#1
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
[Active] TROJAN! C:\windows\system32\kupaviba.dll
I just recently discovered that my computer is infected by Trojan Horse C:\windows\system32\kupaviba.dll (Trojan Generic15AFJI). I tried looking it up online but wasn't able to find much about it.ups occure and is preventing me from downloading some security files and anti-virus software. I was able to update AVG (which is what detected the file). Ad -Ware works and says it is up to date but every time it scans it finds new files to delete. Malware Destroyer was disabled and will not run. Malewarebytes will not run either.
Didn't find the information you thought to find?Similar Threads
#2
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,300
Computer Experience:
Hi,this post as indicated at the top of this forum & follow the instructions.
#3
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
It is preventing me from downloading that DDS thing. I am running RootRepeal right now.
#4
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
ROOTREPEAL (c) AD , 2007-2009SP3
#5
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,300
Computer Experience:
Quote:
Originally Posted by
ianchesh
It is preventing me from downloading that DDS thing. I am running RootRepeal right now.
Use another PC (friend/family/public library) to download & transfer via USB stick.
#6
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
Here is the DDS log.HJT Report ===============http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://kl.bar.need2find.com/KL/menusearch.html?p=KL js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Yahoojs : browser.startup.homepage - hxxp://www.yahoo.com/js : keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=js : yahoo.homepage.dontask - trueAd -Aware Service;Lavasoft Ad -Aware Service;c:\program files\lavasoft\ad -aware\AAWService.exe [2009-1-18 1028432]
#7
Administrator
Profile: Join Date: Dec 2001
Location: 35⁰ 53'55.1" N, 14⁰ 28'37.5" E
Posts: 3,300
Computer Experience:
Thanks. A malware expert will look at this in the next few days.
#8
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,702
Computer Experience:
Please download ComboFix from Here Here **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop** Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Very Important! disable your anti-virus , script blocking and any anti-malware real-time protection before "unpredictable results" .Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. NOTE. Recovery Console Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it startsPlease do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** Make sure, you re-enable your security programs, when you're done with Combofix. DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!! HijackThis :http://www.trendsecure.com/portal/en...kthis/download Download HijackThis Installer Do NOT attempt to fix anything! NOTE. If you're using Vista, right click on HijackThis , and click Run as Administrator
#9
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
Combofix... when I was trying to download this it kept saying that I couldn't download it. I ended up using a disk to download it onto my laptop and burning it to a disk which I then got onto this computer and ran it.Ad -Aware Service]TCP "= 21525:TCP :BitComet 21525 TCP Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\Lavasoft\Ad -Aware\AAWService.exe [1/18/2009 2:34 PM 1028432]Ad -Aware Update (Weekly).jobAd -Aware\Ad -AwareAdmin.exe [2009-01-18 16:03]http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://kl.bar.need2find.com/KL/menusearch.html?p=KL js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Yahoojs : browser.startup.homepage - hxxp://www.yahoo.com/js : keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=js : yahoo.homepage.dontask - true.http://www.gmer.net cf ,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22ad ,a2,e7,8a,bf,05,5ecf ,c7,0c,b0,9a,d4,94,d0,52,fe,51,07,58, \Ad -Aware\AAWTray.exe
#10
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
Hijackthis...SP3 (WinNT 5.01.2600)Ad -Aware\AAWService.exeAd -Aware\AAWTray.exehttp://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://kl.bar.need2find.com/KL/menusearch.html?p=KL http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://www.creative.com/su/ocx/15030/CTSUEng.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://h30155.www3.hp.com/ediags/dd/...allMgr_v01.cab http://h30155.www3.hp.com/ediags/dd/...lMgr_v01_6.cab http://update.microsoft.com/microsof...?1135478588514 http://update.microsoft.com/microsof...?1135478583686 http://imlive.com/chatsource/ImlCID.cab http://bartelldrugs.lifepics.com/net...eUploader3.cab http://gameadvisor.futuremark.com/global/msc311.cab http://upload.mediamax.com/Upload/XUpload.ocx http://www.creative.com/su/ocx/15030/CTPID.cab Ad -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exe
#11
Malware Analyst
Profile: Join Date: Aug 2002
Location: Daly City, CA
Posts: 4,702
Computer Experience:
Open Windows Explorer . Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders .http://www.virustotal.com/ for security check:mmf.sys open Notepad Click Start , then Run
Type notepad .exe in the Run Box.
