HiJackThis log. Help with Vundo please

Question

Hi. Please help me. I´m trying to help my family with there computer, Norton says that it been infected with Vundo in vturs.dll. Neither smithfraudfix or virtumundobegone could fix it. I´d tryed to remove the files from DOS but the virus appears to be there. It´s hard to do things/give instructions over the phone so now I try a Hijackthis log.     Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 19:10:44, on 2008-01-09 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program\Compaq\Easy Access Button Support\StartEAK.exe C:\Program\Norton Internet Security\IAMAPP.EXE C:\Program\NORTON~1
avapw32.exe C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\WINDOWS\system32\ctfmon.exe C:\Program\Compaq\Easy Access Button Support\StartEAK .exe C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe C:\Program\Compaq\Easy Access Button Support\CPQEADM.EXE C:\Program\NORTON~1
avapw32 .exe C:\Program\Norton Internet Security\IAMAPP .EXE C:\WINDOWS\system32\ctfmon .exe C:\COMPAQ\CPQINET\CPQInet.exe C:\Compaq\EAKDRV\EAUSBKBD.EXE C:\Program\Compaq\EASYAC~1\BttnServ.exe C:\Program\Norton AntiVirus
avapsvc.exe C:\Program\Norton Internet Security\NISUM.EXE C:\WINDOWS\System32
vsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program\Norton Internet Security\SymProxySvc.exe C:\Program\Norton Internet Security\NISSERV.EXE C:\Program\Delade filer\Symantec Shared\Security Center\SymWSC.exe C:\Program\Canon\CAL\CALMAIN.exe C:\Program\Norton Internet Security\ATRACK.EXE C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program\Trend Micro\HijackThisensning.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\Install\Windows-KB890830-V1.37-delta.exe d:\68f8a28e8ffcbf66cf\mrtstub.exe C:\WINDOWS\system32\MRT.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer erhållen av Spray R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar R3 - URLSearchHook: ICQ  Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program\ICQToolbar	oolbaru.dll F3 - REG:win.ini: load=C:\WINDOWS\system32\vturs.exe O2 - BHO: myBar BHO - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - C:\Program\MyWay\myBar\1.bin\MYBAR.DLL O2 - BHO: Länkhjälp till Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program\Delade filer\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {2B3CBDC2-8AB6-45B1-B59E-7B0DEE595917} - C:\WINDOWS\system32\xxyyyya.dll O2 - BHO: (no name) - {728383E9-80B3-4444-901A-C6D128AC613C} - C:\WINDOWS\system32\vturs.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program\google\googletoolbar2.dll O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &SearchBar - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - C:\Program\MyWay\myBar\1.bin\MYBAR.DLL O3 - Toolbar: ICQ  Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program\ICQToolbar	oolbaru.dll O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program\Norton AntiVirus\NavShExt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program\google\googletoolbar2.dll O4 - HKLM\..\Run: [CPQEASYACC] C:\Program\Compaq\Easy Access Button Support\StartEAK.exe O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize O4 - HKLM\..\Run: [iamapp] C:\Program\Norton Internet Security\IAMAPP.EXE O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\Program\SYMNET~1\SNDMon.exe /Consumer O4 - HKLM\..\Run: [NAV Agent] C:\Program\NORTON~1
avapw32.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] 'C:\Program\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe' O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] 'C:\Program\Adobe\Reader 8.0\Reader\Reader_sl.exe' O4 - HKLM\..\RunServices: [WinStart.exe] WinStart.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: &ICQ Toolbar Search - res://C:\Program\ICQToolbar	oolbaru.dll/SEARCH.HTML O8 - Extra context menu item: E&xportera till Microsoft Excel - res://C:\Program\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program\ICQLite\ICQLite.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program\Messenger\msmsgs.exe O9 - Extra button: Spray Mail - {4268B44F-183C-4A24-8F81-E125F74C5551} - http://mail.spray.se (file missing) (HKCU) O14 - IERESET.INF: START_PAGE_URL=http://www.spray.se O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by110w.bay110.mail.live.com/mail/resources/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1098027798328 O16 - DPF: {6E5E167B-1566-4316-B27F-0DDAB3484CF7} (Image Uploader Control) - http://www.extrafilm.se/ImageUploader4.cab O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.5 Control) - https://lagring.storegate.se/user/Files/Cabs/ImageUploader3.cab O20 - Winlogon Notify: winxtx32 - C:\WINDOWS\SYSTEM32\winxtx32.dll O20 - Winlogon Notify: xxyyyya - C:\WINDOWS\SYSTEM32\xxyyyya.dll O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program\Canon\CAL\CALMAIN.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Norton AntiVirus Auto-Protect (navapsvc) - Symantec Corporation - C:\Program\Norton AntiVirus
avapsvc.exe O23 - Service: Norton Internet Security Service (NISSERV) - Symantec Corporation - C:\Program\Norton Internet Security\NISSERV.EXE O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program\Norton Internet Security\NISUM.EXE O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32
vsvc32.exe O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\Program\DELADE~1\SYMANT~1\SCRIPT~1\SBServ.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\SNDSrvc.exe O23 - Service: Norton Internet Security Proxy Service (SymProxySvc) - Symantec Corporation - C:\Program\Norton Internet Security\SymProxySvc.exe O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program\Delade filer\Symantec Shared\Security Center\SymWSC.exe -- End of file - 8052 bytes

