Geeby.dll infected - Free Antivirus Forum

Geeby.dll infected

BullGuard Antivirus Forum > Virus Removal > Removal Tools > Geeby.dll infected

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-21-2008 7:38 (GMT +1)

I ran the tool hijackthis according to the instructions read in the
forum

this is the result

Logfile of HijackThis v1.99.1
Scan saved at 15:15:13, on 21/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Archivos de programa\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\svchost.exe
C:\Documents and Settings\Administrador\Mis documentos\Mis archivos recibidos\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.windowsue.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer proporcionado por Windows uE
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {11241072-58BB-40CE-9171-0B2BDFB22E97} - C:\WINDOWS\system32\rqrsppm.dll
O2 - BHO: (no name) - {5D42D819-8457-4338-9BEF-3705BCEB7565} - C:\WINDOWS\system32\geeby.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowsingAdvisor - {F1E96EDC-E0C8-BE98-1F15-C29DBED83B53} - C:\Archivos de programa\BrowsingAdvisor\BrowsingAdvisor-1.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [mmtask] C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Microsoft Spool 21 Service] spool21.exe
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.es/s/v/27.49/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://eugelepori.spaces.live.com/PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: rqrsppm - C:\WINDOWS\SYSTEM32\rqrsppm.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe

what I have to do?

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13642

Posted 3-21-2008 7:44 (GMT +1)

Hi Euge

Please download Combofix:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

and save to the desktop.

Close all other browser windows.

Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".

Please navigate to the system tray on the bottom right hand corner and look for Nod32 icon.
click it -> click on the x button.
a popup will warn that protection will now be disabled. Click on "Yes" to disable the Antivirus guard.

Go to start --> run and copy/paste in the following:

"%userprofile%\desktop\combofix.exe" /killall

When finished, it will produce a logfile located at C:\ComboFix.txt.

Post the contents of that log in your next reply with a new hijackthis log.

Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.

NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-21-2008 8:54 (GMT +1)

"forum moderator" i did what you said me, here is the log

ComboFix 08-03-21.1 - Administrador 2008-03-21 16:31:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.3082.18.155 [GMT -3:00]
Se ejecuta desde: C:\Documents and Settings\Administrador\Mis documentos\Mis archivos recibidos\ComboFix.exe

[color=red][b]ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! [/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\agcdp.dll
C:\WINDOWS\system32\geeby.dll
C:\WINDOWS\system32\rqrsppm.dll
C:\WINDOWS\system32\ybeeg.ini
C:\WINDOWS\system32\ybeeg.ini2

.
((((((((((((((((((((((((( Files Created from 2008-02-21 to 2008-03-21 )))))))))))))))))))))))))))))))
.

