|
|
||
|
|
11-06-2009, 04:36 PM
|
#1 (permalink) |
|
Diamond Member
 
Join Date: Jan 2008
Location: Connecticut/New Jersey, USA
Age: 18
Posts: 3,712
|
Nasty Virus - HJT Log
Have a friend who's laptop has a nasty virus. I already ran MalwareByres twice and removed everything found. Hoping someone could check this HJT log out to see if anything suspicious is left.
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:38:45 AM, on 11/6/2009 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v8.00 (8.00.6001.18828) Boot mode: Normal Running processes: C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNo tifier.exe C:\Program Files (x86)\TOSHIBA\TANU\TANU.exe C:\Program Files (x86)\CyberLink\PowerCinema for TOSHIBA\PCMAgent.exe C:\Program Files (x86)\CyberLink\PowerCinema for TOSHIBA\Kernel\CLML\CLMLSvc.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files (x86)\Java\jre6\bin\jusched.exe C:\Program Files (x86)\iTunes\iTunesHelper.exe C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Internet Explorer\iexplore.exe C:\Program Files (x86)\Windows Live\Toolbar\wltuser.exe C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O1 - Hosts: ::1 localhost O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files (x86)\AskBarDis\bar\bin\askBar.dll O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll O4 - HKLM\..\Run: [TANU] %ProgramFiles%\TOSHIBA\TANU\TANU.exe O4 - HKLM\..\Run: [TUSBSleepChargeSrv] %ProgramFiles(x86)%\TOSHIBA\TOSHIBA USB Sleep and Charge Utility\TUSBSleepChargeSrv.exe O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [NDSTray.exe] "C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe" O4 - HKLM\..\Run: [cfFncEnabler.exe] "C:\Program Files (x86)\TOSHIBA\ConfigFree\cfFncEnabler.exe" O4 - HKLM\..\Run: [Intuit SyncManager] C:\Program Files (x86)\Common Files\Intuit\Sync\IntuitSyncManager.exe startup O4 - HKLM\..\Run: [TrayServer] "C:\Program Files (x86)\MAGIX\Movie_Edit_Pro_15_Plus_Download_versio n\TrayServer.exe" O4 - HKLM\..\Run: [hudosetir] Rundll32.exe "c:\progra~3\jekehafe\jekehafe.dll",a O4 - HKCU\..\Run: [Media Codec Update Service] C:\Program Files (x86)\Essentials Codec Pack\WECPUpdate.exe -s O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [hudosetir] Rundll32.exe "c:\progra~3\jekehafe\jekehafe.dll",a O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~2\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~2\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~2\OFFICE11\REFIEBAR.DLL O13 - Gopher Prefix: O18 - Protocol: intu-help-qb2 - {84D77A00-41B5-4B8B-8ADF-86486D72E749} - C:\Program Files (x86)\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing) O20 - AppInit_DLLs: c:\PROGRA~3\jekehafe\jekehafe.dll O21 - SSODL: fepapifas - {3683d2d6-8ab9-481a-9694-4c77d45aae48} - c:\progra~3\jekehafe\jekehafe.dll (file missing) O22 - SharedTaskScheduler: mujuzedij - {3683d2d6-8ab9-481a-9694-4c77d45aae48} - c:\progra~3\jekehafe\jekehafe.dll (file missing) O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Unknown owner - C:\Windows\system32\agr64svc.exe (file missing) O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing) O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASKService - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\AskService.exe O23 - Service: ASKUpgrade - Unknown owner - C:\Program Files (x86)\AskBarDis\bar\bin\ASKUpgrade.exe O23 - Service: Autodesk Network Licensing Service - Autodesk, Inc. - C:\Program Files (x86)\Common Files\Autodesk Shared\Service\AdskNetSrv.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe O23 - Service: TOSHIBA Web Camera Service (camsvc) - TOSHIBA - C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCameraSrv.exe O23 - Service: ConfigFree Gadget Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFProcSRVC.exe O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel(R) Corporation - C:\Program Files\Intel\WiFi\bin\EvtEng.exe O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files (x86)\MAGIX\Common\Database\bin\fbserver.