AriKnight
Topic Starter
Experiencing email spam issues similiar to this thread I found on the forum.
http://forums.tomcoyote.org/index.php?showtopic=73458
Yahoo is also acting sluggish, but I’m not sure if it’s the site of my PC.
RECYCLER has put itself on all partitions and it seems to generate new entries for reasons I don't understand. Ad-aware lists the entries as various usage tracks.
C:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Paging)
E:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-1003 (Local)
E:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Local)
F:\RECYCLER\S-1-5-21-343818398-179605362-725345543-500 (Data Volume)
F:\RECYCLER\S-1-5-21-343818398-179605362-725345543-1003 (Data Volume)
F:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Data Volume)
This is the most I have found out about the above:
Dillinger (THIS ACCOUNT IS NEVER USED)
SID S-1-5-21-1801674531-2025429265-839522115-1003
Disabled No
Lockout No
Password Changeable Yes
Password Age 95 Days 19:51:5263760661122694100000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1003) gid(513)
Last Logon Sun Nov 19 17:21:22 2006
Account Expires Never
HelpAssistant
SID S-1-5-21-1801674531-2025429265-839522115-1000
Description Account for Providing Remote Assistance
Full Name Remote Desktop Help Assistant Account
Disabled Yes
Lockout No
Password Changeable No
Password Age 104 Days 16:43:5263760661122755200000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1000) gid(513)
Account Expires Never
Peon
SID S-1-5-21-1801674531-2025429265-839522115-501
Disabled Yes
Lockout No
Password Changeable No
Password Age 0 Days 0:00:5263760661122694100000000000000000.000
Password Expires No
Password Required No
UID and GID uid(501) gid(513)
Account Expires Never
Saralonde (MAIN ACCOUNT USED)
SID S-1-5-21-1801674531-2025429265-839522115-500
Disabled No
Lockout No
Password Changeable Yes
Password Age 104 Days 21:50:5263760661122711400000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(500) gid(513)
Last Logon Fri Jan 05 10:54:17 2007
Account Expires Never
SUPPORT_388945a0
SID S-1-5-21-1801674531-2025429265-839522115-1002
Description This is a vendor's account for the Help and Support Service
Full Name CN=Microsoft Corporation,L=Redmond,S=Washington,C=US
Disabled Yes
Lockout No
Password Changeable No
Password Age 104 Days 16:41:5263760661122719400000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1002) gid(513)
Account Expires Never
Member Of DPC\HelpServicesGroup
SDFix found these three files:
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\ENU\RdrMsgENU.pdf
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\RdrMsgSplash.pdf
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\WebSearch\WebSearchENU.pdf
Any idea why they are password protected and are they a threat?
What are these entries?
E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
E:\775994f021d14946e586e3d4a84361bd\msxml4-KB927978-enu.log
Odd items found in E:\WINDOWS\system32
cdplayer.exe.manifest
logonui.exe.manifest
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
winoldap.mod
Ccleaner keeps saying that the file extentions are obsolete.
KazaaBegone v1.30
REGKEY: [Bullguard] HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_RECONN
REGKEY: [Bullguard] HKLM\SYSTEM\Controlset002\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\Controlset002\Enum\Root\LEGACY_RECONN
REGKEY: [Bullguard] HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RECONN
I don't have Kazaa installed on this PC nor has it ever been. I attempted to clean up these entries, but they are still showing up.
