Aricou
Topic Starter
Background: I noticed that my AVG wasnt starting on boot up, along with various other programs. and I was getting an error about jkklj.exe and dropper.agent.GIT. So I googled it and found this forum, and skimmed through this thread: http://forums.whatthetech.com/Dropper_Agen…ems_t86874.html
I then ran the suggested programs CCleaner, SDFix and ComboFix, and to see if it all worked Im now going to post the log files for each and a HijackThis log from afterward. To be clear I ran ComboFix without any of the scripts, as I noted they are customized for the individual.
Thanks in advance,
Andre
CCleaner log
Adobe Photoshop 7.0
Adobe Reader 8.1.0
AIM 6
Apple Software Update
Ares 2.0.9
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AutoUpdate
AVG 7.5
Axis & Allies
CCleaner (remove only)
Creative System Information
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Download Manager 2.3.6
FLV Player 2.0, build 23
foobar2000 v0.9.4.4
Ghost Recon
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB926239)
Indeo® Software
Insurgency ( Remove only)
Insurgency Mod
Java 2 Runtime Environment, SE v1.4.2
Kaspersky Anti-Virus 6.0 SOS
Magic DVD Ripper V5.2
Max Payne
Microsoft .NET Framework 2.0
Microsoft Combat Flight Simulator 2
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Halo
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Need For Speed Hot Pursuit 2
Need for Speed™ Most Wanted PC Demo
Nero Suite
PowerDVD
PowerISO
QuickTime
Risk II
Sansa Media Converter
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Shogun - Total War - Warlord Edition
Soldat 1.3.1
Sound Blaster Audigy 2
Steam
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Valve Hammer Editor
Viewpoint Media Player
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
SDFix
SDFix: Version 1.125
Run by [removed] on Wed 01/09/2008 at 12:43 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Name:
core
Path:
system32\drivers\core.sys
core - Deleted
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting…
Normal Mode:
Checking Files:
Trojan Files Found:
C:\Documents and Settings\Andre Ricou.ANDRE\Local Settings\Temp\nsa13.tmp.exe - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\WINDOWS\mrofinu572.exe - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
Folder C:\Temp\1cb - Removed
Folder C:\Temp\bkR11 - Removed
Folder C:\WINDOWS\system32\Z1 - Removed
Removing Temp Files…
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 12:56:55
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden services & system hive …
scanning hidden registry entries …
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000093
"TracesSuccessful"=dword:00000002
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
——————
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Steam\\steamapps\\tyi2eal\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\tyi2eal\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Microsoft Games\\Halo\\HALO.EXE"="C:\\Program Files\\Microsoft Games\\Halo\\HALO.EXE:*:Enabled:Halo"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"G:\\ETC\\Soldat\\Soldat.exe"="G:\\ETC\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Program Files\\Steam\\steamapps\\tyi2eal\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\tyi2eal\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"c:\\windows\\system32\\rlvknlg.exe"="c:\\windows\\system32\\rlvknlg.exe:*:Enabled:rlvknlg.exe"
"C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe"="C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe:*:Enabled:GhostRecon"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
Remaining Files:
—————
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes:
Fri 19 Oct 2007 4,348 A.SH. — "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Fri 28 Sep 2007 0 A.SH. — "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"
Mon 10 Dec 2007 22,528 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL0005.tmp"
Mon 10 Dec 2007 20,480 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2032.tmp"
Mon 10 Dec 2007 22,528 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2677.tmp"
Mon 10 Dec 2007 25,088 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2804.tmp"
Mon 10 Dec 2007 20,480 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2827.tmp"
Finished!
ComboFix
ComboFix 08-01-09.2 - Andre Ricou 2008-01-09 13:11:16.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1798 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: and Settings\Andre Ricou.ANDRE\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\daSgo02
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\jkklj.exe
C:\WINDOWS\system32\jlkkj.ini
C:\WINDOWS\system32\jlkkj.ini2
C:\WINDOWS\system32\tusqrqq.dll
.
((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
.
