#1
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
adware.ezula issue, hijack this log posted
Hello again,SP2 (WinNT 5.02.3790)SP2 (6.00.3790.3959)http://www.adobe.com/ https://portal.carealliance.com/port...redSession.dll http://10.10.1.20/SWToolset.exe https://10.10.1.43/plugins/vkvm/ActiveXVideoViewer.cab http://www.update.microsoft.com/micr...?1189550347824 http://www.update.microsoft.com/micr...?1189550339113 http://10.1.18.30/FusionServer/ActiveX/coefir.cab http://10.1.18.30/FusionServer/ActiveX/eFilmX.cab https://portal.carealliance.com/port.../mckntauth.ocx sp2 with terminal services, all functionality appears correct with the exception of the finding of this adware and erratic internet explorer behavior. The system is fully backed up using symantec backup exec and we have removed other virus and spyware that was infecting this system along the same time using symantec antivirus and spybot. Thanks for the help!
Didn't find the information you thought to find?Similar Threads
#2
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Ughhh ......... you've got one of the latest nasties, and it's a PITA. Lets see what we can do with it.Open Spybot Search & Destroy.
In the Mode menu click "Advanced mode " if not already selected.
Choose "Yes " at the Warning prompt.
Expand the "Tools " menu.
Click "Resident ".
Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active. " box.
In the File menu click "Exit " to exit Spybot Search & Destroy.
VundoFix by Atribune, saving it to your desktop.Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK .
Note: It is possible that VundoFix encounters a file it could not remove. In this case, VundoFix will run on reboot . If that happens, follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting. here , saving the file to your desktop.Close all open programs and windows Double click combofix.exe and follow the prompts.
When finished, it will open a log for you. Post that log, the C:\VundoFix.txt log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#3
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
combofix log
ComboFix 07-11-08.3 - administrator 2007-11-19 10:43:26.1 - NTFSx860 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]DHCP DnsCachehttp://www.gmer.net
#4
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
vundofix log
VundoFix V6.6.2
#5
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
new Hijack this log
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.02.3790)SP2 (6.00.3790.3959)http://www.adobe.com/ https://portal.carealliance.com/port...redSession.dll http://10.10.1.20/SWToolset.exe https://10.10.1.43/plugins/vkvm/ActiveXVideoViewer.cab http://www.update.microsoft.com/micr...?1189550347824 http://www.update.microsoft.com/micr...?1189550339113 http://10.1.18.30/FusionServer/ActiveX/coefir.cab http://10.1.18.30/FusionServer/ActiveX/eFilmX.cab https://portal.carealliance.com/port.../mckntauth.ocx
#6
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Scan again with HijackThis and place a check next to the following entries, close all other windows then click Fix Checked.Deckard's System Scanner (dss .exe) and save it to your desktop.Close all applications and windows Double click on dss .exe to run it and follow the prompts.
When the scan is complete, two text files will open; main.txt , which will be maximized and extra.txt , which will be minimized.
#7
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
deckerds main.txt log part 1
Deckard's System Scanner v20071014.68SP2 (WinNT 5.02.3790)SP2 (6.00.3790.3959)dss .exehttp://www.adobe.com/ https://portal.carealliance.com/port...redSession.dll http://10.10.1.20/SWToolset.exe https://10.10.1.43/plugins/vkvm/ActiveXVideoViewer.cab http://www.update.microsoft.com/micr...?1189550347824 http://www.update.microsoft.com/micr...?1189550339113 http://10.1.18.30/FusionServer/ActiveX/coefir.cab http://10.1.18.30/FusionServer/ActiveX/eFilmX.cab https://portal.carealliance.com/port.../mckntauth.ocx .cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%* IP in IP Tunnel Driver) - c:\windows\system32\drivers\ipinip.sys (file missing)PCI \VEN_8086&DEV_1076&SUBSYS_016D1028&REV_05\5&C8E9BA0&0&400228PCI \VEN_8086&DEV_1076&SUBSYS_016D1028&REV_05\5&C8E9BA0&0&400228
#8
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
deckerds main.txt log part 2
2007-11-04 11:42:26 86016 --a------ C:\WINDOWS\system32\DellSPMsg.dll <Not Verified; Dell, Inc.; Change Management SDK>DHCP DnsCache
#9
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
First, delete the copy of VundoFix.exe you currently have and download a fresh one. Then delete the file C:\VundoFix.txtod2 ib1 cp1 bo2 ap1 contents of the code box below and paste it into a blank notepad, then save it to your desktop as;vundofix.vft << make sure it's .vft and NOT .txt All Files (*.*)
Code:
C:\WINDOWS\system32\pcmssnen.dll
C:\WINDOWS\system32\rptphqtm.exe
C:\WINDOWS\system32\udvndlir.exe
C:\WINDOWS\system32\alfehlaa.dll
C:\WINDOWS\system32\rulqrxij.exe
C:\WINDOWS\system32\pipsjnel.exe
C:\WINDOWS\system32\idyvykee.exe
C:\WINDOWS\system32\ybphpewf.exe
C:\WINDOWS\system32\rmdhtmnd.exe
C:\WINDOWS\system32\rkksgdus.exe
C:\WINDOWS\system32\uxgmonco.exe
C:\WINDOWS\system32\bwbayumi.exe
C:\WINDOWS\system32\rdlkaqnk.exe
C:\WINDOWS\system32\iucgtedb.exe
C:\WINDOWS\system32\fjtnxgnc.exe
C:\WINDOWS\system32\gbilfyeh.exe
C:\WINDOWS\system32\cnyefinv.exe
C:\WINDOWS\system32\tttpohgh.exe
C:\WINDOWS\system32\nerkwrfy.exe
C:\WINDOWS\system32\wrxolinr.exe
C:\WINDOWS\system32\qmkrkypk.exe
C:\WINDOWS\system32\oyksensg.exe
C:\WINDOWS\system32\meiuvntb.exe
C:\WINDOWS\system32\ilqelqim.exe
C:\WINDOWS\system32\bttmmtrf.exe
C:\WINDOWS\system32\kjluojcv.exe
C:\WINDOWS\system32\aqwqlkvi.exe
C:\WINDOWS\system32\jdpoukfa.exe
C:\WINDOWS\system32\psblqyul.exe
C:\WINDOWS\system32\xpaiagtx.exe
C:\WINDOWS\system32\exrtorir.exe
C:\WINDOWS\system32\kpnycsdr.exe
C:\WINDOWS\system32\ubnpubsn.exe
C:\WINDOWS\system32\tvgxjffu.exe
C:\WINDOWS\system32\btglcsyy.exe
C:\WINDOWS\system32\scdeybvw.exe
C:\WINDOWS\system32\oyeoidoj.exe
C:\WINDOWS\system32\mwarisdc.exe
C:\WINDOWS\system32\pctlyrck.exe
C:\WINDOWS\system32\qssqycex.exe
C:\WINDOWS\system32\ptrefreb.exe
C:\WINDOWS\system32\bqjieohr.exe
C:\WINDOWS\system32\tnsygsok.exe
C:\WINDOWS\system32\dtppnphn.exe
C:\WINDOWS\system32\ocnlrxrd.exe
C:\WINDOWS\system32\sawdptix.exe
C:\WINDOWS\system32\xjpynghw.dll
C:\WINDOWS\system32\cwntlius.dll
C:\WINDOWS\system32\uwwixadt.dll
C:\WINDOWS\system32\mdbjcsdu.dll
C:\WINDOWS\system32\wjwiubjs.dll
C:\WINDOWS\system32\plfhggnj.dll
C:\WINDOWS\system32\govytbts.dll Close all other windows and programs .Double-click VundoFix.exe to run it.
Drag vundofix.vft onto the listbox (white box) of VundoFix.
Click the "Remove Vundo" button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK .
Please post the contents of C:\vundofix.txt and a new dss log.
Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting jotti and upload the following two files for analysis. Copy the results and post them here.BiosMsg.dll windrv.sys
#10
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
new logs - vundo/biosmsg/windrv results
Vundofix.txt:
#11
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
registry
I would be comfortable editing the registry. Just let me know what needs to be done.
#12
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Grab an updated copy of ComboFix. Download ComboFix by sUBs from here or here , saving the file to your desktop.Close all open programs and windows Double click combofix.exe and follow the prompts.
When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
#13
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
new combofix log 11/23/07
ComboFix 07-11-19.3 - administrator 2007-11-23 18:07:57.2 - NTFSx860 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]0 \0 ]DHCP DnsCachehttp://www.gmer.net
#14
Senior Member
Profile: Join Date: Nov 2007
Posts: 81
Computer Experience:
hijack this 11/23/07
Logfile of Trend Micro HijackThis v2.0.2SP2 (WinNT 5.02.3790)SP2 (6.00.3790.3959)http://www.adobe.com/ https://portal.carealliance.com/port...redSession.dll http://10.10.1.20/SWToolset.exe https://10.10.1.43/plugins/vkvm/ActiveXVideoViewer.cab http://www.update.microsoft.com/micr...?1189550347824 http://www.update.microsoft.com/micr...?1189550339113 http://10.1.18.30/FusionServer/ActiveX/coefir.cab http://10.1.18.30/FusionServer/ActiveX/eFilmX.cab https://portal.carealliance.com/port.../mckntauth.ocx
#15
Staff
Profile: Join Date: Apr 2003
Location: New Bremen, Ohio U.S.A.
Posts: 12,524
Computer Experience:
Empty the C:\Temp folder.contents of the code box below and paste it into a blank notepad, then save it to your desktop as;CFScript.txt All Files (*.*)
Code:
File::
C:\WINDOWS\system32\aalhefla.ini
C:\WINDOWS\system32\bvskkekv.ini
C:\WINDOWS\system32\eniuktwl.ini
C:\WINDOWS\system32\xcmsjohf.ini
C:\WINDOWS\system32\hnoctmce.ini
C:\WINDOWS\system32\rcmfxohr.ini
C:\WINDOWS\system32\fcsmtnwo.ini
C:\WINDOWS\system32\yiyhfjjq.ini
C:\WINDOWS\system32\dlrjbmdn.ini
C:\WINDOWS\system32\tbmlufbo.ini
C:\WINDOWS\system32\bobynphj.ini
C:\WINDOWS\system32\aftbyymm.ini
C:\WINDOWS\system32\fupetkcv.ini
C:\WINDOWS\system32\ubdniyrg.ini
C:\WINDOWS\system32\sjknwlaq.ini
C:\WINDOWS\system32\gcsbqcjw.ini
C:\WINDOWS\system32\anvajlny.ini
C:\WINDOWS\system32\qesridhq.ini
C:\WINDOWS\system32\tnjqxvmt.ini
C:\WINDOWS\system32\fjgykpyf.ini
C:\WINDOWS\system32\ydevqksu.ini
C:\WINDOWS\system32\bwotgeia.ini
C:\WINDOWS\system32\irsxqpgj.ini
C:\WINDOWS\system32\nvdgrais.ini
C:\WINDOWS\system32\ltblheht.ini
C:\WINDOWS\system32\enaufxde.ini
C:\WINDOWS\system32\dktannad.ini
C:\WINDOWS\system32\blnggryv.ini
C:\WINDOWS\system32\qwfdmwkn.ini
C:\WINDOWS\system32\nqdbptmd.ini
C:\WINDOWS\system32\rxywigdd.ini
C:\WINDOWS\system32\nlghhebs.ini
C:\WINDOWS\system32\mmyhwxmr.ini
C:\WINDOWS\system32\oftfwhhy.ini
C:\WINDOWS\system32\xabrhvkd.ini
C:\WINDOWS\system32\ucybutpn.ini
C:\WINDOWS\system32\qyoeghyf.ini
C:\WINDOWS\system32\ibbfstdw.ini
C:\WINDOWS\system32\fosvsqkq.ini
C:\WINDOWS\system32\whgnypjx.ini
C:\WINDOWS\system32\ssoscbjb.ini
C:\WINDOWS\system32\suiltnwc.ini
C:\WINDOWS\system32\qxipiotf.ini
C:\WINDOWS\system32\aoxgwuoq.ini
C:\WINDOWS\system32\tdaxiwwu.ini
C:\WINDOWS\system32\ivnvyetb.ini
C:\WINDOWS\system32\udscjbdm.ini
C:\WINDOWS\system32\sjbuiwjw.ini
C:\WINDOWS\system32\jngghflp.ini
C:\WINDOWS\system32\stbtyvog.ini
C:\WINDOWS\system32\mkvnardk.ini
C:\WINDOWS\system32\cexwrtup.ini
C:\WINDOWS\system32\ddreuvhs.ini Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
All times are GMT +1. The time now is 05:53 .
