CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
Donations. Become Premium Today! Premium Icon
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 934
Comments: 25
block bottom
spacer spacer
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Login to check your private messagesLogin to check your private messages   LoginLogin   Your Favorite ForumsSelect FavForums 

[IN PROGRESS]Systemerrorfixer malware

 
Post new topic   Reply to topic       All -> FavForums -> Trend Micro HijackThis Logs [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Thu May 15, 2008 3:28 pm    Post subject: Systemerrorfixer malware
Reply with quote

From vna...This is a reconstituted effort. When I boot my computer, a program, systemerrorfixer, pops up. I immediately input the Ctrl-Alt-Delete and remove the program. I check control panel/remove and remove the program if it is there. I then go to run/msconfig/startup and remove any support to 'systemerrorfixer' found there. I then go to the MALWAREBYTES' ANTI-MALWARE program and get the following report results:

Malwarebytes' Anti-Malware 1.12
Database version: 729

Scan type: Full Scan (C:\|)
Objects scanned: 156241
Time elapsed: 42 minute(s), 39 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 4
Files Infected: 21

Memory Processes Infected:
c:\program files\systemerrorfixer\ucookw.exe (Rogue.WinPCDoctor) -> No action taken.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products (Rogue.Multiple) -> No action taken.
HKEY_CURRENT_USER\Software\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Common Files\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\Res (Rogue.SystemErrorFixer) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer (Rogue.SystemErrorFixer) -> No action taken.

Files Infected:
c:\program files\systemerrorfixer\ucookw.exe (Rogue.WinPCDoctor) -> No action taken.
C:\Program Files\SystemErrorFixer\kernel.dll (Rogue.WinPCDoctor) -> No action taken.
C:\System Volume Information\_restore{079C5BB7-ADD4-48BD-8BA8-6FF0372BB769}\RP20\A0001607.exe (Rogue.WinPCDoctor) -> No action taken.
C:\Program Files\SystemErrorFixer\atl71.dll (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\License.rtf (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\mfc71.dll (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\msvcp71.dll (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\msvcr71.dll (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\Readme.rtf (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\rm.url (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\SysRep.exe (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\SysRep.exe.xml (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\SysRep.url (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\transpaid.exe (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\unins000.dat (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\unins000.exe (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\urls.ini (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\Res\Main.ico (Rogue.SystemErrorFixer) -> No action taken.
C:\Program Files\SystemErrorFixer\Res\RecycleBin.ico (Rogue.SystemErrorFixer) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer\Contact Customer Service.lnk (Rogue.SystemErrorFixer) -> No action taken.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer\SystemErrorFixer.lnk (Rogue.SystemErrorFixer) -> No action taken.

The next time I boot, the same process occurs as described above. How can this "systemerrorfixer" program be permanently removed?
Your help is appreciated. Thank you.
From vna
Back to top
View users profile Send private message
nosirrah

Security Expert
Special Response Team

Joined: Apr 19, 2006
Posts: 6293
Location: USA
MIRT MVP Premium Rootkit Responders Security Experts SRT

PostPosted: Fri May 16, 2008 2:08 am    Post subject:
Reply with quote

"No action taken"

This indicates that you ran a scan but then did not tell MBAM to remove the threats .

After the scan please click "show results" and then "remove selected" .
Back to top
View users profile Send private message Send email
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Fri May 16, 2008 4:55 pm    Post subject:
Reply with quote

From vna.....I did as you directed, clicked on "show results" and then "remove selected". I then checked in my start/run/msconfig/startup and found @ Command, "C:\Program Files\SystemErorFixer\SysRep.exe" and @ location "Software\Microsoft\Windows\CurrentVersion\Run". I
deleted this startup entry. I then ran "Malwarebytes' Anti-Maleware" which showed some 30 infected files. I again clicked on "show results" and then "remove selected". I rebooted and the "systemerrorfixer" program automatically came up again. It just does not go away. I do not see any damage from this malware, except as a nagging irritant. If you desire, I will run the Malwarebytes' Anti-malware again and reboot again and advise you of the results. I appreciate your indulgence. Thank you. From vna.
I checked control panel/remove but the "systemerrorfixer" program was not present.
Back to top
View users profile Send private message
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Fri May 16, 2008 5:53 pm    Post subject:
Reply with quote

