Trojan on the ropes- HJT+MWB logs

FirefoxForNow · February 21, 2009

Here we go-

Got a trojan via a WRC torrent DL with IE7. I first noticed that my McAfee had dis-enabled itself. Immedately, went to system restore but all the restore points previous to infection were deleted/hidden. I already had malwarebytes installed, and ran it straight away. It returned several results which were deleted. My comp also had installed AdAware and SpyBot (newest versions) which I ran as well. Both detected small malware, which were deleted.

After restart, McAfee initialized in dis-enabled state. Firefox is working, but IE7 returns exponential numbers of popups. After startup, if I run anti-spyware, a trojan is usually detected. If I delete the trojan, there is no significant change for a few minutes, then randomly a prompt "Generic Host Process for Win32 services has encountered a problem and needs to close..." If i try to initialize a app after that message, the OS sorta crashes, where nothing will load: no task manager will pop up, no shut down window, etc.

I've got my MWB and HJT logs here. I'll post my McAfee log at the end, if it helps. If you need, I can take a screenshot of active processes and post.

Please help!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:57:22 PM, on 2/20/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\Program Files\NETGEAR\WG311v3\WinDomainlogon.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\ehome\ehtray.exe

C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe

C:\WINDOWS\system32\Rundll32.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe

C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe

C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\CTsvcCDA.EXE

C:\WINDOWS\eHome\ehRecvr.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\MsPMSPSv.exe

C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe

C:\Documents and Settings\Marcus\Desktop\iPod\bin\iPodService.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\eHome\ehmsas.exe

C:\Program Files\Network Associates\VirusScan\mcshield.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: {e50ee11a-c2b8-2708-f7b4-323b11df1dc9} - {9cd1fd11-b323-4b7f-8072-8b2ca11ee05e} - C:\WINDOWS\system32\mvoqas.dll

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [intelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\Sound Blaster Live! 24-bit\Surround Mixer\CTSysVol.exe /r

O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper

O4 - HKLM\..\Run: [updReg] C:\WINDOWS\UpdReg.EXE

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey

O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\tbmon.exe"

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe

O4 - Global Startup: NETGEAR WG311v3 Smart Wizard.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O20 - AppInit_DLLs: mvoqas.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Documents and Settings\Marcus\Desktop\iPod\bin\iPodService.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\mcshield.exe

O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\vstskmgr.exe

--

End of file - 8679 bytes

Malwarebytes' Anti-Malware 1.31

Database version: 1525

Windows 5.1.2600 Service Pack 3

2/20/2009 5:46:28 PM

mbam-log-2009-02-20 (17-46-28).txt

Scan type: Quick Scan

Objects scanned: 55712

Time elapsed: 3 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 2

Registry Values Infected: 0

Registry Data Items Infected: 5

Folders Infected: 0

Files Infected: 7

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.

C:\Documents and Settings\Marcus\Local Settings\Temp\ntdll64.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\mousehook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

C:\Documents and Settings\Marcus\Local Settings\Temp\mousehook.dll (Trojan.FakeAlert) -> Delete on reboot.

McAfee:

2/12/2009 2:21:35 AM Statistics:

2/12/2009 2:21:35 AM Files scanned: 19329

2/12/2009 2:21:35 AM Files detected: 1

2/12/2009 2:21:35 AM Files cleaned: 0

2/12/2009 2:21:35 AM Files deleted: 1

2/12/2009 2:21:35 AM Files moved: 0

2/12/2009 12:09:23 PM Engine version = 5.3.00

2/12/2009 12:09:23 PM DAT version = 5514

2/12/2009 12:09:23 PM Number of virus signatures in EXTRA.DAT = None

2/12/2009 12:09:23 PM Names of viruses that EXTRA.DAT can detect = None

2/12/2009 12:09:53 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\RuntimeTypeInfoSet.class (Virus)

2/12/2009 12:21:53 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\TypeInfoImpl.class (Virus)

2/12/2009 8:55:30 PM Script execution blocked GENERALLEE\Marcus iexplore.exe Script executed by iexplore.exe Exploit-MS06-014 (Trojan)

2/12/2009 9:03:38 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM aawservice.exe C:\WINDOWS\Driver Cache\i386\driver.cab\CTABCEP2.GPD (Virus)

2/12/2009 9:12:28 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM aawservice.exe C:\Program Files\Activision\Call of Duty 2\main\iw_13.iwd\mtl_metal_chimney (Virus)