2008-01-09 13:08 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 12:40 . 2008-01-09 12:40 d——– C:\WINDOWS\ERUNT
2008-01-09 01:16 . 2008-01-09 01:16 88 –ahs—- C:\WINDOWS\klif.spi
2008-01-08 22:45 . 2008-01-09 10:43 4,193,312 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-08 22:45 . 2008-01-09 10:43 58,280 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-08 22:45 . 2008-01-09 10:43 6,688 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-08 22:45 . 2008-01-09 10:43 1,700 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-08 22:41 . 2008-01-08 22:41 d——– C:\Program Files\Kaspersky Lab
2008-01-08 22:41 . 2008-01-08 22:42 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-01-08 22:40 . 2008-01-08 22:40 d——– C:\KAV
2008-01-08 22:37 . 2008-01-08 22:37 d——– C:\Program Files\CCleaner
2007-12-30 18:19 . 2007-12-30 18:19 d——– C:\Program Files\FLV Player
2007-12-30 18:12 . 2008-01-09 01:16 d——– C:\WINDOWS\system32\mr9
2007-12-30 18:12 . 2007-12-30 18:13 d——– C:\WINDOWS\system32\cc9
2007-12-30 18:12 . 2008-01-08 16:11 d——– C:\WINDOWS\system32\ardCo01
2007-12-30 18:12 . 2007-12-30 18:12 d——– C:\WINDOWS\system32\aj2
2007-12-30 18:12 . 2007-12-30 18:12 d——– C:\Temp\cEeer12
2007-12-29 12:47 . 2004-08-04 03:56 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2007-12-29 12:47 . 2004-08-04 01:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-29 12:47 . 2004-08-04 01:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-29 12:47 . 2001-08-17 22:36 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2007-12-24 23:11 . 2007-12-24 23:11 d——– C:\Program Files\Red Storm Entertainment
2007-12-23 16:19 . 2007-12-23 16:19 d——– C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Leadertech
2007-12-23 16:16 . 2007-12-23 16:16 d——– C:\Program Files\Atari
2007-12-20 10:48 . 2007-12-20 10:48 d——– C:\Program Files\Total War
2007-12-20 10:44 . 2007-12-20 10:44 d——– C:\Documents and Settings\Andre Ricou.ANDRE\WINDOWS
2007-12-18 07:58 . 2008-01-08 08:09 69 –a—— C:\WINDOWS\NeroDigital.ini
2007-12-17 09:40 . 2007-12-17 09:42 d——– C:\Program Files\Common Files\Ahead
2007-12-17 09:40 . 2007-12-17 09:40 d——– C:\Program Files\Ahead
2007-12-17 09:40 . 2004-07-20 16:24 1,568,768 ——— C:\WINDOWS\system32\ImagX7.dll
2007-12-17 09:40 . 2004-07-20 16:24 476,320 ——— C:\WINDOWS\system32\ImagXpr7.dll
2007-12-17 09:40 . 2004-07-20 16:24 471,040 ——— C:\WINDOWS\system32\ImagXRA7.dll
2007-12-17 09:40 . 2004-07-09 08:43 364,544 ——— C:\WINDOWS\system32\TwnLib4.dll
2007-12-17 09:40 . 2004-07-20 16:24 262,144 ——— C:\WINDOWS\system32\ImagXR7.dll
2007-12-17 09:40 . 2000-06-26 10:45 106,496 –a—— C:\WINDOWS\system32\TwnLib20.dll
2007-12-17 09:40 . 2001-06-26 07:15 38,912 ——— C:\WINDOWS\system32\picn20.dll
2007-12-16 11:34 . 2007-12-16 11:34 d——– C:\Program Files\Ligos
2007-12-16 11:34 . 2000-06-23 14:05 136,704 –a—— C:\WINDOWS\system32\iacenc.dll
2007-12-16 11:34 . 2000-06-22 13:09 56,320 ——— C:\WINDOWS\system32\iyvu9_32.dll
2007-12-16 11:26 . 2007-12-16 11:26 d——– C:\Program Files\Microprose
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 03:31 ——— d—–w C:\Program Files\Steam
2008-01-09 03:31 ——— d—–w C:\Program Files\QuickTime
2008-01-09 03:31 ——— d—–w C:\Program Files\PowerISO
2008-01-09 03:31 ——— d—–w C:\Program Files\Download Manager
2008-01-09 03:24 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\AVG7
2008-01-09 03:09 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\mIRC
2008-01-08 22:05 ——— d—–w C:\Program Files\mIRC
2008-01-08 22:01 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\foobar2000
2007-12-25 04:11 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-23 21:15 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-08 18:12 ——— d—–w C:\Program Files\BitTorrent
2007-12-04 05:49 ——— d—–w C:\Program Files\Viewpoint
2007-12-04 05:49 ——— d—–w C:\Program Files\AIM6
2007-12-04 05:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2007-12-04 05:48 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads
2007-12-04 05:48 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2007-12-03 21:11 0 —-a-r C:\logwmemory.bin
2007-12-02 02:55 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\CyberLink
2007-12-02 02:49 ——— d—–w C:\Program Files\CyberLink
2007-12-02 02:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
2007-11-27 03:57 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\BitTorrent
2007-11-27 03:29 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Viewpoint
2007-11-23 23:30 ——— d—–w C:\Program Files\Max Payne
2007-11-23 01:14 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\IGN_DLM
2007-11-22 00:11 ——— d—–w C:\Program Files\MagicDVDRipper
2007-11-20 12:23 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\BitTorrent DNA
2007-11-18 00:26 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-16 04:38 ——— d—–w C:\Program Files\Java
2007-11-16 04:36 ——— d—–w C:\Program Files\Common Files\Java
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 13:50 368 —-a-w C:\drmHeader.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2004-03-19 03:33 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2008-01-09 13:11 571392]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-04 14:48 145920]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-17 19:26:14]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2006-01-12 11:56]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys [2001-08-17 09:02]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 13:22:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-09 13:26:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-09 18:26:11
.
