Computer infected with Trojan.clciker.CM

ronnieboy · June 2007

Hello.

I have BD Ver. 10. It's has worked well for me for about 6 months, however, a trojan appears to have passed through. It is strange because I do deep scans almost every day and update as well. It shows no infections at all, but when I log on to my MSN explorer I get an elert saying http://popunder.adsrevenue.net/popup?11818...awex&pop=er is infected with trojan.clicker.cm and has been blocked by BD. Sure enough, my MSN web page has been replaced with a "fire search" web page. I have repeatedly deleted the infected file, but it comes back everytime. I have quarantined it and also deleted it in safe mode. I have seen some references that it could be located in some undeleted Norton anti-virus files. Norton was included in one of the software packages when I built my computer, but I never activated it. It was deleted immediately months ago. Unfortunately, I'm not a software guru. Looking for some help. Please!

Niels · June 2007

Hi ronnieboy

Download this removal tool for Norton : http://www.softpedia.com/get/Tweak/Uninsta...oval-Tool.shtml If the trojan has injected some Norton files they will get deleted when you run the uninstaller. Because there are still leftovers when you uninstalled it via the normal way.

Try also this go to start,my computer,rightclick on my computer and choose properties,system restore,check the option disable system restore on all stations confirm by pressing on apply and ok. You will loose your previous systemrestore points.

Download superantispyware : http://downloads2.superantispyware.com/dow...AntiSpyware.exe

Update it and reboot your pc into safe mode. Perform a complete scan.

Reboot your pc again and perform a deep scan. Post the scan log afterwards or attach it with your next post.

Regards

Niels

ronnieboy · June 2007

Niels, thankyou for your reply and help. I downloaded the Norton removal tool and ran it. Also, I disabled system restore as you suggested. The BD alert still comes up with trojan.clicker.cm when I log on to my MSN explorer web page. The screen is still MSN premium, but the center is blocked out with a different search engine. I don't get any random popups which is good.

I downloaded the superantispyware program and updated it. I ran it in safe mode through administrator and nothing was found. I rebooted and ran another complete scan. Nothing showed again. I have posted the log as as shown. I also ran BD deep scan again and nothing came up.

More help would be much appreciated! Thanks.

Niels · June 2007

Hi ronnieboy

Could you please post the location were BitDefender finds trojan.clicker.cm? I can't view your log because only virus researchers can download attachments in this section. You can try this when you use Internet explorer go to tools, maintain insert applications,choose for insert applications that are used by Internet explorer now search for strange entries en select them and press on disable. I recommend that you also download hijackthis : http://www.spywareinfo.com/~merijn/files/HijackThis.exe Place hijackthis in a separate folder e.g c:/hijackthis Doubleclick on hijackthis and choose do a system scan and save a logfile. Copy the entire logfile into your next post. Because if you upload them here on the forum I can't see it but on other forum sections I can download it.

Regards

Niels

ronnieboy · June 2007

Niels,

Bit defender identifies the infected file as: http://popunder.adsrevenue.net/popunder.ph...blk=1&fc=-1

Also, I tried accessing internet explorer by double clicking the blue "e" icon and received an error message stating the following:Cannot find 'file///c:/program/msn/msncoreFiles/msn.exe' make sure the path or Internet address is correct. I do get internet service by clicking the MSN "butterfly" icon.

Here is the hijack log file as shown below:

Logfile of HijackThis v1.99.1

Scan saved at 5:13:33 PM, on 6/16/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe

C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\hpoipm07.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

C:\Documents and Settings\User\Desktop\iefix\IEFix.exe

C:\WINDOWS\system32\msiexec.exe

C:\Documents and Settings\User\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\ProgramFiles\MSN\MSNCoreFiles\msn.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O4 - HKLM\..\Run: [soundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray

O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidSetup.exe boot

O4 - HKLM\..\Run: [AsusServiceProvider] C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe

O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"

O4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe

O4 - HKLM\..\Run: [bDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg

O4 - HKLM\..\Run: [bDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"

O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HPAiODevice(hp officejet 5100 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eB...l_v1-0-3-48.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Program Files\Softwin\BitDefender10\vsserv.exe" /service (file missing)

O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)

Thanks again for your help.

Niels · June 2007

Hi ronnieboy

When I look at your logfile I can't find any bad entries. But try to delete this folder manually: c:/program/msn/msncoreFiles/msn.exe Because that isn't the default installation location. Try also to clean up your temporary internetfiles. You can do this manually in IE by going to tools,internet options,temporary iinternet files press on remove files and check remove also all offline files. Download also toolbar cop: http://www.majorgeeks.com/download4126.html

I see that you already have iefix. Run it. Finally go to the registry by doing this: go to start,run,at the run dialog box type regedit press enter and go to this key: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel You have first to click on the +-icon before HKEY_CURRENT_USER and so on. If you see ResetWebSettings or HomePage entry delete it. Check also these keys:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_ LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main

HKEY_USERS\Default\Software\Microsoft\Internet Explorer\Main

Check Default_Page_URL and Start Page and see if you find a website that you don't know.

Regards

Niels

ronnieboy · June 2007

Hi Niels,

I can't find c:program/msn/msncoreFiles/msn.exe. I cleaned up temporary internet files including offline files per your direction. I downloaded iefix and ran the program. It asked me to retrieve the EXPLORER.EXE file from my SP2 disk which I did. I checked the HKEY files. I didn't see "resetwebsettings" or "Homepage entry" anywhere. The default_Page_URL start page had the MSN web site on it as well.

I downloaded tool bar cop. See below for log file:

Browser Add-on Report generated by ToolbarCop v3.4

6/17/2007 12:34:52 PM

--------------------------------------------------------------

Browser Extension: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL - Enabled - All Users

Browser Extension: Messenger - {FB5F1910-F110-11D2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe - Enabled - All Users

Toolbar: &Address - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - %SystemRoot%\system32\Browseui.dll - Enabled - Current User

Toolbar: &Links - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - %SystemRoot%\system32\SHELL32.dll - Enabled - Current User

Toolbar: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (empty) - Enabled - Current User

BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll - Enabled - All Users

Menu Extension: E&xport to Microsoft Excel - - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000 - Enabled - Current User

Run - Startup: MsnMsgr - - "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background - Enabled - Current User

Run - Startup: SUPERAntiSpyware - - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe - Enabled - Current User

Run - Startup: SoundMAX - - "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray - Enabled - All Users

Run - Startup: JMB36X Configure - - C:\WINDOWS\system32\JMRaidSetup.exe boot - Enabled - All Users

Run - Startup: AsusServiceProvider - - C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe - Enabled - All Users

Run - Startup: Ai Nap - - "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe" - Enabled - All Users

Run - Startup: ATICCC - - "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" - Enabled - All Users

Run - Startup: SoundMAXPnP - - C:\Program Files\Analog Devices\Core\smax4pnp.exe - Enabled - All Users

Run - Startup: NeroFilterCheck - - C:\WINDOWS\system32\NeroCheck.exe - Enabled - All Users

Run - Startup: BDMCon - - "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg - Enabled - All Users

Run - Startup: BDAgent - - "C:\Program Files\Softwin\BitDefender10\bdagent.exe" - Enabled - All Users

Run - Startup: Zone Labs Client - - "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" - Enabled - All Users

Run - Startup: CTHelper - - CTHELPER.EXE - Enabled - All Users

Run - Startup: CTxfiHlp - - CTXFIHLP.EXE - Enabled - All Users

Run - Startup: QuickTime Task - - "C:\Program Files\QuickTime\qttask.exe" -atboottime - Enabled - All Users

Run - Startup: iTunesHelper - - "C:\Program Files\iTunes\iTunesHelper.exe" - Enabled - All Users

List of running Processes

--------------------------------------------------------------

\SystemRoot\System32\smss.exe

\??\C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\Smax4.exe

C:\Program Files\ASUS\AASP\1.00.05\aaCenter.exe

C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe

C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE

C:\Program Files\Softwin\BitDefender10\bdmcon.exe

C:\Program Files\Softwin\BitDefender10\bdagent.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Hewlett-Packard\AiO\hp officejet 5100 series\Bin\hpoant07.exe

C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe

C:\WINDOWS\system32\hpoipm07.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe

C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOFXM07.exe

C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe

C:\Program Files\Softwin\BitDefender10\vsserv.exe

C:\Documents and Settings\User\Desktop\toolbarcop\Toolbarcop.exe

Operating System details

----------------------------------------------------------

Operating System: Windows XP 5.1

Build: 2600

Service Pack level: Service Pack 2

Maybe this will lead to some clues. Thanks for your help.

Niels · June 2007

Hi ronnieboy

I took a look but I can't find anything malicious. There are some items that aren't necessary. Have you still that problem? Youcan try this also redownload ie: http://www.microsoft.com/windows/downloads/ie/getitnow.mspx And use the repair option.

Regards

Niels

ronnieboy · June 2007

Niels,

Unfortunately, I'm still having problemms. I downloaded the Internet explorer file. After restart, I clicked the intenet explorer "e" icon and it stated " Internet explorer cannot display webpage". I clicked my msn icon and the trojan.clicker.cm came up again as usual......

I'm ready for radical surgery. Can I reload my OS oftware and remove this problem? I have all of the existing software and at this point of time it will probably be the faster solution. Can you tell me how to delete the original install and re-install it again? Do you think it would solve my "pop up" problem by doing a complete reinstall?

Thanks again,

Ronnieboy

AndreiASM · June 2007

A complete OS reinstall should be the last solution. It will clean everything you have on your system partition, including work, documents, programs etc. so make sure to save your work. You must be carrefull because if you have malware in other partitions you can get infected again after a clean reinstall.

Andrei

Niels · June 2007

Hi ronnieboy

Uninstall msn completely. Reboot your pc. Perform another complete scan with superantispyware in safe mode. After that perform a deep scan again with BitDefender. Because I think that the virus has attach itself to your msn installation. Are you able to receive mails? If not than you have to download winsockfix: http://www.snapfiles.com/get/winsockxpfix.html Run it press on fix reboot your pc and retry.

Try this also download dr web cureit!: ftp://ftp.drweb.com/pub/drweb/cureit/cureit.exe Download it and let it run in normal mode and also in safe mode. But do not remove vsserv.exe because that is related to BitDefender or anything in the Softwin or BitDefender folder otherwise you have to repair BitDefender. I will wait for a repair or a complete reinstall of your os.

Regards

Niels

ronnieboy · June 2007

Niels,

I plan on deleting MSN completely including the MSN messenger portion. I will then go through the steps suggested above.

I have one question, however, regarding history files as they relate to the internet explorer. Apparently history files are shared between internet explorer and msn explorer. Are these cleaned out when all temporary internet files are deleted or are they something different? I wanted to make sure that the "history" files are deleted as well and I'm certainly not an expert in these matters. I typically use a registry cleaner after logging off from the internet and a history.ies file always appears even when I log on and log off immediately in that order. Maybe this is normal but just wondereing.

Thanks.

Niels · June 2007

Hi ronnieboy

That is a good question. I don't think when you delete the temp files in IE that they also will be cleaned in msn explorer. What options do you have in msn explorer? I ask it because I don't have msn explorer.

Download ccleaner: http://www.filehippo.com/download/9838386a...32ae2/download/ Do not forget to uncheck yahoo toolbar during installation and use the cleanup function. But run it also in safe mode.

Regards

Niels

miekiemoes · June 2007

Hi Ronnieboy,

Cannot find 'file///c:/program/msn/msncoreFiles/msn.exe' make sure the path or Internet address is correct.

I see from your HijackThislog that the reference to your startpage is set to this:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = C:\ProgramFiles\MSN\MSNCoreFiles\msn.exe

which explains why it can't find it, because why would you set a file as a startpage? And in this case, it shows C:\ProgramFiles which should be C:\Program Files... ofcourse it won't be found. Or you use the variable %ProgramFiles% or you use C:\Program Files....

Anyway, check and fix above entry in HijackThis. That should solve the error when you doubleclick the IE icon.

Concerning the trojan.clicker.cm alert when you open MSN Explorer. This is a "problem" with MSN explorer startpage itself, since you said you have replaced it with a "fire search" web page..

Not really sure what you mean by this, but it looks like on that Fire search web page, this popunder is displayed: http://popunder.adsrevenue.net/popunder.ph...blk=1&fc=-1 What you can do here is, block popunder.adsrevenue.net via your host file.

127.0.0.1 *.adsrevenue.net

Or it may be better to just download and use the MVPs hosts file:

http://www.mvps.org/winhelp2002/hosts.htm

This blocks a lot of unwanted sites including adsrevenue.net

Niels · June 2007

Hi miekiemoes

Thanks alot for your assistance.

Regards

Niels

ronnieboy · June 2007

Niels,

I deleted as many aspects of MSN as I could in the safe mode. This included msn messenger and msn games as well. Also, deleted all temp. internet files, history files, cookies, etc. before new install........ I have c_cleaner already as I find it very useful. After performing these functions and having a clean copy of msn installer on my flash drive, the msn explorer was re-installed. The trojan is now gone!!!! I performed multiple scans which turned up clean and no registry alerts. It must have been attached to a msn file of some sort. If I was more experienced, then I might have figured this out sooner! It is a good learning experience which will help in the future. I appreciate all of your help. Thankyou Miekiemoes as well for additional feedback which helped. IE now works as well. My kids have parental privacy controls on their emails, hence sometimes they jump on my mine since they know my password. Better change it I say!

Thanks again very much for your help!

Niels · June 2007

Hi ronnieboy

I suggest that you also install this free protection so some toolbars,spyware,adware,browser hijackers,... can't install: http://www.majorgeeks.com/SpywareBlaster_d2859.html It will protect Internet explorer as Firefox. Install it and run it press next till you get in the main screen. Go to updates,press on check for updates. Press now on protection under quick tasks press on enable all protection. Glad that I and miekiemoes could help you.

Regards

Niels

Computer infected with Trojan.clciker.CM

Comments

All Time Leaders

Categories

Defenders of the month