/2007 14:39:16
ANTIVIR2.VDF : 7.0.2.181   1993728 Bytes   2/24/2008 17:04:53
ANTIVIR3.VDF : 7.0.2.245    216576 Bytes    3/6/2008 17:19:36
AVEWIN32.DLL : 7.6.0.73    3334656 Bytes    3/4/2008 22:42:17
AVWINLL.DLL  : 1.0.0.7       14376 Bytes   2/26/2007 19:36:26
AVPREF.DLL   : 7.0.2.2       25640 Bytes   7/18/2007 16:39:17
AVREP.DLL    : 7.0.0.1      155688 Bytes   4/16/2007 22:16:24
AVPACK32.DLL : 7.6.0.3      360488 Bytes   2/12/2008 14:39:22
AVREG.DLL    : 7.0.1.6       30760 Bytes   7/18/2007 16:17:06
AVARKT.DLL   : 1.0.0.20     278568 Bytes   8/28/2007 21:26:33
AVEVTLOG.DLL : 7.0.0.20      86056 Bytes   7/18/2007 16:10:18
NETNT.DLL    : 7.0.0.0        7720 Bytes    3/8/2007 20:09:42
RCIMAGE.DLL  : 7.0.1.30    2342952 Bytes    8/7/2007 21:38:13
RCTEXT.DLL   : 7.0.62.0      86056 Bytes   8/21/2007 21:50:37
SQLITE3.DLL  : 3.3.17.1     339968 Bytes   7/23/2007 18:37:21

Configuration settings for the scan:
Jobname..........................: Complete system scan
Configuration file...............: c:\program files\avira\antivir personaledition classic\sysscan.avp
Logging..........................: low
Primary action...................: interactive
Secondary action.................: ignore
Scan master boot sector..........: on
Scan boot sector.................: on
Boot sectors.....................: C:,
Scan memory......................: on
Process scan.....................: on
Scan registry....................: on
Search for rootkits..............: on
Scan all files...................: All files
Scan archives....................: on
Recursion depth..................: 20
Smart extensions.................: on
Deviating archive types..........: +BSD Mailbox, +Netscape/Mozilla Mailbox, +Eudora Mailbox, +Squid cache, +Pegasus Mailbox, +MS Outlook Mailbox,
Macro heuristic..................: on
File heuristic...................: high
Deviating risk categories........: +APPL,+GAME,+JOKE,+PCK,+SPR,

Start of the scan: Thursday, March 06, 2008  10:55

Starting search for hidden objects.
'39375' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'mDNSResponder.exe' - '1' Module(s) have been scanned
Scan process 'guard.exe' - '1' Module(s) have been scanned
Scan process 'AppleMobileDeviceService.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'BCMWLTRY.EXE' - '1' Module(s) have been scanned
Scan process 'WLTRYSVC.EXE' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'logonui.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
23 processes with 23 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
      [NOTE]      No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
      [NOTE]      No virus was found!

Starting to scan the registry.
The registry was scanned ( '28' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\hiberfil.sys
      [WARNING]   The file could not be opened!
C:\pagefile.sys
      [WARNING]   The file could not be opened!


End of the scan: Thursday, March 06, 2008  10:58
Used time: 02:44 min

The scan has been canceled!

    619 Scanning directories
   4192 Files were scanned
      0 viruses and/or unwanted programs were found
      0 Files were classified as suspicious:
      0 files were deleted
      0 files were repaired
      0 files were moved to quarantine
      0 files were renamed
      2 Files cannot be scanned
   4192 Files not concerned
    163 Archives were scanned
      2 Warnings
      0 Notes
  39375 Objects were scanned with rootkit scan
      0 Hidden objects were found

[Would you do all this for nothing?]

You have come to The Spykiller for help because your Antivirus or Antispyware hasn't been able to fix your problem.

Modern Malware has become so involved and difficult to fix that it takes a very long time and a lot of hard work to read all the logs posted here and research and prepare the fixes for you. In many cases each part of the fix takes about 30 minutes to prepare, so a large part of my time is spent helping you

Would you do all this for nothing?

The reason I run this site is to raise funds for Hedgehog Rescue

Please donate if I have helped you or you have found this site useful.

You can donate safely and securely by using the paypal service, just click on one of the buttons below.

To donate in UK £

To donate in US$

To donate in Euro €

Any amount no matter how small is gratefully accepted and needed to ensure we keep the Rescue Centre running

To donate via paypal when the button doesn't appear or the link doesn't work: just go to www.paypal.com or your country's paypal log in page and chose send money and use help@thehedgehog.co.uk as recipient email address and select other service as the option. then follow prompts

[Information]

  
  Information
   Security & Protection Blog
   Prevention
   Using Autoruns
     System Restore
  Rss feeds
     Microsoft at Home
     MSRC
     Malware blog

Take the Kaspersky Challenge: See what your current antivirus is missing. Our free online virus scanner is a great way to find out if you have any viruses or spyware on your machine without having to uninstall your current antivirus software or install a new one.

Kaspersky Online Scanner

Most importantly, you can see what viruses your current antivirus software let slip through! Now works with ANY Java enabled browser