2/12/2009 9:42:06 PM Not scanned (The file is encrypted) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityFirewallOpenPorts.zip

2/12/2009 9:42:06 PM Not scanned (The file is encrypted) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\MicrosoftWindowsSecurityFirewallOpenPorts1.zip

2/12/2009 9:42:06 PM Not scanned (The file is encrypted) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WarezPP.zip

2/12/2009 9:42:06 PM Not scanned (The file is encrypted) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WinTDSSrtk.zip

2/12/2009 9:45:08 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\Marcus\Desktop\Adobe Photoshop CS2 9.0 Final\Photoshop CS2\Adobe® Photoshop® CS2\commonfilesinstaller\Data1.cab\SING.DLL (Virus)

2/12/2009 9:45:23 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM aawservice.exe C:\Documents and Settings\Marcus\Desktop\Adobe Photoshop CS2 9.0 Final\Photoshop CS2\Adobe® Photoshop® CS2\Data1.cab\VERSIONCUEUI.DLL (Virus)

2/12/2009 9:48:57 PM Engine version = 5.3.00

2/12/2009 9:48:57 PM DAT version = 5524

2/12/2009 9:48:57 PM Number of virus signatures in EXTRA.DAT = None

2/12/2009 9:48:57 PM Names of viruses that EXTRA.DAT can detect = None

2/12/2009 9:50:19 PM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\Init$1.class (Virus)

2/12/2009 10:09:31 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\DTMNodeList.class (Virus)

2/13/2009 1:40:44 AM Engine version = 5.3.00

2/13/2009 1:40:44 AM DAT version = 5524

2/13/2009 1:40:44 AM Number of virus signatures in EXTRA.DAT = None

2/13/2009 1:40:44 AM Names of viruses that EXTRA.DAT can detect = None

2/13/2009 1:41:27 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\SerializerFactory.class (Virus)

2/13/2009 11:43:27 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\RegistrationDocument.class (Virus)

2/14/2009 3:05:56 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\motif_sv.class (Virus)

2/14/2009 7:11:44 PM Script execution blocked GENERALLEE\Marcus iexplore.exe Script executed by iexplore.exe Exploit-MS06-014 (Trojan)

2/15/2009 4:54:57 PM Not scanned (scan timed out) GENERALLEE\Marcus firefox.exe C:\Documents and Settings\Marcus\Local Settings\Application Data\Mozilla\Firefox\Profiles\vosyr6jb.default\Cache\_CACHE_001_\00000500.EML (Virus)

2/15/2009 8:33:53 PM Not scanned (scan timed out) GENERALLEE\Marcus firefox.exe C:\Documents and Settings\Marcus\Local Settings\Application Data\Mozilla\Firefox\Profiles\vosyr6jb.default\Cache\_CACHE_001_\00000500.EML (Virus)

2/15/2009 9:15:40 PM Script execution blocked GENERALLEE\Marcus iexplore.exe Script executed by iexplore.exe Exploit-MS06-014 (Trojan)

2/15/2009 9:24:06 PM Not scanned (scan timed out) GENERALLEE\Marcus firefox.exe C:\Documents and Settings\Marcus\Local Settings\Application Data\Mozilla\Firefox\Profiles\vosyr6jb.default\Cache\_CACHE_001_\00000500.EML (Virus)

2/17/2009 10:31:28 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\DigestMD5Base.class (Virus)

2/17/2009 4:19:51 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\WindowsIconFactory$CheckBoxIcon.class (Virus)

2/18/2009 10:32:13 AM Not scanned (scan timed out) NT AUTHORITY\SYSTEM jqs.exe C:\Program Files\Java\jre6\lib\rt.jar\NamespaceMappings.class (Virus)

2/18/2009 6:00:43 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\FuncHere.class (Virus)

2/18/2009 7:33:44 PM Statistics:

2/18/2009 7:33:44 PM Files scanned: 30376

2/18/2009 7:33:44 PM Files detected: 0

2/18/2009 7:33:44 PM Files cleaned: 0

2/18/2009 7:33:44 PM Files deleted: 0

2/18/2009 7:33:44 PM Files moved: 0

2/18/2009 9:41:44 PM Engine version = 5.3.00

2/18/2009 9:41:44 PM DAT version = 5524

2/18/2009 9:41:44 PM Number of virus signatures in EXTRA.DAT = None

2/18/2009 9:41:44 PM Names of viruses that EXTRA.DAT can detect = None

2/18/2009 9:42:17 PM Not scanned (scan timed out) GENERALLEE\Marcus WgaTray.exe C:\Program Files\Java\jre6\lib\rt.jar\XSSimpleTypeDecl$2.class (Virus)

