Trojan.vundo.duh/trojan.dropper.vundo.d

gogetassgk
gogetassgk
in Malware talk

Hi . :]


This trojan has been killing me.. This dll called sstts.dll is the link to Trojan.vundo.DUH. I tried deleting it from registry and the dll and its exe, but after restarting it pops back up sadly.. The lsass.exe cpu usage is very much abnormal.


hopefuly this wll be solved with flying colors! :mellow:


here's the hijackthis :


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 7:23:43 AM, on 12/29/2007


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v7.00 (7.00.6000.16574)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\spoolsv.exe


C:\WINDOWS\Explorer.EXE


C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


C:\WINDOWS\system32\CTsvcCDA.exe


C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


C:\WINDOWS\system32\nvsvc32.exe


C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


C:\WINDOWS\system32\RUNDLL32.EXE


C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\ctfmon.exe


C:\WINDOWS\System32\MsPMSPSv.exe


C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe


C:\Program Files\BitDefender\BitDefender 2008\bdagent .exe


C:\WINDOWS\system32\ctfmon .exe


G:\HiJackThis.exe


C:\WINDOWS\system32\wuauclt.exe


C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe


C:\WINDOWS\System32\svchost.exe


C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://cgi.verizon.net/bookmarks/bmredir.a...mp;bm=ho_search


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Verizon Online


O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Viewpoint\Viewpoint Toolbar V35\ViewBar.dll


O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll


O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup


O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC


O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName


O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit


O4 - HKLM\..\Run: [bitDefender Antiphishing Helper] "C:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"


O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"


O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto


O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\Policies\Explorer\Run: [{90DBAD9F-0958-1033-0120-030401040001}] "C:\Program Files\Common Files\{90DBAD9F-0958-1033-0120-030401040001}\Update.exe" mc-110-12-0000272


O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe


O4 - Global Startup: eBoostr Control Panel.lnk = C:\Program Files\eBoostr\eBoostrCP.exe


O4 - Global Startup: Verizon Online Dialer.lnk = C:\Program Files\Common Files\Verizon Online\ConnMgr\Verizon Online.exe


O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar V35\ViewBar.dll/CXTSEARCH.HTML


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000


O8 - Extra context menu item: Mail to a Friend... - http://client.alexa.com/holiday/******/actions/mailto.htm


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL


O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe


O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O15 - Trusted Zone: http://toolbar.imageshack.us


O16 - DPF: vzTCPConfig - http://www2.verizon.net/help/dsl_settings/...vzTCPConfig.CAB


O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://activatemydsl.verizon.net/sdcCommon...DSL/tgctlcm.cab


O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB


O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab


O16 - DPF: {207048D8-A40B-4505-AE24-92FF13BEB269} (myDancerCTL Class) - http://web.spaceillusion.com/help/myDancer1020.cab


O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab


O16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applicatio...torLauncher.cab


O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab


O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab


O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1142644284781


O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1142644273406


O16 - DPF: {A93D84FD-641F-43AE-B963-E6FA84BE7FE7} (LinkSys Content Update) - http://www.linksysfix.com/netcheck/67/install/gtdownls.cab


O16 - DPF: {BCA9A936-F557-408E-8301-D5B2B302EFD6} (SiUpdaterCtrl Class) - http://web.spaceillusion.com/help/iDanceUpdater1020.cab


O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo...GPlugin9USA.cab


O16 - DPF: {D88C7675-7CEE-4C9A-BDD4-7A43EED7794D} (Logout Class) - http://www.tricksteronline.com/control/KALogoutComponent.cab


O16 - DPF: {DBA230D1-8467-4e69-987E-5FAE815A3B45} -


O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15028/CTPID.cab


O17 - HKLM\System\CCS\Services\Tcpip\..\{37893201-9695-4DF7-A6DF-23BC0DB0D549}: NameServer = 85.255.114.19,85.255.112.11


O17 - HKLM\System\CCS\Services\Tcpip\..\{AA94B8E2-49F3-44C0-B99D-F9B78E9C3DD2}: NameServer = 71.243.0.12 71.250.0.12


O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.114.19 85.255.112.11


O17 - HKLM\System\CS4\Services\Tcpip\Parameters: NameServer = 85.255.114.19 85.255.112.11


O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.114.19 85.255.112.11


O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe


O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe


O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe


O23 - Service: eBoostr Service (EBOOSTRSVC) - Unknown owner - C:\Program Files\eBoostr\EBstrSvc.exe (file missing)


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe


O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender S.R.L. - C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe


O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe


O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe


O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe


O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe


O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - Unknown owner - (no file)


O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe


O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe


--


End of file - 9993 bytes

Comments

  • farbar
    farbar ✭
    edited January 2008

    Hi gogetassgk,


    I see nobody has replied to your post yet. I am recovering from a nasty flew and may be tomorrow I am going to work. But I have still some spare time. I don't know if your problem is already solved. If not and you need assistance to clean the infection (I have some idea about it) please do the following:

    1. Give a short description of the symptoms and eventually what you have already done (with or without success).
    2. Go to the folder where hijackthis.exe resides (the usual path is C:\windows\program files\Trend Micro\hijackthis\hijackthis.exe). Rename 'hijackthis.exe' to something like 'moonlight.exe'. Note that renaming the shortcut dosn't do the job.
    3. Run hijackthis and post a fresh log.
    Success!
  • Unknown
    Unknown
    edited January 2008

    Hello,


    please attach the files detected as Trojan.Vundo.DUH and provide the full path for them and I will send you a removal tool which will get rid of these nasty files :)


    regards,


    Marius Botis

  • kulturloseramerikaner
    kulturloseramerikaner
    Hello,


    please attach the files detected as Trojan.Vundo.DUH and provide the full path for them and I will send you a removal tool which will get rid of these nasty files :)


    regards,


    Marius Botis


    Marius, could you provide another one of those please? I'm having the same issue with vundo; I thought I had it under control, but did a scan last night in safe mode just to be certain and sure enough there is a whole new crop in stuff that normally autostarts when I boot normally. The particularly nasty thing is that the scan flagged bdagent.exe as being corrupted!?!?!


    I'm at work at the moment, but I can post the paths when I get home.


    Thanks

  • zimunchino
    zimunchino

    i have the same problem ... i used Avenger to delete vundos: cbxxyyy.dll and gebyw.dll from system32 folder ... but the computer still too slow and i still dont understand why are the processes doubled in the task manager ??? in example there is:


    MsnMsgr.Exe


    MsnMsgr .Exe


    and


    ctfmon.exe


    ctfmon .exe


    the other process has space before dot ... :S :unsure:

  • Unknown
    Unknown

    Dear kulturloseramerikaner, zimuchino:


    please provide those samples (the corrupted file-bdagent.exe, the weird filenames as "MsnMsgr .exe", "ctfmon .exe", etc).


    Thanks!

  • farbar
    farbar ✭
    edited January 2008

    I am sorry to give you guys the bad news that removing the individual files detected by AV can help if the file is the only source of infection. It does not help when you have got multiple sources of infections or if the file is not the source but one of its tools. zimunchino is giving us a clear example of this. It specially applies to gogetassgk who initiated this post. His log shows at least two sources of infections and the fact that his log is not complete you expect a possible third infection which is hiding itself from HJT. Even if he removes the dll he is naming his problem is not solved.

All Time Leaders

Categories

Defenders of the month