Rootkit and Trojan Downloader.

Broggy · November 18, 2009

Okay so, the general problem is. I scan, I get rid of these problems I have ( log will follow ) and I keep getting them back on the reboot. I'm not sure why, I quarantine them everytime and they really dont seem to be doing any harm, but peace of mind would be helpful. Anywhere, heres the logfile. Please halp me. =[

MBAM LOG

------------

Malwarebytes' Anti-Malware 1.41

Database version: 3159

Windows 6.0.6002 Service Pack 2

11/15/2009 2:13:24 AM

mbam-log-2009-11-15 (02-13-23).txt

Scan type: Full Scan (A:\|C:\|)

Objects scanned: 230626

Time elapsed: 58 minute(s), 37 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 4

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Users\Mowat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BXHKNC2J\ea2check[1].exe (Spyware.Passwords) -> No action taken.

C:\Users\Mowat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UODKT39S\e4c61as[2].exe (Spyware.Passwords) -> No action taken.

C:\Users\Mowat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZIDQDH9M\c1xstfra[2].exe (Trojan.Downloader) -> No action taken.

C:\Users\Mowat\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZIDQDH9M\i3spec32[1].exe (Rootkit.Agent) -> No action taken.

Hijackthis! Log

--------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 6:28:32 PM, on 11/15/2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18828)

Boot mode: Normal

Running processes:

C:\Program Files (x86)\Skype\Phone\Skype.exe

C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe

C:\Users\Mowat\AppData\Local\Temp\n2scv.exe

c:\PROGRA~2\mcafee.com\agent\mcagent.exe

C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files (x86)\iTunes\iTunesHelper.exe

C:\Program Files (x86)\NCH Swift Sound\VRS\vrs.exe

C:\Program Files (x86)\Skype\Plugin Manager\skypePM.exe

C:\Program Files (x86)\Mozilla Firefox\firefox.exe

C:\Program Files (x86)\Skype\Toolbars\Shared\SkypeNames.exe

C:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O1 - Hosts: 91.121.221.171 thepiratebay.org