2/18/2009 9:50:45 PM Not scanned (scan timed out) GENERALLEE\Marcus iexplore.exe C:\Program Files\Java\jre6\lib\rt.jar\BootstrapResolver.class (Virus)

2/19/2009 12:17:23 AM Statistics:

2/19/2009 12:17:23 AM Files scanned: 2185

2/19/2009 12:17:23 AM Files detected: 0

2/19/2009 12:17:23 AM Files cleaned: 0

2/19/2009 12:17:23 AM Files deleted: 0

2/19/2009 12:17:23 AM Files moved: 0

2/19/2009 12:25:35 AM Engine version = 5.3.00

2/19/2009 12:25:35 AM DAT version = 5524

2/19/2009 12:25:35 AM Number of virus signatures in EXTRA.DAT = None

2/19/2009 12:25:35 AM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 12:25:50 AM Cleaned C:\WINDOWS\system32\prunnet.exe Generic.dx (Trojan)

2/19/2009 12:29:53 AM Statistics:

2/19/2009 12:29:53 AM Files scanned: 0

2/19/2009 12:29:53 AM Files detected: 1

2/19/2009 12:29:53 AM Files cleaned: 0

2/19/2009 12:29:53 AM Files deleted: 0

2/19/2009 12:29:53 AM Files moved: 0

2/19/2009 12:31:51 AM Engine version = 5.3.00

2/19/2009 12:31:51 AM DAT version = 5524

2/19/2009 12:31:51 AM Number of virus signatures in EXTRA.DAT = None

2/19/2009 12:31:51 AM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 1:51:31 AM Engine version = 5.3.00

2/19/2009 1:51:31 AM DAT version = 5524

2/19/2009 1:51:31 AM Number of virus signatures in EXTRA.DAT = None

2/19/2009 1:51:31 AM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 10:04:24 AM Engine version = 5.3.00

2/19/2009 10:04:24 AM DAT version = 5524

2/19/2009 10:04:24 AM Number of virus signatures in EXTRA.DAT = None

2/19/2009 10:04:24 AM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 10:08:04 AM Statistics:

2/19/2009 10:08:04 AM Files scanned: 0

2/19/2009 10:08:04 AM Files detected: 0

2/19/2009 10:08:04 AM Files cleaned: 0

2/19/2009 10:08:04 AM Files deleted: 0

2/19/2009 10:08:04 AM Files moved: 0

2/19/2009 10:10:32 AM Engine version = 5.3.00

2/19/2009 10:10:32 AM DAT version = 5524

2/19/2009 10:10:32 AM Number of virus signatures in EXTRA.DAT = None

2/19/2009 10:10:32 AM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 4:33:38 PM Engine version = 5.3.00

2/19/2009 4:33:38 PM DAT version = 5524

2/19/2009 4:33:38 PM Number of virus signatures in EXTRA.DAT = None

2/19/2009 4:33:38 PM Names of viruses that EXTRA.DAT can detect = None

2/19/2009 4:49:17 PM Statistics:

2/19/2009 4:49:17 PM Files scanned: 1

2/19/2009 4:49:17 PM Files detected: 0

2/19/2009 4:49:17 PM Files cleaned: 0

2/19/2009 4:49:17 PM Files deleted: 0

2/19/2009 4:49:17 PM Files moved: 0

2/19/2009 4:52:57 PM Engine version = 5.3.00

2/19/2009 4:52:57 PM DAT version = 5524

2/19/2009 4:52:57 PM Number of virus signatures in EXTRA.DAT = None

2/19/2009 4:52:57 PM Names of viruses that EXTRA.DAT can detect = None

2/20/2009 12:45:25 AM Engine version = 5.3.00

2/20/2009 12:45:25 AM DAT version = 5524

2/20/2009 12:45:25 AM Number of virus signatures in EXTRA.DAT = None

2/20/2009 12:45:25 AM Names of viruses that EXTRA.DAT can detect = None

2/20/2009 8:45:35 AM Engine version = 5.3.00

2/20/2009 8:45:35 AM DAT version = 5524

2/20/2009 8:45:35 AM Number of virus signatures in EXTRA.DAT = None

2/20/2009 8:45:35 AM Names of viruses that EXTRA.DAT can detect = None

2/20/2009 5:18:32 PM Engine version = 5.3.00

2/20/2009 5:18:32 PM DAT version = 5524

2/20/2009 5:18:32 PM Number of virus signatures in EXTRA.DAT = None

2/20/2009 5:18:32 PM Names of viruses that EXTRA.DAT can detect = None

2/20/2009 5:41:00 PM Engine version = 5.3.00

2/20/2009 5:41:00 PM DAT version = 5524

2/20/2009 5:41:00 PM Number of virus signatures in EXTRA.DAT = None

2/20/2009 5:41:00 PM Names of viruses that EXTRA.DAT can detect = None

2/20/2009 5:47:08 PM Statistics:

