Jump to content


Photo
- - - - -

Bad Image Report


  • This topic is locked This topic is locked
4 replies to this topic

#1 Angel_956

Angel_956

    New Member

  • Members
  • Pip
  • 2 posts

Posted 14 November 2009 - 01:16 AM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:10:54 AM, on 11/14/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Personal Guard 2009\personalguard.exe
C:\WINDOWS\system32\winsc.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com...de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://url.urtbk.com...&...&b42=0.0042
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [VSOCheckTask] "c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [QBReminderFlash] "C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\explorer.exe.exe" /runcleanupscript
O4 - HKLM\..\Run: [gegatihol] Rundll32.exe "c:\windows\system32\kubidima.dll",a
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: c:\windows\system32\junefare.dll c:\windows\system32\moyebari.dll c:\windows\system32\kubidima.dll,zeveluhe.dll
O21 - SSODL: SysNet - {D23FCF7F-F13E-4879-98E2-A4CC8C185395} - C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll
O21 - SSODL: duduvates - {6db93f93-921e-4f8a-ab73-978e117d0668} - c:\windows\system32\moyebari.dll (file missing)
O21 - SSODL: wafadotef - {c0412f81-bbff-4936-b782-346ddf7e63cc} - (no file)
O21 - SSODL: rigosaful - {b78cfd46-7fa1-4be5-8374-344aa5cdc506} - c:\windows\system32\moyebari.dll (file missing)
O21 - SSODL: fufigotum - {8a7893ff-b018-45f2-bf5f-1712640f115b} - c:\windows\system32\junefare.dll (file missing)
O21 - SSODL: fuboriliy - {b83ea837-f4c9-4d27-b4df-22fdb8375caa} - c:\windows\system32\kubidima.dll
O21 - SSODL: dilotiril - {6c70730a-f11e-4d5b-9256-02b5af2a2487} - c:\windows\system32\kubidima.dll
O21 - SSODL: sezepinub - {19430de4-a317-4d56-9a51-6099bbb3818b} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: kupuhivus - {6db93f93-921e-4f8a-ab73-978e117d0668} - c:\windows\system32\moyebari.dll (file missing)
O22 - SharedTaskScheduler: gahurihor - {b78cfd46-7fa1-4be5-8374-344aa5cdc506} - c:\windows\system32\moyebari.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {8a7893ff-b018-45f2-bf5f-1712640f115b} - c:\windows\system32\junefare.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {b83ea837-f4c9-4d27-b4df-22fdb8375caa} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: gahurihor - {6c70730a-f11e-4d5b-9256-02b5af2a2487} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: mujuzedij - {19430de4-a317-4d56-9a51-6099bbb3818b} - c:\windows\system32\kubidima.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) - Networks Associates Technology, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8480 bytes

#2 miekiemoes

miekiemoes

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 7,673 posts
  • Gender:Female
  • Location:Belgium

Posted 14 November 2009 - 06:30 AM

Hi,

* Start HijackThis, close all open windows leaving only HijackThis running. Place a check against each of the following:

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O4 - HKLM\..\Run: [gegatihol] Rundll32.exe "c:\windows\system32\kubidima.dll",a
O20 - AppInit_DLLs: c:\windows\system32\junefare.dll c:\windows\system32\moyebari.dll c:\windows\system32\kubidima.dll,zeveluhe.dll
O21 - SSODL: SysNet - {D23FCF7F-F13E-4879-98E2-A4CC8C185395} - C:\Documents and Settings\All Users\Microsoft AData\sysnet.dll
O21 - SSODL: duduvates - {6db93f93-921e-4f8a-ab73-978e117d0668} - c:\windows\system32\moyebari.dll (file missing)
O21 - SSODL: wafadotef - {c0412f81-bbff-4936-b782-346ddf7e63cc} - (no file)
O21 - SSODL: rigosaful - {b78cfd46-7fa1-4be5-8374-344aa5cdc506} - c:\windows\system32\moyebari.dll (file missing)
O21 - SSODL: fufigotum - {8a7893ff-b018-45f2-bf5f-1712640f115b} - c:\windows\system32\junefare.dll (file missing)
O21 - SSODL: fuboriliy - {b83ea837-f4c9-4d27-b4df-22fdb8375caa} - c:\windows\system32\kubidima.dll
O21 - SSODL: dilotiril - {6c70730a-f11e-4d5b-9256-02b5af2a2487} - c:\windows\system32\kubidima.dll
O21 - SSODL: sezepinub - {19430de4-a317-4d56-9a51-6099bbb3818b} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: kupuhivus - {6db93f93-921e-4f8a-ab73-978e117d0668} - c:\windows\system32\moyebari.dll (file missing)
O22 - SharedTaskScheduler: gahurihor - {b78cfd46-7fa1-4be5-8374-344aa5cdc506} - c:\windows\system32\moyebari.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {8a7893ff-b018-45f2-bf5f-1712640f115b} - c:\windows\system32\junefare.dll (file missing)
O22 - SharedTaskScheduler: kupuhivus - {b83ea837-f4c9-4d27-b4df-22fdb8375caa} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: gahurihor - {6c70730a-f11e-4d5b-9256-02b5af2a2487} - c:\windows\system32\kubidima.dll
O22 - SharedTaskScheduler: mujuzedij - {19430de4-a317-4d56-9a51-6099bbb3818b} - c:\windows\system32\kubidima.dll


* Click on Fix Checked when finished and exit HijackThis.
Make sure your Internet Explorer is closed when you click Fix Checked!

Then, please update MalwareBytes and run a scan....

  • Start MalwareBytes and click the Update tab. There click "Check for updates"
  • Once the updates are downloaded, perform a quick scan again.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply along with a fresh HijackThis log, then we'll proceed from there with new steps.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
Mieke Verburgh
Director of Research

Posted Image

Follow us: Twitter, Become a fan: Facebook

#3 Angel_956

Angel_956

    New Member

  • Members
  • Pip
  • 2 posts

Posted 14 November 2009 - 10:57 PM

Thank you for all your help(:

#4 miekiemoes

miekiemoes

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 7,673 posts
  • Gender:Female
  • Location:Belgium

Posted 15 November 2009 - 03:28 AM

Hi,

Please post the new logs afterwards since leftovers may still be present.
Mieke Verburgh
Director of Research

Posted Image

Follow us: Twitter, Become a fan: Facebook

#5 miekiemoes

miekiemoes

    Forum Deity

  • Administrators
  • PipPipPipPipPipPip
  • 7,673 posts
  • Gender:Female
  • Location:Belgium

Posted 25 November 2009 - 02:36 PM

Since there is no feedback anymore, I assume this issue is resolved ... so, this Topic is closed.
If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.
Mieke Verburgh
Director of Research

Posted Image

Follow us: Twitter, Become a fan: Facebook




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users