possible keylogger and other viruses

Discussion in 'Malware Help (A Specialist Will Reply)' started by fredneck, Aug 7, 2009.

  1. fredneck

    fredneck Private E-2

    My paypal account has been hacked twice in the last six months. Closed account after first hack and opened new one with all different info. It happened again last week....someone in China. Anyway, ran all the malware scans and here are the logs...could not download rootrepeal unless I paid. It said my 30 day trial was over.
     

    Attached Files:

    fredneck, Aug 7, 2009
    #1
  2. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    First a little advice. Allowing all users to have Admin. privileges as well as having Kazaa installed on your system is a huge security risk. Once any users gets infected, it will infect all user accounts. You need to run SAS and MBAM on each user account, and then change their privileges.

    Your system can barely run XP....you need 4 times as much ram as what you have:
    Total Physical Memory 256.00 MB
    Available Physical Memory 78.37 MB

    Run this: Disable/Remove Windows Messenger to remove Windows Messenger. Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):

    Run C:\MGtools\analyse.exe by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator). This is really HijackThis (select Do a system scan only) and select the following lines but DO NOT CLICK FIX until you exit all browser sessions including the one you are reading in right now:
    After clicking Fix, exit HJT.

    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

Driver::
jvvoice
tpciidex

File::
C:\Documents and Settings\Joby\LOCAL Settings\Temp\268.tmp.exe
C:\Documents and Settings\Joby\LOCAL Settings\Temp\267.tmp.exe
c:\documents and settings\All Users\Application Data\svchosts.exe
C:\Documents and Settings\Joby\Desktop\a
c:\docume~1\Ammon\LOCALS~1\Temp\jvvoice.sys
c:\docume~1\Ammon\LOCALS~1\Temp\tpciidex.sys

RegLockDel::
[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor\Adwr_291]
@DACL=(02 0000)
"ExistFile"="c:\\Program Files\\KaZaA\\Kazaa.exe"
"LoctNum"=dword:00000003
"ShowChange"=dword:00000000
"DaysCnt"=dword:00000001
"PopMaxDay"=dword:00000008
"ConnFrqn"=dword:00000014
"LastCMSConn"=hex:7f,72,cf,3d,01,ff,91,01
"LastDate"=dword:3dd0ff90
"PopDonSes"=dword:00000001
"PopDonDay"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor Services\Queue]
@DACL=(02 0000)
"BnsCnt"=dword:00000000
"DapCnt"=dword:00000000
"DapPtr"=dword:00000001
"BnsPtr"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor Services\Status]
@DACL=(02 0000)
"IdleState"=dword:00000001
[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7239C462-6987-5177-AF61-FF4790041E7B}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000005
"Time"=hex:d6,07,01,00,01,00,02,00,15,00,13,00,1f,00,67,01

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000344
"Time"=hex:d6,07,01,00,01,00,02,00,15,00,13,00,20,00,1f,00

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor\Adwr_291]
@DACL=(02 0000)
"ExistFile"="c:\\Program Files\\KaZaA\\Kazaa.exe"
"LoctNum"=dword:00000003
"ShowChange"=dword:00000000
"DaysCnt"=dword:00000000
"PopMaxDay"=dword:00000008
"ConnFrqn"=dword:00000014
"LastCMSConn"=hex:c2,1f,c9,3d,01,ff,91,01
"LastDate"=dword:3d572c6b
"PopDonDay"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor Services\Queue]
@DACL=(02 0000)
"BnsCnt"=dword:00000000
"DapCnt"=dword:00000000
"DapPtr"=dword:00000001
"BnsPtr"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor Services\Status]
@DACL=(02 0000)
"IdleState"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000016
"Time"=hex:d5,07,0a,00,01,00,11,00,0c,00,36,00,25,00,48,01

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1010\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000002
"Time"=hex:d5,07,01,00,00,00,1e,00,03,00,04,00,0d,00,48,01

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"systeminfors"=-

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\267.tmp]


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\267.tmp.exe]


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\268.tmp]


[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\268.tmp.exe]
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now run Ccleaner to clean out only temp files and nothing else!

    Now run the C:\MGtools\GetLogs.bat file by double clicking on it (Note: if using Vista, don't double click, use right click and select Run As Administrator).

    Then attach the below logs:

    * C:\ComboFix.txt
    * C:\MGlogs.zip

    Make sure you tell me how things are working now!
     
    TimW, Aug 10, 2009
    #2
  3. fredneck

    fredneck Private E-2

    Kazaa has not been used for years...just can't seem to wipe it out completely. Also, My wife and I are the only ones that use this computer and we always log on under my name. I will probably just delete the other accounts. The machine is working fine, I am just worried about a keylogger problem. I will do as you suggested and post the results. Thanks.
     
    fredneck, Aug 10, 2009
    #3
  4. fredneck

    fredneck Private E-2

    Here are the latest results. Thanks!
     

