ROOFIE(MTL)
Topic Starter
My Computer is not so happy right now. ESET scan reveiled this:
C:\Documents and Settings\Lucy\Local Settings\Application Data\apsdia\ppiisftav.exe - a variant of Win32/Kryptik.DBX trojan - cleaned by deleting - quarantined [1]
It also found earlier this week SPYWAREPROTECT 2009.
I have looked at my firewall logs and it has reported starting earlier this month to have on average 1-2 port scanning attacks.
These have increased since the 10th, to an average of 13 a day. (port scanning attacks)
below are the (2) logs requested and (1) attachment.
If the logs are clean let me know, because as of right now I have to peddle a lot harder to get this thing to move. If it isn't malware I am possibly loosing my HD. Backing up everything tonight.
Thanks in advance.
DDS (Ver_09-06-26.01) - NTFSx86
Run by [removed] at 23:07:32.85 on Tue 03/16/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_18
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1346 [GMT -7:00]
AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\astsrv.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\WINDOWS\Dit.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Extensis\Suitcase Fusion 2\FMCore.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Lucy\Desktop\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyServer = http=127.0.0.1:5555
uInternet Settings,ProxyOverride =
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: ContributeBHO Class: {074c1dc5-9320-4a9a-947d-c042949c6216} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
TB: Contribute Toolbar: {517bdde4-e3a7-4570-b21e-2b52b6139fc7} - c:\program files\adobe\/Adobe Contribute CS3/contributeieplugin.dll
TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [RocketDock] "c:\program files\rocketdock\RocketDock.exe"
uRun: [FMCore.exe] "c:\program files\extensis\suitcase fusion 2\FMCore.exe" -standalone
uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear
mRun: [Dit] Dit.exe
mRun: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\MSMSGS.EXE
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - d:\progra~1\micros~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - d:\progra~1\micros~1\office12\REFIEBAR.DLL
Trusted Zone: movin975.com\www
DPF: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://support.cox.com//sdccommon/download/tgctlcm.cab
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab
DPF: {62789780-B744-11D0-986B-00609731A21D} - hxxp://maricopa.gov/assessor/gis/plugin/mgaxctrl.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1228977051578
DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - hxxp://download.divx.com/player/DivXBrowserPlugin.cab
DPF: {6824D897-F7E1-4E41-B84B-B1D3FA4BF1BD} - hxxp://utilities.pcpitstop.com/Exterminate2/pcpitstopAntiVirus.dll
DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15101/CTSUEng.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1228977043406
DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} - hxxp://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {9732FB42-C321-11D1-836F-00A0C993F125} - hxxp://pcpitstop.com/mhLbl.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://ccfiles.creative.com/Web/softwareupdate/su/ocx/15110/CTPID.cab
DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} - hxxp://photos.msn.com/resources/neutral/controls/DigWebX2.cab?10,0,910,0
DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} - hxxp://utilities.pcpitstop.com/Optimize3/pcpitstop2.dll
Notify: LBTWlgn - c:\program files\common files\logitech\bluetooth\LBTWlgn.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\lucy\applic~1\mozilla\firefox\profiles\aaqa01be.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q;=
FF - prefs.js: browser.search.selectedEngine - Live Search
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.live.com/results.aspx?FORM=IEFM1&q;=
FF - component: c:\documents and settings\lucy\application data\mozilla\firefox\profiles\aaqa01be.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - component: c:\documents and settings\lucy\application data\mozilla\firefox\profiles\aaqa01be.default\extensions\{fcab6fdd-5585-425b-95c1-5ed856f3fd08}\components\nsCatcher.dll
FF - plugin: c:\documents and settings\lucy\application data\move networks\plugins\npqmp071503000010.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\quicktime\plugins\npqtplugin8.dll
FF - plugin: c:\program files\veoh networks\veohwebplayer\npWebPlayerVideoPluginATL.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
—- FIREFOX POLICIES —-
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.notify.interval - 600000
FF - user.js: content.switch.threshold - 600000
FF - user.js: nglayout.initialpaint.delay - 600
============= SERVICES / DRIVERS ===============
R2 ekrn;Eset Service;c:\program files\eset\eset smart security\ekrn.exe [2007-12-21 468224]
S3 ADASPROT;SYSTWEAKASO;\??\c:\program files\advanced system optimizer 3\adasprot32.sys –> c:\program files\advanced system optimizer 3\adasprot32.sys [?]