2/20/2009 5:47:08 PM Files scanned: 0

2/20/2009 5:47:08 PM Files detected: 0

2/20/2009 5:47:08 PM Files cleaned: 0

2/20/2009 5:47:08 PM Files deleted: 0

2/20/2009 5:47:08 PM Files moved: 0

2/20/2009 5:49:35 PM Engine version = 5.3.00

2/20/2009 5:49:35 PM DAT version = 5524

2/20/2009 5:49:35 PM Number of virus signatures in EXTRA.DAT = None

2/20/2009 5:49:35 PM Names of viruses that EXTRA.DAT can detect = None

Thanks Again!

Tigger93 · February 21, 2009

Hi.

Please update Malwarebytes, run a quick scan and post the log. Also run this scan please:

Download Lop S&D from here

Double-click Lop S&D.exe
Choose the language, then choose Option 1 (Search)
Wait till the scan completes
Post the log which is created: (%SystemDrive%\lopR.txt)

FirefoxForNow · February 21, 2009

Thanks for the Help. I did as you asked. As a heads up: when I ran the updated MWB, spyware SD resident came up with an alert saying "Browser helper object value added" with a long serial number for the process that started (9cd1fd11-b323-4d7f- ......) I don't think it was a MWB process, might be related to the trojan.

Not to sound ungreatful (I'm anything but)- this LOP S&D software is a little sketchy. Small and french? Please don't ask me to DL any additional tools unless absolutely necessary. I already listed my armada of installed tools, and it doesn't seem like I should need any more. Unless that's the only way.

Thanks again!

Updated MWB log:

Malwarebytes' Anti-Malware 1.34

Database version: 1782

Windows 5.1.2600 Service Pack 3

2/20/2009 6:56:59 PM

mbam-log-2009-02-20 (18-56-59).txt

Scan type: Quick Scan

Objects scanned: 68998

Time elapsed: 3 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 1

Registry Keys Infected: 7

Registry Values Infected: 0

Registry Data Items Infected: 2

Folders Infected: 0

Files Infected: 10

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

C:\WINDOWS\system32\mvoqas.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9cd1fd11-b323-4b7f-8072-8b2ca11ee05e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{9cd1fd11-b323-4b7f-8072-8b2ca11ee05e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9cd1fd11-b323-4b7f-8072-8b2ca11ee05e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\prunnet (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\system32\mvoqas.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\WINDOWS\system32\ungrdxwa.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\senekakxmifuxf.dll (Trojan.TDSS) -> Delete on reboot.

C:\WINDOWS\system32\senekaobwgwsrn.dll (Trojan.TDSS) -> Delete on reboot.

C:\WINDOWS\system32\ddcYqOgh.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\senekawqdutehb.sys (Trojan.TDSS) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\senekabgiteqot.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\senekamliltabd.dll (Trojan.Agent) -> Delete on reboot.

C:\WINDOWS\system32\senekaqatxthsm.dat (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Here is the LOP SD log

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )

BIOS : Phoenix ROM BIOS PLUS Version 1.10 A01

USER : Marcus ( Administrator )

BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:144 Go (Free:11 Go)

D:\ (CD or DVD)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( Fri 02/20/2009|19:07 )

--------------------\\ Listing folders in APPLIC~1

[09/10/2005|12:05] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Creative

[08/19/2004|01:14] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Identities

[09/10/2005|11:52] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Jasc Software Inc

[09/10/2005|11:50] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Microsoft

[09/10/2005|11:42] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Sun

[09/10/2005|11:57] C:\DOCUME~1\ADMINI~1\APPLIC~1\<DIR> Symantec

[04/23/2006|09:32] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe

[04/23/2006|09:48] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Adobe Systems

[09/14/2005|08:33] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> AOL

[01/24/2007|07:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Apple Computer

[05/26/2007|06:45] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> BVRP Software

[03/29/2008|02:31] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Dell

[04/11/2008|10:50] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> GTek

[10/02/2005|07:02] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> HP

[09/10/2005|11:52] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> InstallShield

[09/10/2005|11:54] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Intuit

[12/19/2008|12:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Lavasoft

[12/20/2008|02:05] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Malwarebytes

[11/04/2008|01:06] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Microsoft

[09/14/2005|08:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Network Associates

[09/10/2005|11:53] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> QuickTime

[08/19/2004|01:22] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> SBSI

[12/20/2008|05:59] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Spybot - Search & Destroy

[09/14/2005|08:14] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Symantec

[05/28/2006|10:46] C:\DOCUME~1\ALLUSE~1\APPLIC~1\<DIR> Windows Genuine Advantage

[09/10/2005|12:05] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Creative

[08/19/2004|01:14] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Identities

[09/10/2005|11:52] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Jasc Software Inc

[08/19/2004|12:57] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Microsoft

[09/10/2005|11:42] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Sun

[09/10/2005|11:57] C:\DOCUME~1\DEFAUL~1\APPLIC~1\<DIR> Symantec

[03/10/2006|09:31] C:\DOCUME~1\LOCALS~1\APPLIC~1\<DIR> Microsoft

[12/04/2008|10:11] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Adobe

[02/25/2006|06:26] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> AdobeUM

[03/07/2006|09:36] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Apple Computer

[05/03/2008|11:08] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> BitZipper

[03/04/2008|06:34] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Creative

[09/25/2005|11:26] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> CyberLink

[12/09/2005|06:53] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Google

[04/14/2007|02:59] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Gtek

[12/20/2008|12:51] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Help

[06/28/2007|06:40] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> HP

[08/19/2004|01:14] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Identities

[05/26/2007|06:34] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> InstallShield

[09/26/2005|03:41] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Jasc Software Inc

[12/19/2008|01:00] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Lavasoft

[10/11/2005|07:55] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Leadertech

[03/28/2006|08:35] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Macromedia

[12/20/2008|02:05] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Malwarebytes

[02/06/2008|09:18] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Microsoft

[12/20/2008|12:30] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Mozilla

[04/25/2006|10:40] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Opera

[04/30/2008|10:05] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Real

[10/11/2005|07:56] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Sonic

[09/10/2005|11:42] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Sun

[09/10/2005|11:57] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Symantec

[02/14/2006|10:40] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Talkback

[02/14/2006|10:40] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> Thunderbird

