Trojan removal

[LA_MERC_goose]

A friend of mine tells his computer is acting funny so I tell him to bring it over and I'll look at it.

Here's what I've done:
Unistalled unneeded crap
uninstalled old anti-virus software that has expired.
installed & ran ad-aware
installed & ran sybot search and destroy
installed & ran hijackthis
installed newer antivirus and tried to update virus definitions ... failed.

I'm getting win32.murlo.ff.rtk & Smitfraud-C from sybot S&D repeatedly. It tried to remove it but can not.

I'm at a loss ... need someone with time and patience.

[LA_MERC_Spark]

you can try to use...you guessed it... trk.... I have had success with it because it runs totally independent of windows.

[LA_MERC_MadMAX]

You could also build an image w/ BartPE and load up AV and Anti-Spyware software in it and boot from that - like Spark's suggestion, eliminates the windows install on the HDD from the mix.

[LA_MERC_goose]

Is it possible to copy virus definitions from one machine to another?

[LA_MERC_th33_r00k]

d/l smitfraudfix.exe from the ftp server. put on desktop. Boot in safe mode and run it. reboot in normal mode. post a hjt log here mano.

[LA_MERC_goose]

I logged in safe mode as the administrator and ran the smitfraudfix.exe ... but I'm getting apop up window saying the "Registry editing has been disabled by your administrator." ummmmmmmm, that ain't right!

I can't get into regedit nor msconfig

[LA_MERC_goose]

Here's the HJT log file:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:07:47 PM, on 12/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\SAV\DefWatch.exe
C:\WINDOWS\system32\cba\pds.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\SAV\Rtvscan.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Lexmark 4300 Series\lxcemon.exe
C:\PROGRA~1\SAV\vptray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\system.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\lxcecoms.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\system32\printer.exe
F2 - REG:system.ini: UserInit=userinit.exe,
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [LXCECATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCEtim e.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [lxcemon.exe] "C:\Program Files\Lexmark 4300 Series\lxcemon.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [clkhost] C:\WINDOWS\devadwp.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SAV\vptray.exe
O4 - HKCU\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: system.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Pol icies\System, DisableRegedit=1
O8 - Extra context menu item: &Search - ?p=ZUxdm304YYUS
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {556DDE35-E955-11D0-A707-000000521957} - http://www.xblock.com/download/xclean_micro.exe
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\systems.txt
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DefWatch - Symantec Corporation - C:\Program Files\SAV\DefWatch.exe
O23 - Service: Intel PDS - Intel® Corporation - C:\WINDOWS\system32\cba\pds.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: lxce_device - Lexmark International, Inc. - C:\WINDOWS\system32\lxcecoms.exe
O23 - Service: Symantec AntiVirus Server (Norton AntiVirus Server) - Symantec Corporation - C:\Program Files\SAV\Rtvscan.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - c:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

--
End of file - 6811 bytes

[LA_MERC_goose]

Would restoring to a control point do me any good?

[LA_MERC_th33_r00k]

I doubt it, it may have been there a while now. your restore section is prolly infected also.

Zlob virus takes away admin rights.

[LA_MERC_th33_r00k]

Save data......wipe / reload, unless you have time.

when said and done.......

Norton Removal Tool : http://www.majorgeeks.com/Norton_Removal_Tool_SymNRT_d4749.html

[LA_MERC_goose]

Why am I removing all of Norton?

[LA_MERC_th33_r00k]

Do you have control panel?

Right click My comp > Properties > System Restore > disable ????

Call me?

[LA_MERC_th33_r00k]

Norton is a pain.....it works so-so and is resource hoggy. I do not like it.

[LA_MERC_goose]

I'm calling it a night ... I'll pick up again tomorrow. Thanks Evil Parrot ... I mean rook :D

[LA_MERC_M@lACHi]

I was wondering who this parrot dude was.....I thought I missed a memo. I topic. Sometimes is is just a lot easier and uses less to time to wipe and reinstall the OS. My 2 sense. :-)

[LA_MERC_goose]

That's not the answer I'm looking for M@L! It's not my system to be playing God with. If it were mine, I'd yank the hard drive and start with a new one, but that's just me.

[LA_MERC_th33_r00k]

The issue here is one that CAN be worked out. It will take a lot of time, and multiple postings of logs and such. For such an INDEPTH issue I refer the services of www.majorgeeks.com. There techs look at this all day long, and they know EXACTLY what they see, and respond fairly quickly to the matter. If you truly want to "solve" the problem with out wiping and reloading, then go to major geeks and start a thread or poke around on their website searching what you see on that comp.

What I do know.....
Your buddy or someone with access to your buddy's comp downloaded an "Anti-virus" software from a pop-up warning. That is why it will be very hard to remove. They gave it "rights" so to speak. WinAntivirus or such. Find out which one, search major geeks, start the process, and start drinking the stuff your buddy needs to buy for your time and PATIENCE.

[LA_MERC_goose]

Rook hit the nail on the head ... WinAntiVirus ... now I'm trying to kill the processes, delete the files and find my farking bottle of grey goose!

[LA_MERC_th33_r00k]

*Cough* Fix name *Cough* May help more *Cough*

[LA_MERC_M@lACHi]

LOL! I was just trying to help Bro! I do hate figuring out how to remove crap like that. I guess working in a limited environment here has made me somewhat lazy to that fact. We do not have that problem. :-)