Awvvu.dll I Need Help Please!

Anchorless · January 2008

The other day I booted up my PC and was having all of the following issues some of which were worded so well I copied from another fella who was having similar troubles.

I had two new icons on my desktop, Windows XP's "Help and Support" icon and Windows XP's "Windows Update", both pointing to http://storageprotector.com. Symptoms of this infection included sluggishness, inability to double-click "My computer" icon as well as others, depending of the configuration of the system.

I googled the NT_Kernel error 1256 and came upon the forum http://forum.bitdefender.com/index.php?showtopic=3561 and after combing through the forum I found a fix mentioned called FixVundo.exe. I downloaded this third-party utility and ran it. It detected several .dlls related to this trojan and deleted all of them except for awvvu.dll and awvvu.exe The system required a reboot. Once rebooted, it DID NOT delete the final files.

However, a new error message popped up wanting to run one of the affected .dll but was unable to locate it. The two malicious icons on the desktop also remained. I was able to delete the icons. After double-clicking the C: icon, roughly 2,000+ .tmp files, all starting with the name posxxx.dll were in the root. I highlighted and deleted those files.

I entered the registry editor and went to HKEY_LOCAL_MACHINE\HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and deleted the .dll in that group.

Every time I reboot my computer, it's a slow boot and I am getting plenty of POP UP Ads. I also receive a buffer overrun that McAffee catches and deals with.

I am Pretty sure all of this is stemming from the awvvu.dll and awvvu.exe files in my system32 folder. I recently ran HiJackThis and can post a log asap. The log has a run command to run [kernel] also which has it's own folder under program files. Could this be the malware kernal.exe? I think I can probably fix the problem with just checking a few boxes that look suspicious but would like some help with it.

Thanks a lot in advance.

kyron · January 2008

kernal.exe ? 99% malware only by name:P:P. but if you paste the log here would be better. also, did you try BDAspy? (you can get it from http://students.info.uaic.ro/~daniel.chipi...DAspySetup.exe). If the normal scan doesn't work, you may try a DeepScan. keep us informed.

farbar · January 2008

Hi kyron,

You may have cleaned the infection partially with Vundofix, but as you mentioned you don't seem totally clean. I suggest you post a HJT log. Check if you still have unusual amount of .tmp files particularly on C drive.

farbar · January 2008

To kyron: I am sorry on two accounts: one is that I mentioned your name in place of the original poster. The second is that going to another topic and seeing your reply I realised that as long as you are on the case I can better retreat and let you do the good job you are doing.

Anchorless · January 2008

kernal.exe ? 99% malware only by name:P:P. but if you paste the log here would be better. also, did you try BDAspy? (you can get it from http://students.info.uaic.ro/~daniel.chipi...DAspySetup.exe). If the normal scan doesn't work, you may try a DeepScan. keep us informed.

I'll post my HiJack Log in as soon as I get to my PC. Thanks!

Anchorless · January 2008

Thanks a lot for the advice! I downloaded the malware tool you linked to and it came up with zero errors. Vundofix still detects awvvu.dll but cannot remove it. I still get a buffer overload in Internet Explorer that Mcaffee blocks, and I cannot double click with my mouse unless I go into the control panel and reset double click options on reboot.

Here is the HGT Log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:25:04 AM, on 1/20/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\stsystra.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

C:\WINDOWS\system32\Rundll32.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

C:\Program Files\RF Wireless Mouse\cm20.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

C:\DOCUME~1\FRED\LOCALS~1\Temp\clclean.0001

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\Dell\QuickSet\quickset .exe

C:\WINDOWS\system32\WDBtnMgr.exe

C:\Program Files\SiteAdvisor\6253\SiteAdv.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol .exe

C:\Program Files\RF Wireless Mouse\cm20 .exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe

C:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\SiteAdvisor\6253\SiteAdv .exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\McAfee.com\Agent\mcagent.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\Program Files\HP\HP Software Update\HPWuSchd .exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr .exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\McAfee.com\Agent\mcagent .exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\SiteAdvisor\6253\SAService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect .exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\McAfee\MSC\mcuimgr.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\FRED\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset .exe .exe .exe .exe .exe .exe .exe .exe .exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime

O4 - HKCU\..\Run: [setDefaultMIDI] MIDIDef.exe

O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html

O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

O17 - HKLM\System\CCS\Services\Tcpip\..\{64617C4F-0F10-4316-9A7A-8E372853EE6C}: NameServer = 38.9.212.2,38.9.222.2

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe

O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe

O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe

O23 - Service: Microsoft cache control (MSControlService) - Unknown owner - C:\WINDOWS\system32\windows

O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6253\SAService.exe

O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--

End of file - 11974 bytes

kyron · January 2008

(sorry for delay)

Anchorless, please make an archive with all the content of C:\Program Files\kernel\ and give it to me.

Anchorless · January 2008

(sorry for delay)

Anchorless, please make an archive with all the content of C:\Program Files\kernel\ and give it to me.

Kyron, by archive do you mean a .zip file or .rar file? I noticed this morning I had another unusual .dll file in my system registry and took it out using regedit.

The desktop icons that I had posted in my initial post, had shown back up on my computer. Running VUNDOFIX to get rid of them again and archiving contents of C:\Program Files\kernel\ for you.

Thanks for the help, and do not worry about the delay.

Anchorless · January 2008

Kyron, here is the archived kernal file. It's in .rar format. I took it right from my system 32 folder.

After deleting the icons on my desktop and running vundofix.exe I had 1,000 .tmp files on my C:\ drive that I was able to delete.

Seems like I halted the virus, but since I didn't get rid of it, it respawned and kicked back into shape.

Still can't double click on startup.

Here is my VudoFix Logfile

It says it removed awvvu.dll but I just checked the system32 folder and it still remains.

VundoFix V6.7.7

Checking Java version...

Java version is 1.4.2.3

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.3

Old versions of java are exploitable and should be removed.

Java version is 1.5.0.6

Old versions of java are exploitable and should be removed.

Scan started at 4:36:40 PM 1/22/2008

Listing files found while scanning....

C:\windows\system32\awvvu.dll

C:\WINDOWS\system32\awvvu.exe

C:\WINDOWS\system32\cytjddlk.dll

C:\WINDOWS\system32\klddjtyc.ini

C:\WINDOWS\system32\kqqeixgm.dll

C:\WINDOWS\system32\putfqicw.dll

C:\WINDOWS\system32\sktfwsyw.exe

C:\WINDOWS\system32\snpmldwi.exe

C:\windows\system32\uvvwa.ini

C:\WINDOWS\system32\uvvwa.ini2

C:\WINDOWS\system32\wciqftup.ini

C:\WINDOWS\system32\wpssqanx.dll

C:\WINDOWS\system32\xkcsxunf.dll

C:\windows\system32\xkcsxunf.dllbox

C:\WINDOWS\system32\ydwbftst.dll

Beginning removal...

Attempting to delete C:\windows\system32\awvvu.dll

C:\windows\system32\awvvu.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\awvvu.exe

C:\WINDOWS\system32\awvvu.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\cytjddlk.dll

C:\WINDOWS\system32\cytjddlk.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\klddjtyc.ini

C:\WINDOWS\system32\klddjtyc.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\kqqeixgm.dll

C:\WINDOWS\system32\kqqeixgm.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\putfqicw.dll

C:\WINDOWS\system32\putfqicw.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\sktfwsyw.exe

C:\WINDOWS\system32\sktfwsyw.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\snpmldwi.exe

C:\WINDOWS\system32\snpmldwi.exe Has been deleted!

Attempting to delete C:\windows\system32\uvvwa.ini

C:\windows\system32\uvvwa.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\uvvwa.ini2

C:\WINDOWS\system32\uvvwa.ini2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\wciqftup.ini

C:\WINDOWS\system32\wciqftup.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\wpssqanx.dll

C:\WINDOWS\system32\wpssqanx.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\xkcsxunf.dll

C:\WINDOWS\system32\xkcsxunf.dll Has been deleted!

Attempting to delete C:\windows\system32\xkcsxunf.dllbox

C:\windows\system32\xkcsxunf.dllbox Has been deleted!

Attempting to delete C:\WINDOWS\system32\ydwbftst.dll

C:\WINDOWS\system32\ydwbftst.dll Has been deleted!

Performing Repairs to the registry.

Done!

Beginning removal...

Attempting to delete C:\WINDOWS\system32\cytjddlk.dll

C:\WINDOWS\system32\cytjddlk.dll Has been deleted!

Performing Repairs to the registry.

Done!

/applications/core/interface/file/attachment.php?id=19773" data-fileExt='zip' data-fileid='19773'>kernel.rar.zip

Cd-MaN · January 2008

File already detected as "Trojan.Drastwor.A".

Best regards.

Anchorless · January 2008

File already detected as "Trojan.Drastwor.A".

Best regards.

Thanks a lot. How do remove it from my computer? Should I fix the hijack this log where it runs kernal.exe and then go back in and delete folder manually? None of my virus protectors find kernal.exe as a virus. I've ran vundofix, avg, bitdefender, mcaffee, addaware.

Thanks for the info!

farbar · January 2008

Hi Anchorless,

Since you have send the files and now understandably want help to remove the infection I would be ready to help you. I can see the infection is partially revealed by HJT. But still managing to hide itself. If you wanted my assistance try this as for me it is the shortcut: Change the HijackThis.exe to something like moon.exe or whatever you like. Double click moon.exe or whatever you name it (name.exe) and make a new log.

As soon as I see your new log after renaming HJT we can begin. But in advance:

Try to avoid using Internet and rebooting (unless it is neccesary for disinfection) until you PC is clean. As you may have noticed the infection creates a lot of junks and changes the extension of the running processes and makes them dysfunctional.
If you cannot run a program by double clicking instead of changing the setting and reboot go to start-run and type the path to the program and click OK (example: this is the path to your HJT C:\Documents and Settings\FRED\Desktop\HiJackThis.exe).
And yes if you mange to fix kernel.exe and remove it you can do it.

Anchorless · January 2008

Hi Anchorless,

Since you have send the files and now understandably want help to remove the infection I would be ready to help you. I can see the infection is partially revealed by HJT. But still managing to hide itself. If you wanted my assistance try this as for me it is the shortcut: Change the HijackThis.exe to something like moon.exe or whatever you like. Double click moon.exe or whatever you name it (name.exe) and make a new log.

As soon as I see your new log after renaming HJT we can begin. But in advance:

Try to avoid using Internet and rebooting (unless it is neccesary for disinfection) until you PC is clean. As you may have noticed the infection creates a lot of junks and changes the extension of the running processes and makes them dysfunctional.

If you cannot run a program by double clicking instead of changing the setting and reboot go to start-run and type the path to the program and click OK (example: this is the path to your HJT C:\Documents and Settings\FRED\Desktop\HiJackThis.exe).

And yes if you mange to fix kernel.exe and remove it you can do it.

Thank you for the information. Renamed HiJackthis.exe to moon.exe and ran program. Here is the new log file. I didn't mess with the kernal.exe file yet. Waiting for any help from you first!

I really appreciate the help!

farbar · January 2008

I don't see any log. Please copy and paste it.

Anchorless · January 2008

I don't see any log. Please copy and paste it.

Sorry about that. Here is the log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:11:27 PM, on 1/25/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe

c:\program files\common files\mcafee\mna\mcnasvc.exe

c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe

C:\Program Files\McAfee\MPF\MPFSrv.exe

C:\Program Files\McAfee\MSK\MskSrver.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\Program Files\SiteAdvisor\6253\SAService.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\McAfee.com\Agent\mcagent.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe

C:\PROGRA~1\McAfee.com\Agent\mcagent .exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\RF Wireless Mouse\cm20.exe

C:\DOCUME~1\FRED\LOCALS~1\Temp\clclean.0001

C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol .exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\RF Wireless Mouse\cm20 .exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe

C:\Program Files\HP\HP Software Update\HPWuSchd.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\HP\HP Software Update\HPWuSchd .exe

C:\Program Files\HP\hpcoretech\hpcmpmgr .exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect .exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe

C:\Program Files\McAfee\MSC\mcuimgr.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\HPZipm12.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\HP\hpcoretech\comp\hpdarc.exe

C:\PROGRA~1\McAfee.com\Agent\mcupdate.exe

C:\Documents and Settings\FRED\Desktop\MOON.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F3 - REG:win.ini: load=C:\WINDOWS\system32\awvvu.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - \Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll

O2 - BHO: {b937c143-9f8d-821b-31a4-fe83301fcc13} - {31ccf103-38ef-4a13-b128-d8f9341c739b} - C:\WINDOWS\system32\wpssqanx.dll (file missing)

O2 - BHO: (no name) - {3401DB32-7F00-4EC7-A890-A75F64973843} - C:\WINDOWS\system32\hgggedb.dll (file missing)

O2 - BHO: McAntiPhishingBHO - {377C180E-6F0E-4D4C-980F-F45BD3D40CF4} - C:\Program Files\McAfee\MSK\mcapbho.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll

O2 - BHO: (no name) - {8E905BEF-8BDD-4BD2-B75E-BE63BA7D97FD} - (no file)

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: (no name) - {AAE1499F-CDDF-4CDD-BA5F-500017E7153F} - C:\WINDOWS\system32\awvvu.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - \Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {BC632F0E-13D7-41EA-A503-E3048D509289} - (no file)

O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6253\SiteAdv.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - \Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - \Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset .exe .exe .exe .exe .exe .exe .exe .exe .exe .exe .exe .exe .exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [start RF Wireless Mouse] C:\Program Files\RF Wireless Mouse\cm20.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe

O4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6253\SiteAdv.exe

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey

O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe" -s

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime

O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "D:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

O4 - HKCU\..\Run: [setDefaultMIDI] MIDIDef.exe

O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe

O4 - HKCU\..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html

O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html

O8 - Extra context menu item: Append to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html

O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html