[02/19/2009|12:18] C:\DOCUME~1\Marcus\APPLIC~1\<DIR> uTorrent

[08/19/2004|12:57] C:\DOCUME~1\NETWOR~1\APPLIC~1\<DIR> Microsoft

--------------------\\ Scheduled Tasks located in C:\WINDOWS\Tasks

[02/20/2009 07:01 PM][--a------] C:\WINDOWS\tasks\mfwpraie.job

[02/20/2009 07:01 PM][--ah-----] C:\WINDOWS\tasks\SA.DAT

[08/10/2004 02:00 AM][-r-h-----] C:\WINDOWS\tasks\desktop.ini

--------------------\\ Listing Folders in C:\Program Files

[01/23/2009|08:09] C:\Program Files\<DIR> Activision

[04/23/2006|09:51] C:\Program Files\<DIR> Adobe

[09/10/2005|11:47] C:\Program Files\<DIR> ATI Technologies

[05/26/2007|06:34] C:\Program Files\<DIR> Avanquest update

[05/03/2008|11:25] C:\Program Files\<DIR> BitZipper

[12/28/2005|08:22] C:\Program Files\<DIR> Canon

[09/16/2007|01:33] C:\Program Files\<DIR> CDex_150

[02/19/2009|01:02] C:\Program Files\<DIR> Common Files

[08/19/2004|01:02] C:\Program Files\<DIR> ComPlus Applications

[02/19/2009|04:49] C:\Program Files\<DIR> Creative

[12/22/2007|03:41] C:\Program Files\<DIR> Crystal Player

[03/02/2006|01:50] C:\Program Files\<DIR> CureROM

[09/10/2005|11:49] C:\Program Files\<DIR> CyberLink

[12/10/2005|06:52] C:\Program Files\<DIR> DAEMON Tools

[10/24/2006|08:11] C:\Program Files\<DIR> DC++

[09/10/2005|12:01] C:\Program Files\<DIR> Dell

[09/10/2005|11:52] C:\Program Files\<DIR> Dell Inc

[04/14/2007|02:48] C:\Program Files\<DIR> DellSupport

[10/22/2008|12:23] C:\Program Files\<DIR> DivX

[08/19/2004|01:16] C:\Program Files\<DIR> EnglishOtto

[04/20/2006|05:25] C:\Program Files\<DIR> Fargo

[02/19/2009|04:47] C:\Program Files\<DIR> GemMaster

[12/09/2005|06:53] C:\Program Files\<DIR> Google

[12/30/2008|10:33] C:\Program Files\<DIR> GTR2

[10/02/2005|07:02] C:\Program Files\<DIR> Hewlett-Packard

[10/02/2005|07:03] C:\Program Files\<DIR> HP

[02/19/2009|04:49] C:\Program Files\<DIR> InstallShield Installation Information

[09/10/2005|11:48] C:\Program Files\<DIR> Intel

[11/02/2008|02:18] C:\Program Files\<DIR> Internet Explorer

[09/10/2005|11:54] C:\Program Files\<DIR> Intuit

[01/24/2007|07:07] C:\Program Files\<DIR> iTunes

[09/26/2005|03:41] C:\Program Files\<DIR> Jasc Software Inc

[02/19/2009|01:04] C:\Program Files\<DIR> Java

[10/13/2008|09:25] C:\Program Files\<DIR> K-Lite Codec Pack

[12/19/2008|01:00] C:\Program Files\<DIR> Lavasoft

[09/29/2007|01:04] C:\Program Files\<DIR> LucasArts

[02/20/2009|06:52] C:\Program Files\<DIR> Malwarebytes' Anti-Malware

[11/02/2008|02:24] C:\Program Files\<DIR> Messenger

[09/14/2005|08:55] C:\Program Files\<DIR> Microsoft ActiveSync

[08/19/2004|01:07] C:\Program Files\<DIR> microsoft frontpage

[12/20/2007|05:45] C:\Program Files\<DIR> Microsoft Games

[09/14/2005|09:27] C:\Program Files\<DIR> Microsoft IntelliPoint

[09/14/2005|08:55] C:\Program Files\<DIR> Microsoft Office

[09/10/2005|11:51] C:\Program Files\<DIR> Microsoft Plus! Digital Media Edition

[09/10/2005|11:51] C:\Program Files\<DIR> Microsoft Plus! Photo Story 2 LE

[09/14/2005|08:55] C:\Program Files\<DIR> Microsoft Visual Studio

[09/14/2005|08:55] C:\Program Files\<DIR> Microsoft Works

[09/14/2005|08:53] C:\Program Files\<DIR> Microsoft.NET

[09/10/2005|11:48] C:\Program Files\<DIR> Modem Helper

[09/10/2005|11:48] C:\Program Files\<DIR> Modem On Hold

[05/26/2007|06:43] C:\Program Files\<DIR> Motorola Phone Tools

[11/02/2008|02:18] C:\Program Files\<DIR> Movie Maker

[02/20/2009|07:02] C:\Program Files\<DIR> Mozilla Firefox

[08/19/2004|01:01] C:\Program Files\<DIR> MSN

[08/19/2004|01:01] C:\Program Files\<DIR> MSN Gaming Zone

[11/15/2006|03:01] C:\Program Files\<DIR> MSXML 4.0

[09/10/2005|11:50] C:\Program Files\<DIR> MUSICMATCH

[11/27/2006|09:30] C:\Program Files\<DIR> NETGEAR

[11/02/2008|02:15] C:\Program Files\<DIR> NetMeeting

[09/14/2005|08:22] C:\Program Files\<DIR> Network Associates

[08/19/2004|01:02] C:\Program Files\<DIR> Online Services

[11/02/2008|02:15] C:\Program Files\<DIR> Outlook Express

[05/10/2006|02:55] C:\Program Files\<DIR> PC-Pine

[01/24/2007|07:06] C:\Program Files\<DIR> QuickTime

[09/10/2005|11:53] C:\Program Files\<DIR> Real

[08/19/2004|01:20] C:\Program Files\<DIR> RGB

[12/10/2005|08:47] C:\Program Files\<DIR> Rockstar Games

[04/14/2008|06:08] C:\Program Files\<DIR> SCi Games

[06/26/2007|09:40] C:\Program Files\<DIR> Soldier of Fortune II - Double Helix MP TEST

