RPK Posted December 10, 2011 ID:503309 Share Posted December 10, 2011 Trouble: stdrt.exe appears in Task Manager process list. It consumes a lot of memory and clock cycles. Runs from C:\windows\temp\mrt*.tmp. The actual directory name changes. F-Prot antivirus, MalwareBytes, full scan (free version), and Windows Defender do not complain about it but it looks suspicious to me. Is this malware and if so how do I remove it?.DDS (Ver_2011-08-26.01) - NTFSx86 Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 1.6.0_29Run by BSM at 9:29:54 on 2011-12-10Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1673 [GMT -5:00].AV: F-PROT Antivirus for Windows *Enabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}.============== Running Processes ===============.C:\Windows\system32\wininit.exeC:\Windows\system32\lsm.exeC:\Windows\system32\svchost.exe -k DcomLaunchC:\Windows\system32\nvvsvc.exeC:\Windows\system32\svchost.exe -k rpcssC:\Windows\System32\svchost.exe -k secsvcsC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestrictedC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestrictedC:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe -k GPSvcGroupC:\Windows\system32\SLsvc.exeC:\Windows\system32\svchost.exe -k LocalServiceC:\Windows\system32\svchost.exe -k NetworkServiceC:\Program Files\NVIDIA Corporation\Display\NvXDSync.exeC:\Windows\system32\nvvsvc.exeC:\Windows\System32\LEXBCES.EXEC:\Windows\System32\spoolsv.exeC:\Windows\System32\LEXPPS.EXEC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkC:\Windows\TEMP\mrt1351.tmp\stdrt.exeC:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exeC:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exeC:\Program Files\Google\Google Media Server\GoogleMediaServer.exeC:\Program Files\Google\Google Japanese Input\GoogleIMEJaCacheService.exeC:\Program Files\Memopal\MemopalCrawler.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestrictedc:\Program Files\Common Files\Protexis\License Service\PsiService_2.exeC:\Program Files\Iomega\QuikProtect\QpMonitor.exeC:\Program Files\Dell Support Center\bin\sprtsvc.exeC:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exeC:\Windows\system32\svchost.exe -k imgsvcC:\Program Files\TeamViewer\Version6\TeamViewer_Service.exeC:\Windows\System32\svchost.exe -k WerSvcGroupC:\Windows\system32\SearchIndexer.exeC:\Windows\system32\DRIVERS\xaudio.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonationC:\Windows\system32\taskeng.exeC:\Users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exeC:\Users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exeC:\Program Files\Google\Update\1.3.21.79\GoogleCrashHandler.exeC:\Windows\system32\taskeng.exeC:\Windows\system32\Dwm.exeC:\Windows\Explorer.EXEC:\Program Files\Windows Defender\MSASCui.exeC:\Windows\RtHDVCpl.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Dell Support Center\bin\sprtcmd.exeC:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exeC:\Program Files\RKS Fax\rksfax_control.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Common Files\Java\Java Update\jusched.exeC:\Program Files\DellSupport\DSAgnt.exeC:\Program Files\Google\Google Media Server\GoogleMediaScanner.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Digital Line Detect\DLG.exeC:\Program Files\MagicDisc\MagicDisc.exeC:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeC:\Program Files\Windows Media Player\wmpnscfg.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Iomega\QuikProtect\QuikProtect.exeC:\Windows\system32\taskmgr.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exeC:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\SearchProtocolHost.exe.============== Pseudo HJT Report ===============.uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5070831uWindow Title = Internet Explorer provided by DellBHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dllBHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dllBHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dllBHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\bae\BAE.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllTB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dlluRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startupuRun: [Google Media Scanner] "c:\program files\google\google media server\GoogleMediaScanner.exe"uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenteruRun: [skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimizeduRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exemRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hidemRun: [RtHDVCpl] RtHDVCpl.exemRun: [iSUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -startmRun: [<NO NAME>] mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"mRun: [ECenter] c:\dell\e-center\EULALauncher.exemRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startupmRun: [QuickFinder Scheduler] "c:\program files\corel\wordperfect office x4\programs\QFSCHD140.EXE"mRun: [%PROVIDERID%] "bin\sprtcmd.exe" /P %PROVIDERID%mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCentermRun: [iomega Home Storage Manager] c:\program files\iomega\home storage manager\Iomega Discovery.exemRun: [igfxTray] c:\windows\system32\igfxtray.exemRun: [HotKeysCmds] c:\windows\system32\hkcmd.exemRun: [Persistence] c:\windows\system32\igfxpers.exemRun: [F-PROT Antivirus Tray application] c:\program files\frisk software\f-prot antivirus for windows\FProtTray.exemRun: [RKS Fax Print Controller] "c:\program files\rks fax\rksfax_control.exe"mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottimemRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"mRun: [QuiKProtect] c:\program files\iomega\quikprotect\StartQuikProtect.exemRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"StartupFolder: c:\users\bsm\appdata\roaming\micros~1\windows\startm~1\programs\startup\magicd~1.lnk - c:\program files\magicdisc\MagicDisc.exeStartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exemPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)mPolicies-system: EnableUIADesktopToggle = 0 (0x0)IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000IE: Open with WordPerfect - c:\program files\corel\wordperfect office x4\programs\WPLauncher.htaIE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dllIE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLLDPF: {4B54A9DE-EF1C-4EBE-A328-7C28EA3B433A} - hxxp://quickscan.bitdefender.com/qsax/qsax.cabDPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} - hxxps://transfers.ds.microsoft.com/FTM/TransferSource/grTransferCtrl.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cabDPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cabNotify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dllNotify: igfxcui - igfxdev.dllAppInit_DLLs: c:\progra~1\google\google~2\GOEC62~1.DLL.================= FIREFOX ===================.FF - ProfilePath - .============= SERVICES / DRIVERS ===============.R0 FPAV_RTP;FPAV_RTP;c:\windows\system32\drivers\FStopW.sys [2011-11-29 704800]R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2010-1-5 189888]R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2010-1-5 60352]R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2011-6-6 64952]R2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;c:\users\errol\data\apps\postgresql\enterprisedb-apachephp\apache\bin\httpd.exe [2010-12-25 18432]R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-11-15 21504]R2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\frisk software\f-prot antivirus for windows\FPAVServer.exe [2011-10-6 84136]R2 Google MediaServer;Google MediaServer;c:\program files\google\google media server\GoogleMediaServer.exe [2009-11-9 622080]R2 GoogleIMEJaCacheService;Google Japanese Input Cache Service;c:\program files\google\google japanese input\GoogleIMEJaCacheService.exe [2011-9-13 664192]R2 Memopal Crawler;Memopal Crawler;c:\program files\memopal\MemopalCrawler.exe [2010-10-1 1290752]R2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-1-26 50704]R2 QPCopyEngine;QPCopyEngine;c:\program files\iomega\quikprotect\QpMonitor.exe [2010-6-24 247088]R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\nvidia corporation\3d vision\nvSCPAPISvr.exe [2010-10-16 369256]R2 TeamViewer6;TeamViewer 6;c:\program files\teamviewer\version6\TeamViewer_Service.exe [2011-3-13 2253688]R3 QsFsFltr;QsFsFltr;c:\windows\system32\drivers\QsFsFltr.sys [2010-6-24 19384]S2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\mrvcl32.exe [2011-8-5 819729]S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-11-9 135664]S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-8-31 30192]S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2009-11-9 135664]S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]S3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\drivers\xds560.sys [2011-1-25 31472].=============== Created Last 30 ================.2011-12-10 14:06:43 56200 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{020ab745-0385-4cba-af84-572e5c9e138f}\offreg.dll2011-12-10 13:55:20 -------- d-----w- c:\users\bsm\appdata\roaming\QuickScan2011-12-09 23:29:37 -------- d-----w- c:\users\bsm\appdata\roaming\Malwarebytes2011-12-09 23:29:32 -------- d-----w- c:\programdata\Malwarebytes2011-12-09 23:29:29 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-12-09 23:29:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-12-09 07:05:30 6823496 ----a-w- c:\programdata\microsoft\windows defender\definition updates\{020ab745-0385-4cba-af84-572e5c9e138f}\mpengine.dll2011-11-29 14:52:32 704800 ----a-w- c:\windows\system32\drivers\FStopW.sys.==================== Find3M ====================.2011-10-29 18:02:19 3350 --sha-w- c:\programdata\KGyGaAvL.sys2011-10-03 10:06:03 472808 ----a-w- c:\windows\system32\deployJava1.dll2011-09-20 21:02:55 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys2011-09-13 05:53:36 1416832 ----a-w- c:\windows\system32\GIMEJa.ime.============= FINISH: 9:31:12.11 =============== Link to post Share on other sites More sharing options...