2008-03-20 18:24 . 2008-03-20 18:23 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-03-20 18:24 . 2008-03-20 18:23 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-03-20 18:24 . 2008-03-20 18:23 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-03-20 14:13 . 2008-03-20 14:13 2,162 --a------ C:\WINDOWS\system32\tmmute.ini
2008-03-20 14:12 . 2008-03-20 14:12 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-03-20 14:12 . 2008-03-20 14:12 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-19 17:20 . 2004-08-30 21:00 1,470,464 --a------ C:\WINDOWS\system32\WinSpooler.exe
2008-03-19 17:20 . 2008-03-20 16:22 37,888 --a------ C:\WINDOWS\system32\rar.exe
2008-03-18 16:28 . 2008-03-18 16:28 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-03-18 16:28 . 2008-03-18 16:28 <DIR> d-------- C:\WINDOWS\system32\oobe
2008-03-18 16:28 . 2008-03-18 16:28 <DIR> d-------- C:\WINDOWS\srchasst
2008-03-18 16:28 . 2008-03-18 16:28 <DIR> d-------- C:\WINDOWS\msagent
2008-03-18 16:28 . 2008-03-18 16:28 <DIR> d-------- C:\Archivos de programa\microsoft frontpage
2008-03-18 15:03 . 2008-03-18 15:03 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-18 15:03 . 2008-03-18 15:03 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-18 13:41 . 2005-09-23 07:29 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2008-03-18 12:06 . 2008-03-18 16:28 <DIR> d-------- C:\Archivos de programa\Archivos comunes\Symantec Shared
2008-03-17 19:23 . 2008-03-21 16:38 <DIR> d-a------ C:\Documents and Settings\All Users\Datos de programa\TEMP
2008-03-16 02:08 . 2008-03-16 02:08 244 --ah----- C:\sqmnoopt02.sqm
2008-03-16 02:08 . 2008-03-16 02:08 232 --ah----- C:\sqmdata02.sqm
2008-03-03 17:12 . 2008-03-03 17:12 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\WLInstaller
2008-03-03 17:12 . 2008-03-18 16:25 <DIR> d-------- C:\Archivos de programa\Windows Live
2008-03-03 17:12 . 2008-03-03 17:12 <DIR> d--hsc--- C:\Archivos de programa\Archivos comunes\WindowsLiveInstaller
2008-02-29 18:20 . 2006-10-04 23:42 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2008-02-29 18:20 . 2006-10-04 23:42 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2008-02-29 16:04 . 2008-02-29 16:04 <DIR> d-------- C:\Archivos de programa\Pirelli
2008-02-29 16:04 . 2008-02-29 16:04 126 --a------ C:\WINDOWS\PRLTP_USBdrv.ini
2008-02-29 16:03 . 2008-02-29 16:03 859 --a------ C:\WINDOWS\ST6UNST.004
2008-02-29 15:51 . 2008-02-29 15:51 <DIR> d-------- C:\Archivos de programa\Driver
2008-02-29 15:50 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-02-29 15:46 . 2008-02-29 15:46 859 --a------ C:\WINDOWS\ST6UNST.003
2008-02-29 15:35 . 2008-02-29 15:35 859 --a------ C:\WINDOWS\ST6UNST.002
2008-02-29 15:34 . 2008-02-29 15:34 859 --a------ C:\WINDOWS\ST6UNST.001
2008-02-29 15:05 . 2006-02-14 15:24 1,471,185 --------- C:\WINDOWS\setup.cab
2008-02-29 15:05 . 2008-02-29 16:03 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-02-29 15:05 . 2008-02-29 16:03 20,480 --------- C:\WINDOWS\Setup1.exe
2008-02-29 15:05 . 2008-02-29 15:05 1,065 --a------ C:\WINDOWS\ST6UNST.000
2008-02-29 15:05 . 2008-02-29 15:05 6 --a------ C:\[u]0[/u]000.cfg
2008-02-26 22:27 . 2008-02-26 22:27 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
2008-02-26 22:26 . 2006-12-18 03:19 16,128 --a------ C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-02-26 22:25 . 2008-02-26 22:25 <DIR> d-------- C:\Archivos de programa\CONEXANT
2008-02-26 22:25 . 2004-09-29 04:33 1,036,928 -ra------ C:\WINDOWS\system32\drivers\HSF_DP.sys
2008-02-26 22:25 . 2004-09-29 04:34 702,592 -ra------ C:\WINDOWS\system32\drivers\HSF_CNXT.sys
2008-02-26 22:25 . 2004-09-29 04:35 219,136 -ra------ C:\WINDOWS\system32\drivers\HSFHWBS2.sys
2008-02-26 22:25 . 2004-09-28 23:19 129,045 -ra------ C:\WINDOWS\system32\drivers\HSFProf.cty
2008-02-26 22:25 . 2004-03-17 01:00 86,016 -ra------ C:\WINDOWS\system32\mdmxsdk.dll
2008-02-26 22:25 . 2004-08-04 04:34 39,018 -ra------ C:\WINDOWS\system32\hsfci011.dll
2008-02-26 22:25 . 2004-03-17 01:04 13,059 -ra------ C:\WINDOWS\system32\drivers\mdmxsdk.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-20 21:46 --------- d-----w C:\Archivos de programa\Eset
2008-03-20 18:25 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
2008-03-20 18:25 --------- d-----w C:\Archivos de programa\Spybot - Search & Destroy
2008-03-20 16:20 --------- d-----w C:\Archivos de programa\BrowsingAdvisor
2008-03-18 18:37 --------- d-----w C:\Archivos de programa\Unlocker
2008-03-18 18:37 --------- d-----w C:\Archivos de programa\TuneUp Utilities 2006
2008-03-18 18:27 --------- d-----w C:\Archivos de programa\Ares
2008-03-18 16:51 --------- d-----w C:\Archivos de programa\Google
2008-03-18 15:03 --------- d-----w C:\Archivos de programa\eMule
2008-03-17 13:48 --------- d-----w C:\Archivos de programa\FBrowsingAdvisor
2008-03-03 17:08 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\BSplayer Pro
2008-02-29 21:20 --------- d-----w C:\Archivos de programa\Picasa2
2008-02-29 19:04 --------- d--h--w C:\Archivos de programa\InstallShield Installation Information
2008-02-19 18:16 --------- d-----w C:\Archivos de programa\FBrowserAdvisor
2008-02-06 16:52 57,344 ----a-w C:\Documents and Settings\Administrador\lametritonus.dll
2008-02-06 16:52 162,304 ----a-w C:\Documents and Settings\Administrador\lame_enc.dll
2008-01-31 01:29 --------- d-----w C:\Archivos de programa\Archivos comunes\Vbox
2007-12-06 17:50 740,764 ----a-w C:\Archivos de programa\TraductorGlobalSetup.exe
2006-11-19 10:58 763,128 ----a-w C:\WINDOWS\system32\config\systemprofile\SPTDinst.exe
2006-11-19 10:58 763,128 ----a-w C:\Documents and Settings\Default User\SPTDinst.exe
2006-11-19 10:58 763,128 ----a-w C:\Documents and Settings\Administrador\SPTDinst.exe
2004-08-31 00:00 1,470,464 ----a-w C:\Archivos de programa\runme.exe
.