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FLEXnet Licensing Service 64 - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files (x86)\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe O23 - Service: Google Update Service (gupdate1ca22ddba177ef1) (gupdate1ca22ddba177ef1) - Google Inc. - C:\Program Files (x86)\Google\Update\GoogleUpdate.exe O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max Design 2010 32-bit 32-bit (mi-raysat_3dsmax2010_32) - Unknown owner - C:\Program Files (x86)\Autodesk\3ds Max Design 2010\mentalray\satellite\raysat_3dsmax2010_32serve r.exe O23 - Service: mental ray 3.7 Satellite for Autodesk 3ds Max Design 2010 64-bit 64-bit (mi-raysat_3dsmax2010_64) - Unknown owner - C:\Program Files\Autodesk\3ds Max Design 2010\mentalray\satellite\raysat_3dsmax2010_64serve r.exe O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: QBCFMonitorService - Intuit - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files (x86)\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS. exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel(R) Corporation - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: TOSHIBA Modem region select service (RSELSVC) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\rselect\RSelSvc.exe O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe O23 - Service: TOSHIBA HDD Protection (Thpsrv) - Unknown owner - C:\Windows\system32\ThpSrv.exe (file missing) O23 - Service: TOSHIBA Navi Support Service (TNaviSrv) - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA DVD PLAYER\TNaviSrv.exe O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing) O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe O23 - Service: TOSHIBA eco Utility Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TECO\TecoService.exe O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files (x86)\Viewpoint\Common\ViewpointService.exe O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 12077 bytes
__________________
Mach Speed MSNV-939 nForce Socket 939 AMD Athlon 64 X2 3800+ (OC'd to 2.20 Ghz) Power Up Black ATX Mid-T Case w/700W & Clear Side 4 GB DDR PC3200 RAM/Logitech MX Revolution Mouse 690 GB Storage (320S-ATA, 120-ATA, 250-SATA) Asus HD4870DK 1GB 22" Viewsonic LCD w/ iPod Dock + 22" ASUS Logitech G15 Keyboard/G51 Seakers Computer Pics Last edited by voyagerfan99; 11-06-2009 at 04:55 PM. |
|
|
|
11-06-2009, 05:15 PM
|
#2 (permalink) |
|
Moderator
 
Join Date: Sep 2005
Location: Near Joliet Illinois
Age: 39
Posts: 3,612
|
Yes, the pc is still infected but since combofix and other stronger programs won't run in a 64bit OS, it limits you on what you can do.
Here are the infections... O4 - HKLM\..\Run: [hudosetir] Rundll32.exe "c:\progra~3\jekehafe\jekehafe.dll",a O4 - HKCU\..\Run: [hudosetir] Rundll32.exe "c:\progra~3\jekehafe\jekehafe.dll",a O20 - AppInit_DLLs: c:\PROGRA~3\jekehafe\jekehafe.dll O21 - SSODL: fepapifas - {3683d2d6-8ab9-481a-9694-4c77d45aae48} - c:\progra~3\jekehafe\jekehafe.dll (file missing) O22 - SharedTaskScheduler: mujuzedij - {3683d2d6-8ab9-481a-9694-4c77d45aae48} - c:\progra~3\jekehafe\jekehafe.dll (file missing)
__________________
Motherboard - Gigabyte GA-EP45-UD3R CPU - E8400 Memory - 2GB Corsair XMS2 (2x 1gb) Graphics - ATI HD3870 Hard Drives - 250GB Seagate DVD Drive - Lite-On DVD Burner - Lite-On Power Supply - Rosewill RP600V2-S-SL 600W 22" Acer widescreen AL2216WBD |
|
|
|
|
11-06-2009, 07:14 PM
|
#3 (permalink) | |
|
Diamond Member
Join Date: Jan 2008
Location: Connecticut/New Jersey, USA
Age: 18
Posts: 3,712
|
Quote:
__________________
Mach Speed MSNV-939 nForce Socket 939 AMD Athlon 64 X2 3800+ (OC'd to 2.20 Ghz) Power Up Black ATX Mid-T Case w/700W & Clear Side 4 GB DDR PC3200 RAM/Logitech MX Revolution Mouse 690 GB Storage (320S-ATA, 120-ATA, 250-SATA) Asus HD4870DK 1GB 22" Viewsonic LCD w/ iPod Dock + 22" ASUS Logitech G15 Keyboard/G51 Seakers Computer Pics |
|
|
|
|
|
11-06-2009, 09:04 PM
|
#4 (permalink) |
|
Moderator
Join Date: Sep 2005
Location: Near Joliet Illinois
Age: 39
Posts: 3,612
|
I doubt they are gone, infections can't be removed that easily. Did you rerun hijackthis to see if they were still there?
