Trojan.Agent

dennisl · September 9, 2010

I unfortunately have an infection with the above.

Last year I had a similar problem & re followed your earlier instrucions using Combofix, but regret this has not been succesful on this occasion.

Logs below -hope you can help.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:40:05, on 09/09/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kontiki\KService.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\SRNMIC~1\SOLOSENT.EXE

C:\SRNMIC~1\SOLOCFG.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\PROGRA~1\WinZip\winzip32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloadcenter.intel.com/detail_des...;ProductID=1784

R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,c:\program files\intel\wireless\bin\ifrmewrksrv.exe,c:\program files\microsoft\desktoplayer.exe,

O2 - BHO: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll

O2 - BHO: ZoneAlarm Security Engine Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O3 - Toolbar: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll

O3 - Toolbar: ZoneAlarm Security Engine - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - C:\Program Files\CheckPoint\ZAForceField\TrustChecker\bin\TrustCheckerIEPlugin.dll

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [soloSentry] C:\SRNMIC~1\SOLOSENT.EXE

O4 - HKLM\..\Run: [soloSchedule] C:\SRNMIC~1\SOLOCFG.EXE

O4 - HKLM\..\Run: [soloSysCheck] C:\SRNMIC~1\SYSCHECK.COM

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [nonep] C:\Program Files\riv87\oops.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: ZoneAlarm Toolbar IswSvc (IswSvc) - Check Point Software Technologies - C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe

O23 - Service: LeapFrog Connect Device Service - LeapFrog Enterprises, Inc. - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe

O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--

End of file - 6701 bytes

ComboFix 10-09-08.01 - **** 09/09/2010 8:57.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.702 [GMT 1:00]

Running from: c:\documents and settings\****\Desktop\ComboFix.exe

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\****\Application Data\Qeca\yqvo.exe

c:\documents and settings\****\Local Settings\Application Data\{C40D5472-713E-4487-969F-EE9A1F58AA14}

c:\documents and settings\****\Local Settings\Application Data\{C40D5472-713E-4487-969F-EE9A1F58AA14}\chrome.manifest

c:\documents and settings\****\Local Settings\Application Data\{C40D5472-713E-4487-969F-EE9A1F58AA14}\chrome\content\_cfg.js

c:\documents and settings\****\Local Settings\Application Data\{C40D5472-713E-4487-969F-EE9A1F58AA14}\chrome\content\overlay.xul

c:\documents and settings\****\Local Settings\Application Data\{C40D5472-713E-4487-969F-EE9A1F58AA14}\install.rdf

c:\program files\Internet Explorer\complete.dat

c:\program files\Internet Explorer\dmlconf.dat

c:\program files\Microsoft\DesktopLayer.exe

c:\windows\alacigitulob.dll

c:\windows\eladihos.dll

c:\windows\eriqamab.dll

c:\windows\exakeyoj.dll

c:\windows\eyesecoqaf.dll

c:\windows\otowasil.dll

c:\windows\ugunepubikehejon.dll

c:\windows\uwovuzitoha.dll

c:\windows\uyuxiqeni.dll

Infected copy of c:\windows\system32\drivers\WudfPf.sys was found and disinfected

Restored copy from - Kitty had a snack

.

((((((((((((((((((((((((( Files Created from 2010-08-09 to 2010-09-09 )))))))))))))))))))))))))))))))

.

2010-09-08 14:30 . 2010-09-09 08:07 -------- d-----w- c:\program files\riv87

2010-09-07 21:43 . 2010-09-07 21:43 -------- d-----w- c:\program files\syst32

2010-09-07 21:43 . 2010-09-09 08:07 -------- d-----w- c:\program files\Microsoft

2010-08-19 12:44 . 2010-08-19 12:44 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple Computer

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-09-09 08:10 . 2009-07-09 11:19 -------- d-----w- c:\documents and settings\All Users\Application Data\Kontiki

2010-09-09 08:10 . 2008-04-30 02:42 -------- d-----w- c:\documents and settings\****\Application Data\Utakl

2010-09-09 08:04 . 2009-07-10 05:35 -------- d-----w- c:\documents and settings\****\Application Data\Qeca

