Malware Simply Called "Antivirus Software"

M

mustardgas

New Member
As for opening malwarebytes in safe mode, the message is the safe as the one shown when I tried to open the HJT install- "...marked for deletion."
 
johnb35

johnb35

Administrator
Staff member
Well, i'm thinking the infection will stop any exe from running, thats why i told you to download .com or .scr file.
 
M

mustardgas

New Member
I was able to run rkill in safe mode, which allowed me to open malwarebytes. However, when I tried to update malwarebytes, I got an error message. I assume this is because I can't connect to the internet during safe mode. Is there any way I could get around this?

Here's the hijackthis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:37:50 PM, on 4/2/2010
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18444)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\SYSTEM32\WISPTIS.EXE
C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe
C:\Windows\helppane.exe
C:\Windows\Explorer.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe
O4 - HKLM\..\Run: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\Windows\system32\WLTRAY.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Dell DataSafe Online] "C:\Program Files\Dell DataSafe Online\DataSafeOnline.exe" /m
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P dellsupportcenter
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [edmpcdub] C:\Users\filmmaker\AppData\Local\vwhnyiffe\vdqvidftssd.exe
O4 - Startup: OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Dell Remote Access.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\aestsrv.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Advanced Networking Service (hnmsvc) - Dell Inc. - c:\ProgramData\SingleClick Systems\Advanced Networking Service\hnm_svc.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
O23 - Service: SupportSoft Sprocket Service (DellSupportCenter) (sprtsvc_DellSupportCenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_238116a1\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Windows\system32\Pen_Tablet.exe
O23 - Service: TabletServiceWacom - Wacom Technology, Corp. - C:\Windows\system32\Wacom_Tablet.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE

--
End of file - 8158 bytes
 
johnb35

johnb35

Administrator
Staff member
For now just run malwarebytes not updated and lets see if it kills the process that is stopping it from getting updated. Post the log from malwarebytes after running it. You have one infection here and most likely many hidden still.

O4 - HKCU\..\Run: [edmpcdub] C:\Users\filmmaker\AppData\Local\vwhnyiffe\vdqvidf tssd.exe
 
johnb35

johnb35

Administrator
Staff member
Just an offer here, if you are willing, I could remote into your system and help you that way.
 
johnb35

johnb35

Administrator
Staff member
log me in, team viewer, remote assistance via windows live messenger are just a few different ways.
 
M

mustardgas

New Member
johnb35 said:
Just an offer here, if you are willing, I could remote into your system and help you that way.
Click to expand...

Although you and the others who've responded have been EXTREMELY helpful, I'm not exactly comfortable letting you have direct access to my computer. To be honest, I feel a little strange having given you all the log information earlier, as I don't quite understand that stuff, and therefore don't know exactly what you or others could do with that info if you had malicious intent. I probably sound pretty paranoid and ignorant (I certainly am when it comes to computers), but it's hard for me to be too trusting of others online, especially after these crazy virus episodes I've been experiencing.

I tried a malwarebytes scan. Nothing was detected. But it was a quick scan. Should I try the full scan?
 
M

mustardgas

New Member
johnb35 said:
For now just run malwarebytes not updated and lets see if it kills the process that is stopping it from getting updated. Post the log from malwarebytes after running it. You have one infection here and most likely many hidden still.

O4 - HKCU\..\Run: [edmpcdub] C:\Users\filmmaker\AppData\Local\vwhnyiffe\vdqvidf tssd.exe
Click to expand...

How can I update it without an internet connection?
 
deanj20

deanj20

New Member
I'm not exactly comfortable letting you have direct access to my computer.
Click to expand...

Don't blame you there. He's just trying to help out, but you don't know that... :p

To be honest, I feel a little strange having given you all the log information earlier, as I don't quite understand that stuff, and therefore don't know exactly what you or others could do with that info if you had malicious intent.
Click to expand...

Once again, I don't blame you. Better safe than sorry, right? But fear not - those logs are useless to anyone who has malicious intent - they simply show what processes, etc are running on your machine and browser variables. At best, someone could see that you're running a program that could be exploited (I don't see any), but they would have to know your IP address (which they would have to have server access to get), then get around what security (if any) your ISP has in place, past your router security and your firewall and actually know how to exploit said software. So... pretty harmless information there.

I tried a malwarebytes scan. Nothing was detected. But it was a quick scan. Should I try the full scan?
Click to expand...
Definitely run a full scan.

How can I update it without an internet connection?
Click to expand...
He's hoping that after Malwarebyte's Antimalware runs, you post your new HJT log and we tell you what else need to do, you will be able to get internet access. johnb35 will probably be back on in a bit. I'd be happy to guide you until then. Just run a full scan with Malwarebytes, then post your HJT log here and we'll go from there. :D
 
M

mustardgas

New Member
deanj20 said:
Don't blame you there. He's just trying to help out, but you don't know that... :p



Once again, I don't blame you. Better safe than sorry, right? But fear not - those logs are useless to anyone who has malicious intent - they simply show what processes, etc are running on your machine and browser variables. At best, someone could see that you're running a program that could be exploited (I don't see any), but they would have to know your IP address (which they would have to have server access to get), then get around what security (if any) your ISP has in place, past your router security and your firewall and actually know how to exploit said software. So... pretty harmless information there.

