Trojan.Agent Virtumonde.prx problems

matua105 · November 30, 2008

I can't seem to get rid of a file called liyuwuviho in my registry which is calling a nesilifo.dll. There are probably hidden files that I am not catching.

Here is HJT:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:14:30 PM, on 11/29/2008

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Symantec AntiVirus\Smc.exe

C:\Program Files\Symantec AntiVirus\SNAC.EXE

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\ActivCard\acautoreg.exe

C:\Program Files\Common Files\ActivCard\accoca.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Sun\SDK\lib\appservService.exe

C:\PROGRA~1\HPAVAD~1\avChgSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Remote tools\msraLinkMonitor.exe

C:\Sun\SDK\jdk\bin\java.exe

C:\WINDOWS\system32\PSIService.exe

C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe

C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe

C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe

C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Program Files\Symantec AntiVirus\Rtvscan.exe

C:\Program Files\UPHClean\uphclean.exe

C:\WINDOWS\system32\SearchIndexer.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Symantec AntiVirus\SmcGui.exe

C:\WINDOWS\system32\SearchProtocolHost.exe

C:\Program Files\Hewlett-Packard\PC COE\COEMsgDisplay.exe

C:\Program Files\ActivCard\ActivCard Gold\agquickp.exe

C:\Program Files\Hewlett-Packard\PC COE\IDA.EXE

C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\PROGRA~1\hpq\Shared\HPQTOA~1.EXE

C:\Program Files\Hewlett-Packard\GetIT\GetIT.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Common Files\Sonic Shared\CineTray.exe

C:\Program Files\Windows Desktop Search\WindowsSearch.exe

C:\Sun\SDK\jdk\bin\javaw.exe

C:\Program Files\Symantec AntiVirus\SymCorpUI.exe

C:\Program Files\Symantec AntiVirus\SavUI.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://*.compaq.com

O15 - Trusted Zone: *.cpqcorp.net

O15 - Trusted Zone: http://*.dcu.org

O15 - Trusted Zone: http://*.dec.com

O15 - Trusted Zone: *.hp.com

O15 - Trusted Zone: http://*.hpe-learning.com

O15 - Trusted Zone: *.hpqcorp.net

O15 - Trusted Zone: *.hpshopping.com

O15 - Trusted Zone: http://*.listen.com

O15 - Trusted Zone: http://*.llnwd.net

O15 - Trusted Zone: *.real.com

O15 - Trusted Zone: http://*.skillport.com

O15 - Trusted Zone: http://*.skillsoft.com

O15 - Trusted Zone: http://*.tandem.com

O15 - Trusted Zone: http://ie.config.asia.compaq.com (HKLM)

O15 - Trusted Zone: http://ie.config.eur.compaq.com (HKLM)

O15 - Trusted Zone: http://ie.config.im.hou.compaq.com (HKLM)

O15 - Trusted Zone: http://ie.config.jp.compaq.com (HKLM)

O15 - Trusted Zone: http://ie.config.ecom.dec.com (HKLM)

O15 - Trusted Zone: http://ie.config.tandem.com (HKLM)

O16 - DPF: {00000014-9593-4264-8B29-930B3E4EDCCD} - https://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall14.cab

O16 - DPF: {00000021-9593-4264-8B29-930B3E4EDCCD} - https://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall21.cab

O16 - DPF: {00000030-9593-4264-8B29-930B3E4EDCCD} - https://test.rooms.hp.com/vRoom_Cab/WebHPVCInstall30.cab

O16 - DPF: {00000032-9593-4264-8B29-930B3E4EDCCD} (HPVirtualRooms32 Class) - https://www.rooms.hp.com/vRoom_Cab/WebHPVCInstall32.cab

O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPITWeb/Customer...DataManager.CAB

O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cab

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab

O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqcpqdktp/downloads/sysinfo.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1199561706073

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1220563491695

O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab

O16 - DPF: {857ABA85-8AB2-4C9E-8FAA-D2A963739859} (HPPKI Control) - https://digitalbadge.external.hp.com/hp/HPPKI.cab

O16 - DPF: {A996E48C-D3DC-4244-89F7-AFA33EC60679} (Settings Class) - https://digitalbadge.external.hp.com/hp/capicom.cab

O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://66.193.150.85/activex/AMC.cab

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net

O17 - HKLM\Software\..\Telephony: DomainName = americas.hpqcorp.net

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = americas.cpqcorp.net

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = AMERICAS.cpqcorp.net,AMERICAS.hpqcorp.net,hpqcorp.net,cpqcorp.net

O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll

O20 - AppInit_DLLs: C:\WINDOWS\system32\yifiroso.dll

O23 - Service: ActivCard Gold Autoregister (acautoreg) - ActivIdentity - C:\Program Files\Common Files\ActivCard\acautoreg.exe