LDTate Posted December 12, 2011 ID:504258 Share Posted December 12, 2011 Logs will be closed if you haven't replied within 3 days Please don't attach the scans / logs for these tools, use "copy/paste".DO NOT use any TOOLS such as Combofix or HijackThis fixes without supervision.Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.Please go to http://www.virustotal.com/, click on Browse, and upload the following file for analysis:C:\Windows\TEMP\mrt1351.tmp\stdrt.exeThen click Submit. Allow the file to be scanned, and then please copy and paste the results here for me to see.If virustotal is too busy you can try these.http://virusscan.jotti.orghttp://www.kaspersky.com/scanforvirus.html Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:504934 Share Posted December 14, 2011 Jotti's malware scanThis file has been scanned before. The results for this previous scan are listed below.--------------------------------------------------------------------------------Filename: stdrt.exe Status: Scan finished. 2 out of 20 scanners reported malware.Scan taken on: Sun 27 Nov 2011 19:08:08 (CET) Permalink: (h-t-t-p-:-/-/virusscan.jotti.org/en/scanresult/596f66587f7374b3aaba71b008df999c561e9f99/24a8bc196cac01c0d2be55f9d47df1d52c17ca20)--------------------------------------------------------------------------------Additional infoFile size: 368640 bytes Filetype: PE32 executable for MS Windows (GUI) Intel 80386 32-bit MD5: 685ffcd7c90059ddd988373a09780bf0 SHA1: d170e1f91d8553e7687bc43d957ec277b91cc5e5 Scannersarcavir 2011-11-27 Found nothingavast 2011-11-26 Found nothingavg 2011-11-27 Found nothingavira 2011-11-27 Found nothingbitdefender 2011-11-27 Found nothingclamav 2011-11-27 Found nothingcpsecure 2011-11-27 Found nothingdrweb 2011-11-27 Found nothingemsisoft 2011-11-27 Found nothingnod32 2011-11-27 Found nothingfprot 2011-11-27 Found nothingfsecure 2011-11-27 Found nothinggdata 2011-11-26 Found nothingikarus 2011-11-27 Found nothingkaspersky 2011-11-27 Found nothingpanda 2011-11-27 Mal/Agent-NLquickheal 2011-11-27 Found nothingsophos 2011-11-25 Win32.Agent.QTPvba32 2011-11-27 Found nothingvirusbuster 2011-11-27 Found nothing Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:504936 Share Posted December 14, 2011 CORRECTION:Scannersarcavir 2011-11-27 Found nothingavast 2011-11-27 Found nothingavg 2011-11-27 Found nothingavira 2011-11-27 Found nothingbitdefender 2011-11-27 Found nothingclamav 2011-11-27 Found nothingcpsecure 2011-11-26 Found nothingdrweb 2011-11-27 Found nothingemsisoft 2011-11-27 Found nothingnod32 2011-11-27 Found nothingfprot 2011-11-26 Found nothingfsecure 2011-11-27 Found nothinggdata 2011-11-27 Found nothingikarus 2011-11-27 Found nothingkaspersky 2011-11-27 Found nothingpanda 2011-11-27 Found nothingquickheal 2011-11-27 Found nothingsophos 2011-11-27 Mal/Agent-NLvba32 2011-11-25 Win32.Agent.QTPvirusbuster 2011-11-27 Found nothing Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2011 ID:504938 Share Posted December 14, 2011 Please do not attach the scan results from Combofx. Use copy/paste.Vista and Windows 7 users:1. These tools MUST be run from the executable. (.exe) every time you run them 2. With Admin Rights (Right click, choose "Run as Administrator")Download ComboFix from one of these locations:Link 1Link 2 If using this link, Right Click and select Save As.* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective ProgramsDouble click on ComboFix.exe & follow the prompts.Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7. Note: If you have XP SP3, use the XP SP2 package.If Vista or Windows 7, skip the Recovery Console partAs part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.Notes:1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper. 4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.Give it atleast 20-30 minutes to finish if needed.Please do not attach the scan results from Combofx. Use copy/paste.Also please describe how your computer behaves at the moment. Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:504975 Share Posted December 14, 2011 How it's behaving?There appears to be no c:\Windows\TEMP folder.A "C:\Windows\Prefetch\STDRT.EXE-525448BA.pf" exists.I cannot find another file on the C drive that includes the stdrt.exe name except *.url links in Favorites. Stdrt.exe does not appear in the Task Manager process list.I have not restarted the PC. When I did restart the PC after running the task previous to this one, stdrt.exe was present in the TEMP folder, but was not running; i.e., did not start spontaneously with the restart.===================================================ComboFix 11-12-13.03 - BSM 12/14/2011 13:07:19.1.2 - x86Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1676 [GMT -5:00]Running from: c:\users\BSM\Downloads\ComboFix.exeAV: F-PROT Antivirus for Windows *Disabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))..c:\users\BSM\GoToAssistDownloadHelper.exec:\users\Errol\AppData\Local\TempDIRc:\users\Errol\AppData\Roaming\Bitcoinc:\users\Errol\AppData\Roaming\Bitcoin\.lockc:\users\Errol\AppData\Roaming\Bitcoin\__db.001c:\users\Errol\AppData\Roaming\Bitcoin\__db.002c:\users\Errol\AppData\Roaming\Bitcoin\__db.003c:\users\Errol\AppData\Roaming\Bitcoin\__db.004c:\users\Errol\AppData\Roaming\Bitcoin\__db.005c:\users\Errol\AppData\Roaming\Bitcoin\__db.006c:\users\Errol\AppData\Roaming\Bitcoin\addr.datc:\users\Errol\AppData\Roaming\Bitcoin\blk0001.datc:\users\Errol\AppData\Roaming\Bitcoin\blkindex.datc:\users\Errol\AppData\Roaming\Bitcoin\database\log.0000000101c:\users\Errol\AppData\Roaming\Bitcoin\db.logc:\users\Errol\AppData\Roaming\Bitcoin\debug.logc:\users\Errol\AppData\Roaming\Bitcoin\wallet.dat..