[09/10/2005|11:56] C:\Program Files\<DIR> Sonic

[12/20/2008|05:58] C:\Program Files\<DIR> Spybot - Search & Destroy

[09/14/2005|08:18] C:\Program Files\<DIR> Symantec

[02/20/2009|05:52] C:\Program Files\<DIR> Trend Micro

[08/19/2004|01:14] C:\Program Files\<DIR> Uninstall Information

[02/19/2009|12:17] C:\Program Files\<DIR> uTorrent

[04/11/2008|10:50] C:\Program Files\<DIR> VideoLAN

[09/10/2005|11:50] C:\Program Files\<DIR> Windows Media Player

[11/02/2008|02:15] C:\Program Files\<DIR> Windows NT

[08/19/2004|01:02] C:\Program Files\<DIR> Windows Plus

[08/19/2004|01:05] C:\Program Files\<DIR> WindowsUpdate

[08/19/2004|01:07] C:\Program Files\<DIR> xerox

[04/14/2006|03:25] C:\Program Files\<DIR> Xilisoft

[09/10/2005|11:52] C:\Program Files\<DIR> Your Company Name

--------------------\\ Listing Folders in C:\Program Files\Common Files

[04/23/2006|09:47] C:\Program Files\Common Files\<DIR> Adobe

[04/23/2006|09:47] C:\Program Files\Common Files\<DIR> Adobe Systems Shared

[09/14/2005|08:33] C:\Program Files\Common Files\<DIR> AOL

[09/14/2005|08:22] C:\Program Files\Common Files\<DIR> Cisco Systems

[09/14/2005|08:55] C:\Program Files\Common Files\<DIR> DESIGNER

[02/04/2008|01:44] C:\Program Files\Common Files\<DIR> DirectX

[10/02/2005|07:04] C:\Program Files\Common Files\<DIR> HP

[09/10/2005|12:01] C:\Program Files\Common Files\<DIR> InstallShield

[09/14/2005|08:46] C:\Program Files\Common Files\<DIR> Intuit

[09/14/2005|08:55] C:\Program Files\Common Files\<DIR> L&H

[09/14/2005|08:56] C:\Program Files\Common Files\<DIR> Microsoft Shared

[08/19/2004|01:04] C:\Program Files\Common Files\<DIR> MSSoap

[09/14/2005|08:21] C:\Program Files\Common Files\<DIR> Network Associates

[09/10/2005|11:53] C:\Program Files\Common Files\<DIR> Nullsoft

[08/19/2004|12:57] C:\Program Files\Common Files\<DIR> ODBC

[03/10/2006|07:28] C:\Program Files\Common Files\<DIR> Real

[08/19/2004|01:04] C:\Program Files\Common Files\<DIR> Services

[09/10/2005|11:56] C:\Program Files\Common Files\<DIR> Sonic Shared

[08/19/2004|12:57] C:\Program Files\Common Files\<DIR> SpeechEngines

[09/14/2005|08:24] C:\Program Files\Common Files\<DIR> SWF Studio

[09/14/2005|08:16] C:\Program Files\Common Files\<DIR> Symantec Shared

[11/02/2008|02:14] C:\Program Files\Common Files\<DIR> System

[09/10/2005|11:51] C:\Program Files\Common Files\<DIR> TiVo Shared

[12/19/2008|12:58] C:\Program Files\Common Files\<DIR> Wise Installation Wizard

[03/10/2006|07:28] C:\Program Files\Common Files\<DIR> xing shared

--------------------\\ Process

( 55 Processes )

... OK !

--------------------\\ Searching with S_Lop

No Lop folder found !

--------------------\\ Searching for Lop Files - Folders

C:\DOCUME~1\Marcus\Cookies\marcus@divavillage.advertserve[1].txt

C:\DOCUME~1\Marcus\Cookies\marcus@imagevenue.advertserve[2].txt

C:\DOCUME~1\Marcus\Cookies\marcus@advertising[1].txt

C:\DOCUME~1\Marcus\Cookies\marcus@advertising[2].txt

C:\DOCUME~1\Marcus\Cookies\marcus@adopt.euroclick[2].txt

--------------------\\ Searching within the Registry

..... OK !

--------------------\\ Checking the Hosts file

Hosts file CLEAN

--------------------\\ Searching for hidden files with Catchme

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-20 19:08:47

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden files: 0

--------------------\\ Searching for other infections

--------------------\\ ROOTKIT !!

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\LEGACY_TDSSSERV.SYS]

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Enum\Root\LEGACY_TDSSSERV.SYS]

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_TDSSSERV.SYS]

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\TDSSserv.sys]

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\TDSSserv.sys]

Rootkit Tibs ! .. [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TDSSserv.sys]

--------------------\\ Suspect ..