From vna...I went ahead and ran "Malwarebytes' Anti-Malware" again and it showed no infected files. I then rebooted and the "systemerrorfixer" re-appeared automatically again. I deleted by means of Ctrl-Alt-Delete.. From vna...
Back to top
View users profile Send private message
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Fri May 16, 2008 8:57 pm    Post subject:
Reply with quote

from vna... More information... I went to start/search to check any files with "systemerrorfixer" on my Drive "C".
The result was: Name:"vaughn n. anderson@ systemerrorfixer[1]" in folder: "C:\Documents and Settings\Vaughn N. Anderson\Cookies". I deleted this file and rebooted. "systemerrorfixer" automatically came up. I deleted with Ctrl-Alt-Delete. from vna...
Back to top
View users profile Send private message
nosirrah

Security Expert
Special Response Team

Joined: Apr 19, 2006
Posts: 6293
Location: USA
MIRT MVP Premium Rootkit Responders Security Experts SRT

PostPosted: Fri May 16, 2008 11:10 pm    Post subject:
Reply with quote

Seems that there is something going on under the hood , a trojan that is reinstalling this .

Please follow the instructions on this page :

CastleCops Link/t213297-How_to_Be_READY.html

Step 5 is where you will be generating a log that will likely show the cause .
Back to top
View users profile Send private message Send email
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Fri May 16, 2008 11:48 pm    Post subject:
Reply with quote

From vna....
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:19 PM, on 5/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\WINDOWS\system32\S3trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\VCOM\AutoSave\AutoSave.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VirusScannerPro] C:\PROGRA~1\AVANQU~1\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AutoSave] "C:\Program Files\VCOM\AutoSave\AutoSave.exe" /Autorun
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SBI] C:\Program Files\Registry Mechanic\setup_sbd_en.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187116748328
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\toolbars\Shared\Skype4ComAPI.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: SystemSuite Task Manager - Avanquest Software USA, Inc. - C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe

--
End of file - 9435 bytes
From vna...
Back to top
View users profile Send private message
nosirrah

Security Expert
Special Response Team

Joined: Apr 19, 2006
Posts: 6293
Location: USA
MIRT MVP Premium Rootkit Responders Security Experts SRT

PostPosted: Sat May 17, 2008 3:32 pm    Post subject:
Reply with quote

I did some research on this infection and found where they made their change . Malwarebytes' Anti-Malware has been updated and should now detect thefile that is reinstalling this .

Please update Malwarebytes' Anti-Malware .

Scan and save the log to post after reboot then remove and reboot .

Post the Malwarebytes' Anti-Malware log and a new HijackThis log .

Let us know if that got it .
Back to top
View users profile Send private message Send email
vna

Trooper
Trooper


Joined: Apr 26, 2008
Posts: 25
Location: USA
PostPosted: Sat May 17, 2008 5:17 pm    Post subject:
Reply with quote

From vna.... I updated Malwarebytes' Anti-Malware..Here's the subsequent LOG..
Malwarebytes' Anti-Malware 1.12
Database version: 758

Scan type: Full Scan (C:\|)
Objects scanned: 161050
Time elapsed: 41 minute(s), 22 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 9
Files Infected: 41

Memory Processes Infected:
c:\program files\systemerrorfixer\ucookw.exe (Rogue.WinPCDoctor) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Purchased Products (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\SystemErrorFixerDownloader (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SBI (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\Common Files\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\Res (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\systemerrorfixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\systemerrorfixer\Data (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.

