Hi,
recently got the trojan Vundo.... ran a scan but didn't get rid of it. Tried running SUPER atnit spyware and it found some stuff but when I restarted it was still there. Then I found a thread for the solution here in this forum. I ran HIJACK THIS and here is the log...
Logfile of Trend Micro HijackThis v2.0.2http://www.dell4me.com/myway http://us.mc1138.mail.yahoo.com/mc/welcome?.gx=0&.tm=1257277272&.rand=fgum1tah2tiev http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://channels.aimtoday.com/search/aimtoolbar.jsp http://www.symantec.com/techsupp/servlet/ProductMessages?module=2009&error=0&language=en&product=SymNRT&version=2009.0.5.26&build=Symantec&a=00000082.00000003.00000019&b=00000082.00000049.000000bb&c=00000082.0000006f.00000148 http://www.yahoo.com https://secure.stamps.com/download/us/registration/3_0_0_804/sdcregie.cab http://download.infotriever.com/bin/ifhelper.cab http://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab http://www.worldwinner.com/games/shared/wwlaunch.cab http://a19.g.akamai.net/7/19/7125/1440/ftp.coupons.com/v3123/cpbrkpie.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.worldwinner.com/games/shared/uninstall.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Now I need some help! Thanks,
Gary
Hi gdaws
Welcome to the Norton Forum
I'm not an expert in reading HiJackThis logs, but I can see that you are running a quite old Adobe Reader version which should be updated to the current one. Adobe Reader usually updates their programs due to security reasons. You are also using Spyware Doctor which is another full time scanner. Spyware Doctor has been known to interfere with Norton products. Having 2 real time security scanners cause more problems than they can fix as you are finding out now. You are also 1 sp behind for Windows xp which means you are lacking some of the windows updates which would have protected your computer further also.
If you look at this thread, you may have a generation 3 rootkit.
http://community.norton.com/norton/board/message?board.id=nis_feedback&thread.id=90498
Message Edited by floplot on 12-07-2009 10:53 AM
The following entries seem to be malicious:
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://channels.aimtoday.com/search/aimtoolbar.jsp
Quads
December 8, 2009, 3:35am
4
Hi gdaws
I see you PMed me
I no longer do malware /Rootkit removal on this site using advanced tools and scripting, As there are not enough guidelines and protection for the user here.
It could be (before a definition update) that you have the TDL3 Rootkit.
Quads
Hi gdawsonia
I would recommend that you back up your files. Then since you have a possible rootkit, I would go to a site that specializes in removing rootkits like www.bleepingcomputer.com It is a very busy site and you will have to wait your turn and follow their directions. Another alternative would be to bring your computer to a repair shop near you that does that type of thing. Good luck
Can you just check my log and see if you see anything bad??
Running processes:http://www.dell4me.com/myway http://us.mc1138.mail.yahoo.com/mc/welcome?.gx=0&.tm=1257277272&.rand=fgum1tah2tiev http://go.microsoft.com/fwlink/?LinkId=69157 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=54896 http://go.microsoft.com/fwlink/?LinkId=69157 http://www.symantec.com/techsupp/servlet/ProductMessages?module=2009&error=0&language=en&product=SymNRT&version=2009.0.5.26&build=Symantec&a=00000082.00000003.00000019&b=00000082.00000049.000000bb&c=00000082.0000006f.00000148 http://www.yahoo.com https://secure.stamps.com/download/us/registration/3_0_0_804/sdcregie.cab http://download.infotriever.com/bin/ifhelper.cab http://public2.uploader.officelive.com/_layouts/1033/wh/ActiveX/MsnPUpld.cab http://www.worldwinner.com/games/shared/wwlaunch.cab http://a19.g.akamai.net/7/19/7125/1440/ftp.coupons.com/v3123/cpbrkpie.cab http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab http://www.worldwinner.com/games/shared/uninstall.cab http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Quads
December 8, 2009, 7:48am
8
Hi
In testing on my own PC just over the last 30mins I can confirm even once the Rootkit is disabled that Tidserv (TDSS) even though this looks like a Gen 2 can be heuristically detected as Vundo.2 or similar.
Instead of Tidserv
I had already disabled the Rootkit, before detection.
So I can see TDSS Gen 3 (TDL3) could be detected as Vundo.2
Quads
jAW
December 8, 2009, 1:25pm
9
Can you just check my log and see if you see anything bad??
Hi gdawsonla,
You have one 016 entry that probably is related to CouponBar. You can actually remove all the 016 entries if you want to, when you visit any page that uses these they will be reinstalled again.
O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/1440/ftp.coupons.com/v3123/cpbrkpie.cab
You also have a process "h:\autorun.exe" that usually should not be running unless H: is a CD/DVD and you had it loaded with a disc when you took the log. What type of drive is your H: drive?
Otherwise the log looks ok.
Do you still get warnings about Vundo? If so from where? If it is Norton that gives the warnings, could you please check the History log and see if you have anything under Unresolved Security Risks.
Regards
jAW