------- Sigcheck -------

2006-12-17 22:18 578048 37ce819e8ecb3517b9981a886876ef72 C:\WINDOWS\system32\user32.dll

2006-12-18 07:34 360576 64a75ea132e38494525fdb545b75ef81 C:\WINDOWS\system32\drivers\tcpip.sys

2006-12-17 22:18 2059776 437c13aa25f9a30d8a43c318973593fd C:\WINDOWS\system32\ntkrnlpa.exe

2006-12-17 22:18 2182528 4ce3f75b94dd878cd2d2775323e1f0be C:\WINDOWS\system32\ntoskrnl.exe

2004-08-19 10:42 952832 29345218b2ac9b0bdee9c22ba9bb0235 C:\WINDOWS\explorer.exe
2004-08-19 10:42 1034752 89c8dd146ceaf482d82822766437d93f C:\WINDOWS\XPize\Backup\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1E96EDC-E0C8-BE98-1F15-C29DBED83B53}]
2007-12-30 17:49 1019904 --a------ C:\Archivos de programa\BrowsingAdvisor\BrowsingAdvisor-1.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 10:42 30208]
"msnmsgr"="C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTimer"="VTTimer.exe" [2006-09-21 16:36 53248 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2007-02-06 07:30 176128 C:\WINDOWS\system32\VTTrayp.exe]
"mmtask"="C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2004-06-18 00:24 53248]
"RTHDCPL"="RTHDCPL.EXE" [2007-05-10 18:08 16342528 C:\WINDOWS\RTHDCPL.exe]
"nod32kui"="C:\Archivos de programa\Eset\nod32kui.exe" [2008-03-20 18:23 949376]
"Microsoft Spool 21 Service"="spool21.exe" []
"MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2006-12-17 22:18 185856]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-19 10:42 30208]
"Picasa Media Detector"="C:\Archivos de programa\Picasa2\PicasaMediaDetector.exe" [2007-10-23 18:18 443968]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide3"="cmd.exe" [2004-08-19 10:42 402944 C:\WINDOWS\system32\cmd.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"Windows Printing Driver"= WinSpooler.exe
"NTSpool"= NTSpool.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\geeby.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-10-18 11:34 5724184 C:\Archivos de programa\Windows Live\Messenger\MsnMsgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Archivos de programa\\Ares\\Ares.exe"=
"C:\\Archivos de programa\\eMule\\emule.exe"=
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"=

R1 BIOS;BIOS;C:\WINDOWS\system32\drivers\BIOS.sys [2005-03-16 03:23]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2006-12-18 03:19]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1d143c13-5aca-11dc-9115-806d6172696f}]
\Shell\AutoRun\command - E:\bootcd\wintools\autorun.exe

.
Contents of the 'Scheduled Tasks' folder
"2008-03-07 20:15:00 C:\WINDOWS\Tasks\Mantenimiento con 1 clic.job"
- C:\Archivos de programa\TuneUp Utilities 2006\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-21 16:38:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\Archivos de programa\Eset\pr_imon.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Eset\nod32krn.exe
.
**************************************************************************
.
Completion time: 2008-03-21 16:41:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-21 19:41:02

and here is the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 16:47:09, on 21/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Archivos de programa\internet explorer\iexplore.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Archivos de programa\Traduce Gratis\Translator.exe
C:\Documents and Settings\Administrador\Mis documentos\Mis archivos recibidos\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowsingAdvisor - {F1E96EDC-E0C8-BE98-1F15-C29DBED83B53} - C:\Archivos de programa\BrowsingAdvisor\BrowsingAdvisor-1.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [mmtask] C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Microsoft Spool 21 Service] spool21.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.es/s/v/27.49/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://eugelepori.spaces.live.com/PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe

I'm waiting for your help, thanks you

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-22-2008 1:42 (GMT +1)

the problem was solved, but i don't know how...

