Darsolan

January 9, 2010

Ok, so theres definately something still there. Kaspersky found something but I wasnt sure if it deleted it, so I downloaded AVG. AVG is finding things, but I believe they are things that are getting infected not the actually trojan thats doing it.

Saturday, January 9, 2010

Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Saturday, January 09, 2010 09:14:33

Records in database: 3308111

Scan settings

scan using the following database extended

Scan archives yes

Scan e-mail databases yes

Scan area Critical areas

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

C:\Documents and Settings\Brad\Start Menu\Programs\Startup

C:\Program Files

C:\WINDOWS

Scan statistics

Objects scanned 94618

Threats found 1

Infected objects found 1

Suspicious objects found 0

Scan duration 01:49:48

File name Threat Threats count

C:\WINDOWS\system32\AscConTest.dll Infected: Trojan.Win32.BHO.acvs 1

Selected area has been scanned.

-----------------------------------------------------------------------------

AVG scan found: "D:\Steam\steamapps\common\dawn of war 2\Install\gfwlivesetup.exe";"The file is signed with a broken digital signature, issued by: Microsoft Corporation.";""

AVG Rootkit found: "C:\Documents and Settings\Brad\Cookies\brad@malwarebytes[2].txt";"Hidden file";"Reboot is required to finish the action"

-----------------------------------------------------------------------------

Saturday, January 9, 2010

Operating system: Microsoft Windows XP Professional Service Pack 3 (build 2600)

Kaspersky Online Scanner version: 7.0.26.13

Last database update: Saturday, January 09, 2010 09:14:33

Records in database: 3308111

Scan settings

scan using the following database extended

Scan archives yes

Scan e-mail databases yes

Scan area Critical areas

C:\Documents and Settings\All Users\Start Menu\Programs\Startup

C:\Documents and Settings\Brad\Start Menu\Programs\Startup

C:\Program Files

C:\WINDOWS

Scan statistics

Objects scanned 94618

Threats found 1

Infected objects found 1

Suspicious objects found 0

Scan duration 01:49:48

File name Threat Threats count

C:\WINDOWS\system32\AscConTest.dll Infected: Trojan.Win32.BHO.acvs 1

Selected area has been scanned.

January 9, 2010

Looks like I posted my ComboFix logs twice instead of my Hijack This logs...its late.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 3:10:15 AM, on 1/9/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Motorola Media Link\NServiceEntry.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe

C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\WINDOWS\system32\java.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\WINDOWS\system32\UAService.exe

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe

C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE

C:\Program Files\Razer\razertra.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\WINDOWS\CTHELPER.EXE

C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\Program Files\Motorola\MotoConnectService\MotoConnect.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Java\jre6\bin\java.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll

O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll

O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1125.0\msneshellx.dll

O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE

O4 - HKLM\..\Run: [razertra] C:\Program Files\Razer\razertra.exe

O4 - HKLM\..\Run: [sBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE

O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE

O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume

O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\U7SjxDGOQ.exe" /runcleanupscript

O4 - HKLM\..\Run: [combofix] "C:\ComboFix\CF6956.cfxxe" /c "C:\ComboFix\C.bat"

O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\FilePlanet\Download Manager\DLM.exe /windowsstart /startifwork

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [steam] "D:\Steam\Steam.exe" -silent

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab

O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo...sreqlab_nvd.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase8942.cab

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1186621291781

O16 - DPF: {DB7BF79A-FC51-4B5A-92BC-A65731174380} (InstantAction Game Launcher) - http://www.instantaction.com/download/iaplayer.cab

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -

O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by115fd.bay115.hotmail.msn.com/activex/HMAtchmt.ocx

O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: DeviceMonitorService - Nero AG - C:\Program Files\Motorola Media Link\NServiceEntry.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe

O23 - Service: MotoConnect Service - Unknown owner - C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe

O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

O23 - Service: SecuROM User Access Service (UserAccess) - Unknown owner - C:\WINDOWS\system32\UAService.exe

--

End of file - 10724 bytes

January 9, 2010

Ok, so this morning I got a warning from windows defender that I had Vundo.me and later Vundo.H. Of course at that point it had deleted malewarebytes exe file so I had to leave it till this evening.