Thanks for the breakdown deanj20. I figured you guys were trustworthy (people have been submitting there logs for some time now after all). But you can never be too sure, right?

Definitely run a full scan.

Currently running full scan.

He's hoping that after Malwarebyte's Antimalware runs, you post your new HJT log and we tell you what else need to do, you will be able to get internet access. johnb35 will probably be back on in a bit. I'd be happy to guide you until then. Just run a full scan with Malwarebytes, then post your HJT log here and we'll go from there. :D
Click to expand...

I accept and appreciate any guidance you can give.
 
OvenMaster

OvenMaster

VIP Member
I had this POS virus hit my Vista laptop a few days ago.

1. http://www.myantispyware.com/2010/0...are-2010-vista-antivirus-2010-vista-guardian/

2. cut and paste all of this following text in Notepad and save it as a .reg file called "fix.reg" on your desktop.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

3. Double-click that .reg file. It will look like nothing has happened. Not true. Reboot and run Malwarebytes and do a FULL scan on your computer.

4. After you are done, search for av.exe or ave.exe and delete it in case Malwarebytes does not erase it for you. It should.

5. You should be just fine after this. A full virus scan would not hurt.

This worked perfectly for me. Good luck!
 
Last edited:
M

mustardgas

New Member
He's hoping that after Malwarebyte's Antimalware runs, you post your new HJT log and we tell you what else need to do, you will be able to get internet access. johnb35 will probably be back on in a bit. I'd be happy to guide you until then. Just run a full scan with Malwarebytes, then post your HJT log here and we'll go from there. :D[/QUOTE]

Full scan revealed no infections.
 
M

mustardgas

New Member
mustardgas said:
He's hoping that after Malwarebyte's Antimalware runs, you post your new HJT log and we tell you what else need to do, you will be able to get internet access. johnb35 will probably be back on in a bit. I'd be happy to guide you until then. Just run a full scan with Malwarebytes, then post your HJT log here and we'll go from there. :D
Click to expand...

Full scan revealed no infections.
 
M

mustardgas

New Member
OvenMaster said:
I had this POS virus hit my Vista laptop a few days ago.

1. http://www.myantispyware.com/2010/0...are-2010-vista-antivirus-2010-vista-guardian/

2. cut and paste all of this following text in Notepad and save it as a .reg file called "fix.reg" on your desktop.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

3. Double-click that .reg file. It will look like nothing has happened. Not true. Reboot and run Malwarebytes and do a FULL scan on your computer.

4. After you are done, search for av.exe or ave.exe and delete it in case Malwarebytes does not erase it for you. It should.

5. You should be just fine after this. A full virus scan would not hurt.

This worked perfectly for me. Good luck!
Click to expand...

So I perform steps 1-3 in safe mode, then perform steps 4 and 5 in normal mode?
 
M

mustardgas

New Member
OvenMaster said:
I had this POS virus hit my Vista laptop a few days ago.

1. http://www.myantispyware.com/2010/0...are-2010-vista-antivirus-2010-vista-guardian/

2. cut and paste all of this following text in Notepad and save it as a .reg file called "fix.reg" on your desktop.

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\Software\Classes\.exe]
[-HKEY_CURRENT_USER\Software\Classes\secfile]
[-HKEY_CLASSES_ROOT\secfile]
[-HKEY_CLASSES_ROOT\.exe\shell\open\command]

[HKEY_CLASSES_ROOT\exefile\shell\open\command]
@="\"%1\" %*"

[HKEY_CLASSES_ROOT\.exe]
@="exefile"
"Content Type"="application/x-msdownload"

3. Double-click that .reg file. It will look like nothing has happened. Not true. Reboot and run Malwarebytes and do a FULL scan on your computer.

4. After you are done, search for av.exe or ave.exe and delete it in case Malwarebytes does not erase it for you. It should.

5. You should be just fine after this. A full virus scan would not hurt.

This worked perfectly for me. Good luck!
Click to expand...

Ok, I gave special attention to the reply containing the above quote, becuase I tried the exact same thing during my last malware episode, and the problem was resolved. However, this instance is different; I tried the above steps while my computer was in safe mode, then rebooted into normal mode so I could run a malwarebytes scan. Whoops- malwarebytes is still blocked. The above steps had no effect. My computer is the same. Additionally, I thought I might be able to try the above steps while in normal mode. Turns out I CAN'T EVEN OPEN NOTEPAD! It's as if I have access to nothing now. And during safe mode, and I can't even access the internet because my computer is a wifi laptop.

Is this completely hopeless?
 
deanj20

deanj20

New Member
Is this completely hopeless?
Click to expand...

No. :D

Run HijackThis! in Safe Mode - do a System Scan and put a check next to this entry:

O4 - HKCU\..\Run: [edmpcdub] C:\Users\filmmaker\AppData\Local\vwhnyiffe\vdqvidf tssd.exe

and click "Fix Selected".

Then go to Start-->Run-->type 'msconfig' and hit <enter>

In the Startup tab, click 'Disable All'
then, in the Services tab, check 'Hide All Microsoft Services' and click 'Disable All'

Click 'OK' and restart the computer in Safe Mode.

Run HijackThis! again, and post the log here. Also - is there any way you can plug you computer into the router with an ethernet cable? I'm sure you're tired of running back and forth between computers?
 
You must log in or register to reply here.
Top