O23 - Service: ActivCard Gold service (Accoca) - ActivCard - C:\Program Files\Common Files\ActivCard\accoca.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: SunJavaSystemAppserver9PE (AppServer9PE) - Unknown owner - C:\Sun\SDK\lib\appservService.exe

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: HP-AV Change Monitor Service (AvChgSvc) - Unknown owner - C:\PROGRA~1\HPAVAD~1\avChgSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: Lan Discover Agent (magaService) - Unknown owner - C:\Program Files\Sygate\SSA\maga\maga.exe (file missing)

O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe

O23 - Service: MSRA Link Monitor (msralinkmonitor) - Unknown owner - C:\Program Files\Remote tools\msraLinkMonitor.exe

O23 - Service: PictureTaker - LANovation - C:\WINDOWS\system32\PCTKRNT.SYS

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: HP OVCM Notify Daemon (radexecd) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\radexecd.exe

O23 - Service: HP OVCM Scheduler Daemon (radsched) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\radsched.exe

O23 - Service: HP OVCM MSI Redirector (Radstgms) - Hewlett-Packard - C:\Program Files\Hewlett-Packard\PC COE 3\OV CMS\Radstgms.exe

O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Smc.exe

O23 - Service: Symantec Network Access Control (SNAC) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\SNAC.EXE

O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

--

End of file - 16584 bytes

Panda Active Scan:

;*******************************************************************************

********************************************************************************

*

*******************

ANALYSIS: 2008-11-29 15:42:04

PROTECTIONS: 1

MALWARE: 55

SUSPECTS: 1

;*******************************************************************************

********************************************************************************

*

*******************

PROTECTIONS

Description Version Active Updated

;===============================================================================

================================================================================

=

===================

Windows Defender 1.1.3903.0 No No

;===============================================================================

================================================================================

=

===================

MALWARE

Id Description Type Active Severity Disinfectable Disinfected Location

;===============================================================================

================================================================================

=

===================

00041904 adware/sidesearch Adware No 0 Yes No hkey_classes_root\sep.av.scandlgs

00041904 adware/sidesearch Adware No 0 Yes No hkey_local_machine\software\classes\sep.av.scandlgs

00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@trafficmp[1].txt

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@casalemedia[1].txt

00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@casalemedia[1].txt

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@doubleclick[1].txt

00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@doubleclick[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@atdmt[2].txt

00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@atdmt[1].txt

00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@247realmedia[2].txt

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@fastclick[1].txt

00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@fastclick[2].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@tribalfusion[1].txt

00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@tribalfusion[1].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@mediaplex[1].txt

00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@mediaplex[2].txt

00159564 Cookie/WUpd TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@revenue[2].txt

00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@www.myaffiliateprogram[1].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@com[2].txt

00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@com[1].txt

00167704 Cookie/Xiti TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@xiti[1].txt

00167747 Cookie/Azjmp TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@azjmp[2].txt

00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@statcounter[1].txt

00167795 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@club.cdfreaks[2].txt

00168048 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@perf.overture[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@ad.yieldmanager[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@ad.yieldmanager[1].txt

00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@ad.yieldmanager[2].txt

00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@apmebf[1].txt

00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@burstnet[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@serving-sys[1].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@serving-sys[5].txt

00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@serving-sys[2].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@bs.serving-sys[1].txt

00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@bs.serving-sys[2].txt

00168097 Cookie/BurstBeacon TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@www.burstbeacon[1].txt

00168105 Cookie/Cd Freaks TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@cdfreaks[2].txt

00168109 Cookie/Adtech TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@adtech[1].txt

00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@server.iad.liveperson[1].txt

00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@stat.onestat[2].txt

00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@advertising[2].txt

00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@media.adrevolver[2].txt

00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@statse.webtrendslive[2].txt

00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@ads.pointroll[2].txt

00170549 Cookie/FortuneCity TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@fortunecity[2].txt

00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@overture[1].txt

00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@realmedia[2].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@questionmarket[2].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@questionmarket[1].txt

00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@questionmarket[1].txt

00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@zedo[2].txt

00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@bluestreak[1].txt

00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@adrevolver[1].txt

00187950 Cookie/bravenetA TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@bravenet[1].txt

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\NetworkService\Cookies\system@go[1].txt

00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@go[1].txt

00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@searchportal.information[1].txt

00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@target[1].txt

00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\hpadmin\Cookies\hpadmin@did-it[1].txt

00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@did-it[2].txt

00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@atwola[2].txt

00273339 Cookie/Smartadserver TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@smartadserver[1].txt

00286732 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@www3.addfreestats[2].txt