2010-09-09 07:48 . 2010-05-07 10:07 -------- d-----w- c:\documents and settings\****\Application Data\Ogoton

2010-09-08 15:04 . 2008-09-29 02:51 -------- d-----w- c:\documents and settings\****\Application Data\Ewrahi

2010-09-08 15:02 . 2009-04-21 15:05 -------- d-----w- c:\documents and settings\****\Application Data\Rugywe

2010-09-08 14:40 . 2010-05-16 11:24 -------- d-----w- c:\documents and settings\****\Application Data\Oqid

2010-09-08 14:40 . 2010-01-21 11:30 -------- d-----w- c:\documents and settings\****\Application Data\Axyduc

2010-09-08 14:31 . 2008-09-22 14:26 -------- d-----w- c:\documents and settings\****\Application Data\Geope

2010-09-08 14:29 . 2009-01-19 14:21 29748924 ----a-w- c:\windows\Internet Logs\tvDebug.Zip

2010-09-07 22:13 . 2009-01-08 15:12 664 ----a-w- c:\windows\system32\d3d9caps.dat

2010-09-07 22:04 . 2009-08-11 19:27 217600 ----a-w- C:\UNWISE.EXE

2010-09-07 22:03 . 2008-07-12 09:38 -------- d-----w- c:\documents and settings\****\Application Data\Foacru

2010-09-07 21:43 . 2010-09-08 15:02 170982 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat

2010-09-07 21:37 . 2008-04-08 15:32 4212 ---ha-w- c:\windows\system32\zllictbl.dat

2010-09-01 13:37 . 2010-03-16 18:36 -------- d-----w- c:\documents and settings\****\Application Data\Ofexug

2010-08-05 21:18 . 2010-08-05 21:18 -------- d-----w- c:\program files\Free M4a to MP3 Converter

2010-07-26 12:44 . 2010-06-28 16:59 -------- d-----w- c:\program files\iTunes

2010-07-26 12:43 . 2010-07-26 12:43 -------- d-----w- c:\program files\iPod

2010-07-26 12:43 . 2008-04-08 15:47 -------- d-----w- c:\program files\Common Files\Apple

2010-07-21 14:49 . 2010-07-21 14:49 339968 ----a-w- c:\windows\system32\RapportBuka.dll

2010-07-20 12:15 . 2010-07-20 12:15 -------- d-----w- c:\documents and settings\****\Application Data\CheckPoint

2010-07-20 12:10 . 2010-07-20 12:10 -------- d-----w- c:\program files\Conduit

2010-07-20 12:10 . 2010-07-20 12:10 -------- d-----w- c:\program files\ZoneAlarm

2010-07-20 12:10 . 2010-07-20 12:10 -------- d-----w- c:\program files\CheckPoint

2010-07-20 10:20 . 2010-07-20 10:20 38 ----a-w- c:\windows\SOLOSCAN.BAT

2010-07-20 09:39 . 2010-07-20 09:39 -------- d-----w- c:\documents and settings\****\Application Data\Malwarebytes

2010-07-20 09:39 . 2010-07-20 09:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-07-20 09:39 . 2010-07-20 09:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-07-20 08:47 . 2010-07-20 08:46 -------- d-----w- c:\program files\Registry Patrol

2010-07-19 17:26 . 2009-07-09 11:19 -------- d-----w- c:\program files\Kontiki

2010-07-19 16:44 . 2010-02-23 12:05 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9

2010-07-19 16:02 . 2010-07-19 16:02 -------- d-----w- c:\program files\Enigma Software Group

2010-07-19 10:46 . 2010-07-19 10:46 120 ----a-w- c:\windows\Mmaci.dat

2010-07-19 10:46 . 2010-07-19 10:46 0 ----a-w- c:\windows\Wrejupukalegete.bin

2010-07-16 09:35 . 2010-07-12 15:43 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-07-16 09:35 . 2010-07-12 15:43 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-06-23 12:51 . 2010-07-20 12:09 1238528 ----a-w- c:\windows\system32\zpeng25.dll

2010-06-23 12:51 . 2010-07-20 12:09 69120 ----a-w- c:\windows\system32\zlcomm.dll

