Help: Trojan-Dropper.win32.docb

[[RSX-S]]

Sigh... Somehow I got infected with this trojan and it's causing a lot of problems on my computer. Here is the Hijackthis log below. It seems it has infected Kaspersky itself. Is there any chance of removing this trojan without formatting?

I've "fixed" a few items already. The ones below I'm not too sure about what to do with.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:14:26 PM, on 12/13/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Documents and Settings\Kenjai\Application Data\xssend2\svcnost.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDMedia.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\Applets\LCDRSS.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Documents and Settings\Kenjai\Desktop\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,,c:\prog ram files\microsoft\watermark.exe
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [{4BF8A933-24A6-82F5-0DE2-5C86FA452DC5}] "C:\Documents and Settings\Kenjai\Application Data\Payp\ciwiy.exe"
O4 - HKCU\..\Run: [mssend] "C:\Documents and Settings\Kenjai\Application Data\xssend2\svcnost.exe"
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\ie_banner_deny.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: avp - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2010\avp.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

--
End of file - 5878 bytes

[hotong]

scan it in safe mode

[InvisibleSoul]

Boot up in safe mode and remove these with Hijackthis:

F2 - REG:system.ini: UserInit=cwindows\system32\userinit.exe,,cprog ram files\microsoft\watermark.exe
O4 - HKCU\..\Run: [{4BF8A933-24A6-82F5-0DE2-5C86FA452DC5}] "CDocuments and Settings\Kenjai\Application Data\Payp\ciwiy.exe"
O4 - HKCU\..\Run: [mssend] "CDocuments and Settings\Kenjai\Application Data\xssend2\svcnost.exe"
O23 - Service: PnkBstrA - Unknown owner - CWINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - CWINDOWS\system32\PnkBstrB.exe

Delete the files as well.

But you might be pretty much screwed.

If this is the similar strain of virus that I dealt with a couple months ago that dropped the watermark.exe file, it infects all or most the .exe, .dll and .html files on your system... so even if you get rid of the stuff above, once you run one of the infected files, they'll all come back.

It's a nasty mofo.

If you have any .html or .htm files no your system, open one up with notepad and see if there's some strange code in there.

If there is... I would personally recommend to reinstall the system. Seriously.

[CP.AR]

^ damn that's one bitch of a virus

[[RSX-S]]

Okay, I'll try the safe mode thing first, if it doesn't work then I'll format it.

If I resort to that, is it safe to copy over some personal files like pics and videos? Obviously I'll avoid .exe and .dll files.

[InvisibleSoul]

Originally Posted by [RSX-S]

Okay, I'll try the safe mode thing first, if it doesn't work then I'll format it.

If I resort to that, is it safe to copy over some personal files like pics and videos? Obviously I'll avoid .exe and .dll files.

No. The picture and video files themselves should be fine, but if this is a variant of the same virus strain as what I had (which is W32.Ramnit - you can look that up), another thing it can do is infect portable drives which then infects any other machine it connects to.

Seriously, this thing is one bad mother.

Maybe you can burn the picture and videos to a DVD? I think that would be safer than a USB drive.

[[RSX-S]]

Most of my pictures are still in raw form. It's going to forever copy to DVD's. I was thinking starting fresh in a new drive, but I'm worried that the anti-virus won't be powerful enough to stop the virus after I connect the infected drive to recover the pictures.


I'm curious as to how I caught this virus. I haven't downloaded much in the past couple of weeks, but I'm not the only one that uses this computer.

Everything was fine until one day Kaspersky started popping up warnings about programs that I normally trust.

[InvisibleSoul]

I caught a version of the Ramnit virus that was like zero-day from some Korean website... when I got it and tried researching it, there was NO information about Ramnit + watermark.exe whatsoever. My Symantec Antivirus was completely useless in stopping it, but then again, from what I read, most antivirus software is.

I used information from an old strain where it dropped a file called desktoplayer.exe instead, and I was fortunate to be able to contain it fast enough so that it didn't affect any critical system .exe and .dll files. I deleted all the infected files, and my laptop has been fine since.

If you search "Ramnit watermark.exe" on Google, the second link on MajorGeeks is what I wrote.

[Noizz]

Try this before you format, it's worked wonders for me. I've fixed 3 of my co-workers computers and my gf's laptop. Make sure you run the update before running the scan.

http://www.malwarebytes.org/

[InvisibleSoul]

Originally Posted by Noizz

Try this before you format, it's worked wonders for me. I've fixed 3 of my co-workers computers and my gf's laptop. Make sure you run the update before running the scan.

http://www.malwarebytes.org/

MalwareBytes is good, but it won't do shit for this one.

[cdizzle_996]

This happened to me 2 weeks ago. I tried everything, and eventually did a system restore.

[Kim Jong Un]

Remove System32.
Posted via RS Mobile

[reza]

try combofix before formatting:
http://www.combofix.org/download.php

[willystyle]

Combofix is useless with 64-bit OS..