Logfile of HijackThis v1.99.1
Scan saved at 10:58:10 AM, on 1/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\ntvdm.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Documents and Settings\Administrator\Desktop\Scanner.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [pccguide.exe] "E:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [OE] "E:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
FindItNt2000
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: E:\Documents and Settings\[removed]\Desktop\Setup Files\finditnt2000xp\Find It NT-2K-XP
——- System Files in System32 Directory ——-
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/27/2006 06:07 AM dllcache
09/23/2006 08:14 PM Microsoft
0 File(s) 0 bytes
2 Dir(s) 132,014,886,912 bytes free
——- Hidden Files in System32 Directory ——-
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/27/2006 06:07 AM dllcache
12/19/2006 09:25 AM 786,432 ROCBBB.bac
12/19/2006 09:25 AM 786,432 ROCBB3.bac
12/19/2006 09:24 AM 0 ROCBC8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBC3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBC0.tmp.LOG
12/19/2006 09:24 AM 0 ROCBBB.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB0.tmp.LOG
12/19/2006 09:24 AM 0 ROCBAB.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA0.tmp.LOG
12/19/2006 09:24 AM 0 ROCB9B.tmp.LOG
12/14/2006 03:45 PM 262,144 ROCBB8.bac
12/14/2006 03:45 PM 262,144 ROCBC0.bac
12/14/2006 03:45 PM 262,144 ROCBC8.bac
10/02/2006 10:47 PM GroupPolicy
09/23/2006 08:46 PM 488 WindowsLogon.manifest
09/23/2006 08:46 PM 488 logonui.exe.manifest
09/23/2006 08:46 PM 749 cdplayer.exe.manifest
09/23/2006 08:46 PM 749 sapi.cpl.manifest
09/23/2006 08:46 PM 749 nwc.cpl.manifest
09/23/2006 08:46 PM 749 ncpa.cpl.manifest
09/23/2006 08:46 PM 749 wuaucpl.cpl.manifest
24 File(s) 2,364,017 bytes
2 Dir(s) 132,014,882,816 bytes free
———— Files Named "Guard" —————
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
—— Temp Files in System32 Directory ——
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/19/2006 08:57 AM 57,344 ROCB9B.tmp
1 File(s) 57,344 bytes
0 Dir(s) 132,014,882,816 bytes free
—————— User Agent —————-
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
————- Keys Under Notify ————-
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"Shutdown"="WLEventShutdown"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000000
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=hex(2):57,67,61,4c,6f,67,6f,6e,2e,64,6c,6c,00
"Event"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
"Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
00,00,d1,2a,46,bb,8a,01,02,4c,b2,74,d0,83,30,93,01,a6,04,00,00,00,04,00,00,\
00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,06,97,77,95,ca,ea,95,29,\
11,43,ff,54,99,77,c4,59,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,3b,\
9a,0d,2a,5f,e6,a5,55,2e,ce,df,72,bc,09,c1,5c,b0,01,00,00,71,fd,ec,08,b4,66,\
dd,a2,08,1c,4f,71,38,e4,27,51,92,11,70,25,c7,d6,b7,cb,ce,09,96,c6,df,f4,a0,\
b1,e5,1e,c1,2b,1c,1c,4f,0c,a7,b5,c8,0f,c5,87,48,75,45,32,ed,d0,2c,d4,51,2b,\
af,34,8b,60,1b,4f,ae,67,5d,df,9e,95,9c,06,80,15,a2,55,ca,fd,1a,90,3f,cd,bf,\
93,f0,c3,c2,78,23,64,ce,5c,b1,8a,11,a0,66,a8,45,1d,68,c4,95,73,71,42,d1,81,\
08,4c,4f,4e,9b,f8,43,3f,66,2c,ae,96,b8,8a,dd,49,22,19,08,73,0f,b6,53,8a,3c,\
01,97,ca,cc,e2,1e,ad,cb,f1,39,29,0f,31,1b,5e,4a,9e,53,1b,50,a6,20,a9,89,74,\