copy/paste the entire content of the codebox below into the Notepad window:
Code:
File::
c:\windows\system32\firovopa.dll
c:\windows\system32\gusuvote.dll
c:\windows\system32\hosezora.dll
c:\windows\system32\lesufuya.dll
c:\windows\system32\lutazipu.dll
c:\windows\system32\nodugari.dll
c:\windows\system32\pulemebo.dll
Folder::
Driver::
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pudanayad"=-
RegLockDel:: Save the above as CFScript.txt drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.http://users.pandora.be/bluepatchy/m...s/CFScript.gif Combofix.txt A new HijackThis log .
#12
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
VIRUSTOTAL Scan:
#13
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
double post
Last edited by ianchesh; 2 Weeks Ago at 23:27 .
Reason: double post
#14
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
ComboFix 09-10-28.08 - Ian 11/01/2009 13:43.4.1 - NTFSx86Ad -Aware Service]TCP "= 21525:TCP :BitComet 21525 TCP Ad -Aware Service;Lavasoft Ad -Aware Service;c:\program files\Lavasoft\Ad -Aware\AAWService.exe [1/18/2009 1:34 PM 1028432]Ad -Aware Update (Weekly).jobAd -Aware\Ad -AwareAdmin.exe [2009-01-18 16:03]http://www.yahoo.com/ext/search/search.html http://www.yahoo.com http://kl.bar.need2find.com/KL/menusearch.html?p=KL js : browser.search.defaulturl - hxxp://search.yahoo.com/search?fr=ffsp1&p=js : browser.search.selectedEngine - Yahoojs : browser.startup.homepage - hxxp://www.yahoo.com/js : keyword.URL - hxxp://search.yahoo.com/search?fr=ffds1&p=js : yahoo.homepage.dontask - true.http://www.gmer.net cf ,55,c7,95,2b,14,4d,f8,66,7b,0c,1b,19,52,fe,22ad ,a2,e7,8a,bf,05,5ecf ,c7,0c,b0,9a,d4,94,d0,52,fe,51,07,58, \
#15
Member
Profile: Join Date: Jan 2009
Posts: 21
Computer Experience:
Logfile of Trend Micro HijackThis v2.0.2SP3 (WinNT 5.01.2600)http://www.yahoo.com/ http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://us.rd.yahoo.com/customize/ie/...ch/search.html http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com http://kl.bar.need2find.com/KL/menusearch.html?p=KL http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab http://www.creative.com/su/ocx/15030/CTSUEng.cab http://www.nvidia.com/content/Driver...sysreqlab3.cab http://www.fileplanet.com/fpdlmgr/ca..._2.3.6.108.cab http://lads.myspace.com/upload/MySpaceUploader1006.cab http://h30155.www3.hp.com/ediags/dd/...allMgr_v01.cab http://h30155.www3.hp.com/ediags/dd/...lMgr_v01_6.cab http://update.microsoft.com/microsof...?1135478588514 http://update.microsoft.com/microsof...?1135478583686 http://imlive.com/chatsource/ImlCID.cab http://bartelldrugs.lifepics.com/net...eUploader3.cab http://gameadvisor.futuremark.com/global/msc311.cab http://upload.mediamax.com/Upload/XUpload.ocx http://www.creative.com/su/ocx/15030/CTPID.cab Ad -Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad -Aware\AAWService.exe
All times are GMT +1. The time now is 12:58 .
