Inactive Trojan SHeur2.MUX - infected win\sys32\userinit.exe

[Inactive] Trojan SHeur2.MUX - infected win\sys32\userinit.exe

Hi,

I am a new member who has a problem with Malware -Trojan SHeur2.MUX

My PC config is as under
-----------------------------
Operating System: Windows XP Home Edition (5.1, Build 2600) Service Pack 3 (2600.xpsp_sp3_gdr.080814-1236)
Language: English (Regional Setting: English)
System Manufacturer: INTEL_
System Model: D845GVS1
BIOS: BIOS Date: 02/16/04 02:29:53 Ver: 08.00.08
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz
Memory: 510MB RAM
----------------------
I have AVG Free 8.0.176- (virus database is the latest-270.10.13/1914 dated 25 Jan 2009 - today) and Malwarebytes Anti Malware 1.33 (database version 1691 dated 24 Jan 2009) installed.

Since the last 2 days AVG resident shield keeps popping up a message " "THREAT DETECTED - c:\windows\sys32\userinit.exe infected with Trojan SHeur2.MUX "

On using the Heal option - AVG displays a message "some files cannot be healed."

Malware shows 2 infected files and removes them, but each time I reboot, the trojan reappears. I have removed it 3 times in safe mode, run SDfix but to no avail.

Details of DDS.txt files is as under
------------------
DDS (Ver_09-01-19.01) - FAT32x86
Run by admn at 11:29:27.23 on 25/01/2009
Internet Explorer: 8.0.6001.18241 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.510.136 [GMT 5.5:30]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
SVCHOST.EXE
C:\WINDOWS\System32\svchost.exe -k netsvcs
SVCHOST.EXE
SVCHOST.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
g:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
g:\PROGRA~1\AVG\AVG8\avgrsx.exe
g:\PROGRA~1\AVG\AVG8\avgemc.exe
G:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\admn\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = about:blank
uSearch Bar = hxxp://www.google.com/ie
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Octh Class: {000123b4-9b42-4900-b3f7-f4b073efc214} - h:\program files\orbitdownloader\orbitcth.dll
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - f:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - g:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - g:\spybot~1\SDHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
TB: Grab Pro: {c55bbcd6-41ad-48ad-9953-3609c48eacc7} - h:\program files\orbitdownloader\GrabPro.dll
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
mRun: [AVG8_TRAY] g:\progra~1\avg\avg8\avgtray.exe
mRun: [PD0630 STISvc] RunDLL32.exe P0630Pin.dll,RunDLL32EP 513
mRun: [basicsmssmenu] "c:\program files\seagate\basics\basics status\MaxMenuMgrBasics.exe "
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [Callcentric]
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
dRunOnce: [RunNarrator] Narrator.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobea~1.lnk - c:\windows\installer\{ac76ba86-1033-0000-7760-000000000002}\SC_Acrobat.exe
IE: &Download by Orbit - h:\program files\orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - h:\program files\orbitdownloader\orbitmxt.dll/204
IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert to existing PDF - c:\program files\adobe\acrobat 7.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Do&wnload selected by Orbit - h:\program files\orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - h:\program files\orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
IE: {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~1\office11\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - g:\spybot~1\SDHelper.dll
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {474F00F5-3853-492C-AC3A-476512BBC336} - hxxp://picasaweb.google.com/s/v/26.34/uploader2.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1170329067328
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1198386722078
DPF: {88D969C0-F192-11D4-A65F-0040963251E5} - file://c:\tempei4\ei40_\msxml4.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {DE22A7AB-A739-4C58-AD52-21F9CD6306B7} - hxxp://download.microsoft.com/download/7/E/6/7E6A8567-DFE4-4624-87C3-163549BE2704/clearadj.cab
DPF: {EECC2B58-FDE7-4F3A-B933-B25BE90F1D37} - hxxp://download.yoomba.com/YoombaActivation.cab
TCP: {40862260-086D-4AA3-95D2-5F9490D4EB40} = 192.168.1.1
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - g:\program files\avg\avg8\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
AppInit_DLLs: avgrsstx.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {F552DDE6-2090-4bf4-B924-6141E87789A5} - No File

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admn\applic~1\mozilla\firefox\profiles\875yhbp1.default\
FF - component: g:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\opera\program\plugins\npfdm.dll
FF - plugin: f:\program files\real\realplayer\netscape6\nppl3260.dll
FF - plugin: f:\program files\real\realplayer\netscape6\nprjplug.dll
FF - plugin: f:\program files\real\realplayer\netscape6\nprpjplug.dll
FF - plugin: g:\program files\opera\program\plugins\npdivx32.dll
FF - plugin: g:\program files\opera\program\plugins\npdsplay.dll
FF - plugin: g:\program files\opera\program\plugins\NPOFFICE.DLL
FF - plugin: g:\program files\opera\program\plugins\npqtplugin.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin2.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin3.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin4.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin5.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin6.dll
FF - plugin: g:\program files\opera\program\plugins\npqtplugin7.dll
FF - plugin: g:\program files\opera\program\plugins\NPSWF32.dll
FF - plugin: g:\program files\opera\program\plugins\npwmsdrm.dll
FF - plugin: h:\program files\divx\divx player\npDivxPlayerPlugin.dll
FF - plugin: h:\program files\divx\divx web player\npdivx32.dll
FF - plugin: h:\program files\videolan\vlc\npvlc.dll