00286736 Cookie/Cgi-bin TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@www6.addfreestats[1].txt

00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@ads.addynamix[1].txt

00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@citi.bridgetrack[1].txt

00444270 Adware/InternetSpeedMonitor Adware No 0 No No C:\Program Files\Common Files\Real\Update_OB\020a57bd.exe[iCheck.exe]

01196325 Cookie/Enhance TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@enhance[1].txt

01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\unpingco\Cookies\unpingco@adserver.easyad[2].txt

02897073 Cookie/Revenue TrackingCookie No 0 Yes No C:\WINDOWS\Temp\Cookies\unpingco@adsrevenue[1].txt

02900551 Application/ProductKeyExplorer HackTools No 0 Yes No C:\Program Files\VisualStudio2005\productkeyexplorer_setup.exe

03839851 Trj/Downloader.MDW Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{40A9C770-9957-4CD1-8CA8-2B0B29CCF829}\RP378\A0087300.sys

;===============================================================================

================================================================================

=

===================

SUSPECTS

Sent Location ȕ

;===============================================================================

================================================================================

=

===================

No C:\Program Files\Common Files\Real\Update_OB\020a57bd.exe[GetModule20.exe] ȕ

;===============================================================================

================================================================================

=

===================

VULNERABILITIES

Id Severity Description ȕ

;===============================================================================

================================================================================

=

===================

;===============================================================================

================================================================================

=

===================

MBAM:

Malwarebytes' Anti-Malware 1.30

Database version: 1435

Windows 5.1.2600 Service Pack 3

11/29/2008 2:45:08 PM

mbam-log-2008-11-29 (14-44-54).txt

Scan type: Quick Scan

Objects scanned: 61698

Time elapsed: 9 minute(s), 25 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liyuwuviho (Trojan.Agent) -> No action taken.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

SPYBOT S&D:

--- Search result list ---

Hint of the Day: Click the bar at the right of this to see more information! ()

Microsoft.Windows.Security.InternetExplorer: [sBI $A3433CBF] Settings (Registry change, nothing done)

HKEY_USERS\S-1-5-21-839522115-1383384898-515967899-1351697\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe

Microsoft.WindowsSecurityCenter.FirewallBypass: [sBI $D80580B5] Settings (Registry value, nothing done)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\explorer.exe

Microsoft.WindowsSecurityCenter.FirewallBypass: [sBI $B067B5B7] Settings (Registry value, nothing done)

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\WINDOWS\explorer.exe

Virtumonde.prx: [sBI $3F5CA9DA] Autorun settings (liyuwuviho) (Registry value, nothing done)

HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liyuwuviho

Virtumonde.prx: [sBI $3F5CA9DA] Autorun settings (liyuwuviho) (Registry value, nothing done)

HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liyuwuviho

Virtumonde.prx: [sBI $3F5CA9DA] Autorun settings (liyuwuviho) (Registry value, nothing done)

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\liyuwuviho

AdRevolver: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

Omniture: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

Omniture: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

CasaleMedia: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

CoreMetrics: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

DoubleClick: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

AdRevolver: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

FastClick: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

Zedo: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

MediaPlex: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

AdRevolver: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

Right Media: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

MediaPlex: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

BurstMedia: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

AdRevolver: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

WebTrends live: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

BurstMedia: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

DoubleClick: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

Statcounter: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

DoubleClick: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

BlueStreak: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

HitBox: Tracking cookie (Internet Explorer: unpingco) (Cookie, nothing done)

DoubleClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

CasaleMedia: Tracking cookie (Firefox: default) (Cookie, nothing done)

AdRevolver: Tracking cookie (Firefox: default) (Cookie, nothing done)

MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)

WebTrends live: Tracking cookie (Firefox: default) (Cookie, nothing done)

CoreMetrics: Tracking cookie (Firefox: default) (Cookie, nothing done)

AdRevolver: Tracking cookie (Firefox: default) (Cookie, nothing done)

DoubleClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

CasaleMedia: Tracking cookie (Firefox: default) (Cookie, nothing done)

HitBox: Tracking cookie (Firefox: default) (Cookie, nothing done)

FastClick: Tracking cookie (Firefox: default) (Cookie, nothing done)

MediaPlex: Tracking cookie (Firefox: default) (Cookie, nothing done)

Statcounter: Tracking cookie (Firefox: default) (Cookie, nothing done)

Zedo: Tracking cookie (Firefox: default) (Cookie, nothing done)

AdRevolver: Tracking cookie (Firefox: default) (Cookie, nothing done)

Zedo: Tracking cookie (Firefox: default) (Cookie, nothing done)

BlueStreak: Tracking cookie (Firefox: default) (Cookie, nothing done)