Upon going over the forums I ended up running Combofix, (I know now I should have waited), got the renamed exe file, and supposedly cleaned out the virus (according to malewarebytes). I did not however run any of the script files into combofix, since I saw that I shouldnt be running it as it was running.

So at this point I wanted to link my logs to see if anything else is left over. I did run "combofix /uninstall" and windows defender came up clean. At the time of this writing Kaspersky Online Scanner 7 is running for critical locations. Going to crash for the night, check in later, thanks in advance.

-B

----------------------------------------

Malwarebytes' Anti-Malware 1.44

Database version: 3526

Windows 5.1.2600 Service Pack 3

Internet Explorer 8.0.6001.18702

1/9/2010 2:08:12 AM

mbam-log-2010-01-09 (02-08-12).txt

Scan type: Quick Scan

Objects scanned: 118150

Time elapsed: 3 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

------------------------------------------------

ComboFix 10-01-04.01 - Brad 01/09/2010 1:51.3.1 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1629 [GMT -8:00]

Running from: c:\documents and settings\Brad\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\SIntf16.dll

.

((((((((((((((((((((((((( Files Created from 2009-12-09 to 2010-01-09 )))))))))))))))))))))))))))))))

.

2010-01-09 08:26 . 2010-01-09 08:26 -------- d-----w- C:\VundoFix Backups

2010-01-09 08:22 . 2010-01-09 08:22 -------- d-----w- c:\documents and settings\Brad\Local Settings\Application Data\Threat Expert

2009-12-21 18:22 . 2009-12-21 18:22 -------- d-----w- c:\documents and settings\Brad\Application Data\motorola

2009-12-21 18:22 . 2009-12-21 18:22 -------- d-----w- c:\documents and settings\All Users\Application Data\motorola

2009-12-21 03:25 . 2009-12-21 03:25 -------- d-----w- c:\program files\Common Files\Nero

2009-12-21 03:25 . 2010-01-09 09:58 -------- d-----w- c:\program files\Motorola Media Link

2009-12-21 03:25 . 2009-12-21 03:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Nero

2009-12-21 03:25 . 2009-12-21 03:25 -------- d-----w- c:\documents and settings\Brad\Local Settings\Application Data\Motorola

2009-12-21 03:24 . 2009-12-21 03:24 -------- d-----w- c:\program files\Motorola

2009-12-21 03:24 . 2009-12-21 03:24 -------- d-----w- c:\program files\Common Files\Motorola Shared

2009-12-21 03:19 . 2009-12-21 03:19 -------- d-----w- c:\documents and settings\Brad\Local Settings\Application Data\Downloaded Installations

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-01-09 09:58 . 2006-03-08 19:55 13985 ----a-w- c:\windows\system32\tablet.dat

2010-01-09 09:32 . 2009-12-01 18:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-01-09 09:27 . 2005-03-28 02:21 -------- d-----w- c:\program files\Trillian

2010-01-09 08:41 . 2008-07-09 22:08 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-01-09 08:13 . 2008-12-03 02:14 -------- d-----w- c:\program files\Windows Live Safety Center

2010-01-08 00:07 . 2009-12-01 18:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-01-08 00:07 . 2009-12-01 18:38 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-01-06 08:50 . 2005-03-21 03:00 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-01-03 03:29 . 2009-12-05 20:36 5061520 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2010-01-02 07:56 . 2009-09-13 10:50 306672 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2009-12-02 18:30 . 2005-06-07 22:05 -------- d-----w- c:\documents and settings\Brad\Application Data\Apple Computer

2009-12-02 08:33 . 2009-12-02 08:32 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}

2009-12-02 08:33 . 2009-12-02 08:32 -------- d-----w- c:\program files\iTunes

2009-12-02 08:32 . 2005-10-20 23:45 -------- d-----w- c:\program files\iPod

2009-12-02 08:32 . 2007-07-18 02:44 -------- d-----w- c:\program files\Common Files\Apple

2009-12-02 08:29 . 2009-12-02 08:27 -------- d-----w- c:\program files\QuickTime

2009-12-01 19:08 . 2009-09-16 09:41 -------- d-----w- c:\program files\NVIDIA Corporation

2009-12-01 18:39 . 2008-05-24 01:52 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8

2009-12-01 18:38 . 2009-12-01 18:38 -------- d-----w- c:\documents and settings\Brad\Application Data\Malwarebytes

2009-12-01 18:38 . 2009-12-01 18:38 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-11-21 04:32 . 2009-11-21 04:32 278120 ----a-w- c:\windows\system32\nvmccs.dll

2009-11-21 04:32 . 2009-11-21 04:32 154216 ----a-w- c:\windows\system32\nvsvc32.exe

2009-11-21 04:32 . 2009-11-21 04:32 145000 ----a-w- c:\windows\system32\nvcolor.exe

2009-11-21 04:32 . 2009-11-21 04:32 12669544 ----a-w- c:\windows\system32\nvcpl.dll

2009-11-21 04:32 . 2009-11-21 04:32 110184 ----a-w- c:\windows\system32\nvmctray.dll

2009-11-21 04:32 . 2009-11-21 04:32 81920 ----a-w- c:\windows\system32\nvwddi.dll

2009-11-20 05:42 . 2007-06-29 07:39 592488 ----a-w- c:\windows\system32\NVUNINST.EXE

2009-11-13 01:07 . 2009-11-13 01:07 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe

2009-11-04 07:25 . 2009-11-04 07:25 152576 ----a-w- c:\documents and settings\Brad\Application Data\Sun\Java\jre1.6.0_17\lzma.dll

2009-11-04 07:25 . 2009-11-04 07:25 79488 ----a-w- c:\documents and settings\Brad\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-11-03 04:42 . 2009-10-03 05:32 195456 ------w- c:\windows\system32\MpSigStub.exe

2009-10-29 07:45 . 2004-08-04 07:56 916480 ------w- c:\windows\system32\wininet.dll

2009-10-21 05:38 . 2004-08-04 07:56 75776 ----a-w- c:\windows\system32\strmfilt.dll

2009-10-21 05:38 . 2004-08-04 07:56 25088 ----a-w- c:\windows\system32\httpapi.dll

2009-10-20 16:20 . 2004-08-04 06:00 265728 ----a-w- c:\windows\system32\drivers\http.sys

2009-10-13 10:30 . 2004-08-04 07:56 270336 ----a-w- c:\windows\system32\oakley.dll

2009-10-12 13:38 . 2004-08-04 07:56 149504 ----a-w- c:\windows\system32\rastls.dll

2009-10-12 13:38 . 2004-08-04 07:56 79872 ----a-w- c:\windows\system32\raschap.dll

2009-10-11 12:17 . 2008-12-10 23:10 411368 ----a-w- c:\windows\system32\deploytk.dll

.

((((((((((((((((((((((((((((( SnapShot@2010-01-09_09.09.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2010-01-09 09:58 . 2010-01-09 09:58 16384 c:\windows\Temp\Perflib_Perfdata_6d8.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igndlm.exe"="c:\program files\FilePlanet\Download Manager\DLM.exe" [2007-03-05 1103480]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-16 68856]

"Steam"="d:\steam\Steam.exe" [2009-10-31 1217808]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTSysVol"="c:\program files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe" [2003-09-17 57344]

"CTDVDDET"="c:\program files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE" [2003-06-18 45056]

"razertra"="c:\program files\Razer\razertra.exe" [2005-04-07 114688]