((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))..2011-12-14 18:21 . 2011-12-14 18:21 -------- d-----w- c:\users\postgres\AppData\Local\temp2011-12-14 18:21 . 2011-12-14 18:21 -------- d-----w- c:\users\Errol\AppData\Local\temp2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\RPK\AppData\Local\temp2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\God\AppData\Local\temp2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\Default\AppData\Local\temp2011-12-14 18:20 . 2011-12-14 18:20 -------- d-----w- c:\users\Administrator\AppData\Local\temp2011-12-14 17:45 . 2011-12-14 17:45 -------- d-----w- c:\users\RPK\AppData\Roaming\Apple Computer2011-12-13 06:36 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{35DC0095-20FF-4252-8E7D-B9B2A2F080E8}\mpengine.dll2011-12-10 13:55 . 2011-12-10 13:55 -------- d-----w- c:\users\BSM\AppData\Roaming\QuickScan2011-12-10 02:05 . 2011-12-10 02:05 -------- d-----w- c:\program files\Common Files\Adobe2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\users\BSM\AppData\Roaming\Malwarebytes2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\programdata\Malwarebytes2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-12-09 23:29 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-11-29 14:52 . 2011-11-11 15:24 704800 ----a-w- c:\windows\system32\drivers\FStopW.sys2011-11-19 20:38 . 2011-11-21 00:59 -------- d-----w- c:\users\Errol\cygwin...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-10-29 18:02 . 2009-11-09 05:06 3350 --sha-w- c:\programdata\KGyGaAvL.sys2011-10-21 22:55 . 2011-10-21 22:55 485576 ----a-w- c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe2011-10-03 10:06 . 2010-12-04 00:19 472808 ----a-w- c:\windows\system32\deployJava1.dll2011-09-20 21:02 . 2011-11-09 04:01 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]"Google Media Scanner"="c:\program files\Google\Google Media Server\GoogleMediaScanner.exe" [2009-11-09 319488]"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 17920]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-09 30192]"QuickFinder Scheduler"="c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2009-06-23 83232]"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]"Iomega Home Storage Manager"="c:\program files\Iomega\Home Storage Manager\Iomega Discovery.exe" [2009-05-18 147456]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-14 142104]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-14 154392]"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-14 138008]"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]"RKS Fax Print Controller"="c:\program files\RKS Fax\rksfax_control.exe" [2007-11-29 3912200]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]"QuiKProtect"="c:\program files\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232].c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-1-3 576000].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-8-31 50688].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux4"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]@="Service".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]"DisableMonitoring"=dword:00000001.R2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\mrvcl32.exe [2011-08-06 819729]R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]R2 Memopal Crawler;Memopal Crawler;c:\program files\Memopal\MemopalCrawler.exe [2010-10-01 1290752]R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-09 30192]R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]R3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\DRIVERS\xds560.sys [2010-09-29 31472]S0 FPAV_RTP;FPAV_RTP;c:\windows\system32\DRIVERS\FStopW.sys [2011-11-11 704800]S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-30 691696]S1 Ext2fs;Ext2fs;c:\windows\system32\DRIVERS\ext2fs.sys [2008-09-25 189888]S1 IfsMount;IfsMount;c:\windows\system32\DRIVERS\ifsmount.sys [2008-08-29 60352]S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]S2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;c:\users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe [2010-10-07 18432]S2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2011-10-06 84136]S2 Google MediaServer;Google MediaServer;c:\program files\Google\Google Media Server\GoogleMediaServer.exe [2009-11-09 622080]S2 GoogleIMEJaCacheService;Google Japanese Input Cache Service;c:\program files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe [2011-09-13 664192]S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-01-27 50704]S2 QPCopyEngine;QPCopyEngine;c:\program files\Iomega\QuikProtect\QpMonitor.exe [2010-06-24 247088]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]S3 QsFsFltr;QsFsFltr;c:\windows\system32\DRIVERS\QsFsFltr.sys [2010-06-24 19384]..