starbomb · Answer

Thanks I don´t know if there are any P2P program on the computer. please notice that I don´t have fysical contat with the computer, it´s my mothers 30 miles away... I also post the log in a swedish forum, http://www.pchemma.se/forum/thread.jsp?f=37&t=16472

Bugbatter · Answer

Welcome. Thank you for using Dell Community Forums.
I am reviewing your log.
In the meantime, you can help me by doing the following:

* Have you have posted this issue on another forum? If so, please provide a link to the topic.

* If you are using any cracked software, please remove it.
Definition of cracked software:
http://en.wikipedia.org/wiki/Software_cracking

* If you are using any P2P (file sharing) programs, please remove them before we clean your computer.
The nature of such software and the high incidence of malware in files downloaded with them is counter productive to restoring your PC to a healthy state.

* If this computer belongs to someone else, do you have authority to apply the fixes we will use?

* Have you already fixed entries using HijackThis? If so, please restore all the backups and then post another log.

* After we begin working, please print or copy all instructions to Notepad in order to assist you when carrying out procedures.
Please follow all instructions in sequence. Do not, on your own, install/re-install any programs or run any fixes or scanners that you have not been instructed to use because this may cause conflicts with the tools that I am using.

** We may be using some specialized tools during our fix. Certain embedded files that are part of legitimate programs or specialized fix tools such as process.exe, restart.exe, SmiUpdate.exe, reboot.exe, ws2fix.exe, prcviewer.exe and nircmd.exe may at times be detected by some anti-virus/anti-malware scanners as a "RiskTool", "Hacking tool", "Potentially unwanted tool", or even "malware (virus/trojan)" when that is not the case.
Such programs have legitimate uses in contexts where an authorized user or administrator has knowingly installed it. These detections do not necessarily mean the file is malware or a bad program. It means it has the potential for being misused by others. Anti-virus scanners cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert you or even automatically remove them.

* If your replies do not fit in one post while we are handling your issue, please reply to yourself until all text is submitted. It may take several posts.

I look forward to your reply.

Bugbatter · Answer

Your log has not been replied to at the Swedish forum. If you would prefer to work over there, that is fine. However, if you do that, I will discontinue research on your problem in order to work with other people waiting in line for help. Let me know what you would like to do.

If you do not have physical contact with the computer, how will you use the tools and post reports from their logs? If I handle your problem, cleaning will take several days. There are multiple infections showing in that log.

I will wait for your reply before I continue.

starbomb · Answer

Ok, I really appreciate your help. My post in the other forum have also been answered, basiclly the answere is that it´s some new form of Vundo and it´s really hard to clean the computer, maybe not worth the efford? The are backups on all the important files and pictures, maybe it´s easier to reinstall? in that case, what should I think on (we already reinstalled all the norton and installed Nod32 instead and as you said, it looks like there are very many virus and stuff...)/norton did´t find much.

starbomb · Answer

sorry, uninstalled norton....

Bugbatter · Answer

The problem is that you cannot simply 'tell' your mother what tools to use. Our instructions must be printed out and followed EXACTLY step-by-step with any errors reported accurately. Otherwise, if something goes wrong, it could damage the system. Please let me know how you want to proceed.

starbomb · Answer

Hi. I understand your concern about my distane to the computer but that should´t be any big problem, I will tell my mother what tools/action she has to take in order to enable you to help me.. I don´t think my post will geat any majoure attention in the swedish forum, do you want me to delete it? Because I belive I can get better help from you than I will get in that forum.   Thanks!

Bugbatter · Answer

I cannot read Swedish, but the reply was short, so I get the impression that the helper did not want to fix this.

We can try to fix it, but you really need to have access to the computer so that you can sit in front of it and follow step-by-step instructions. It may take several days.

starbomb · Answer

:-) maby you do understand swedish...   well, I think you can leave this problem, I will formate the drive and reinstall.   Thanks for you help anyway..   --Someony can close this thread

Bugbatter · Answer

Thank you for letting us know. Your decision is probably the best under these circumstances.

Virus & Spyware

HiJackThis log. Help with Vundo please

Was this post helpful?