"SBDrvDet"="c:\program files\Creative\SB Drive Det\SBDrvDet.exe" [2002-12-04 45056]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"CTHelper"="CTHELPER.EXE" [2006-08-11 17920]

"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-11 18944]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2009-02-03 233304]

"nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-13 642856]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-11-21 12669544]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-11-21 110184]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-11-13 141600]

"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\U7SjxDGOQ.exe" [2010-01-09 1394000]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-23 39264]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\Sony\\Station\\Launchpad\\LaunchPad.exe"=

"c:\\WINDOWS\\system32\\dpvsetup.exe"=

"d:\\games\\Warcraft III\\Warcraft III.exe"=

"c:\\Program Files\\Trillian\\trillian.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\WINDOWS\\system32\\sessmgr.exe"=

"c:\\Program Files\\Trillian\\users\\default\\downloads\\MSN\\dalimar@hotmail.com\\PONG.exe"=

"d:\\games\\World of Warcraft\\WoW-1.6.0.4500-to-1.6.1-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-1.8.3.4807-to-1.8.4.4878-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-1.9.2.4996-to-1.9.3.5059-enUS-downloader.exe"=

"d:\\files\\WoW\\WoW-2.0.0.5610-enUS-Installer-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5610-to-2.0.0.5665-enUS-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5665-to-2.0.0.5666-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-1.12.0.5595-to-1.12.1.5875-enUS-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5666-to-2.0.0.5849-enUS-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5849-to-2.0.0.5894-enUS-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5894-to-2.0.0.5921-enUS-downloader.exe"=

"d:\\games\\Burning Crusade F&F\\WoW-2.0.0.5921-to-2.0.0.5965-enUS-downloader.exe"=

"d:\\games\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"d:\\games\\World of Warcraft\\Repair.exe"=

"d:\\games\\World of Warcraft\\BackgroundDownloader.exe"=

"d:\\games\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.5.6320-to-2.0.6.6337-enUS-downloader.exe"=

"d:\\games\\Warhammer\\Warhammer.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"=

"d:\\games\\SupremeCommander\\Supreme Commander\\bin\\SupremeCommander.exe"=

"d:\\games\\SupremeCommander\\GPGNet\\GPG.Multiplayer.Client.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-2.0.10.6448-to-2.0.12.6546-enUS-downloader.exe"=

"d:\\games\\World in Conflict - BETA\\wic.exe"=

"d:\\games\\World in Conflict\\wic.exe"=

"d:\\games\\World in Conflict\\wic_online.exe"=

"d:\\games\\World in Conflict\\wic_ds.exe"=

"d:\\games\\EVE\\bin\\ExeFile.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=

"c:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=

"d:\\games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

"c:\\WINDOWS\\system32\\PnkBstrA.exe"=

"c:\\WINDOWS\\system32\\PnkBstrB.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Alias\\Maya8.0\\bin\\maya.exe"=

"d:\\games\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

"d:\\games\\RelicCOH.exe"=

"d:\\games\\World of Warcraft\\Launcher.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"d:\\games\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=

"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=

"d:\\games\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=

"d:\\games\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=

"d:\\Steam\\steamapps\\common\\dawn of war 2\\DOW2.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"d:\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4sp.exe"=

"d:\\Steam\\steamapps\\common\\call of duty modern warfare 2\\iw4mp.exe"=

"c:\\Program Files\\Motorola Media Link\\MML.exe"=

"d:\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

"c:\\Program Files\\iTunes\\iTunesHelper.exe"=

"c:\\Program Files\\Windows Defender\\MsMpEng.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"6112:TCP"= 6112:TCP:WarCraft III Battle.net

"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

"6881:TCP"= 6881:TCP:Blizzard Downloader: 6881

"67:UDP"= 67:UDP:DHCP Discovery Service

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [6/13/2008 1:17 PM 717296]

