Recommended Posts

C:\WINDOWS\$NtServicePackUninstall$\iexplore.exe <-- What is this? I scanned with A-Squared and it detect this as a Trojan-Spy.Win32.Goldun.ms, I deleted it then I scanned my computer again with A-Squared then it found "Trojan-Spy.Win32.Goldun.ms" again but different file directory: C:\System Volume Information\_restore{7FC5AE51-038D-4E9D-BF18-7A2D918702BE}\RP6\A0001474.dll and C:\System Volume Information\_restore{7FC5AE51-038D-4E9D-BF18-7A2D918702BE}\RP6\A0003169.exe

How did I ever get these files and trojan? :(

Can someone help me, is it false positive or what?

--------------------------------------------------------

ALSO IS THERE ANYTHING I SHOULD BE WORRIED ABOUT IN THIS HIJACK THIS LOG???

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\Program Files\MSN Messenger\MsnMsgr.Exe

C:\Program Files\a-squared Free\a2service.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\Microsoft LifeCam\MSCamSvc.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Winamp\Winamp.exe

C:\Documents and Settings\Admin\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bigpond.com/

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [sBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181473509843

O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\Program Files\a-squared Free\a2service.exe

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hope you can help me!

Link to comment
https://www.neowin.net/forum/topic/566969-security-help/
Share on other sites

  Quote
This Trojan steals confidential data. It is a Windows PE EXE file. The Trojan components vary in size from 39 to 48KB.

The Trojan gets the path to Internet Explorer and modifies iexplore.exe, by adding an import from %System%\scvcrl.dll to the import table

This ensures that the Trojan file will be loaded every time Microsoft Internet Explorer is launched.

The Trojan harvests passwords from the data files of the following instant messenging clients:

QIP2005

Trillian

MSN Messenger

Yahoo Messenger

AOL

Miranda

Removal instructions

If your computer does not have an up-to-date antivirus, or does not have an antivirus solution at all, follow the instructions below to delete the malicious program:

1. Use Task Manager to terminate all iexplore.exe processes.

2. Delete the following file:

%System%\msvcrl.dll

3. Restore the original iexplore.exe file using the Windows installation disk.

more information: http://www.viruslist.com/en/viruses/encycl...?virusid=135929

Link to comment
https://www.neowin.net/forum/topic/566969-security-help/#findComment-588628557
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Never use an in-browser password manager. It creates a barrier to using any other web browser.
    • I have always wondered if there is any difference between .BAT and .CMD files!
    • I will confirm the Vista hate was ridiculous. They had a point before SP1 and too many didn't use newer components at launch, misleading some to believe it was bad. It really wasn't (after SP1.) The jump from 98/ME to XP didn't get a bad reaction at all from what I remember. 8 was awful. 10 for the most part ran pretty well but people disliked the telemetry and standard MS shenanigans, but 11 is definitely worse in some ways.
    • What I can confirm to not be exaggerations or misinformation is the slowness of the standard right click menus and the Task Manager in Windows 11, even on brand spanking new bare installs.
    • Linux 6.16-rc2: Smaller than usual, but with notable network and bcachefs tweaks by Paul Hill Linus Torvalds, the creator of the Linux kernel, has just released the second release candidate of Linux 6.16. Following the release of Linux 6.15, developers submitted their new features to be merged with Linux 6.16. These release candidates are focused on polishing the kernel before release, following the merging of new features. In his weekly mailing list post, Torvalds noticed that things were pretty quiet this week and that this could be due to developers taking a summer vacation or just taking a break following a large merge window a few weeks ago. This isn’t uncommon at this point in the cycle and Torvalds expects more activity next week. Networking and bcachefs dominate changes The second release candidate, despite being small, still brings some notable changes, namely network drivers, Bluetooth drivers, and bcachefs, a copy-on-write filesystem for Linux. The improvements to network drivers have a direct impact on end users, it means that newer networking hardware works out of the box when you install Linux and existing problematic drivers get fixed. There were also improvements made to the Rust infrastructure and core networking changes. Implementing Rust in the kernel is good for users as it has memory safety built in, leaving hackers less to attack in Linux systems. Rust has received backlash by some opinionated Linux developers who don’t want to learn a new language, but it doesn’t look like it’s going anywhere. Under the hood: specific fixes This week, a diverse set of developers have contributed fixes to the kernel that improve kernel stability, Bluetooth connectivity, file sharing over SMB, and virtualization performance. Some specific changes this week include: Fixes for CPU burning, firmware stats, and use-after-free (UAF) issues with the ath11k and ath12k Wi-Fi drivers. Various fixes for UAF, NULL pointer differences and advertising issues in Bluetooth drivers. Improvements to Server Message Block (SMB) related to directory cache reuse and a fix for performance regression with deferred closes. In KVM (Kernel-based Virtual Machine), there are fixes for SEV-SNP support, memory pre-faulting, and ARM64 selftests. The SMB fixes are notable because it's an important protocol in networked Windows environments. It helps with file sharing, printer sharing, and Active Directory integration. By improving Linux’s support for this protocol, readers using SMB in Linux to talk to Windows machines will have a smoother experience. Ongoing development Linux 6.16 is due to get seven or eight release candidates over the cycle so there are now five or six weeks until the stable version arrives. Even when it is out, most people’s first use of this kernel will be when distributions decide to ship it, as they can be tricky to install manually. Stay tuned each week as we bring you all the new changes which each new release candidate.
  • Recent Achievements

    • Explorer
      Legend20 went up a rank
      Explorer
    • One Month Later
      jezzzy earned a badge
      One Month Later
    • First Post
      CSpera earned a badge
      First Post
    • One Month Later
      MIR JOHNNY BLAZE earned a badge
      One Month Later
    • Apprentice
      Wireless wookie went up a rank
      Apprentice
  • Popular Contributors

    1. 1
      +primortal
      625
    2. 2
      ATLien_0
      276
    3. 3
      +FloatingFatMan
      178
    4. 4
      Michael Scrip
      152
    5. 5
      Steven P.
      115
  • Tell a friend

    Love Neowin? Tell a friend!