2010-06-23 12:51 . 2010-07-20 12:09 103936 ----a-w- c:\windows\system32\zlcommdb.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]

"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

2010-05-09 10:50 2517088 ----a-w- c:\program files\ZoneAlarm\tbZone.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

"{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]

"{66F2E20D-0DA8-4C11-A9C8-DD8477B88ACD}"= "c:\program files\ZoneAlarm\tbZone.dll" [2010-05-09 2517088]

[HKEY_CLASSES_ROOT\clsid\{66f2e20d-0da8-4c11-a9c8-dd8477b88acd}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2010-09-09 860160]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2010-09-09 753664]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-07-14 77824]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 148888]

"SoloSentry"="c:\srnmic~1\SOLOSENT.EXE" [2009-10-15 77824]

"SoloSchedule"="c:\srnmic~1\SOLOCFG.EXE" [2009-10-15 303104]

"SoloSysCheck"="c:\srnmic~1\SYSCHECK.COM" [2010-03-27 237568]

"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2010-06-23 1043968]

"nonep"="c:\program files\riv87\oops.exe" [2010-09-09 156160]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\system32\userinit.exe,,c:\program files\microsoft\desktoplayer.exe"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier]

2010-07-13 14:10 47904 ----a-w- c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gStart]

2008-08-13 13:34 1891416 ----a-w- c:\garmin\gStart.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]

2006-07-14 16:08 118784 ----a-w- c:\windows\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxtray]

2006-07-14 16:07 94208 ----a-w- c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Inini]

2008-04-14 00:12 33280 ----a-w- c:\windows\system32\rundll32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISW]

2010-05-26 13:35 730600 ----a-w- c:\program files\CheckPoint\ZAForceField\ForceField.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

2010-07-21 14:53 141608 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mcexecwin]

2008-04-14 00:12 33280 ----a-w- c:\windows\system32\rundll32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Monitor]

2009-11-10 09:14 443728 ----a-w- c:\program files\LeapFrog\LeapFrog Connect\Monitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nonep]

2010-09-07 22:03 211456 ----a-w- c:\program files\syst32\oops.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2010-09-07 21:59 479232 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]

2007-05-10 09:22 405504 ----a-w- c:\program files\SigmaTel\C-Major Audio\WDM\stsystra.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe"=

"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=

"c:\\Program Files\\SopCast\\SopCast.exe"=

"c:\\Program Files\\Common Files\\ProspectSoft Shared\\ASA\\Win32\\dbeng9.exe"=

"c:\\Program Files\\Kontiki\\KService.exe"=

"c:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager\\MediaManager.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

R1 RapportBuka;RapportBuka;c:\windows\system32\drivers\RapportBuka.sys [01/03/2010 22:16 390528]

R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [26/05/2010 14:35 26352]

R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [26/05/2010 14:35 493032]

R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [01/07/2010 12:07 840936]

S0 adxsvy;adxsvy;c:\windows\system32\drivers\axlcst.sys --> c:\windows\system32\drivers\axlcst.sys [?]

S0 dldm;dldm;c:\windows\system32\drivers\pgmsgog.sys --> c:\windows\system32\drivers\pgmsgog.sys [?]

S1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [01/07/2010 12:07 0]

S1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [01/07/2010 12:07 0]

S2 SSPORT;SSPORT;\??\c:\windows\system32\Drivers\SSPORT.sys --> c:\windows\system32\Drivers\SSPORT.sys [?]

S3 esgiguard;esgiguard;\??\c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys --> c:\program files\Enigma Software Group\SpyHunter\esgiguard.sys [?]

S3 s1018bus;Sony Ericsson Device 1018 driver (WDM);c:\windows\system32\drivers\s1018bus.sys [06/08/2009 11:58 90408]

S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter;c:\windows\system32\drivers\s1018mdfl.sys [06/08/2009 11:58 15016]

S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver;c:\windows\system32\drivers\s1018mdm.sys [06/08/2009 11:58 122024]

S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\s1018mgmt.sys [06/08/2009 11:59 115368]

S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS);c:\windows\system32\drivers\s1018nd5.sys [06/08/2009 11:59 25768]

S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface;c:\windows\system32\drivers\s1018obex.sys [06/08/2009 11:59 111784]

S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM);c:\windows\system32\drivers\s1018unic.sys [06/08/2009 11:59 117544]

.

Contents of the 'Scheduled Tasks' folder

2010-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2009-10-22 10:50]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.uk/

uInternet Connection Wizard,ShellNext = hxxp://downloadcenter.intel.com/detail_desc.aspx?DwnldID=8061&ProductID=1784

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

------- File Associations -------

.

scrfile="%1" %*

.

- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)

MSConfigStartUp-kdx - c:\program files\Kontiki\KHost.exe

MSConfigStartUp-Vnotuje - c:\windows\pcococ.dll

MSConfigStartUp-{4E3F9816-F833-D799-57F1-5180EB3B6E08} - c:\documents and settings\****\Application Data\Ewrahi\ubum.exe

MSConfigStartUp-{E0A2501B-F1A1-65FB-2FEA-50C8FA682158} - c:\documents and settings\****\Application Data\Axyduc\pahy.exe

AddRemove-{76E41F43-59D2-4F30-BA42-9A762EE1E8DE} - c:\program files\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-09-09 09:09

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]

"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]

@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10i_ActiveX.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]

@Denied: (A 2) (Everyone)

@="IFlashBroker4"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(5328)

c:\windows\system32\WININET.dll

c:\program files\Trusteer\Rapport\bin\rooksbas.dll

c:\windows\system32\ieframe.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\SCardSvr.exe

c:\program files\Internet Explorer\IEXPLORE.EXE

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\Kontiki\KService.exe

c:\program files\Trusteer\Rapport\bin\RapportService.exe

.

**************************************************************************

.

Completion time: 2010-09-09 09:18:31 - machine was rebooted

ComboFix-quarantined-files.txt 2010-09-09 08:18

Pre-Run: 70,225,047,552 bytes free

Post-Run: 68,866,592,768 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - EF77BA77E74D95289B32594268749D88

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Database version: 4578

Windows 5.1.2600 Service Pack 3

Internet Explorer 7.0.5730.13

09/09/2010 12:18:09

mbam-log-2010-09-09 (12-18-09).txt

Scan type: Quick scan

Objects scanned: 139837

Time elapsed: 10 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 3

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\program files\microsoft\desktoplayer.exe -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (c:\windows\system32\userinit.exe,c:\program files\intel\wireless\bin\ifrmewrksrv.exe,c:\program files\microsoft\desktoplayer.exe,) Good: (userinit.exe) -> No action taken.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Program Files\Microsoft\desktoplayer.exe (Trojan.Agent) -> No action taken.

LDTate · September 10, 2010

What anti-Virus program are you usning?

dennisl · September 12, 2010

Solo Antivirus

http://www.srnmicro.com/

LDTate · September 12, 2010

Delete this file:

C:\Program Files\Microsoft\desktoplayer.exe

Empty Recycle Bin

Reboot and "copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment.

dennisl · September 13, 2010

I removed the file but after reboot it reappeared.

When the file was deleted the comp was slow to start up, but after another restart it seems fairly normal. I tried removing with MWB but as you can see the infection keeps coming back again.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 09:46:28, on 13/09/2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.17055)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\ZoneLabs\vsmon.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Kontiki\KService.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\SRNMIC~1\SOLOSENT.EXE

C:\SRNMIC~1\SOLOCFG.EXE

C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\CheckPoint\ZAForceField\ForceField.exe

C:\Program Files\Trusteer\Rapport\bin\RapportService.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://downloadcenter.intel.com/detail_des...;ProductID=1784

R3 - URLSearchHook: ZoneAlarm Toolbar - {66f2e20d-0da8-4c11-a9c8-dd8477b88acd} - C:\Program Files\ZoneAlarm\tbZone.dll

F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe,c:\program files\intel\wireless\bin\ifrmewrksrv.exe,c:\program files\microsoft\desktoplayer.exe,,c:\program files\intel\wireless\bin\ifrmewrksrvsrv.exe