R2 DeviceMonitorService;DeviceMonitorService;c:\program files\Motorola Media Link\NServiceEntry.exe [10/19/2009 3:48 PM 87336]

R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [11/13/2008 11:43 AM 204800]

R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [12/20/2009 7:44 PM 91392]

R2 PfDetNT;PfDetNT;c:\windows\system32\drivers\pfmodnt.sys [8/11/2006 1:56 PM 8192]

R3 Razerlow;Razerlow USB Filter Driver;c:\windows\system32\drivers\Razerlow.sys [3/20/2005 7:33 PM 13225]

S0 d347bus;d347bus;c:\windows\system32\DRIVERS\d347bus.sys --> c:\windows\system32\DRIVERS\d347bus.sys [?]

S0 d347prt;d347prt;c:\windows\system32\Drivers\d347prt.sys --> c:\windows\system32\Drivers\d347prt.sys [?]

S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 6:19 PM 13592]

S3 09cca938-75a4-4baa-9a1c-bebf595b931a;09cca938-75a4-4baa-9a1c-bebf595b931a;\??\f:\cds300\cds300.dll --> f:\cds300\cds300.dll [?]

S3 SetupNTGLM7X;SetupNTGLM7X;\??\f:\ntglm7x.sys --> f:\NTGLM7X.sys [?]

.

Contents of the 'Scheduled Tasks' folder

2009-12-02 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/webhp?sourceid=navclient&ie=UTF-8

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html

Trusted Zone: hotmail.com\www

.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-01-09 01:59

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully

user: MBR read successfully

called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys nvraid.sys hal.dll ACPI.sys sdcplh.sys >>UNKNOWN [0x8A93A1F8]<<

kernel: MBR read successfully

detected MBR rootkit hooks:

\Driver\Disk -> CLASSPNP.SYS @ 0xb80ecf28

\Driver\ACPI -> ACPI.sys @ 0xb7e67cb8

IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022

ParseProcedure -> ntkrnlpa.exe @ 0x80577c84

\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x80579022

ParseProcedure -> ntkrnlpa.exe @ 0x80577c84

NDIS: Marvell Yukon 88E8053 PCI-E Gigabit Ethernet Controller #2 -> SendCompleteHandler -> NDIS.sys @ 0xb7cbfbb0

PacketIndicateHandler -> NDIS.sys @ 0xb7ccca21

SendHandler -> NDIS.sys @ 0xb7caa87b

user & kernel MBR OK

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-448539723-436374069-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID]

@Denied: (Full) (LocalSystem)

[HKEY_USERS\S-1-5-21-448539723-436374069-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:a0,86,cd,24,32,32,4a,2f,78,41,09,69,6b,e3,62,78,65,35,a5,fe,1b,8c,78,

3b,6a,5a,2f,19,03,49,2a,47,dd,04,83,cb,a1,ca,26,e5,50,82,49,71,53,0c,a3,16,\

"??"=hex:fa,70,e3,3a,97,0a,02,56,14,59,03,c8,9a,70,fc,62

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3636)

c:\windows\system32\WININET.dll

c:\windows\system32\msi.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\webcheck.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\windows\system32\RUNDLL32.EXE

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\CTsvcCDA.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\java.exe

c:\windows\system32\PnkBstrB.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Motorola\MotoConnectService\MotoConnect.exe

c:\windows\system32\Tablet.exe

c:\windows\system32\UAService.exe

c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\Windows Media Player\WMPNetwk.exe

.

**************************************************************************

.

Completion time: 2010-01-09 02:02:36 - machine was rebooted

ComboFix-quarantined-files.txt 2010-01-09 10:02

ComboFix2.txt 2010-01-09 09:30

ComboFix3.txt 2010-01-09 09:13

Pre-Run: 13,914,271,744 bytes free

Post-Run: 13,871,517,696 bytes free

- - End Of File - - 5E357C46EE98E8C62A7750A4611E6F4A

--------------------------------