C:\WINDOWS\system32\TDSSmtvd.dat

--------------------\\ Cracks & Keygens ..

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 albums\Jay Z\In My Lifetime, Volume 1\12 - Jay-Z - Rap Game Crack Game.mp3

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 albums\Kanye West\Late Registration\08-Crack Music featuring Game.mp3

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 albums\Notorious BIG\Ten Crack Commandments.mp3

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Acid Pro 5.0 + Keygen

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Age of Empires III crack

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Acid Pro 5.0 + Keygen\Acid Pro 5.0.exe

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Acid Pro 5.0 + Keygen\Fix Registration.reg

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Acid Pro 5.0 + Keygen\Keygen.exe

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Acid Pro 5.0 + Keygen\README.txt

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\Age of Empires III crack\dev-ae33.rar

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\SW KOTOR II\Crack

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\SW KOTOR II\Crack\swkotor2.exe

C:\DOCUME~1\Marcus\My Documents\MARCUS\MUSIC\MP3 Downloads\SW KOTOR II\Crack\swkotor2.ini

[F:97][D:16]-> C:\DOCUME~1\Marcus\LOCALS~1\Temp

[F:479][D:0]-> C:\DOCUME~1\Marcus\Cookies

[F:237][D:8]-> C:\DOCUME~1\Marcus\LOCALS~1\TEMPOR~1\content.IE5

1 - "C:\Lop SD\LopR_1.txt" - Fri 02/20/2009|19:10 - Option : [1]

--------------------\\ Scan completed at 19:10:23

Tigger93 · February 21, 2009

The tools I had you download are needed to clean your PC (and for the record, no it's not small and Frenchy, it's in English and isn't a removal tool, simply a tool to help in the diagnostic process).

However, since you're using cracks, we cannot continue to help.

FirefoxForNow · February 21, 2009

Tigger-

Thanks for what help you were able to provide. I didn't intend to insult your diagnostic tools- I'm just a little apprehensive of installing more software at this point. The french-as-a-primary language aspect made me think twice.

I'm sorry that you cannot help me any further.

The cracks and keygens in the My Documents folder I am familiar with and pose no threat- I can uninstall/delete them if that would help things.

If you cannot help me any further with direct instructions, can you:

(A) give me some analysis of the nature of my problem/situation from the diagnostic data provided

( suggest an attack approach or plan of addressing my situation (such as removing problematic cracks)

Additionally, if any other moderators are able to help/make suggestions that would be appreciated as well.

Tigger93 · February 21, 2009

Please don't be offended by anything I said, I was simply pointing out a few things about that tool. While it may seem a little odd that the tool starts in French, most of our tools have multiple languages, and we would never have you download anything that is not safe.

While the cracks you have may not pose a threat, cracks are a way of getting infected, and when people have cracks on the computer and we find them, that's usually where they got the infection from. You also must remember cracks are illegal.

I will be able to continue helping you if you remove the cracks. Let me know.

FirefoxForNow · February 21, 2009

Tigger-

Thanks for sticking it out with me. I removed the "crack" files that had been on my hard drive. The three files that LOP S&D is still identifying are all actual .mp3s that I uploaded from CD and actively listen to. The files which LOP had previously identified under "cracks and keygens" I had acquired over two ago. Also, they were acquired directly in 1st person from a friend via USB key, not through any p2p service. Therefore, I'd be surprised if they were related to my recent infection. Unless its a really crafty infection.

Note for MBAM community: Any "crack" files previously displayed in diagnostic results were NOT related to the infringement of copyrighted or trademarked data. Piracy is illegal and should not be practiced by MBAM users. It is an easy way to contract malware. Don't do it!

Here's the new Lop log. Other than deleting the indicated files, I have preformed no other actions since last post.

Thanks, cheers, and hope your weekend is starting off better than mine.

--------------------\\ Lop S&D 4.2.5-0 XP/Vista

Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 3

X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 3.00GHz )

BIOS : Phoenix ROM BIOS PLUS Version 1.10 A01

USER : Marcus ( Administrator )

BOOT : Normal boot

C:\ (Local Disk) - NTFS - Total:144 Go (Free:18 Go)

D:\ (CD or DVD)

I:\ (Local Disk) - NTFS - Total:372 Go (Free:174 Go)

"C:\Lop SD" ( MAJ : 19-12-2008|23:40 )

Option : [1] ( Fri 02/20/2009|21:23 )