2008-01-09 15:43:15 — E O F —
HijackThis (after above)
Logfile of HijackThis v1.99.1
Scan saved at 1:42:10 PM, on 1/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1190431746937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1190431730796
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jin…indows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
I then ran the suggested programs CCleaner, SDFix and ComboFix, and to see if it all worked Im now going to post the log files for each and a HijackThis log from afterward. To be clear I ran ComboFix without any of the scripts, as I noted they are customized for the individual.
Thanks in advance,
Andre
CCleaner log
Adobe Photoshop 7.0
Adobe Reader 8.1.0
AIM 6
Apple Software Update
Ares 2.0.9
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AutoUpdate
AVG 7.5
Axis & Allies
CCleaner (remove only)
Creative System Information
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Download Manager 2.3.6
FLV Player 2.0, build 23
foobar2000 v0.9.4.4
Ghost Recon
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB926239)
Indeo® Software
Insurgency ( Remove only)
Insurgency Mod
Java 2 Runtime Environment, SE v1.4.2
Kaspersky Anti-Virus 6.0 SOS
Magic DVD Ripper V5.2
Max Payne
Microsoft .NET Framework 2.0
Microsoft Combat Flight Simulator 2
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Halo
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0
mIRC
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 Parser and SDK
Need For Speed Hot Pursuit 2
Need for Speed™ Most Wanted PC Demo
Nero Suite
PowerDVD
PowerISO
QuickTime
Risk II
Sansa Media Converter
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
Shogun - Total War - Warlord Edition
Soldat 1.3.1
Sound Blaster Audigy 2
Steam
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Valve Hammer Editor
Viewpoint Media Player
WebFldrs XP
Windows Genuine Advantage Validation Tool (KB892130)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
SDFix
SDFix: Version 1.125
Run by [removed] on Wed 01/09/2008 at 12:43 PM
Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix
Safe Mode:
Checking Services:
Name:
core
Path:
system32\drivers\core.sys
core - Deleted
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting…
Normal Mode:
Checking Files:
Trojan Files Found:
C:\Documents and Settings\Andre Ricou.ANDRE\Local Settings\Temp\nsa13.tmp.exe - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\WINDOWS\mrofinu572.exe - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
Folder C:\Temp\1cb - Removed
Folder C:\Temp\bkR11 - Removed
Folder C:\WINDOWS\system32\Z1 - Removed
Removing Temp Files…
ADS Check:
C:\WINDOWS
No streams found.
C:\WINDOWS\system32
No streams found.
C:\WINDOWS\system32\svchost.exe
No streams found.
C:\WINDOWS\system32\ntoskrnl.exe
No streams found.
Final Check:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 12:56:55
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden services & system hive …
scanning hidden registry entries …
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000093
"TracesSuccessful"=dword:00000002
scanning hidden files …
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
Remaining Services:
——————
Authorized Application Key Export:
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\mIRC\\mirc.exe"="C:\\Program Files\\mIRC\\mirc.exe:*:Enabled:mIRC"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Steam\\steamapps\\tyi2eal\\source sdk base\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\tyi2eal\\source sdk base\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Ares\\Ares.exe"="C:\\Program Files\\Ares\\Ares.exe:*:Enabled:Ares p2p for windows"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe"
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"="C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Program Files\\Microsoft Games\\Halo\\HALO.EXE"="C:\\Program Files\\Microsoft Games\\Halo\\HALO.EXE:*:Enabled:Halo"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"G:\\ETC\\Soldat\\Soldat.exe"="G:\\ETC\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Soldat\\Soldat.exe"="C:\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Program Files\\Steam\\steamapps\\tyi2eal\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\tyi2eal\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"c:\\windows\\system32\\rlvknlg.exe"="c:\\windows\\system32\\rlvknlg.exe:*:Enabled:rlvknlg.exe"
"C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe"="C:\\Program Files\\Red Storm Entertainment\\Ghost Recon\\GhostRecon.exe:*:Enabled:GhostRecon"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
Remaining Files:
—————
File Backups: - C:\SDFix\backups\backups.zip
Files with Hidden Attributes:
Fri 19 Oct 2007 4,348 A.SH. — "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Fri 28 Sep 2007 0 A.SH. — "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"
Mon 10 Dec 2007 22,528 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL0005.tmp"
Mon 10 Dec 2007 20,480 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2032.tmp"
Mon 10 Dec 2007 22,528 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2677.tmp"
Mon 10 Dec 2007 25,088 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2804.tmp"
Mon 10 Dec 2007 20,480 …H. — "C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Microsoft\Word\~WRL2827.tmp"
Finished!
ComboFix
ComboFix 08-01-09.2 - Andre Ricou 2008-01-09 13:11:16.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1798 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: and Settings\Andre Ricou.ANDRE\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\daSgo02
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\jkklj.exe
C:\WINDOWS\system32\jlkkj.ini
C:\WINDOWS\system32\jlkkj.ini2
C:\WINDOWS\system32\tusqrqq.dll
.
((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
.
2008-01-09 13:08 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 12:40 . 2008-01-09 12:40 d——– C:\WINDOWS\ERUNT
2008-01-09 01:16 . 2008-01-09 01:16 88 –ahs—- C:\WINDOWS\klif.spi
2008-01-08 22:45 . 2008-01-09 10:43 4,193,312 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-08 22:45 . 2008-01-09 10:43 58,280 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-08 22:45 . 2008-01-09 10:43 6,688 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-08 22:45 . 2008-01-09 10:43 1,700 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-08 22:41 . 2008-01-08 22:41 d——– C:\Program Files\Kaspersky Lab
2008-01-08 22:41 . 2008-01-08 22:42 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-01-08 22:40 . 2008-01-08 22:40 d——– C:\KAV
2008-01-08 22:37 . 2008-01-08 22:37 d——– C:\Program Files\CCleaner
2007-12-30 18:19 . 2007-12-30 18:19 d——– C:\Program Files\FLV Player
2007-12-30 18:12 . 2008-01-09 01:16 d——– C:\WINDOWS\system32\mr9
2007-12-30 18:12 . 2007-12-30 18:13 d——– C:\WINDOWS\system32\cc9
2007-12-30 18:12 . 2008-01-08 16:11 d——– C:\WINDOWS\system32\ardCo01
2007-12-30 18:12 . 2007-12-30 18:12 d——– C:\WINDOWS\system32\aj2
2007-12-30 18:12 . 2007-12-30 18:12 d——– C:\Temp\cEeer12
2007-12-29 12:47 . 2004-08-04 03:56 159,232 –a—— C:\WINDOWS\system32\ptpusd.dll
2007-12-29 12:47 . 2004-08-04 01:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2007-12-29 12:47 . 2004-08-04 01:58 15,104 –a–c— C:\WINDOWS\system32\dllcache\usbscan.sys
2007-12-29 12:47 . 2001-08-17 22:36 5,632 –a—— C:\WINDOWS\system32\ptpusb.dll
2007-12-24 23:11 . 2007-12-24 23:11 d——– C:\Program Files\Red Storm Entertainment