a5,be,10,fd,08,32,b2,7f,64,8e,ff,f2,4a,e9,40,e6,db,fa,9b,01,86,3e,e8,d2,d2,\
49,2b,22,80,60,af,1b,73,d7,38,3e,be,92,23,20,5c,bc,87,4d,ba,d2,b0,d4,af,b7,\
3f,32,35,2e,f1,d2,46,a9,43,09,5e,09,de,5d,c7,a7,c2,08,43,fe,57,55,f0,1f,eb,\
4f,a3,dc,b6,66,fe,aa,8c,87,16,d0,0f,49,ff,4c,92,1c,a3,44,54,46,65,41,8e,10,\
da,70,c9,88,8f,17,9e,2a,47,59,25,1b,e7,fb,29,8d,c5,4d,33,ff,78,36,e0,75,93,\
b8,70,0c,e7,2e,85,fa,bc,2e,c6,9b,28,da,4c,71,d9,a1,60,90,ad,f9,20,d4,14,d7,\
75,be,a0,fc,e4,c4,7e,88,cf,dd,bc,ac,4c,b4,c8,92,9e,dc,50,63,8b,0a,41,2e,ff,\
80,f4,9a,fe,0b,8f,7c,eb,6e,ec,39,66,af,7f,14,f3,cb,68,32,52,4d,50,19,fe,d5,\
16,cb,26,9a,6a,8d,71,2c,69,60,84,a0,b2,ba,d0,2d,3d,c3,e5,c0,0b,37,56,6b,c4,\
cb,f2,b7,2b,b2,89,1c,c4,51,b6,24,fc,05,29,77,9d,1f,1e,92,ee,97,d5,ed,b8,e8,\
85,3d,fd,9a,d0,bd,8b,5d,f7,01,b6,16,43,b1,28,19,c8,39,cc,0e,17,02,52,61,65,\
a7,14,00,00,00,ff,82,26,af,d8,3b,b8,98,8b,af,13,24,e2,f3,b1,e9,c4,2f,74,d2
————- Locate.com Results ————-
E:\WINDOWS\SYSTEM32\
rocb9b~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbab~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb3.bac Tue Dec 19 2006 9:25:08a A..H. 786,432 768.00 K
rocbb3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb8.bac Thu Dec 14 2006 3:45:26p A..H. 262,144 256.00 K
rocbb8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbbb.bac Tue Dec 19 2006 9:25:08a A..H. 786,432 768.00 K
rocbbb~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc0.bac Thu Dec 14 2006 3:45:26p A..H. 262,144 256.00 K
rocbc0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc8.bac Thu Dec 14 2006 3:45:06p A..H. 262,144 256.00 K
rocbc8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
17 items found: 17 files, 0 directories.
Total of file sizes: 2,359,296 bytes 2.25 M
——– Strings.exe Qoologic Results ——–
——— Strings.exe Aspack Results ———
E:\WINDOWS\system32\MRT.exe: (ASPack)
E:\WINDOWS\system32\MRT.exe: (AsPack2k)
E:\WINDOWS\system32\MRT.exe: (Aspack %s)
E:\WINDOWS\system32\MRT.exe: ASPack 1.61
E:\WINDOWS\system32\MRT.exe: ASPack 1.084
E:\WINDOWS\system32\MRT.exe: ASPack 1.083
E:\WINDOWS\system32\MRT.exe: ASPack 1.08.02b
E:\WINDOWS\system32\MRT.exe: ASPack 1.07b
E:\WINDOWS\system32\MRT.exe: ASPack 1.05b
E:\WINDOWS\system32\MRT.exe: ASPack 1.02
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\ntdll.dll: .aspack
————– HKLM Run Key —————-
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="\"E:\\Program Files\\Trend Micro\\Internet Security 2007\\pccguide.exe\""
RootkitRevealer
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_top 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_bottom 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_left 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_right 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC* 9/23/2006 7:47 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 9/23/2006 7:47 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\TrendMicro\PC-cillin\15\ScanInfo\LastScanFile 1/6/2007 12:34 PM 46 bytes Windows API length not consistent with raw hive data.
I hope someone can help me figure out if I have a nasty on my PC or if I'm just being paranoid.
http://forums.tomcoyote.org/index.php?showtopic=73458
Yahoo is also acting sluggish, but I’m not sure if it’s the site of my PC.
RECYCLER has put itself on all partitions and it seems to generate new entries for reasons I don't understand. Ad-aware lists the entries as various usage tracks.
C:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Paging)
E:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-1003 (Local)
E:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Local)
F:\RECYCLER\S-1-5-21-343818398-179605362-725345543-500 (Data Volume)
F:\RECYCLER\S-1-5-21-343818398-179605362-725345543-1003 (Data Volume)
F:\RECYCLER\S-1-5-21-1801674531-2025429265-839522115-500 (Data Volume)
This is the most I have found out about the above:
Dillinger (THIS ACCOUNT IS NEVER USED)
SID S-1-5-21-1801674531-2025429265-839522115-1003
Disabled No
Lockout No
Password Changeable Yes
Password Age 95 Days 19:51:5263760661122694100000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1003) gid(513)
Last Logon Sun Nov 19 17:21:22 2006
Account Expires Never
HelpAssistant
SID S-1-5-21-1801674531-2025429265-839522115-1000
Description Account for Providing Remote Assistance
Full Name Remote Desktop Help Assistant Account
Disabled Yes
Lockout No
Password Changeable No
Password Age 104 Days 16:43:5263760661122755200000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1000) gid(513)
Account Expires Never
Peon
SID S-1-5-21-1801674531-2025429265-839522115-501
Disabled Yes
Lockout No
Password Changeable No
Password Age 0 Days 0:00:5263760661122694100000000000000000.000
Password Expires No
Password Required No
UID and GID uid(501) gid(513)
Account Expires Never
Saralonde (MAIN ACCOUNT USED)
SID S-1-5-21-1801674531-2025429265-839522115-500
Disabled No
Lockout No
Password Changeable Yes
Password Age 104 Days 21:50:5263760661122711400000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(500) gid(513)
Last Logon Fri Jan 05 10:54:17 2007
Account Expires Never
SUPPORT_388945a0
SID S-1-5-21-1801674531-2025429265-839522115-1002
Description This is a vendor's account for the Help and Support Service
Full Name CN=Microsoft Corporation,L=Redmond,S=Washington,C=US
Disabled Yes
Lockout No
Password Changeable No
Password Age 104 Days 16:41:5263760661122719400000000000000000.000
Password Expires No
Password Required Yes
UID and GID uid(1002) gid(513)
Account Expires Never
Member Of DPC\HelpServicesGroup
SDFix found these three files:
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\ENU\RdrMsgENU.pdf
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\Messages\RdrMsgSplash.pdf
Password protected file E:\Program Files\Adobe\Acrobat 7.0\Reader\WebSearch\WebSearchENU.pdf
Any idea why they are password protected and are they a threat?
What are these entries?
E:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll
E:\775994f021d14946e586e3d4a84361bd\msxml4-KB927978-enu.log
Odd items found in E:\WINDOWS\system32
cdplayer.exe.manifest
logonui.exe.manifest
ncpa.cpl.manifest
nwc.cpl.manifest
sapi.cpl.manifest
WindowsLogon.manifest
wuaucpl.cpl.manifest
winoldap.mod
Ccleaner keeps saying that the file extentions are obsolete.
KazaaBegone v1.30
REGKEY: [Bullguard] HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\ControlSet001\Enum\Root\LEGACY_RECONN
REGKEY: [Bullguard] HKLM\SYSTEM\Controlset002\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\Controlset002\Enum\Root\LEGACY_RECONN
REGKEY: [Bullguard] HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_FILESPY5
REGKEY: [Bullguard] HKLM\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_RECONN
I don't have Kazaa installed on this PC nor has it ever been. I attempted to clean up these entries, but they are still showing up.
Logfile of HijackThis v1.99.1
Scan saved at 10:58:10 AM, on 1/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
E:\Program Files\iPod\bin\iPodService.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
E:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\WINDOWS\system32\ntvdm.exe
E:\WINDOWS\system32\wuauclt.exe
E:\Documents and Settings\Administrator\Desktop\Scanner.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - E:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [pccguide.exe] "E:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [OE] "E:\Program Files\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O20 - Winlogon Notify: WgaLogon - E:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Apple Computer, Inc. - E:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - E:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
FindItNt2000
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: E:\Documents and Settings\[removed]\Desktop\Setup Files\finditnt2000xp\Find It NT-2K-XP
——- System Files in System32 Directory ——-
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/27/2006 06:07 AM dllcache
09/23/2006 08:14 PM Microsoft
0 File(s) 0 bytes
2 Dir(s) 132,014,886,912 bytes free
——- Hidden Files in System32 Directory ——-
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/27/2006 06:07 AM dllcache
12/19/2006 09:25 AM 786,432 ROCBBB.bac
12/19/2006 09:25 AM 786,432 ROCBB3.bac
12/19/2006 09:24 AM 0 ROCBC8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBC3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBC0.tmp.LOG
12/19/2006 09:24 AM 0 ROCBBB.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBB0.tmp.LOG
12/19/2006 09:24 AM 0 ROCBAB.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA8.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA3.tmp.LOG
12/19/2006 09:24 AM 0 ROCBA0.tmp.LOG
12/19/2006 09:24 AM 0 ROCB9B.tmp.LOG
12/14/2006 03:45 PM 262,144 ROCBB8.bac
12/14/2006 03:45 PM 262,144 ROCBC0.bac
12/14/2006 03:45 PM 262,144 ROCBC8.bac
10/02/2006 10:47 PM GroupPolicy
09/23/2006 08:46 PM 488 WindowsLogon.manifest
09/23/2006 08:46 PM 488 logonui.exe.manifest
09/23/2006 08:46 PM 749 cdplayer.exe.manifest
09/23/2006 08:46 PM 749 sapi.cpl.manifest
09/23/2006 08:46 PM 749 nwc.cpl.manifest
09/23/2006 08:46 PM 749 ncpa.cpl.manifest
09/23/2006 08:46 PM 749 wuaucpl.cpl.manifest
24 File(s) 2,364,017 bytes
2 Dir(s) 132,014,882,816 bytes free
———— Files Named "Guard" —————
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
—— Temp Files in System32 Directory ——
Volume in drive E has no label.
Volume Serial Number is 60E1-B482
Directory of E:\WINDOWS\System32
12/19/2006 08:57 AM 57,344 ROCB9B.tmp
1 File(s) 57,344 bytes
0 Dir(s) 132,014,882,816 bytes free
—————— User Agent —————-
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
————- Keys Under Notify ————-
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
"Logon"="WLEventLogon"
"Logoff"="WLEventLogoff"
"Startup"="WLEventStartup"
"Shutdown"="WLEventShutdown"
"StartScreenSaver"="WLEventStartScreenSaver"
"StopScreenSaver"="WLEventStopScreenSaver"
"Lock"="WLEventLock"
"Unlock"="WLEventUnlock"
"StartShell"="WLEventStartShell"
"PostShell"="WLEventPostShell"
"Disconnect"="WLEventDisconnect"
"Reconnect"="WLEventReconnect"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000000
"SafeMode"=dword:00000001
"MaxWait"=dword:ffffffff
"DllName"=hex(2):57,67,61,4c,6f,67,6f,6e,2e,64,6c,6c,00
"Event"=dword:00000000
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon\Settings]
"Data"=hex:01,00,00,00,d0,8c,9d,df,01,15,d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,\
00,00,d1,2a,46,bb,8a,01,02,4c,b2,74,d0,83,30,93,01,a6,04,00,00,00,04,00,00,\
00,53,00,00,00,03,66,00,00,a8,00,00,00,10,00,00,00,06,97,77,95,ca,ea,95,29,\
11,43,ff,54,99,77,c4,59,00,00,00,00,04,80,00,00,a0,00,00,00,10,00,00,00,3b,\
9a,0d,2a,5f,e6,a5,55,2e,ce,df,72,bc,09,c1,5c,b0,01,00,00,71,fd,ec,08,b4,66,\
dd,a2,08,1c,4f,71,38,e4,27,51,92,11,70,25,c7,d6,b7,cb,ce,09,96,c6,df,f4,a0,\
b1,e5,1e,c1,2b,1c,1c,4f,0c,a7,b5,c8,0f,c5,87,48,75,45,32,ed,d0,2c,d4,51,2b,\
af,34,8b,60,1b,4f,ae,67,5d,df,9e,95,9c,06,80,15,a2,55,ca,fd,1a,90,3f,cd,bf,\
93,f0,c3,c2,78,23,64,ce,5c,b1,8a,11,a0,66,a8,45,1d,68,c4,95,73,71,42,d1,81,\
08,4c,4f,4e,9b,f8,43,3f,66,2c,ae,96,b8,8a,dd,49,22,19,08,73,0f,b6,53,8a,3c,\
01,97,ca,cc,e2,1e,ad,cb,f1,39,29,0f,31,1b,5e,4a,9e,53,1b,50,a6,20,a9,89,74,\
a5,be,10,fd,08,32,b2,7f,64,8e,ff,f2,4a,e9,40,e6,db,fa,9b,01,86,3e,e8,d2,d2,\
49,2b,22,80,60,af,1b,73,d7,38,3e,be,92,23,20,5c,bc,87,4d,ba,d2,b0,d4,af,b7,\
3f,32,35,2e,f1,d2,46,a9,43,09,5e,09,de,5d,c7,a7,c2,08,43,fe,57,55,f0,1f,eb,\
4f,a3,dc,b6,66,fe,aa,8c,87,16,d0,0f,49,ff,4c,92,1c,a3,44,54,46,65,41,8e,10,\
da,70,c9,88,8f,17,9e,2a,47,59,25,1b,e7,fb,29,8d,c5,4d,33,ff,78,36,e0,75,93,\
b8,70,0c,e7,2e,85,fa,bc,2e,c6,9b,28,da,4c,71,d9,a1,60,90,ad,f9,20,d4,14,d7,\
75,be,a0,fc,e4,c4,7e,88,cf,dd,bc,ac,4c,b4,c8,92,9e,dc,50,63,8b,0a,41,2e,ff,\
80,f4,9a,fe,0b,8f,7c,eb,6e,ec,39,66,af,7f,14,f3,cb,68,32,52,4d,50,19,fe,d5,\
16,cb,26,9a,6a,8d,71,2c,69,60,84,a0,b2,ba,d0,2d,3d,c3,e5,c0,0b,37,56,6b,c4,\
cb,f2,b7,2b,b2,89,1c,c4,51,b6,24,fc,05,29,77,9d,1f,1e,92,ee,97,d5,ed,b8,e8,\
85,3d,fd,9a,d0,bd,8b,5d,f7,01,b6,16,43,b1,28,19,c8,39,cc,0e,17,02,52,61,65,\
a7,14,00,00,00,ff,82,26,af,d8,3b,b8,98,8b,af,13,24,e2,f3,b1,e9,c4,2f,74,d2
————- Locate.com Results ————-
E:\WINDOWS\SYSTEM32\
rocb9b~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocba8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbab~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb3.bac Tue Dec 19 2006 9:25:08a A..H. 786,432 768.00 K
rocbb3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbb8.bac Thu Dec 14 2006 3:45:26p A..H. 262,144 256.00 K
rocbb8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbbb.bac Tue Dec 19 2006 9:25:08a A..H. 786,432 768.00 K
rocbbb~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc0.bac Thu Dec 14 2006 3:45:26p A..H. 262,144 256.00 K
rocbc0~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc3~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
rocbc8.bac Thu Dec 14 2006 3:45:06p A..H. 262,144 256.00 K
rocbc8~1.log Tue Dec 19 2006 9:24:44a A..H. 0 0.00 K
17 items found: 17 files, 0 directories.
Total of file sizes: 2,359,296 bytes 2.25 M
——– Strings.exe Qoologic Results ——–
——— Strings.exe Aspack Results ———
E:\WINDOWS\system32\MRT.exe: (ASPack)
E:\WINDOWS\system32\MRT.exe: (AsPack2k)
E:\WINDOWS\system32\MRT.exe: (Aspack %s)
E:\WINDOWS\system32\MRT.exe: ASPack 1.61
E:\WINDOWS\system32\MRT.exe: ASPack 1.084
E:\WINDOWS\system32\MRT.exe: ASPack 1.083
E:\WINDOWS\system32\MRT.exe: ASPack 1.08.02b
E:\WINDOWS\system32\MRT.exe: ASPack 1.07b
E:\WINDOWS\system32\MRT.exe: ASPack 1.05b
E:\WINDOWS\system32\MRT.exe: ASPack 1.02
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\MRT.exe: aspACK
E:\WINDOWS\system32\ntdll.dll: .aspack
————– HKLM Run Key —————-
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"pccguide.exe"="\"E:\\Program Files\\Trend Micro\\Internet Security 2007\\pccguide.exe\""
RootkitRevealer
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_top 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_bottom 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_left 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1801674531-2025429265-839522115-500\Software\Microsoft\Internet Explorer\PageSetup\margin_right 12/8/2006 1:00 PM 9 bytes Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC* 9/23/2006 7:47 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 9/23/2006 7:47 PM 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\TrendMicro\PC-cillin\15\ScanInfo\LastScanFile 1/6/2007 12:34 PM 46 bytes Windows API length not consistent with raw hive data.
I hope someone can help me figure out if I have a nasty on my PC or if I'm just being paranoid.
