stdrt.exe

RPK · December 10, 2011

Trouble: stdrt.exe appears in Task Manager process list. It consumes a lot of memory and clock cycles. Runs from C:\windows\temp\mrt*.tmp. The actual directory name changes. F-Prot antivirus, MalwareBytes, full scan (free version), and Windows Defender do not complain about it but it looks suspicious to me. Is this malware and if so how do I remove it?

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29

Run by BSM at 9:29:54 on 2011-12-10

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1673 [GMT -5:00]

.

AV: F-PROT Antivirus for Windows *Enabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}

SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

============== Running Processes ===============

.

C:\Windows\system32\wininit.exe

C:\Windows\system32\lsm.exe

C:\Windows\system32\svchost.exe -k DcomLaunch

C:\Windows\system32\nvvsvc.exe

C:\Windows\system32\svchost.exe -k rpcss

C:\Windows\System32\svchost.exe -k secsvcs

C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted

C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted

C:\Windows\system32\svchost.exe -k netsvcs

C:\Windows\system32\svchost.exe -k GPSvcGroup

C:\Windows\system32\SLsvc.exe

C:\Windows\system32\svchost.exe -k LocalService

C:\Windows\system32\svchost.exe -k NetworkService

C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe

C:\Windows\system32\nvvsvc.exe

C:\Windows\System32\LEXBCES.EXE

C:\Windows\System32\spoolsv.exe

C:\Windows\System32\LEXPPS.EXE

C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork

C:\Windows\TEMP\mrt1351.tmp\stdrt.exe

C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe

C:\Program Files\Google\Google Media Server\GoogleMediaServer.exe

C:\Program Files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe

C:\Program Files\Memopal\MemopalCrawler.exe

C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted

c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

C:\Program Files\Iomega\QuikProtect\QpMonitor.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

C:\Windows\system32\svchost.exe -k imgsvc

C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe

C:\Windows\System32\svchost.exe -k WerSvcGroup

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\DRIVERS\xaudio.exe

C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation

C:\Windows\system32\taskeng.exe

C:\Users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe

C:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exe

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Windows\RtHDVCpl.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exe

C:\Program Files\RKS Fax\rksfax_control.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\Google\Google Media Server\GoogleMediaScanner.exe

C:\Program Files\Skype\Phone\Skype.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\MagicDisc\MagicDisc.exe

C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Iomega\QuikProtect\QuikProtect.exe

C:\Windows\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Windows\system32\DllHost.exe

C:\Windows\system32\wbem\wmiprvse.exe

C:\Windows\system32\SearchProtocolHost.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5070831

uWindow Title = Internet Explorer provided by Dell

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll

BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll

uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup

uRun: [Google Media Scanner] "c:\program files\google\google media server\GoogleMediaScanner.exe"

uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

uRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized

uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe

mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

mRun: [RtHDVCpl] RtHDVCpl.exe

mRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start

mRun: [<NO NAME>]

mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"

mRun: [ECenter] c:\dell\e-center\EULALauncher.exe

mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup

mRun: [QuickFinder Scheduler] "c:\program files\corel\wordperfect office x4\programs\QFSCHD140.EXE"

mRun: [%PROVIDERID%] "bin\sprtcmd.exe" /P %PROVIDERID%

mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter

mRun: [iomega Home Storage Manager] c:\program files\iomega\home storage manager\Iomega Discovery.exe

mRun: [igfxTray] c:\windows\system32\igfxtray.exe

mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe

mRun: [Persistence] c:\windows\system32\igfxpers.exe

mRun: [F-PROT Antivirus Tray application] c:\program files\frisk software\f-prot antivirus for windows\FProtTray.exe

mRun: [RKS Fax Print Controller] "c:\program files\rks fax\rksfax_control.exe"

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

mRun: [QuiKProtect] c:\program files\iomega\quikprotect\StartQuikProtect.exe

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

StartupFolder: c:\users\bsm\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exe

StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe

mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)

mPolicies-system: EnableUIADesktopToggle = 0 (0x0)

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.hta

IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

DPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cab

DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab

Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll

Notify: igfxcui - igfxdev.dll

AppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL

.

================= FIREFOX ===================

.

FF - ProfilePath -

.

============= SERVICES / DRIVERS ===============

.

R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2011-11-29 704800]

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2010-1-5 189888]

R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2010-1-5 60352]

R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]

R2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;c:\users\errol\data\apps\postgresql\enterprisedb-apachephp\apache\bin\httpd.exe [2010-12-25 18432]

R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-11-15 21504]

R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\frisk software\f-prot antivirus for windows\FPAVServer.exe [2011-10-6 84136]

R2 Google MediaServer;Google MediaServer;c:\program files\google\google media server\GoogleMediaServer.exe [2009-11-9 622080]

R2 GoogleIMEJaCacheService;Google Japanese Input Cache Service;c:\program files\google\google japanese input\GoogleIMEJaCacheService.exe [2011-9-13 664192]

R2 Memopal Crawler;Memopal Crawler;c:\program files\memopal\MemopalCrawler.exe [2010-10-1 1290752]

R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-1-26 50704]

R2 QPCopyEngine;QPCopyEngine;c:\program files\iomega\quikprotect\QpMonitor.exe [2010-6-24 247088]

R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]

R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-3-13 2253688]

R3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [2010-6-24 19384]

S2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\mrvcl32.exe [2011-8-5 819729]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-9 135664]

S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-8-31 30192]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-11-9 135664]

S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\drivers\xds560.sys [2011-1-25 31472]

.

=============== Created Last 30 ================

.

2011-12-10 14:06:43 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{020ab745-0385-4cba-af84-572e5c9e138f}\offreg.dll

2011-12-10 13:55:20 -------- d-----w- c:\users\bsm\appdata\roaming\QuickScan

2011-12-09 23:29:37 -------- d-----w- c:\users\bsm\appdata\roaming\Malwarebytes

2011-12-09 23:29:32 -------- d-----w- c:\programdata\Malwarebytes

2011-12-09 23:29:29 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-12-09 23:29:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-09 07:05:30 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{020ab745-0385-4cba-af84-572e5c9e138f}\mpengine.dll

2011-11-29 14:52:32 704800 ----a-w- c:\windows\system32\drivers\FStopW.sys

.

==================== Find3M ====================

.

2011-10-29 18:02:19 3350 --sha-w- c:\programdata\KGyGaAvL.sys

2011-10-03 10:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-20 21:02:55 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

2011-09-13 05:53:36 1416832 ----a-w- c:\windows\system32\GIMEJa.ime

.

============= FINISH: 9:31:12.11 ===============

LDTate · December 12, 2011

Logs will be closed if you haven't replied within 3 days

Please don't attach the scans / logs for these tools, use "copy/paste".

DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.

Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:

C:\Windows\TEMP\mrt1351.tmp\stdrt.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.

If virustotal is too busy you can try these.

http://virusscan.jotti.org

http://www.kaspersky.com/scanforvirus.html

RPK · December 14, 2011

Jotti's malware scan

This file has been scanned before. The results for this previous scan are listed below.

--------------------------------------------------------------------------------

Filename: stdrt.exe

Status: Scan finished. 2 out of 20 scanners reported malware.

Scan taken on: Sun 27 Nov 2011 19:08:08 (CET)

Permalink: (h-t-t-p-:-/-/virusscan.jotti.org/en/scanresult/596f66587f7374b3aaba71b008df999c561e9f99/24a8bc196cac01c0d2be55f9d47df1d52c17ca20)

--------------------------------------------------------------------------------

Additional info

File size: 368640 bytes

Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit

MD5: 685ffcd7c90059ddd988373a09780bf0

SHA1: d170e1f91d8553e7687bc43d957ec277b91cc5e5

Scanners

arcavir 2011-11-27 Found nothing

avast 2011-11-26 Found nothing

avg 2011-11-27 Found nothing

avira 2011-11-27 Found nothing

bitdefender 2011-11-27 Found nothing

clamav 2011-11-27 Found nothing

cpsecure 2011-11-27 Found nothing

drweb 2011-11-27 Found nothing

emsisoft 2011-11-27 Found nothing

nod32 2011-11-27 Found nothing

fprot 2011-11-27 Found nothing

fsecure 2011-11-27 Found nothing

gdata 2011-11-26 Found nothing

ikarus 2011-11-27 Found nothing

kaspersky 2011-11-27 Found nothing

panda 2011-11-27 Mal/Agent-NL

quickheal 2011-11-27 Found nothing

sophos 2011-11-25 Win32.Agent.QTP

vba32 2011-11-27 Found nothing

virusbuster 2011-11-27 Found nothing

RPK · December 14, 2011

CORRECTION:

Scanners

arcavir 2011-11-27 Found nothing

avast 2011-11-27 Found nothing

avg 2011-11-27 Found nothing

avira 2011-11-27 Found nothing

bitdefender 2011-11-27 Found nothing

clamav 2011-11-27 Found nothing

cpsecure 2011-11-26 Found nothing

drweb 2011-11-27 Found nothing

emsisoft 2011-11-27 Found nothing

nod32 2011-11-27 Found nothing

fprot 2011-11-26 Found nothing

fsecure 2011-11-27 Found nothing

gdata 2011-11-27 Found nothing

ikarus 2011-11-27 Found nothing

kaspersky 2011-11-27 Found nothing

panda 2011-11-27 Found nothing

quickheal 2011-11-27 Found nothing

sophos 2011-11-27 Mal/Agent-NL

vba32 2011-11-25 Win32.Agent.QTP

virusbuster 2011-11-27 Found nothing

LDTate · December 14, 2011

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

RPK · December 14, 2011

How it's behaving?

There appears to be no c:\Windows\TEMP folder.

A "C:\Windows\Prefetch\STDRT.EXE-525448BA.pf" exists.

I cannot find another file on the C drive that includes the stdrt.exe name except *.url links in Favorites.

Stdrt.exe does not appear in the Task Manager process list.

I have not restarted the PC.

When I did restart the PC after running the task previous to this one, stdrt.exe was present in the TEMP folder, but was not running; i.e., did not start spontaneously with the restart.

===================================================

ComboFix 11-12-13.03 - BSM 12/14/2011 13:07:19.1.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1676 [GMT -5:00]

Running from: c:\users\BSM\Downloads\ComboFix.exe

AV: F-PROT Antivirus for Windows *Disabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\BSM\GoToAssistDownloadHelper.exe

c:\users\Errol\AppData\Local\TempDIR

c:\users\Errol\AppData\Roaming\Bitcoin

c:\users\Errol\AppData\Roaming\Bitcoin\.lock

c:\users\Errol\AppData\Roaming\Bitcoin\__db.001

c:\users\Errol\AppData\Roaming\Bitcoin\__db.002

c:\users\Errol\AppData\Roaming\Bitcoin\__db.003

c:\users\Errol\AppData\Roaming\Bitcoin\__db.004

c:\users\Errol\AppData\Roaming\Bitcoin\__db.005

c:\users\Errol\AppData\Roaming\Bitcoin\__db.006

c:\users\Errol\AppData\Roaming\Bitcoin\addr.dat

c:\users\Errol\AppData\Roaming\Bitcoin\blk0001.dat

c:\users\Errol\AppData\Roaming\Bitcoin\blkindex.dat

c:\users\Errol\AppData\Roaming\Bitcoin\database\log.0000000101

c:\users\Errol\AppData\Roaming\Bitcoin\db.log

c:\users\Errol\AppData\Roaming\Bitcoin\debug.log

c:\users\Errol\AppData\Roaming\Bitcoin\wallet.dat

.

((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))

.

2011-12-14 18:21 . 2011-12-14 18:21 -------- d-----w- c:\users\postgres\AppData\Local\temp

2011-12-14 18:21 . 2011-12-14 18:21 -------- d-----w- c:\users\Errol\AppData\Local\temp

2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\RPK\AppData\Local\temp

2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\God\AppData\Local\temp

2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\Administrator\AppData\Local\temp

2011-12-14 17:45 . 2011-12-14 17:45 -------- d-----w- c:\users\RPK\AppData\Roaming\Apple Computer

2011-12-13 06:36 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{35DC0095-20FF-4252-8E7D-B9B2A2F080E8}\mpengine.dll

2011-12-10 13:55 . 2011-12-10 13:55 -------- d-----w- c:\users\BSM\AppData\Roaming\QuickScan

2011-12-10 02:05 . 2011-12-10 02:05 -------- d-----w- c:\program files\Common Files\Adobe

2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\users\BSM\AppData\Roaming\Malwarebytes

2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\programdata\Malwarebytes

2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-12-09 23:29 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-29 14:52 . 2011-11-11 15:24 704800 ----a-w- c:\windows\system32\drivers\FStopW.sys

2011-11-19 20:38 . 2011-11-21 00:59 -------- d-----w- c:\users\Errol\cygwin

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-10-29 18:02 . 2009-11-09 05:06 3350 --sha-w- c:\programdata\KGyGaAvL.sys

2011-10-21 22:55 . 2011-10-21 22:55 485576 ----a-w- c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe

2011-10-03 10:06 . 2010-12-04 00:19 472808 ----a-w- c:\windows\system32\deployJava1.dll

2011-09-20 21:02 . 2011-11-09 04:01 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]

"Google Media Scanner"="c:\program files\Google\Google Media Server\GoogleMediaScanner.exe" [2009-11-09 319488]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]

"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]

"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 17920]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-09 30192]

"QuickFinder Scheduler"="c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2009-06-23 83232]

"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]

"Iomega Home Storage Manager"="c:\program files\Iomega\Home Storage Manager\Iomega Discovery.exe" [2009-05-18 147456]

"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-14 142104]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-14 154392]

"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-14 138008]

"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]

"RKS Fax Print Controller"="c:\program files\RKS Fax\rksfax_control.exe" [2007-11-29 3912200]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]

"QuiKProtect"="c:\program files\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]

"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232]

.

c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\

MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-1-3 576000]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-8-31 50688]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"aux4"=wdmaud.drv

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]

@="Service"

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

"DisableMonitoring"=dword:00000001

.

R2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\mrvcl32.exe [2011-08-06 819729]

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]

R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]

R2 Memopal Crawler;Memopal Crawler;c:\program files\Memopal\MemopalCrawler.exe [2010-10-01 1290752]

R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-09 30192]

R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]

R3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\DRIVERS\xds560.sys [2010-09-29 31472]

S0 FPAV_RTP;FPAV_RTP;c:\windows\system32\DRIVERS\FStopW.sys [2011-11-11 704800]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-30 691696]

S1 Ext2fs;Ext2fs;c:\windows\system32\DRIVERS\ext2fs.sys [2008-09-25 189888]

S1 IfsMount;IfsMount;c:\windows\system32\DRIVERS\ifsmount.sys [2008-08-29 60352]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]

S2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;c:\users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe [2010-10-07 18432]

S2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2011-10-06 84136]

S2 Google MediaServer;Google MediaServer;c:\program files\Google\Google Media Server\GoogleMediaServer.exe [2009-11-09 622080]

S2 GoogleIMEJaCacheService;Google Japanese Input Cache Service;c:\program files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe [2011-09-13 664192]

S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-01-27 50704]

S2 QPCopyEngine;QPCopyEngine;c:\program files\Iomega\QuikProtect\QpMonitor.exe [2010-06-24 247088]

S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]

S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]

S3 QsFsFltr;QsFsFltr;c:\windows\system32\DRIVERS\QsFsFltr.sys [2010-06-24 19384]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

Contents of the 'Scheduled Tasks' folder

.

2011-12-14 c:\windows\Tasks\F-PROT Antivirus - Periodic Scan.job

- c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-07-07 21:26]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002Core.job

- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04]

.

2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002UA.job

- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://my.yahoo.com/

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000

IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.hta

TCP: DhcpNameServer = 192.168.1.1

FF - ProfilePath -

.

- - - - ORPHANS REMOVED - - - -

.

ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

ShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll

HKLM-Run-%PROVIDERID% - bin\sprtcmd.exe

Notify-GoToAssist - c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2011-12-14 13:22

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

Completion time: 2011-12-14 13:27:13

ComboFix-quarantined-files.txt 2011-12-14 18:26

.

Pre-Run: 28,871,909,376 bytes free

Post-Run: 31,791,685,632 bytes free

.

- - End Of File - - 0285CE12F2FEB7486B103B886216C389

LDTate · December 14, 2011

It's gone now.

How's it running?

RPK · December 14, 2011

I restarted. Stdrt.exe is back. The reason I became interested in this process is because sometimes this pretty robust, fairly recent PC is slow, and I hear the fan whirring near constantly. This prompts me to see what processe are running. Stdrt.exe uses the most memory on an otherwise idle computer and is using CPU - for what,I don't know. When I looked in on it, I don't see that Microsoft knows anything about it being an OS file, plus it is running from temp, which I find to be an odd place to run a process from if it is important and legitimate.

Task Manager: Image name:stdrt.exe, user:system; CPU: 35 (but varies say 45 to zero); Memory:180M

Now...

C:\Windows>attrib /s *stdrt.exe*

A C:\Windows\temp\mrt1CC3.tmp\stdrt.exe

C:\Windows>

C:\Windows\temp>attrib /s *

A C:\Windows\temp\mrt1CC3.tmp\aviflt.ift

A C:\Windows\temp\mrt1CC3.tmp\bmpFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\fliFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\Get.mfx

A C:\Windows\temp\mrt1CC3.tmp\gifFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\jpgFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\KcActiveX.mfx

A C:\Windows\temp\mrt1CC3.tmp\kcedit.mfx

A C:\Windows\temp\mrt1CC3.tmp\kcfile.mfx

A C:\Windows\temp\mrt1CC3.tmp\kclist.mfx

A C:\Windows\temp\mrt1CC3.tmp\KcWebX.mfx

A C:\Windows\temp\mrt1CC3.tmp\mmfs2.dll

A C:\Windows\temp\mrt1CC3.tmp\pcxFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\pngFlt.ift

A C:\Windows\temp\mrt1CC3.tmp\Registry2.mfx

A C:\Windows\temp\mrt1CC3.tmp\stdrt.exe

A C:\Windows\temp\mrt1CC3.tmp\tgaflt.ift

A C:\Windows\temp\mrt1CC3.tmp\volume.mfx

A C:\Windows\temp\flaFBF3.tmp

A C:\Windows\temp\flaFF10.tmp

C:\Windows\temp>

RPK · December 14, 2011

It likes an Internet connection. If I issue an "ipconfig /release" the CPU goes to zero and the memory goes to 88,00K or so. If I then issue an "ipconfig /renew" it perks up to non-zero CPU and about twice the memory.

It claims to be the "Windows Media Center Diagnostic Application" in the Task Manager Description.

I can kill the prcess, btw, and it will stay kiled (or at least not appear in Task Manager) until a restart.

LDTate · December 14, 2011

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

File::
C:\Windows\temp\mrt1CC3.tmp\aviflt.ift
C:\Windows\temp\mrt1CC3.tmp\bmpFlt.ift
C:\Windows\temp\mrt1CC3.tmp\fliFlt.ift
C:\Windows\temp\mrt1CC3.tmp\Get.mfx
C:\Windows\temp\mrt1CC3.tmp\gifFlt.ift
C:\Windows\temp\mrt1CC3.tmp\jpgFlt.ift
C:\Windows\temp\mrt1CC3.tmp\KcActiveX.mfx
C:\Windows\temp\mrt1CC3.tmp\kcedit.mfx
C:\Windows\temp\mrt1CC3.tmp\kcfile.mfx
C:\Windows\temp\mrt1CC3.tmp\kclist.mfx
C:\Windows\temp\mrt1CC3.tmp\KcWebX.mfx
C:\Windows\temp\mrt1CC3.tmp\mmfs2.dll
C:\Windows\temp\mrt1CC3.tmp\pcxFlt.ift
C:\Windows\temp\mrt1CC3.tmp\pngFlt.ift
C:\Windows\temp\mrt1CC3.tmp\Registry2.mfx
C:\Windows\temp\mrt1CC3.tmp\stdrt.exe
C:\Windows\temp\mrt1CC3.tmp\tgaflt.ift
C:\Windows\temp\mrt1CC3.tmp\volume.mfx
C:\Windows\temp\flaFBF3.tmp
C:\Windows\temp\flaFF10.tmp


Folder::
C:\Windows\temp\mrt1CC3.tmp

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

RPK · December 14, 2011

How's it doing? The same. Rebooted. Stdrt.exe running from a different folder this time.

C:\Windows\temp>dir /s

Volume in drive C is OS

Volume Serial Number is 705D-9AC9

Directory of C:\Windows\temp

12/14/2011 04:16 PM <DIR> .

12/14/2011 04:16 PM <DIR> ..

12/14/2011 04:16 PM 0 fla24F6.tmp

12/14/2011 04:16 PM 0 fla2EF5.tmp

12/14/2011 04:11 PM <DIR> mrtBB81.tmp

2 File(s) 0 bytes

Directory of C:\Windows\temp\mrtBB81.tmp

12/14/2011 04:11 PM <DIR> .

12/14/2011 04:11 PM <DIR> ..

12/14/2011 04:11 PM 24,576 aviflt.ift

12/14/2011 04:11 PM 24,576 bmpFlt.ift

12/14/2011 04:11 PM 28,672 fliFlt.ift

12/14/2011 04:11 PM 12,800 Get.mfx

12/14/2011 04:11 PM 28,672 gifFlt.ift

12/14/2011 04:11 PM 94,208 jpgFlt.ift

12/14/2011 04:11 PM 294,912 KcActiveX.mfx

12/14/2011 04:11 PM 32,768 kcedit.mfx

12/14/2011 04:11 PM 36,864 kcfile.mfx

12/14/2011 04:11 PM 32,768 kclist.mfx

12/14/2011 04:11 PM 161,280 KcWebX.mfx

12/14/2011 04:11 PM 307,200 mmfs2.dll

12/14/2011 04:11 PM 24,576 pcxFlt.ift

12/14/2011 04:11 PM 81,920 pngFlt.ift

12/14/2011 04:11 PM 14,336 Registry2.mfx

12/14/2011 04:11 PM 368,640 stdrt.exe

12/14/2011 04:11 PM 24,576 tgaflt.ift

12/14/2011 04:11 PM 102,400 volume.mfx

18 File(s) 1,695,744 bytes

Total Files Listed:

20 File(s) 1,695,744 bytes

5 Dir(s) 29,085,454,336 bytes free

C:\Windows\temp>

=================================================================================

ComboFix 11-12-13.03 - BSM 12/14/2011 15:12:58.2.2 - x86

Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1834 [GMT -5:00]

Running from: c:\combofix\ComboFix.exe

Command switches used :: c:\combofix\CFScript.txt

AV: F-PROT Antivirus for Windows *Disabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}

SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))

.

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\RPK\AppData\Local\temp

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\postgres\AppData\Local\temp

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\God\AppData\Local\temp

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Errol\AppData\Local\temp

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Default\AppData\Local\temp

2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Administrator\AppData\Local\temp