2007-12-23 16:19 . 2007-12-23 16:19 d——– C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Leadertech
2007-12-23 16:16 . 2007-12-23 16:16 d——– C:\Program Files\Atari
2007-12-20 10:48 . 2007-12-20 10:48 d——– C:\Program Files\Total War
2007-12-20 10:44 . 2007-12-20 10:44 d——– C:\Documents and Settings\Andre Ricou.ANDRE\WINDOWS
2007-12-18 07:58 . 2008-01-08 08:09 69 –a—— C:\WINDOWS\NeroDigital.ini
2007-12-17 09:40 . 2007-12-17 09:42 d——– C:\Program Files\Common Files\Ahead
2007-12-17 09:40 . 2007-12-17 09:40 d——– C:\Program Files\Ahead
2007-12-17 09:40 . 2004-07-20 16:24 1,568,768 ——— C:\WINDOWS\system32\ImagX7.dll
2007-12-17 09:40 . 2004-07-20 16:24 476,320 ——— C:\WINDOWS\system32\ImagXpr7.dll
2007-12-17 09:40 . 2004-07-20 16:24 471,040 ——— C:\WINDOWS\system32\ImagXRA7.dll
2007-12-17 09:40 . 2004-07-09 08:43 364,544 ——— C:\WINDOWS\system32\TwnLib4.dll
2007-12-17 09:40 . 2004-07-20 16:24 262,144 ——— C:\WINDOWS\system32\ImagXR7.dll
2007-12-17 09:40 . 2000-06-26 10:45 106,496 –a—— C:\WINDOWS\system32\TwnLib20.dll
2007-12-17 09:40 . 2001-06-26 07:15 38,912 ——— C:\WINDOWS\system32\picn20.dll
2007-12-16 11:34 . 2007-12-16 11:34 d——– C:\Program Files\Ligos
2007-12-16 11:34 . 2000-06-23 14:05 136,704 –a—— C:\WINDOWS\system32\iacenc.dll
2007-12-16 11:34 . 2000-06-22 13:09 56,320 ——— C:\WINDOWS\system32\iyvu9_32.dll
2007-12-16 11:26 . 2007-12-16 11:26 d——– C:\Program Files\Microprose
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 03:31 ——— d—–w C:\Program Files\Steam
2008-01-09 03:31 ——— d—–w C:\Program Files\QuickTime
2008-01-09 03:31 ——— d—–w C:\Program Files\PowerISO
2008-01-09 03:31 ——— d—–w C:\Program Files\Download Manager
2008-01-09 03:24 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\AVG7
2008-01-09 03:09 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\mIRC
2008-01-08 22:05 ——— d—–w C:\Program Files\mIRC
2008-01-08 22:01 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\foobar2000
2007-12-25 04:11 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-23 21:15 ——— d—–w C:\Program Files\Common Files\InstallShield
2007-12-08 18:12 ——— d—–w C:\Program Files\BitTorrent
2007-12-04 05:49 ——— d—–w C:\Program Files\Viewpoint
2007-12-04 05:49 ——— d—–w C:\Program Files\AIM6
2007-12-04 05:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2007-12-04 05:48 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads
2007-12-04 05:48 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL
2007-12-03 21:11 0 —-a-r C:\logwmemory.bin
2007-12-02 02:55 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\CyberLink
2007-12-02 02:49 ——— d—–w C:\Program Files\CyberLink
2007-12-02 02:49 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\CyberLink
2007-11-27 03:57 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\BitTorrent
2007-11-27 03:29 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\Viewpoint
2007-11-23 23:30 ——— d—–w C:\Program Files\Max Payne
2007-11-23 01:14 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\IGN_DLM
2007-11-22 00:11 ——— d—–w C:\Program Files\MagicDVDRipper
2007-11-20 12:23 ——— d—–w C:\Documents and Settings\Andre Ricou.ANDRE\Application Data\BitTorrent DNA
2007-11-18 00:26 ——— d—–w C:\Program Files\Common Files\Adobe
2007-11-16 04:38 ——— d—–w C:\Program Files\Java
2007-11-16 04:36 ——— d—–w C:\Program Files\Common Files\Java
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 13:50 368 —-a-w C:\drmHeader.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [2004-03-19 03:33 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" [2008-01-09 13:11 571392]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-10-04 14:48 145920]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-17 19:26:14]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"
R0 SI3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\SI3112r.sys [2006-01-12 11:56]
R3 SWUSBFLT;Microsoft SideWinder VIA Filter Driver;C:\WINDOWS\system32\DRIVERS\SWUSBFLT.sys [2001-08-17 09:02]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 13:22:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-01-09 13:26:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-09 18:26:11
.
2008-01-09 15:43:15 — E O F —
HijackThis (after above)
Logfile of HijackThis v1.99.1
Scan saved at 1:42:10 PM, on 1/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\CTHELPER.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe"
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1190431746937
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1190431730796
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.4.2) - http://javadl-esd.sun.com/update/1.4.2/jin…indows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0 SOS\avp.exe" -r (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe