Jump to content


 


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.


Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Infostealer [symantec], Generic.dx [mcafee], Tspy_qqrobber.aa [trend Micro]


  • This topic is locked This topic is locked
2 replies to this topic

#1 calador

calador

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:06:36 PM

Posted 07 June 2008 - 12:02 AM

Edit: Just added Kaspersky report, and it identified the trojan as Backdoor.Win32.Delf.hoq, Trojan Horse

A trojan is pegging my CPU at 100% by spawning processes in infinite loop.

Hi I'm running MS Windows XP SP3. My computer becomes unresponsive when I log into an administrative account. If I check the task manager, several runaway processes appear taking up CPU cycles. These processes are several instances of both "notepad.exe" and "svschosts.exe". I also get error messages from vsjitdebugger.exe complaining about notepad.exe. I've done some research on the net, and I've found one web page describing the trojan:

http://www.threatexpert.com/report.aspx?ui...b3-228c914699be

The link above says that %AppData%\Key Folder\gp2007.dll is masquerading as "notepad.exe". So basically, my task manager looks like the following:

notepad.exe
notepad.exe
svcshosts.exe
notepad.exe
svcshosts.exe
svcshosts.exe
svcshosts.exe
notepad.exe
notepad.exe
vsjitdebugger.exe
notepad.exe
svcshosts.exe
notepad.exe
vsjitdebugger.exe
vsjitdebugger.exe
svcshosts.exe
notepad.exe
notepad.exe
vsjitdebugger.exe
notepad.exe

... and this list continues to grow as time passes until my computer becomes unresponsive. The only way I was able to run DSS was to run "taskkill" multiple times on notepad.exe.

Can anybody help? It sounds pretty malicious to me. So I've kept my computer disconnected from the Internet for the most part (I'm posting this from a laptop), but I did am currently running Kaspersky Online Scanner. I will post the Kaspersky log as soon as it's done. I already ran DSS. For some reason, DSS only gave me a main.txt and no extras.txt. The DSS log is below.


===


Deckard's System Scanner v20071014.68
Run by Nick on 2008-06-06 20:16:43
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Nick.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:48 PM, on 6/6/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Brother\ControlCenter2\brctrcen.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
C:\Program Files\AutoVer\AutoVer.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
C:\Program Files\MagicDisc\MagicDisc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Xfire\xfire.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Orb Networks\Orb\bin\Orb.exe
C:\WINDOWS\system32\notepad.exe
D:\TEMP\Process Explorer\procexp.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
D:\TEMP\Deckard's System Scanner\dss.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Nick.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\WINDOWS\system32\vsjitdebugger.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.netflix.com/MemberHome
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: IE Developer Toolbar BHO - {CC7E636D-39AA-49b6-B511-65413DA137A1} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [kav] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Key] C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [Key] C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector
O4 - HKCU\..\Run: [Orb] C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe
O4 - HKCU\..\Run: [XNeat Windows Manager] C:\Program Files\XNeat Windows Manager\xnViewer.exe /h
O4 - HKCU\..\Run: [AutoVer] C:\Program Files\AutoVer\AutoVer.exe
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - .DEFAULT Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (User 'Default user')
O4 - .DEFAULT Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: Status Monitor.lnk = C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: IE Developer Toolbar - {48FFE35F-36D9-44bd-A6CC-1D34414EAC0D} - C:\Program Files\Microsoft\Internet Explorer Developer Toolbar\IEDevToolbar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {82774781-8F4E-11D1-AB1C-0000F8773BF0} (DLC Class) - https://transfers.ds.microsoft.com/FTM/Tran...ransferCtrl.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/crlupdate/en/crlocx.ocx
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 15824 bytes