I don't know what i did for if.

I do not know much of computers, obviously,

and i'd like to know how the virus died

However, thanks for all

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13642

Posted 3-22-2008 7:45 (GMT +1)

Combofix get rid of it/them -

Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\agcdp.dll
C:\WINDOWS\system32\geeby.dll
C:\WINDOWS\system32\rqrsppm.dll
C:\WINDOWS\system32\ybeeg.ini
C:\WINDOWS\system32\ybeeg.ini2

Unfortunately are you not done - yet ;-)

Download http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
and save it to your desktop.

When you have done this, please boot into Safe Mode (Tap F8 during startup).

Open the extracted folder - C:\ SDFix and doubleclick on RunThis.bat to start the script.

Type Y to begin the script. It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot. When you hit any key, your computer will reboot. Your system will take longer that normal to restart as the fixtool will be running and removing files.

When your desktop loads, the utility will complete the removal and display Finished. Press any key again to end the script and load your desktop icons.

Finally open the SDFix folder on your desktop and copy and paste the contents of Report.txt back in this thread along with fresh hijackthis log, and tell how things are running

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-22-2008 2:51 (GMT +1)

[b]SDFix: Version 1.159 [/b]

Run by Administrador on 22/03/2008 at 10:35

Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix

[b]Checking Services [/b]:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Missing Security Center Service

Rebooting

[b]Checking Files [/b]:

Trojan Files Found:

C:\Windows\Temp\\runme.exe - Deleted
C:\WINDOWS\system32\WinSpooler.exe - Deleted

Removing Temp Files

[b]ADS Check [/b]:

[b]Final Check [/b]:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-22 10:40:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:fac97090
"s2"=dword:125468a3

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1

[b]Remaining Services [/b]:

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Archivos de programa\\Yahoo!\\Messenger\\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe"="C:\\Archivos de programa\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server"
"C:\\Archivos de programa\\Ares\\Ares.exe"="C:\\Archivos de programa\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Archivos de programa\\eMule\\emule.exe"="C:\\Archivos de programa\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

[b]Remaining Files [/b]:

File Backups: - C:\SDFix\backups\backups.zip

[b]Files with Hidden Attributes [/b]:

Wed 5 May 1999        96,306 A.SH. --- "C:\discodatos\COMMAND.COM"
Fri 29 Feb 2008     6,219,320 A..H. --- "C:\Archivos de programa\Picasa2\setup.exe"
Tue 4 Sep 2007             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]

Logfile of HijackThis v1.99.1
Scan saved at 10:44:00, on 22/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Archivos de programa\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe
C:\Archivos de programa\internet explorer\iexplore.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Administrador\Mis documentos\Mis archivos recibidos\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: BrowsingAdvisor - {F1E96EDC-E0C8-BE98-1F15-C29DBED83B53} - C:\Archivos de programa\BrowsingAdvisor\BrowsingAdvisor-1.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [mmtask] C:\Archivos de programa\Musicmatch\Musicmatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [TaskSwitchXP] C:\Archivos de programa\TaskSwitchXP\TaskSwitchXP.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Archivos de programa\Windows Live\Messenger\msnmsgr.exe" /background
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.es/s/v/27.49/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://eugelepori.spaces.live.com/PhotoUpload/MsnPUpld.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Archivos de programa\Ares\chatServer.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe

now?

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-22-2008 3:12 (GMT +1)

touch

nod32 says that it's all OK...

but it has often lain to me.

I'm waiting for your diagnostic...

Thanks

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13642

Posted 3-22-2008 4:03 (GMT +1)

Looks clean to Me smilewinkgrin

To completely and immediately remove any infected file or files in the data store, turn off and then turn on System Restore. To do so, follow these steps:
System Restore

Important -->>> Now that You are clean ->

Please read Tony Klein's excellent article about how to prevent against spyware/hijackers in the future

http://www.castlecops.com/t7736-So_how_did_I_get_infected_in_the_first_place.html

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Euge
New Member

Date Joined Mar 2008
Total Posts : 6

Posted 3-22-2008 4:36 (GMT +1)

Siiiiiii !!!!!!!!

gracias!

thanks!

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 13642

Posted 3-22-2008 5:26 (GMT +1)

My pleasure smile

Since your problem appears to be resolved, this thread will now be closed.

If you need this topic reopened, please PM a Moderator and we will reopen it for you

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

Forum Information

Currently it is Saturday, November 22, 2008 1:45 PM (GMT +1)
There are a total of 64.046 posts in 15.836 threads.
In the last 3 days there were 26 new threads and 153 reply posts. View Active Threads