Sign In
Create Account
0
Our kids' PC is infected such that IE7 is being hijacked to go to windowsclick.com.
Following some diagnostics it looks like a trojan named "uacinit.dll" (variously located in C:\Avenger and C:\windows\system32\) - as well as apparently other dlls that may be the root problem...
Here is a quick/partial insert from a RootRepeal scan (for Files) --
Path: C:\Avenger\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACkxxylnxfrhholca.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACljefnbuqltmgyno.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UAClthmxvrbyxrfjjc.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACraxcoucurswnnyr.log
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACulamiqjpaypibml.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACwkpkoppfqmprsvd.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACxnwswsiersyttar.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACvbfagxiqhemxsbx.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Buffy.KIDS\Local Settings\Temp\UACf516.tmp
Status: Invisible to the Windows API!
The tojan has screwed up the operation of PC such that I can't reliably get MalwareBytes to run, or HJT (will try also in safe mode). On one scan with MWB it did detect the uacinit.dll and tried to delete it on reboot, but without success.
Symantec wasn't very helpful so I installed a 30 day trial copy of Kaspesky and did a full scan but it didn't pick up anything!
Would be very thankful and appreciateive for any helpful guidance to fix this annoying problem.
-
This topic is locked
Back to top
#2
Posted 02 May 2009 - 05:51 PM
-
- Members
-
- 2 posts
New Member
Gemo, on May 2 2009, 12:57 PM, said:
Our kids' PC is infected such that IE7 is being hijacked to go to windowsclick.com.
Following some diagnostics it looks like a trojan named "uacinit.dll" (variously located in C:\Avenger and C:\windows\system32\) - as well as apparently other dlls that may be the root problem...
Here is a quick/partial insert from a RootRepeal scan (for Files) --
Path: C:\Avenger\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACkxxylnxfrhholca.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACljefnbuqltmgyno.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UAClthmxvrbyxrfjjc.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACraxcoucurswnnyr.log
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACulamiqjpaypibml.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACwkpkoppfqmprsvd.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACxnwswsiersyttar.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACvbfagxiqhemxsbx.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Buffy.KIDS\Local Settings\Temp\UACf516.tmp
Status: Invisible to the Windows API!
The tojan has screwed up the operation of PC such that I can't reliably get MalwareBytes to run, or HJT (will try also in safe mode). On one scan with MWB it did detect the uacinit.dll and tried to delete it on reboot, but without success.
Symantec wasn't very helpful so I installed a 30 day trial copy of Kaspesky and did a full scan but it didn't pick up anything!
Would be very thankful and appreciateive for any helpful guidance to fix this annoying problem.
Following some diagnostics it looks like a trojan named "uacinit.dll" (variously located in C:\Avenger and C:\windows\system32\) - as well as apparently other dlls that may be the root problem...
Here is a quick/partial insert from a RootRepeal scan (for Files) --
Path: C:\Avenger\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACkxxylnxfrhholca.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACljefnbuqltmgyno.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UAClthmxvrbyxrfjjc.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACraxcoucurswnnyr.log
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACulamiqjpaypibml.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACwkpkoppfqmprsvd.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACxnwswsiersyttar.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACvbfagxiqhemxsbx.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Buffy.KIDS\Local Settings\Temp\UACf516.tmp
Status: Invisible to the Windows API!
The tojan has screwed up the operation of PC such that I can't reliably get MalwareBytes to run, or HJT (will try also in safe mode). On one scan with MWB it did detect the uacinit.dll and tried to delete it on reboot, but without success.
Symantec wasn't very helpful so I installed a 30 day trial copy of Kaspesky and did a full scan but it didn't pick up anything!
Would be very thankful and appreciateive for any helpful guidance to fix this annoying problem.
Was finally able to install/run HiJackThis v2.0.2 - but I had to rename the installer program (from HJTInstall.exe to, for example, HJTInstall-XX.exe) - guess the trojan is somehow trapping and stopping HJTInstall.exe
So here's a HJT report --
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:11 PM, on 5/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Web traffic protection statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1...toUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewid...oOnlineScan.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo.../sysreqlab3.cab
O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - https://www-secure.symantec.com/techsupp/as...rl/LSSupCtl.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoft...s/as2stubie.cab
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/b...lineScanner.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/Facebo...toUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1155863447171
O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) - http://support.installshield.com/kb/files/.../OCI/isetup.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-sec...m/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab
O16 - DPF: {CE28D5D2-60CF-4C7D-9FE8-0F47A3308078} - https://www-secure.symantec.com/techsupp/as...rl/SymAData.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/Facebo...Uploader4_5.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...933/mcfscan.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab
O20 - AppInit_DLLs: ,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Sansa Updater Service (SansaService) - Unknown owner - C:\Program Files\SanDisk\Sansa Updater\SansaSvr.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowProducer\ScsiAccess.exe
--
End of file - 9085 bytes
Hope the info helps - Best Regards.
#3
Posted 07 May 2009 - 04:17 AM
-
- Administrators
-
- 22,575 posts
Forum Deity
- Gender:Male
- Location:US
Sorry for the delay - currently the site is just too busy for us to handle all of the requests for help. Some other sites are now posting a wait time of up to 10 days.
If you're still there and need assistance please let me know and I'll help you out.
Thanks.
If you're still there and need assistance please let me know and I'll help you out.
Thanks.
#4
Posted 08 May 2009 - 06:35 AM
-
- Administrators
-
- 22,575 posts
Forum Deity
- Gender:Male
- Location:US
#5
Posted 12 May 2009 - 06:22 AM
-
- Administrators
-
- 22,575 posts
Forum Deity
- Gender:Male
- Location:US
Due to the lack of feedback this Topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.
Other members who need assistance please start your own topic in a new thread. Thanks!
The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.
Other members who need assistance please start your own topic in a new thread. Thanks!
The fixes and advice in this thread are for this machine only. Do not apply the instructions from this thread to your own machine. Please start a new thread describing your issue and someone will be along to assist you.
1 user(s) are reading this topic
0 members, 1 guests, 0 anonymous users