============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-1-23 28544]
R0 pxark;pxark;c:\windows\system32\drivers\pxark.sys [2008-8-2 17408]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-7-28 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-7-28 26824]
R3 P0630VID;Creative WebCam Live!;c:\windows\system32\drivers\P0630Vid.sys [2007-1-2 91841]
R4 avg8emc;AVG Free8 E-mail Scanner;g:\progra~1\avg\avg8\avgemc.exe [2008-7-28 875288]
R4 avg8wd;AVG Free8 WatchDog;g:\progra~1\avg\avg8\avgwdsvc.exe [2008-7-28 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-7-28 76040]
S0 Partizan;Partizan;c:\windows\system32\drivers\partizan.sys --> c:\windows\system32\drivers\Partizan.sys [?]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2008-9-13 16512]
S3 RegGuard;RegGuard;c:\windows\system32\drivers\regguard.sys [2008-8-3 25773]

=============== Created Last 30 ================

2009-01-25 11:02 578,560 a------- c:\windows\system32\dllcache\user32.dll
2009-01-25 11:01 <DIR> --d----- c:\windows\ERUNT
2009-01-25 10:54 <DIR> --d----- C:\SDFix
2009-01-25 09:13 125,440 a------- c:\windows\system32\dllcache\userinit.exe
2009-01-23 23:24 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-01-23 23:21 <DIR> --d----- c:\program files\Panda Security
2009-01-23 14:59 <DIR> --dsh--- C:\FOUND.078
2009-01-23 06:44 <DIR> --dsh--- C:\FOUND.077
2009-01-23 06:40 491 a------- c:\windows\system32\win32hlp.cnf
2009-01-19 07:07 207,488 a----r-- c:\windows\system32\drivers\vinyl97.sys
2009-01-14 10:19 <DIR> --d----- C:\divx
2009-01-04 20:39 244 a---h--- C:\sqmnoopt19.sqm
2009-01-04 20:39 232 a---h--- C:\sqmdata19.sqm
2009-01-04 13:58 244 a---h--- C:\sqmnoopt18.sqm
2009-01-04 13:58 232 a---h--- C:\sqmdata18.sqm
2009-01-04 13:57 244 a---h--- C:\sqmnoopt17.sqm
2009-01-04 13:57 232 a---h--- C:\sqmdata17.sqm
2009-01-04 13:57 244 a---h--- C:\sqmnoopt16.sqm
2009-01-04 13:57 232 a---h--- C:\sqmdata16.sqm
2009-01-04 13:56 244 a---h--- C:\sqmnoopt15.sqm
2009-01-04 13:56 232 a---h--- C:\sqmdata15.sqm
2009-01-04 13:56 244 a---h--- C:\sqmnoopt14.sqm
2009-01-04 13:56 232 a---h--- C:\sqmdata14.sqm
2009-01-04 13:56 244 a---h--- C:\sqmnoopt13.sqm
2009-01-04 13:56 232 a---h--- C:\sqmdata13.sqm
2009-01-04 13:55 244 a---h--- C:\sqmnoopt12.sqm
2009-01-04 13:55 232 a---h--- C:\sqmdata12.sqm
2009-01-04 13:54 244 a---h--- C:\sqmnoopt11.sqm
2009-01-04 13:54 232 a---h--- C:\sqmdata11.sqm
2009-01-04 13:54 244 a---h--- C:\sqmnoopt10.sqm
2009-01-04 13:54 232 a---h--- C:\sqmdata10.sqm
2009-01-04 13:51 244 a---h--- C:\sqmnoopt09.sqm
2009-01-04 13:51 232 a---h--- C:\sqmdata09.sqm
2009-01-01 11:33 <DIR> --d----- C:\New Folder 1
2008-12-30 11:40 1 a------- c:\windows\system32\test.ttt
2008-12-27 13:25 120,056 -------- c:\windows\system32\pxcpyi64.exe
2008-12-27 13:25 118,520 -------- c:\windows\system32\pxinsi64.exe

==================== Find3M ====================

2009-01-23 06:39 125,440 a------- c:\windows\system32\userinit.exe
2009-01-14 16:11 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-14 16:11 15,504 a------- c:\windows\system32\drivers\mbam.sys
2008-12-14 19:29 5,699,584 a------- c:\windows\system32\dllcache\mshtml.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll
2008-12-11 16:27 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-12-11 16:27 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-11-22 03:17 524,288 a------- c:\windows\system32\DivXsm.exe
2008-11-22 03:17 3,596,288 a------- c:\windows\system32\qt-dx331.dll
2008-11-22 03:17 129,784 -------- c:\windows\system32\pxafs.dll
2008-11-22 03:16 1,044,480 a------- c:\windows\system32\libdivx.dll
2008-11-22 03:16 200,704 a------- c:\windows\system32\ssldivx.dll
2008-11-22 03:14 161,096 a------- c:\windows\system32\DivXCodecVersionChecker.exe
2008-11-22 03:14 12,288 a------- c:\windows\system32\DivXWMPExtType.dll
2008-11-09 22:51 286,720 a------- c:\windows\iun506.exe
2007-06-11 08:58 310 a------- c:\docume~1\admn\applic~1\regdatels.dat
2008-07-30 13:11 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008073020080731\index.dat

============= FINISH: 11:29:52.79 ===============

I dont know how to send an attachment from the post and would request you let me the email address to which "attach.txt" and screen print of the error can be mailed.

Would be obliged for help.

Thanks.

Ranjit

 

Welcome to WindowsBBS ranjitr

Please visit the following webpage for instructions for downloading and running ComboFix

How to use ComboFix


Download ComboFix by sUBs from here, saving the file to your desktop.


Disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

• Close all open programs and windows
• Double click ComboFix.exe and follow the prompts.
• It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

**NOTE - Please make very sure you allow the Recovery Console to be downloaded and installed if or when prompted.