Print

Vundo trojan and downloader

Sign in
Sign in to post messages.
Latest post 10/31/2009 03:04 PM by Bugbatter. 10 replies.
Back to forum | Previous | Next
Page 1 of 1  
Joined on 06/15/2004
Posts: 7
Points 20

Vundo trojan and downloader

23 Oct 2009 06:28PM

Hello,

My computer is very slow, seems to go to other sites when I search with google.  My norton security keeps finding the above spyware but it cannot remove it.  Here is my hijackthis log.

Thanks,

Dennis

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:05:57 PM, on 10/23/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\helpctr.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpSvc.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\PCHealth\HelpCtr\Binaries\HelpHost.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll

O2 - BHO: (no name) - {CD2B3DC8-C35A-42A9-8FEF-56E6B2EFB6D6} - c:\windows\system32\pwndlck.dll

O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [ccApp] -

O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"

O4 - HKCU\..\Run: [SYSDLL] SYSDLL

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O14 - IERESET.INF: START_PAGE_URL=http://www.insightbb.com

O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409

O16 - DPF: {181BCAB2-C89B-4E4B-9E6B-59FA67A426B5} (Nsepa Control) - https://mymail.humana.com/epa/nsepa.ocx

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab

O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab

O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://l.yimg.com/jh/games/web_games/popcap/bejeweled2/popcaploader_v6.cab

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll

O18 - Filter hijack: text/html - {6CBB7B1D-A2AF-48A5-8EE2-2CF6DAAAFDDD} - C:\WINDOWS\SYSTEM32\bnj.dll

O18 - Filter: text/plain - {6CBB7B1D-A2AF-48A5-8EE2-2CF6DAAAFDDD} - C:\WINDOWS\SYSTEM32\bnj.dll

O20 - Winlogon Notify: qpwwphrq - C:\WINDOWS\SYSTEM32\pwndlck.dll

O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe

--

End of file - 9901 bytes

  • Post Points: 20

10 Replies:

Joined on 10/20/2009
Posts: 48
Points 990

Re: Vundo trojan and downloader

24 Oct 2009 01:22AM

Dennis - Jeff here

Have you done a Norton (Symantec) UPDATE of the Software and Malware Definitons lately, plus a full scan?

If you have not, please do.

Is your Symantec/Norton license current?

Here is a direct link to The NORTON (Symantec) VUNDO removal page. I think you can do this regardless of your License-status.

    http://www.symantec.com/security_response/writeup.jsp?docid=2004-112111-3912-99&tabid=3

FYI. Every Major Security company has a VUNDO-fix available for free. Watch out for Imposters.

Please let me know if this doesn't work or you want another source of Vundo-Fix programs. 

    Jeff

Tags:
  • Post Points: 20
Elyria, Ohio
Joined on 10/27/2009
Posts: 43
Points 590

Re: Vundo trojan and downloader

27 Oct 2009 04:17AM

    Dennis,

    Jeff here again, under a new id..  Is this issue resolved?

      If not, please respond to me and I will get you a SOLUTION.

         Jeff

 

  • Post Points: 20
Joined on 02/11/2006
Posts: 17,272
Points 65,992

Re: Vundo trojan and downloader

27 Oct 2009 04:56AM

Dennis, I'm sorry we could not get to your log sooner. Thank you for waiting patiently.

Please do the following:

  • Download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool.
  • Click Yes at the prompt for Optional Scan.
  • When done, DDS will open two (2) logs

    • 1. DDS.txt
    2. Attach.txt

  • Save both reports to your desktop.
  • Copy/paste both logs to your reply on the forum.
  • Close the program window, and delete the program from your desktop.

    • Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 20
    Elyria, Ohio
    Joined on 10/27/2009
    Posts: 43
    Points 590

    Re: Vundo trojan and downloader

    27 Oct 2009 05:13AM

       Dennis,

       You are know speaking to BugBatter, she is the best there IS!

     

    BugBatter,

    Thank you for taking this on!

    Very Respectfully,

          Jeff

         

    • Post Points: 20
    Joined on 02/11/2006
    Posts: 17,272
    Points 65,992

    Re: Vundo trojan and downloader

    27 Oct 2009 05:58AM

    You're welcome, Jeff.

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 20
    Elyria, Ohio
    Joined on 10/27/2009
    Posts: 43
    Points 590

    Re: Vundo trojan and downloader

    27 Oct 2009 06:05AM

    BugBatter,

      Thanks. You are a better women than me, as a man. I am just trying to cover the night-shift to help you folks out until you folks get ONLINE, Nothing more.

        Again, Very Respectfully,

        Jeff

       

       

    • Post Points: 20
    Joined on 02/11/2006
    Posts: 17,272
    Points 65,992

    Re: Vundo trojan and downloader

    27 Oct 2009 09:58AM

    We appreciate your help, Jeff. This has been a busy week.  If I don't get a chance to complete this one, I'll make sure one of the other security people handles it.

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 5
    Joined on 02/11/2006
    Posts: 17,272
    Points 65,992

    Re: Vundo trojan and downloader

    27 Oct 2009 01:38PM


    Dennis, in the meantime, while you are waiting, please do not search for VundoFix tools. There are some entries that come up in Google that may give you MORE malware if you use them.

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 5
    Joined on 02/11/2006
    Posts: 17,272
    Points 65,992

    Re: Vundo trojan and downloader

    29 Oct 2009 06:02AM

    Dennis,
    We need to see some additional information about what is happening in your machine.

  • Please download DDS by sUBs from one of the following links. Save it to your desktop.
  • Double click on the DDS icon, allow it to run.
  • A small box will open, with an explanation about the tool.
  • Click Yes at the prompt for Optional Scan.
  • When done, DDS will open two (2) logs

    • 1. DDS.txt
    2. Attach.txt

  • Save both reports to your desktop.
  • Copy/paste both logs to your reply on the forum.
  • Close the program window, and delete the program from your desktop.

    • Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet. Information on A/V control HERE.

     

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 5
    Joined on 02/11/2006
    Posts: 17,272
    Points 65,992

    Re: Vundo trojan and downloader

    31 Oct 2009 03:04PM

    Due to the lack of feedback from the original poster, this topic is closed. Everyone else please begin a New Message at the top of the forum.

    Microsoft MVP - Consumer Security

    Member of Alliance of Security Analysis Professionals

    SpywareHammer

     

    Free Internet Security - WOT Web of Trust

     

    • Post Points: 5
    Page 1 of 1