    Attached Files:

    fredneck, Aug 11, 2009
    #4
  5. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Did you run SAS and MBAM on each user account? Did they find anything --> if so attach the logs identifying which account they are.

    Let's do this again. But first:
    Please use add/remove programs to uninstall:
    Kazaa Media Desktop 2.1.1

    Please disable all anti-virus and anti-spyware programs while we do the following (re-enable when you are finished):
    * Make sure that combofix.exe that you downloaded while doing the READ & RUN ME is on your Desktop but Do not run it!
    If it is not on your Desktop, the below will not work.
    * Also make sure you have shut down all protection software (antivirus, antispyware...etc) or they may get in the way of allowing ComboFix to run properly.
    * If ComboFix tells you it needs to update to a new version, make sure you allow it to update.
    * Open Notepad and copy/paste the text in the below code box into it (make sure you scroll all the way down in the code box to get all lines selected ):
    Code:
    KILLALL::

File::
c:\program files\tsi2.db
C:\2466e3e7a627c8b034effc8275

RegLockDel::
[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor\Adwr_291]
@DACL=(02 0000)
"ExistFile"="c:\\Program Files\\KaZaA\\Kazaa.exe"
"LoctNum"=dword:00000003
"ShowChange"=dword:00000000
"DaysCnt"=dword:00000001
"PopMaxDay"=dword:00000008
"ConnFrqn"=dword:00000014
"LastCMSConn"=hex:7f,72,cf,3d,01,ff,91,01
"LastDate"=dword:3dd0ff90
"PopDonSes"=dword:00000001
"PopDonDay"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor Services\Queue]
@DACL=(02 0000)
"BnsCnt"=dword:00000000
"DapCnt"=dword:00000000
"DapPtr"=dword:00000001
"BnsPtr"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Cydoor Services\Status]
@DACL=(02 0000)
"IdleState"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{7239C462-6987-5177-AF61-FF4790041E7B}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000005
"Time"=hex:d6,07,01,00,01,00,02,00,15,00,13,00,1f,00,67,01

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000344
"Time"=hex:d6,07,01,00,01,00,02,00,15,00,13,00,20,00,1f,00

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor\Adwr_291]
@DACL=(02 0000)
"ExistFile"="c:\\Program Files\\KaZaA\\Kazaa.exe"
"LoctNum"=dword:00000003
"ShowChange"=dword:00000000
"DaysCnt"=dword:00000000
"PopMaxDay"=dword:00000008
"ConnFrqn"=dword:00000014
"LastCMSConn"=hex:c2,1f,c9,3d,01,ff,91,01
"LastDate"=dword:3d572c6b
"PopDonDay"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor Services\Queue]
@DACL=(02 0000)
"BnsCnt"=dword:00000000
"DapCnt"=dword:00000000
"DapPtr"=dword:00000001
"BnsPtr"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1008\Software\Cydoor Services\Status]
@DACL=(02 0000)
"IdleState"=dword:00000001

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1009\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000016
"Time"=hex:d5,07,0a,00,01,00,11,00,0c,00,36,00,25,00,48,01

[HKEY_USERS\S-1-5-21-2885428501-3344456904-2111342016-1010\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D714A94F-123A-45CC-8F03-040BCAF82AD6}\iexplore]
@DACL=(02 0000)
"Type"=dword:00000003
"Count"=dword:00000002
"Time"=hex:d5,07,01,00,00,00,1e,00,03,00,04,00,0d,00,48,01
    * Save the above as CFscript.txt and make sure you save it to the same location (should be on your Desktop) as ComboFix.exe
    * At this point, you MUST EXIT ALL BROWSERS NOW before continuing!
    * You should have both the ComboFix.exe and CFScript.txt icons on your Desktop.
    If it asks you to overide the prvevious file with the same name, click YES.
    * Now use your mouse to drag CFscript.txt on top of ComboFix.exe
    http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
    * Follow the prompts.
    * When it finishes, a log will be produced named c:\combofix.txt
    * I will ask for this log below

    Note:

    Do not mouseclick combofix's window while it is running. That may cause it to stall.

    Now download the latest version of MGtools and save it to your root folder. Overwrite your previous MGtools.exe file with this one. Click the exe file and let it run.

    Please attach the new:
    C:\MGLogs.zip
    C:\Combo.txt
     
    TimW, Aug 14, 2009
    #5
  6. fredneck

    fredneck Private E-2

    it won't let me remove kazaa, there is nothing there..."the specified module could not be found". It there somewhere else I can go to remove what is left of this program?
     
    fredneck, Aug 15, 2009
    #6
  7. TimW

    TimW MajorGeeks Administrator - Jedi Malware Expert Staff Member

    Run CCleaner....should or might be in your uninstall list. However, you did not attach the logs I requested after running the fix I gave you.
     
    TimW, Aug 18, 2009
    #7

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds