Worms/Generic.EHY

• caleb_chiang

  15 Dec 07, 22:55

  How to remove this?
  
  Now and then my AVG say that system.exe and svchost.exe kena infected...
  
  Healed and keep poping up...
  
  Detail info after scanning using HijackThis :
  
  Logfile of Trend Micro HijackThis v2.0.2
  Scan saved at 10:38:30 PM, on 12/15/2007
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v7.00 (7.00.6000.16574)
  Boot mode: Normal
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  C:\WINDOWS\system32\ccmsetup\CCMSetup.exe
  C:\WINDOWS\system32\inetsrv\inetinfo.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\WINDOWS\system32\o2flash.exe
  C:\WINDOWS\system32\CCM\CcmExec.exe
  C:\WINDOWS\System.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
  C:\Program Files\Fingerprint Sensor\ATSwpNav.exe
  C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
  C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
  C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
  C:\Program Files\Apoint2K\Apoint.exe
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\system32\igfxext.exe
  C:\WINDOWS\system32\igfxpers.exe
  C:\WINDOWS\system32\igfxsrvc.exe
  C:\WINDOWS\RTHDCPL.EXE
  C:\WINDOWS\AGRSMMSG.exe
  C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
  C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
  C:\Program Files\Apoint2K\Apntex.exe
  C:\Program Files\Apoint2K\HidFind.exe
  C:\Program Files\Winamp\winampa.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\Program Files\Republic Poly\UTClient\UTAgent.exe
  C:\Program Files\MSN Messenger\usnsvc.exe
  C:\Program Files\Internet Explorer\iexplore.exe
  D:\hijackthis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
  F3 - REG:win.ini: load=System
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,System
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
  O4 - HKLM\..\Run: [DispSwitchLauncher] C:\Program Files\Fujitsu\DispSwitch\DispSwitchLauncher.exe
  O4 - HKLM\..\Run: [ATSwpNav] "C:\Program Files\Fingerprint Sensor\ATSwpNav" -run
  O4 - HKLM\..\Run: [LoadFujitsuQuickTouch] C:\Program Files\Fujitsu\Application Panel\QuickTouch.exe
  O4 - HKLM\..\Run: [LoadBtnHnd] C:\Program Files\Fujitsu\BtnHnd\BtnHnd.exe
  O4 - HKLM\..\Run: [IndicatorUtility] C:\Program Files\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe
  O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
  O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
  O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
  O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
  O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
  O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
  O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
  O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
  O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
  O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
  O4 - Startup: UTAgent 4.0.lnk = ?
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
  O4 - Global Startup: UTAgent 4.0.lnk = ?
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: Researcher - {9455301C-CF6B-11D3-A266-00C04F689C50} - C:\Program Files\Common Files\Microsoft Shared\Encarta Researcher\EROPROJ.DLL
  O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = rp.edu.sg
  O17 - HKLM\Software\..\Telephony: DomainName = rp.edu.sg
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = rp.edu.sg
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
  O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
  O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\system32\o2flash.exe
  
  --
  End of file - 7296 bytes
  
• ndmmxiaomayi

  16 Dec 07, 11:28

  You're the second RP student to tio the same virus.
  
  Looks like another one is spreading via the network again, or rather, through MSN.
  
  If you already have MSNCleaner, please delete this copy and download it again as it's being updated regularly.
  
  

  [*]Right click here and select Save Target As. Save it to your desktop.
  [*]Right click on MsnCleaner.zip and select Extract All....
  [*]Click Next on seeing the Welcome to the Compressed (zipped) Folders Extraction Wizard.
  [*]Click on the Browse button. Click on Desktop. Then click OK.
  [*]Click Next. It will start extracting.
  [*]Once done, check (tick) the Show extracted files box and click Finish.
  [*]Double click on MSNCleaner.exe to run it. Click on the Analyze button to find a list of files. Once done, click on the Report button. This will open Notepad, please post the contents of this log file in your next reply.
• caleb_chiang

  17 Dec 07, 22:41

  - Logfile MSNCleaner 1.5.0 by www.forospyware.com
  - Created Logfile: 12/17/2007 on 10:40:45 PM
  - Operative System: Windows XP
  - Boot mode: Normal
  _________________________________________
  
  Detected files: 3
  Deleted file: 0
  Undeleted Files: 0
  
  C:\autorun.inf
  C:\WINDOWS\config\svchost.exe
  C:\WINDOWS\System.exe
  
• caleb_chiang

  17 Dec 07, 22:42

  Anyway, just did a self service reformat at IT helpdesk and now this...
• ndmmxiaomayi

  18 Dec 07, 01:51

  Run it again. Click on Analyze, followed by the Delete button.