__________________
Motherboard - Gigabyte GA-EP45-UD3R CPU - E8400 Memory - 2GB Corsair XMS2 (2x 1gb) Graphics - ATI HD3870 Hard Drives - 250GB Seagate DVD Drive - Lite-On DVD Burner - Lite-On Power Supply - Rosewill RP600V2-S-SL 600W 22" Acer widescreen AL2216WBD |
|
|
|
|
11-06-2009, 09:25 PM
|
#5 (permalink) |
|
Diamond Member
Join Date: Jan 2008
Location: Connecticut/New Jersey, USA
Age: 18
Posts: 3,712
|
I did run it again and they weren't there.
__________________
Mach Speed MSNV-939 nForce Socket 939 AMD Athlon 64 X2 3800+ (OC'd to 2.20 Ghz) Power Up Black ATX Mid-T Case w/700W & Clear Side 4 GB DDR PC3200 RAM/Logitech MX Revolution Mouse 690 GB Storage (320S-ATA, 120-ATA, 250-SATA) Asus HD4870DK 1GB 22" Viewsonic LCD w/ iPod Dock + 22" ASUS Logitech G15 Keyboard/G51 Seakers Computer Pics |
|
|
|
|
11-06-2009, 09:29 PM
|
#6 (permalink) |
|
Moderator
Join Date: Sep 2005
Location: Near Joliet Illinois
Age: 39
Posts: 3,612
|
Thats good, maybe just remnants left over. I also saw viewpoint service in your log. Go into add/remove programs and uninstall anything that say viewpoint, usually viewpoint media player.
__________________
Motherboard - Gigabyte GA-EP45-UD3R CPU - E8400 Memory - 2GB Corsair XMS2 (2x 1gb) Graphics - ATI HD3870 Hard Drives - 250GB Seagate DVD Drive - Lite-On DVD Burner - Lite-On Power Supply - Rosewill RP600V2-S-SL 600W 22" Acer widescreen AL2216WBD |
|
|
|
|
11-07-2009, 12:49 AM
|
#7 (permalink) |
|
Diamond Member
Join Date: Jan 2008
Location: Connecticut/New Jersey, USA
Age: 18
Posts: 3,712
|
Okay thanks.
__________________
Mach Speed MSNV-939 nForce Socket 939 AMD Athlon 64 X2 3800+ (OC'd to 2.20 Ghz) Power Up Black ATX Mid-T Case w/700W & Clear Side 4 GB DDR PC3200 RAM/Logitech MX Revolution Mouse 690 GB Storage (320S-ATA, 120-ATA, 250-SATA) Asus HD4870DK 1GB 22" Viewsonic LCD w/ iPod Dock + 22" ASUS Logitech G15 Keyboard/G51 Seakers Computer Pics |
|
|
|
 |
| Bookmarks |
| Thread Tools | Search this Thread |
| Display Modes | |
|
|
Similar Threads
|
||||
| Thread | Thread Starter | Forum | Replies | Last Post |
| Computer cant find network unless in safe mode. (hjt log included) | ukulele_ninja | Computer Security | 6 | 12-30-2007 03:42 AM |
| C:\WINDOWS\system32\rxx6ot.sys (HJT log) | Livzz | Computer Security | 4 | 10-22-2006 05:47 AM |
| HJT log | 34erd | Computer Security | 1 | 11-29-2005 03:20 PM |
| I have a virus, need help! HJT log included | Pck21 | Computer Security | 8 | 11-12-2005 02:22 AM |
| Nasty Virus | SuperPuppy | Computer Security | 3 | 09-06-2005 10:13 PM |
Hybrid Mode
