Malware Found

• abao

  21 Feb 08, 15:38

  Doing some maintenence on my cousin's PC and found some suspicious files that was identified as Malware.
  
  Advice needed on deleting them, in particular "bias delete.exe" and "Flag dog.exe". Here's the HjackThis log. :D
  
  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:32:42, on 21/02/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\stsystra.exe C:\Program Files\Dell\Media Experience\DMXLauncher.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\Program Files\SmartFix\bin\McciTrayApp.exe C:\PROGRA~1\MSNMES~1\msnmsgr.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Documents and Settings\shuling\Desktop\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://dellsearchedit.myway.com/samisc/dellsidebar.jhtml?p=EF R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www1.ap.dell.com/content/default.aspx?c=sg&l=en&s=gen R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www1.ap.dell.com/content/default.aspx?c=sg&l=en&s=gen R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file) R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ADSTechnology module - {831CBAC0-8283-4653-9D81-FEB9F3F6E47C} - C:\Program Files\ADSTechnology\ADSTechnology.dll O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe" O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [EPSON Stylus C67 Series] "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAAP.EXE" /P23 "EPSON Stylus C67 Series" /O6 "USB001" /M "Stylus C67" O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [singtelTrayApp] "C:\Program Files\SmartFix\bin\McciTrayApp.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [MATH DOES FIRST MODE] C:\Documents and Settings\All Users\Application Data\live 64 math does\bias delete.exe O4 - HKCU\..\Run: [msnmsgr] "C:\PROGRA~1\MSNMES~1\msnmsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [DellTransferAgent] "C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe" O4 - HKCU\..\Run: [Blueproc] C:\DOCUME~1\shuling\APPLIC~1\BASEOB~1\Flag dog.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: &Search - ?p=ZNxdm795YYSG O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab O16 - DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} (EGamesPlugin Class) - https://www.e-games.com.my/com/EGamesPlugin.cab O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-SG/a-UNO1/GAME_UNO1.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u3-windows-i586-jc.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.grab.com/media/6512bd/games/files/1115/popcaploader_v6.cab O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab O21 - SSODL: rdihost - {1FE97E7D-8AF5-4BC5-8014-1CE4F52EFA04} - rdihost.dll (file missing) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe -- End of file - 9998 bytes
• ndmmxiaomayi

  21 Feb 08, 15:43

  I'm going to have a hard time reading this.

• abao

  21 Feb 08, 15:45

  Hmm, I'll do a yousendit then. Gimme a min :)
  
  http://download.yousendit.com/6F38092905947025
• ndmmxiaomayi

  21 Feb 08, 15:46

  Can the log be uploaded to Mediafire or somewhere else. I also need a list of programs installed on his/her PC.

   

  • Please download and install CCleaner Slim.
  • Once installed, double click on the desktop shortcut created.
  • On the leftmost column, click on Tools.
  • On the middle column, click on Uninstall.
  • At the bottom right hand corner, click on the Save to text file... button.
  • By default, it saves this file to C:\Program Files\CCleaner named install.txt. You may want to save it to your desktop to find it easily. Click Save.
  • Close CCleaner.

  Post back these 2 logs:

  1. A new HijackThis log

  2. CCleaner install.txt file

• abao

  21 Feb 08, 15:51

  http://download.yousendit.com/86D032211AC57144
• ndmmxiaomayi

  21 Feb 08, 16:00

  Disable Spybot Teatimer temporarily so that it will not interfere with the fixes.

  1. IRight click the Spybot Icon in the system tray near the clock (looks like a blue/white calendar with a padlock symbol).
  2. Click once on Resident Protection, then right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  3. Go to Start > All Programs > Spybot - Search & Destroy > Spybot Search & Destroy.
  4. Click on Mode > Advanced Mode. When it prompts you, click Yes.
  5. On the left hand side, click on Tools.
  6. Check (tick) this box if it is not yet ticked: Resident.
  7. You will notice that Resident is now added under Tools. Click on Resident.
  8. Uncheck (untick) this box: Resident "TeaTimer" (Protection of over-all system settings) active.
  9. Exit Spybot Search & Destroy.
  10. Restart your computer for the changes to take effect.

  If you already have SDFix, please delete this copy and download it again as it's being updated regularly.

  1. Please download SDFix by AndyManchesta and save it to your desktop.
  2. Double click on SDFix.exe. By default, it will install to C:\.
  3. Click on Install.

  Please print out or save this set of instructions as you will not have internet access during the fix.
  
  Next, boot into Safe Mode.

  1. When you see BIOS screen, start pressing F8.
  2. A boot menu will appear shortly.
  3. Using the up down arrows, select Safe Mode and press the Enter key.
  4. Windows will now load.
  5. Log in to your usual account.
  6. Navigate to C:\SDfix (if you installed it to the default location, otherwise, locate where you installed it)
  7. Double click on RunThis.bat
  8. Type Y to begin the cleanup process.
  9. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  10. Press any key to reboot.
  11. When the PC restarts the tool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  12. Once the desktop icons load, the SDFix report will open on screen. You can also find the report in SDFix folder, named Report.txt.

  Post back a new HijackThis log and the SDFix report.

• abao

  21 Feb 08, 16:29

  Doesnt look that good...
  
  http://download.yousendit.com/D98E8D1F522D2122
• ndmmxiaomayi

  21 Feb 08, 16:44

  Hmm... looks slightly better.

  Upload this file to either Virus Total or Jotti for a scan.

  C:\WINDOWS\system32\813C19FE84.dll

  Just copy and paste the whole bolded line into the Submit text box.

  Uninstall these programs:

  1. ActivationManager

  2. ADSTechnology

  Then restart your computer.

  Next...

  • Download deljob.exe and save it to your desktop.
  • Double click on Deljob.exe.
  • A log, (logit.txt) will open afterwards. If it doesn't, please locate this log on your C drive.
  • Please post the contents of the logfile in your next reply together with a new HijackThis log.

  Post back the deljob log, a new HijackThis log and the Virus Total or Jotti's scan results of the file.

• abao

  21 Feb 08, 16:48

  Jotti found nothing. Will do the rest of the scan now; gimme a few mins.
• abao

  21 Feb 08, 16:57

  http://download.yousendit.com/A124FA1E71DC38B1
• ndmmxiaomayi

  21 Feb 08, 17:13

  Open HijackThis and do a scan.

  Put a tick next to these lines:

  R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)

  R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)

  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

  O2 - BHO: ActivationManager module - {86A44EF7-78FC-4e18-A564-B18F806F7F56} - C:\Program Files\ActivationManager\ActivationManager.dll (file missing)

  O4 - HKLM\..\Run: [MATH DOES FIRST MODE] C:\Documents and Settings\All Users\Application Data\live 64 math does\bias delete.exe

  O8 - Extra context menu item: &Search - ?p=ZNxdm795YYSG

  
  

  Click Fix checked. Close HijackThis.
  

   

  Delete these folders:

  C:\Program Files\ActivationManager

  C:\Documents and Settings\All Users\Application Data\live 64 math does

  This file:

  C:\WINDOWS\system32\813C19FE84.dll

  Move it to the Recycle Bin. In case something crashes it, you can recover it back from the Recycle Bin. If everything works fine, empty the Recycle Bin.

  You know anything about these folders?

  C:\Documents and Settings\All Users\Application Data\55-55-55-55-55-55

  C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9

• abao

  21 Feb 08, 17:22

  C:\Documents and Settings\All Users\Application Data\55-55-55-55-55-55
  
  C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
  
  I know absolutely nothing about these 2 folders. Agree that they look suspicious. I'm always amazed how this computer end up with so much malware everytime I do a check :roll: :p
  
  I'm going to restart and see if everything works fine.
• ndmmxiaomayi

  21 Feb 08, 17:29

  Haha... looking at the amount of games installed... I won't be surprised if some virus or games (quite unlikely) created those folders.

• abao

  21 Feb 08, 17:32

  C:\WINDOWS\system32\813C19FE84.dll
  
  Put it inside bin liao. Looks fine so far. :D
  
  Latest Logfiles:
  http://download.yousendit.com/F22F058F43C3C74F
• abao

  21 Feb 08, 17:34

  Originally posted by ndmmxiaomayi:

  Haha... looking at the amount of games installed... I won't be surprised if some virus or games (quite unlikely) created those folders.

  
  Agree...I'm going to uninstall a few of them later after my cousin gets home.
  
  another qns to ask... I cleared the malwares in this account... would there be any chance that malware would still exist on the other accounts?
• eagle

  21 Feb 08, 17:36

  mayi displaying power again :D

• ndmmxiaomayi

  21 Feb 08, 17:37

  It's possible, although I've not seen that YET. I'm still lucky. Haha. If not got too much work to do. LOL

  If no problems... just do an online scan and see what junk it can bring out - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

• abao

  21 Feb 08, 17:40

  thx. can finally declare done i guess. :D
• ndmmxiaomayi

  21 Feb 08, 17:56

  Yup, hopefully. If Kaspersky find no junk.

• abao

  21 Feb 08, 18:34

  76% done with the scan and I'm seeing 2 virus, 7 infected objects. Dont think its anything too serious... :|
• abao

  21 Feb 08, 19:08

  http://download.yousendit.com/0DC9499762887490
  
  Saw a few suspicious files... :|
  
  Would it be okay if I delete these:
  
  C:\Documents and Settings\meiqi\Local Settings\Temp\51.tmp/data0005 Infected: not-a-virus:AdWare.Win32.BHO.de
  
  C:\Documents and Settings\meiqi\Local Settings\Temp\51.tmp NSIS: infected - 1
  
  C:\Downloads\ChuzzleSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
  
  C:\Downloads\Miss_Management-v1_0-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
  C:\Downloads\Out_Of_Your_Mind-v1_0-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
  
  C:\Downloads\TeddyTavernSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b skipped
  
  C:\Downloads\WeddingDashSetup-dm[1].exe Infected: not-a-virus:AdWare.Win32.Trymedia.b
  
  C:\WINDOWS\Downloaded Program Files\popcaploader.dll Infected: not-a-virus:Downloader.Win32.PopCap.b
• abao

  21 Feb 08, 19:51

  I'm just going to rar them up and put these files in the bin, since I'm going home soon. As always thx for your help Mayi :D
• ndmmxiaomayi

  21 Feb 08, 20:28

  I only recognize Chuzzle and Wedding Dash. They are games by Popcap. The Popcaploader.dll file... well... it's been an adware always... when you download Popcap games it will be back.

  Might want to ask your cousin what they are.

  Temp files can be cleared with a temp file cleaner like CCleaner.