[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache.Contents of the 'Scheduled Tasks' folder.2011-12-14 c:\windows\Tasks\F-PROT Antivirus - Periodic Scan.job- c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-07-07 21:26].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002Core.job- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002UA.job- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04]..------- Supplementary Scan -------.uStart Page = hxxp://my.yahoo.com/IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.htaTCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - .- - - - ORPHANS REMOVED - - - -.ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dllShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dllShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dllShellIconOverlayIdentifiers-{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} - c:\users\BSM\AppData\Roaming\Dropbox\bin\DropboxExt.14.dllHKLM-Run-%PROVIDERID% - bin\sprtcmd.exeNotify-GoToAssist - c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll...**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2011-12-14 13:22Windows 6.0.6002 Service Pack 2 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.Completion time: 2011-12-14 13:27:13ComboFix-quarantined-files.txt 2011-12-14 18:26.Pre-Run: 28,871,909,376 bytes freePost-Run: 31,791,685,632 bytes free.- - End Of File - - 0285CE12F2FEB7486B103B886216C389 Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2011 ID:504980 Share Posted December 14, 2011 It's gone now.How's it running? Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:504988 Share Posted December 14, 2011 I restarted. Stdrt.exe is back. The reason I became interested in this process is because sometimes this pretty robust, fairly recent PC is slow, and I hear the fan whirring near constantly. This prompts me to see what processe are running. Stdrt.exe uses the most memory on an otherwise idle computer and is using CPU - for what,I don't know. When I looked in on it, I don't see that Microsoft knows anything about it being an OS file, plus it is running from temp, which I find to be an odd place to run a process from if it is important and legitimate.Task Manager: Image name:stdrt.exe, user:system; CPU: 35 (but varies say 45 to zero); Memory:180MNow...C:\Windows>attrib /s *stdrt.exe*A C:\Windows\temp\mrt1CC3.tmp\stdrt.exeC:\Windows>C:\Windows\temp>attrib /s *A C:\Windows\temp\mrt1CC3.tmp\aviflt.iftA C:\Windows\temp\mrt1CC3.tmp\bmpFlt.iftA C:\Windows\temp\mrt1CC3.tmp\fliFlt.iftA C:\Windows\temp\mrt1CC3.tmp\Get.mfxA C:\Windows\temp\mrt1CC3.tmp\gifFlt.iftA C:\Windows\temp\mrt1CC3.tmp\jpgFlt.iftA C:\Windows\temp\mrt1CC3.tmp\KcActiveX.mfxA C:\Windows\temp\mrt1CC3.tmp\kcedit.mfxA C:\Windows\temp\mrt1CC3.tmp\kcfile.mfxA C:\Windows\temp\mrt1CC3.tmp\kclist.mfxA C:\Windows\temp\mrt1CC3.tmp\KcWebX.mfxA C:\Windows\temp\mrt1CC3.tmp\mmfs2.dllA C:\Windows\temp\mrt1CC3.tmp\pcxFlt.iftA C:\Windows\temp\mrt1CC3.tmp\pngFlt.iftA C:\Windows\temp\mrt1CC3.tmp\Registry2.mfxA C:\Windows\temp\mrt1CC3.tmp\stdrt.exeA C:\Windows\temp\mrt1CC3.tmp\tgaflt.iftA C:\Windows\temp\mrt1CC3.tmp\volume.mfxA C:\Windows\temp\flaFBF3.tmpA C:\Windows\temp\flaFF10.tmpC:\Windows\temp> Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:504996 Share Posted December 14, 2011 It likes an Internet connection. If I issue an "ipconfig /release" the CPU goes to zero and the memory goes to 88,00K or so. If I then issue an "ipconfig /renew" it perks up to non-zero CPU and about twice the memory.It claims to be the "Windows Media Center Diagnostic Application" in the Task Manager Description.I can kill the prcess, btw, and it will stay kiled (or at least not appear in Task Manager) until a restart. Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2011 ID:504997 Share Posted December 14, 2011 Copy/paste the text in the Codebox below into notepad:Here's how to do that:Click Start > Run type Notepad click OK.This will open an empty notepad file: Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. KillAll::File::C:\Windows\temp\mrt1CC3.tmp\aviflt.iftC:\Windows\temp\mrt1CC3.tmp\bmpFlt.iftC:\Windows\temp\mrt1CC3.tmp\fliFlt.iftC:\Windows\temp\mrt1CC3.tmp\Get.mfxC:\Windows\temp\mrt1CC3.tmp\gifFlt.iftC:\Windows\temp\mrt1CC3.tmp\jpgFlt.iftC:\Windows\temp\mrt1CC3.tmp\KcActiveX.mfxC:\Windows\temp\mrt1CC3.tmp\kcedit.mfxC:\Windows\temp\mrt1CC3.tmp\kcfile.mfxC:\Windows\temp\mrt1CC3.tmp\kclist.mfxC:\Windows\temp\mrt1CC3.tmp\KcWebX.mfxC:\Windows\temp\mrt1CC3.tmp\mmfs2.dllC:\Windows\temp\mrt1CC3.tmp\pcxFlt.iftC:\Windows\temp\mrt1CC3.tmp\pngFlt.iftC:\Windows\temp\mrt1CC3.tmp\Registry2.mfxC:\Windows\temp\mrt1CC3.tmp\stdrt.exeC:\Windows\temp\mrt1CC3.tmp\tgaflt.iftC:\Windows\temp\mrt1CC3.tmp\volume.mfxC:\Windows\temp\flaFBF3.tmpC:\Windows\temp\flaFF10.tmpFolder::C:\Windows\temp\mrt1CC3.tmpSave this file to your desktop, Save this as "CFScript" Here's how to do that:1.Click File;2.Click Save As... Change the directory to your desktop;3.Change the Save as type to "All Files"; 4.Type in the file name: CFScript5.Click Save ...Drag CFScript.txt into ComboFix.exeThen post the results log using Copy / PasteAlso please describe how your computer behaves at the moment. Link to post Share on other sites More sharing options...
RPK Posted December 14, 2011 Author ID:505028 Share Posted December 14, 2011 How's it doing? The same. Rebooted. Stdrt.exe running from a different folder this time.C:\Windows\temp>dir /s Volume in drive C is OS Volume Serial Number is 705D-9AC9 Directory of C:\Windows\temp12/14/2011 04:16 PM <DIR> .12/14/2011 04:16 PM <DIR> ..12/14/2011 04:16 PM 0 fla24F6.tmp12/14/2011 04:16 PM 0 fla2EF5.tmp12/14/2011 04:11 PM <DIR> mrtBB81.tmp 2 File(s) 0 bytes Directory of C:\Windows\temp\mrtBB81.tmp12/14/2011 04:11 PM <DIR> .12/14/2011 04:11 PM <DIR> ..12/14/2011 04:11 PM 24,576 aviflt.ift12/14/2011 04:11 PM 24,576 bmpFlt.ift12/14/2011 04:11 PM 28,672 fliFlt.ift12/14/2011 04:11 PM 12,800 Get.mfx12/14/2011 04:11 PM 28,672 gifFlt.ift12/14/2011 04:11 PM 94,208 jpgFlt.ift12/14/2011 04:11 PM 294,912 KcActiveX.mfx12/14/2011 04:11 PM 32,768 kcedit.mfx12/14/2011 04:11 PM 36,864 kcfile.mfx12/14/2011 04:11 PM 32,768 kclist.mfx12/14/2011 04:11 PM 161,280 KcWebX.mfx12/14/2011 04:11 PM 307,200 mmfs2.dll12/14/2011 04:11 PM 24,576 pcxFlt.ift12/14/2011 04:11 PM 81,920 pngFlt.ift12/14/2011 04:11 PM 14,336 Registry2.mfx12/14/2011 04:11 PM 368,640 stdrt.exe12/14/2011 04:11 PM 24,576 tgaflt.ift12/14/2011 04:11 PM 102,400 volume.mfx 18 File(s) 1,695,744 bytes Total Files Listed: 20 File(s) 1,695,744 bytes 5 Dir(s) 29,085,454,336 bytes freeC:\Windows\temp>=================================================================================ComboFix 11-12-13.03 - BSM 12/14/2011 15:12:58.2.2 - x86Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3325.1834 [GMT -5:00]Running from: c:\combofix\ComboFix.exeCommand switches used :: c:\combofix\CFScript.txtAV: F-PROT Antivirus for Windows *Disabled/Updated* {31B7FFC6-2716-5A4E-528D-32786E690ED2}SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}..((((((((((((((((((((((((( Files Created from 2011-11-14 to 2011-12-14 )))))))))))))))))))))))))))))))..2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\RPK\AppData\Local\temp2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\postgres\AppData\Local\temp2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\God\AppData\Local\temp2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Errol\AppData\Local\temp2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Default\AppData\Local\temp2011-12-14 20:22 . 2011-12-14 20:22 -------- d-----w- c:\users\Administrator\AppData\Local\temp2011-12-14 17:45 . 2011-12-14 17:45 -------- d-----w- c:\users\RPK\AppData\Roaming\Apple Computer2011-12-13 06:36 . 2011-11-21 10:47 6823496 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{35DC0095-20FF-4252-8E7D-B9B2A2F080E8}\mpengine.dll2011-12-10 13:55 . 2011-12-10 13:55 -------- d-----w- c:\users\BSM\AppData\Roaming\QuickScan2011-12-10 02:05 . 2011-12-10 02:05 -------- d-----w- c:\program files\Common Files\Adobe2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\users\BSM\AppData\Roaming\Malwarebytes2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\programdata\Malwarebytes2011-12-09 23:29 . 2011-12-09 23:29 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2011-12-09 23:29 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys2011-11-29 14:52 . 2011-11-11 15:24 704800 ----a-w- c:\windows\system32\drivers\FStopW.sys2011-11-19 20:38 . 2011-11-21 00:59 -------- d-----w- c:\users\Errol\cygwin...(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2011-10-29 18:02 . 2009-11-09 05:06 3350 --sha-w- c:\programdata\KGyGaAvL.sys2011-10-21 22:55 . 2011-10-21 22:55 485576 ----a-w- c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Catalina Marketing Corp\UninstallCouponActivator.exe2011-10-03 10:06 . 2010-12-04 00:19 472808 ----a-w- c:\windows\system32\deployJava1.dll2011-09-20 21:02 . 2011-11-09 04:01 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys..((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4.[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]"Google Media Scanner"="c:\program files\Google\Google Media Server\GoogleMediaScanner.exe" [2009-11-09 319488]"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240].[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"RtHDVCpl"="RtHDVCpl.exe" [2007-05-11 4452352]"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2007-03-16 17920]"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2010-08-09 30192]"QuickFinder Scheduler"="c:\program files\Corel\WordPerfect Office X4\Programs\QFSCHD140.EXE" [2009-06-23 83232]"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 202544]"Iomega Home Storage Manager"="c:\program files\Iomega\Home Storage Manager\Iomega Discovery.exe" [2009-05-18 147456]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-04-14 142104]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-04-14 154392]"Persistence"="c:\windows\system32\igfxpers.exe" [2007-04-14 138008]"F-PROT Antivirus Tray application"="c:\program files\FRISK Software\F-PROT Antivirus for Windows\FProtTray.exe" [2010-07-05 1674032]"RKS Fax Print Controller"="c:\program files\RKS Fax\rksfax_control.exe" [2007-11-29 3912200]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-11-29 421888]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-03-07 421160]"QuiKProtect"="c:\program files\Iomega\QuikProtect\StartQuikProtect.exe" [2010-06-24 58672]"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 479232].c:\users\BSM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MagicDisc.lnk - c:\program files\MagicDisc\MagicDisc.exe [2010-1-3 576000].c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-8-31 50688].[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]"EnableUIADesktopToggle"= 0 (0x0).[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~2\GoogleDesktopNetwork3.dll.[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"aux4"=wdmaud.drv.[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\FPAVServer]@="Service".[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]@="".[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]"DisableMonitoring"=dword:00000001.R2 Adobe Licensing Console;Adobe Licensing Console;c:\windows\system32\mrvcl32.exe [2011-08-06 819729]R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]R2 Memopal Crawler;Memopal Crawler;c:\program files\Memopal\MemopalCrawler.exe [2010-10-01 1290752]R3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2010-08-09 30192]R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 135664]R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]R3 XDS560;Texas Instruments XDS560 Device Driver;c:\windows\system32\DRIVERS\xds560.sys [2010-09-29 31472]S0 FPAV_RTP;FPAV_RTP;c:\windows\system32\DRIVERS\FStopW.sys [2011-11-11 704800]S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-10-30 691696]S1 Ext2fs;Ext2fs;c:\windows\system32\DRIVERS\ext2fs.sys [2008-09-25 189888]S1 IfsMount;IfsMount;c:\windows\system32\DRIVERS\ifsmount.sys [2008-08-29 60352]S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2011-06-06 64952]S2 EnterpriseDBApachePHP;EnterpriseDB ApachePHP;c:\users\Errol\Data\Apps\PostgreSQL\EnterpriseDB-ApachePhp\apache\bin\httpd.exe [2010-10-07 18432]S2 FPAVServer;F-PROT Antivirus for Windows system;c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPAVServer.exe [2011-10-06 84136]S2 Google MediaServer;Google MediaServer;c:\program files\Google\Google Media Server\GoogleMediaServer.exe [2009-11-09 622080]S2 GoogleIMEJaCacheService;Google Japanese Input Cache Service;c:\program files\Google\Google Japanese Input\GoogleIMEJaCacheService.exe [2011-09-13 664192]S2 npf;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2010-01-27 50704]S2 QPCopyEngine;QPCopyEngine;c:\program files\Iomega\QuikProtect\QpMonitor.exe [2010-06-24 247088]S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-16 369256]S2 TeamViewer6;TeamViewer 6;c:\program files\TeamViewer\Version6\TeamViewer_Service.exe [2011-01-27 2253688]S3 QsFsFltr;QsFsFltr;c:\windows\system32\DRIVERS\QsFsFltr.sys [2010-06-24 19384]..[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache.Contents of the 'Scheduled Tasks' folder.2011-12-14 c:\windows\Tasks\F-PROT Antivirus - Periodic Scan.job- c:\program files\FRISK Software\F-PROT Antivirus for Windows\FPWin.exe [2010-07-07 21:26].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-10 01:33].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002Core.job- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04].2011-12-14 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-816122120-2992744234-2568026571-1002UA.job- c:\users\Errol\AppData\Local\Google\Update\GoogleUpdate.exe [2011-07-04 10:04]..------- Supplementary Scan -------.uStart Page = hxxp://my.yahoo.com/IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000IE: Open with WordPerfect - c:\program files\Corel\WordPerfect Office X4\Programs\WPLauncher.htaTCP: DhcpNameServer = 192.168.1.1FF - ProfilePath - ..**************************************************************************.catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2011-12-14 15:22Windows 6.0.6002 Service Pack 2 NTFS.scanning hidden processes ... .scanning hidden autostart entries ... .scanning hidden files ... .scan completed successfullyhidden files: 0.**************************************************************************.--------------------- LOCKED REGISTRY KEYS ---------------------.[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]@Denied: (A) (Users)@Denied: (A) (Everyone)@Allowed: (B 1 2 3 4 5) (S-1-5-20)"BlindDial"=dword:00000000.Completion time: 2011-12-14 15:25:04ComboFix-quarantined-files.txt 2011-12-14 20:25ComboFix2.txt 2011-12-14 18:27.Pre-Run: 31,557,849,088 bytes freePost-Run: 31,529,562,112 bytes free.- - End Of File - - 29BAFC17D854F7BE03C8C9453F3D864E Link to post Share on other sites More sharing options...
LDTate Posted December 14, 2011 ID:505045 Share Posted December 14, 2011 Download and run the Trial version of Unhack mehttp://download.cnet.com/UnHackMe/3000-2239_4-68786.html Link to post Share on other sites More sharing options...
RPK Posted December 15, 2011 Author ID:505311 Share Posted December 15, 2011 Fixed. No sign of stdrt.exe. Link to post Share on other sites More sharing options...
LDTate Posted December 15, 2011 ID:505322 Share Posted December 15, 2011 Did unhack me do the trick? Link to post Share on other sites More sharing options...
RPK Posted December 15, 2011 Author ID:505329 Share Posted December 15, 2011 Yes, it did. Link to post Share on other sites More sharing options...
LDTate Posted December 15, 2011 ID:505330 Share Posted December 15, 2011 GREAT...Good job The following will implement some cleanup procedures as well as reset System Restore points:For XP: Click START run Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.For Vista / Windows 7 Click START Search Now type ComboFix /Uninstall in the runbox and click OK. Note the space between the X and the /, it needs to be there.If you used DeFoggerTo re-enable your Emulation drivers, double click DeFogger to run the tool. The application window will appear Click the Re-enable button to re-enable your CD Emulation drivers Click Yes to continue A 'Finished!' message will appear Click OK DeFogger will now ask to reboot the machine - click OKIMPORTANT! If you receive an error message while running DeFogger, please post the log defogger_enable which will appear on your desktop.Your Emulation drivers are now re-enabled.Here's my usual all clean postTo be on the safe side, I would also change all my passwords. This infection appears to have been cleaned, but as the malware could be configured to run any program a remote attacker requires, it's impossible to be 100% sure that any machine is clean.Log looks good Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.Without a firewall your computer is succeptible to being hacked and taken over.I am very serious about this and see it happen almost every day with my clients.Simply using a Firewall in its default configuration can lower your risk greatly.Using a secure browser plugin M86 SecureBrowsing makes it safe to search, surf and socialize online. This free browser plug-in displays security icons next to links on search engines and social networking sites like Facebook, Twitter and LinkedIn, so you'll know which pages are safe and which ones to avoid.•Free browser plug-in for Internet Explorer and Firefox•Real-time safety ratings•Ideal for Facebook, Twitter and LinkedIn JAVA Click this link and click on the Free JAVA DownloadVisit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.This will ensure your computer has always the latest security updates available installed on your computer.If there are new updates to install, install them immediately, reboot your computer, and revisit the siteuntil there are no more critical updates.Only run one Anti-Virus and Firewall program.I would suggest you read:PC Safety and Security--What Do I Need?.How to Prevent Malware:The full version of Malwarebytes' Anti-Malware could have helped protect your computer against this threat.We use different ways of protecting your computer(s): Dynamically Blocks Malware Sites & ServersMalware Execution PreventionSave yourself the hassle and get protected. Link to post Share on other sites More sharing options...
LDTate Posted December 18, 2011 ID:506308 Share Posted December 18, 2011 Since this issue is resolved I will close the thread to prevent others from posting here. If you need assistance please start your own topic and someone will be happy to assist you. Link to post Share on other sites More sharing options...
Recommended Posts