#1
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
[InActive] Cleaned Virtumonde but Can't run Blacklight
I've worked three days on a client's computer that was infected with Virtumonde. It always seems to come back. http://home.davekeys.com/jimlm2fix.txt http://home.davekeys.com/jimlm2fix.txt
Didn't find the information you thought to find?Similar Threads
#2
Profile: Join Date: Dec 2001
Location: Birkirkara, Malta
Posts: 9,700
Computer Experience:
Quote:
Originally Posted by
davekeys
The log files were too long to post
So split them over 2 posts.
#3
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
OK, here is hijackthis part one:RAM : 1279 MB (51% free)SP3 (WinNT 5.01.2600)Ad -Aware\aawservice.exehttp://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://r.office.microsoft.com/r/rlid...1=32&p2=5&p3=1 http://security.symantec.com/sscv6/S...in/AvSniff.cab http://dlm.tools.akamai.com/dlmanage...ex-2.2.4.3.cab http://security.symantec.com/sscv6/S.../bin/cabsa.cab http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab http://support.f-secure.com/ols/fscax.cab Ad -Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\aawservice.exeHTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
#4
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
hijackthis part 2:
#5
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
hijackthis part 3:AD ---- C:\Documents and Settings\All Users\Application Data\TEMPHD ---- C:\WINDOWS\system32\GroupPolicyHD ---- C:\WINDOWS\$hf_mig$HD ---- C:\Program Files\InstallShield Installation InformationHD ---- C:\Program Files\Uninstall InformationHD ---- C:\Program Files\WindowsUpdatevb .ini
#6
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
hijackthis part 4:HD ---- C:\WINDOWS\infwins dhcp WLAN Card Driver; C:\WINDOWS\system32\DRIVERS\bcmwl5.sys [2004-06-25 315392]WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584]Ad -Aware Service; C:\Program Files\Lavasoft\Ad -Aware\aawservice.exe [2008-09-24 611664]HTTP Server; C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe [2008-06-10 19200]
#7
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
Here's LM2Fix:ad ,6a,01,b0,01,00,00,52,5f,c5,ed,05,87, \ad ,df, \cf ,2d,1b,f5,fc,64,83,ca,98,f8,e9,f1,32,6d,e5,5a,61,2e, \ad ,0b,3b,88,28,4d,4e,a3,9c,35,83,8e,15,04,30,c5,c0, \cf ,00,5d,db,82,c8,f4,b0,e0, \FTP Folders Webview"
#8
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,541
Computer Experience:
Hi davekeysPlease go to Jotti's malware scan
Copy and paste the following file path into *the *"File to upload & scan" box on the top of the page: one at a timeC:\WINDOWS\system32\ghhkljrwBOGUS.dll
Click on the submit button
Please post the results in your next reply.
Here disable realtime protection applications as they sometimes interfere with the tool. this link for any applicable programs you may have.Close all open programs and windows Double click combofix.exe and follow the prompts.
Vista users When finished, it shall produce a log for you. Post the Combofix log
Note: Do not mouseclick combofix's window while its running. That may cause it to stall Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.
#9
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
Thank you. I appreciate the help and update on combofix. I'll run that immediately after this post.
#10
Member
Profile: Join Date: Sep 2008
Posts: 8
Computer Experience:
This is the logfile from the new ver. of combofix:WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! TCP "= 26675:TCP :169.254.2.0/255.255.255.0:Enabled:ActiveSync Servicehttp://www.gmer.net Ad -Aware\aawservice.exe
#11
Staff
Profile: Join Date: Mar 2003
Location: Washington State
Posts: 4,541
Computer Experience:
Hicontents of the code box below and paste it into a blank Notepad , then save it to your desktop as;CFScript.txt All Files (*.*) Close all other windows and programs . Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.Click here to see how to use CFScript.txtPlease do not click on the ComboFix window while it is running a scan. This can cause it to stall.
Code:
http ://www.windowsbbs.com/malware-virus-removal/77280-cleaned-virtumonde-but-cant-run-blacklight.html
Collect::
C:\WINDOWS\system32\ledbjcym.dll
C:\WINDOWS\system32\fgpaggmtBOGUS.ini
C:\WINDOWS\system32\tmggapgf.dll
C:\WINDOWS\system32\BOGUSvmvfibym.dll
C:\WINDOWS\system32\ghhkljrwBOGUS.dll
C:\WINDOWS\system32\BOGUSnzbvik.dll
C:\WINDOWS\system32\FggOYJjlBOGUS.ini
C:\WINDOWS\system32\vqltjuBOGUS.dll
C:\WINDOWS\system32\gcnephdrBOGUS.dll
C:\WINDOWS\system32\ohdmsjnmBOGUS.dll
C:\WINDOWS\system32\rjsbmhssBOGUS.dll
C:\WINDOWS\system32\ixjwgdBOGUS.dll
C:\WINDOWS\system32\FggOYJjlBOGUS.ini2
File::
C:\WINDOWS\system32\ledbjcym.dll
C:\WINDOWS\system32\fgpaggmtBOGUS.ini
C:\WINDOWS\system32\tmggapgf.dll
C:\WINDOWS\system32\BOGUSvmvfibym.dll
C:\WINDOWS\system32\ghhkljrwBOGUS.dll
C:\WINDOWS\system32\BOGUSnzbvik.dll
C:\WINDOWS\system32\FggOYJjlBOGUS.ini
C:\WINDOWS\system32\vqltjuBOGUS.dll
C:\WINDOWS\system32\gcnephdrBOGUS.dll
C:\WINDOWS\system32\ohdmsjnmBOGUS.dll
C:\WINDOWS\system32\rjsbmhssBOGUS.dll
C:\WINDOWS\system32\ixjwgdBOGUS.dll
C:\WINDOWS\system32\FggOYJjlBOGUS.ini2
C:\WINDOWS\system32\YªYª
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"90e3ece7"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"="" Please post the combofix log.
All times are GMT +1. The time now is 12:31 .