S3 BTCFilterService;USB Networking Driver Filter Service;c:\windows\system32\drivers\motfilt.sys [2009-12-26 6016]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2008-8-17 19160]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-12-26 19712]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-12-26 8320]
S3 Motousbnet;Motorola USB Networking Driver Service;c:\windows\system32\drivers\Motousbnet.sys [2009-12-26 24960]
S3 Ndisprot;ArcNet NDIS Protocol Driver;c:\windows\system32\drivers\ndisprot.sys [2008-11-26 27904]
S4 ASTSRV;Nalpeiron Licensing Service;c:\windows\system32\ASTSRV.EXE [2010-1-8 57344]
S4 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2008-8-17 236368]
S4 MotoConnect Service;MotoConnect Service;c:\program files\motorola\motoconnectservice\MotoConnectService.exe [2009-12-26 91392]
S4 SwitchBoard;Adobe SwitchBoard;c:\program files\common files\adobe\switchboard\SwitchBoard.exe [2008-6-11 660864]
S4 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-3-17 92008]
S4 wlidsvc;Windows Live ID Sign-in Assistant;c:\program files\common files\microsoft shared\windows live\WLIDSVC.EXE [2009-3-30 1533808]
============== File Associations ===============
regfile\shell\edit\command=%SystemRoot%\system32\NOTEPAD.EXE %1
=============== Created Last 30 ================
2010-03-16 18:19 -cd—– c:\docume~1\lucy\applic~1\Pegasys Inc
2010-03-16 16:52 -cd—– c:\program files\common files\DivX Shared
2010-03-16 14:50 –d—– C:\ConverterOutput
2010-03-16 14:49 1,761,280 a——- c:\windows\system32\ffdshow.ax
2010-03-16 14:49 262,144 a——- c:\windows\system32\TomsMoComp_ff.dll
2010-03-16 14:49 395,776 a——- c:\windows\system32\libmplayer.dll
2010-03-16 14:49 112,640 a——- c:\windows\system32\libmpeg2_ff.dll
2010-03-16 14:49 2,255,360 a——- c:\windows\system32\libavcodec.dll
2010-03-16 14:49 172,032 a——- c:\windows\system32\ac3filter.ax
2010-03-16 14:00 –d—– c:\windows\system32\wbem\Repository
2010-03-16 13:58 -cd—– c:\program files\Veoh Networks
2010-03-16 13:58 -cd—– c:\program files\DivX
2010-03-16 11:39 -cd—– c:\program files\DivX(2)
2010-03-16 11:38 –d—– c:\docume~1\alluse~1\applic~1\DivX
2010-03-15 16:32 –d—– c:\docume~1\alluse~1\applic~1\vsosdk
2010-03-15 14:47 87,608 ac—— c:\docume~1\lucy\applic~1\inst.exe
2010-03-15 14:47 47,360 ac—— c:\docume~1\lucy\applic~1\pcouffin.sys
2010-03-15 14:47 47,360 a——- c:\windows\system32\drivers\pcouffin.sys
2010-03-15 14:46 217,127 a——- c:\windows\system32\drv43260.dll
2010-03-15 14:46 208,935 a——- c:\windows\system32\drv33260.dll
2010-03-15 14:46 176,165 a——- c:\windows\system32\drv23260.dll
2010-03-15 14:46 102,439 a——- c:\windows\system32\sipr3260.dll
2010-03-15 14:46 65,602 a——- c:\windows\system32\cook3260.dll
2010-03-15 14:46 1,184,984 a——- c:\windows\system32\wvc1dmod.dll
2010-03-15 14:46 -cd—– c:\program files\VSO
2010-03-06 19:10 -cd—– c:\program files\Free Codec
2010-03-06 19:10 140,800 a–shr– c:\windows\system32\perfc009R.dll
2010-02-28 22:44 -cd—– c:\docume~1\lucy\applic~1\Mask Pro 4.0
==================== Find3M ====================
2010-02-02 11:00 85,504 a——- c:\windows\system32\ff_vfw.dll
2010-01-20 03:49 2,328,832 a——- c:\windows\system32\TUKernel.exe
2010-01-12 12:03 14,458,880 a——- c:\windows\system32\nvoglnt.dll
2010-01-12 12:03 11,632,640 a——- c:\windows\system32\nvcompiler.dll
2010-01-12 12:03 6,359,168 a——- c:\windows\system32\nv4_disp.dll
2010-01-12 12:03 4,104,192 a——- c:\windows\system32\nvcuda.dll
2010-01-12 12:03 4,077,672 a——- c:\windows\system32\nvcuvenc.dll
2010-01-12 12:03 2,283,526 a——- c:\windows\system32\nvdata.bin
2010-01-12 12:03 2,259,560 a——- c:\windows\system32\nvcuvid.dll
2010-01-12 12:03 1,081,344 a——- c:\windows\system32\nvapi.dll
2010-01-12 12:03 182,888 a——- c:\windows\system32\nvcodins.dll
2010-01-12 12:03 61,440 a——- c:\windows\system32\OpenCL.dll
2010-01-11 22:17 13,666,408 a——- c:\windows\system32\nvcpl.dll
2010-01-11 22:17 278,120 a——- c:\windows\system32\nvmccs.dll
2010-01-11 22:17 154,216 a——- c:\windows\system32\nvsvc32.exe
2010-01-11 22:17 145,000 a——- c:\windows\system32\nvcolor.exe
2010-01-11 22:17 110,696 a——- c:\windows\system32\nvmctray.dll
2010-01-11 22:17 81,920 a——- c:\windows\system32\nvwddi.dll
2009-12-21 12:14 916,480 a——- c:\windows\system32\wininet.dll
2009-12-17 17:14 411,368 a——- c:\windows\system32\deploytk.dll
============= FINISH: 23:07:48.18 ===============
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-16 23:55:24
Windows 5.1.2600 Service Pack 3
Running: pgobtyce.exe; Driver: C:\DOCUME~1\Lucy\LOCALS~1\Temp\kxtdqpob.sys
—- Devices - GMER 1.0.15 —-
AttachedDevice \FileSystem\Ntfs \Ntfs sisidex.sys (SISIDEX Driver/Windows ® 2000 DDK provider)
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (Eset Personal Firewall TDI filter/ESET)
AttachedDevice \FileSystem\Fastfat \Fat sisidex.sys (SISIDEX Driver/Windows ® 2000 DDK provider)
AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET)
—- Registry - GMER 1.0.15 —-
Reg HKLM\SYSTEM\CurrentControlSet@5 13799
—- EOF - GMER 1.0.15 —-
~CB