Files Infected:
c:\program files\systemerrorfixer\ucookw.exe (Rogue.WinPCDoctor) -> Quarantined and deleted successfully.
C:\Program Files\Registry Mechanic\setup_sbd_en.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\SysRep.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Vaughn N. Anderson\Local Settings\Temp\is-H7EFU.tmp\gfl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Vaughn N. Anderson\Local Settings\Temp\ProductPath\sysrep.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\Registry Mechanic\setup_sbd_en(2).exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\Registry Mechanic\setup_sbd_en(3).exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\Registry Mechanic\setup_sbd_en(4).exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\kernel.dll (Rogue.WinPCDoctor) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{079C5BB7-ADD4-48BD-8BA8-6FF0372BB769}\RP23\A0001709.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{079C5BB7-ADD4-48BD-8BA8-6FF0372BB769}\RP23\A0001721.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{079C5BB7-ADD4-48BD-8BA8-6FF0372BB769}\RP34\A0002225.exe (Rogue.WinPCDoctor) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\atl71.dll (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\License.rtf (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\mfc71.dll (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\msvcp71.dll (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\msvcr71.dll (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\Readme.rtf (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\rm.url (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\sr.log (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\swupd.log (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\SysRep.exe.Log (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\SysRep.exe.xml (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\SysRep.url (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\transpaid.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\unins000.dat (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\unins000.exe (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\urls.ini (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\Res\Main.ico (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\SystemErrorFixer\Res\RecycleBin.ico (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\ErrorKiller.exe (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Errors.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Results.stg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2006_11_11_11_11_14.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Log\log_2006_11_11_11_11_21.eklog (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Program Files\ErrorKiller\Registry Backups\2006-11-11_11-18-57.reg (Rogue.ErrorKiller) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\systemerrorfixer\Data\em (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\systemerrorfixer\Data\oid (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Application Data\systemerrorfixer\Data\user (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer\Contact Customer Service.lnk (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\SystemErrorFixer\SystemErrorFixer.lnk (Rogue.SystemErrorFixer) -> Quarantined and deleted successfully.
Here is theHijackThis log after reboot:
logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:50:38 PM, on 5/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Logitech\iTouch\iTouch.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\SPAMfighter\SFAgent.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
C:\WINDOWS\system32\S3trayp.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe
C:\Program Files\Logitech\Video\LogiTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\VCOM\AutoSave\AutoSave.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\LVCOMSX.EXE
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Common Files\Sonic Shared\CineTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Microsoft SQL Server\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\Program Files\SPAMfighter\sfus.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe
C:\PROGRA~1\AVANQU~1\SYSTEM~1\mxtask.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [zBrowser Launcher] C:\Program Files\Logitech\iTouch\iTouch.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VirusScannerPro] C:\PROGRA~1\AVANQU~1\SYSTEM~1\MemCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SPAMfighter Agent] "C:\Program Files\SPAMfighter\SFAgent.exe" update delay 60
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [S3Trayp] S3trayp.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [MsgCenterExe] "C:\Program Files\Common Files\Real\Update_OB\RealOneMessageCenter.exe" -osboot
O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [AutoSave] "C:\Program Files\VCOM\AutoSave\AutoSave.exe" /Autorun
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O4 - Global Startup: Sonic CinePlayer Quick Launch.lnk = C:\Program Files\Common Files\Sonic Shared\CineTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio2/downloads/sysinfo.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1187116748328
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Skype\toolbars\Shared\Skype4ComAPI.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: SPAMfighter Update Service - SPAMfighter ApS - C:\Program Files\SPAMfighter\sfus.exe
O23 - Service: SystemSuite Task Manager - Avanquest Software USA, Inc. - C:\PROGRA~1\AVANQU~1\SYSTEM~1\MXTask.exe

--
When I rebooted, the systemerorfixer malware DID NOT come up. This hopefully means that your procedure worked. I will reboot several more times to check that this position prevails. If so, let me extend my wholehearted thanks to you. From vna
Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Trend Micro HijackThis Logs All times are GMT
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
2002-2008 © Computer Cops LLC dba CastleCops®. All rights reserved.
Acceptable Use Policy. Use signifies your agreement.
206ppm 0.695s (0.205s)
Making cybercriminals unhappy since 2002*
In Memory of Trpm
spacer spacer