-- Files created between 2008-05-06 and 2008-06-06 -----------------------------

2008-06-06 19:44:32 99 --a------ C:\Documents and Settings\Tylee\notepadkill.bat
2008-06-06 19:44:29 99 --a------ C:\Documents and Settings\Nick2\notepadkill.bat
2008-06-06 15:54:15 0 d-------- C:\TEMP
2008-06-06 07:38:34 0 d-------- C:\Documents and Settings\Tylee\Application Data\FileZilla
2008-06-06 05:21:38 0 d-------- C:\Documents and Settings\Administrator\Application Data\Ahead
2008-06-06 05:21:11 0 d-------- C:\Documents and Settings\Tylee\Application Data\Ahead
2008-06-06 05:19:11 0 d-------- C:\Program Files\Trend Micro
2008-06-05 10:17:43 0 d-------- C:\Program Files\Ghostgum
2008-06-05 10:17:15 0 d-------- C:\Program Files\gs
2008-06-05 09:57:55 0 d-------- C:\Program Files\Microsoft
2008-06-04 04:05:19 0 d-------- C:\Program Files\Microsoft Virtual PC
2008-06-02 14:16:00 0 d-------- C:\Program Files\Scintilla Text Editor
2008-06-01 22:02:28 0 d-------- C:\Documents and Settings\Nick\Application Data\SmartFTP
2008-06-01 21:49:08 0 d-------- C:\Documents and Settings\Nick\Application Data\FileZilla
2008-06-01 21:45:17 0 d-------- C:\Program Files\FileZilla FTP Client
2008-06-01 18:26:53 0 d-------- C:\Program Files\AutoVer
2008-06-01 18:25:48 0 d-------- C:\Program Files\Git
2008-05-31 00:38:34 0 d-------- C:\Documents and Settings\Nick2\Application Data\Realtime Soft
2008-05-31 00:38:34 0 d-------- C:\Documents and Settings\Nick2\Application Data\Logitech
2008-05-31 00:38:31 0 d-------- C:\Documents and Settings\Nick2\Application Data\Key Folder
2008-05-31 00:38:02 0 d-------- C:\Documents and Settings\Nick2\Application Data\Identities
2008-05-31 00:37:48 0 d--h----- C:\Documents and Settings\Nick2\Templates
2008-05-31 00:37:48 0 dr------- C:\Documents and Settings\Nick2\Start Menu
2008-05-31 00:37:48 0 dr-h----- C:\Documents and Settings\Nick2\SendTo
2008-05-31 00:37:48 0 dr-h----- C:\Documents and Settings\Nick2\Recent
2008-05-31 00:37:48 0 d--h----- C:\Documents and Settings\Nick2\PrintHood
2008-05-31 00:37:48 1310720 --ah----- C:\Documents and Settings\Nick2\NTUSER.DAT
2008-05-31 00:37:48 0 d--h----- C:\Documents and Settings\Nick2\NetHood
2008-05-31 00:37:48 0 dr------- C:\Documents and Settings\Nick2\My Documents
2008-05-31 00:37:48 0 d--h----- C:\Documents and Settings\Nick2\Local Settings
2008-05-31 00:37:48 0 dr------- C:\Documents and Settings\Nick2\Favorites
2008-05-31 00:37:48 0 d-------- C:\Documents and Settings\Nick2\Desktop
2008-05-31 00:37:48 0 d--hs---- C:\Documents and Settings\Nick2\Cookies
2008-05-31 00:37:48 0 dr-h----- C:\Documents and Settings\Nick2\Application Data
2008-05-31 00:37:48 0 d---s---- C:\Documents and Settings\Nick2\Application Data\Microsoft
2008-05-30 12:11:01 0 d-------- C:\Documents and Settings\Tylee\Application Data\Realtime Soft
2008-05-29 17:48:29 0 d-------- C:\Documents and Settings\Nick\Application Data\Realtime Soft
2008-05-29 15:06:51 0 d-------- C:\ruby
2008-05-29 14:17:10 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-24 23:34:43 0 d-------- C:\Documents and Settings\All Users\Application Data\OrbNetworks
2008-05-19 16:01:41 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-05-19 16:01:41 0 d-------- C:\Documents and Settings\Nick\Application Data\Vso
2008-05-19 16:01:41 47360 --a------ C:\Documents and Settings\Nick\Application Data\pcouffin.sys <Not Verified; VSO Software; Patin couffin engine>
2008-05-19 16:01:34 0 d-------- C:\Program Files\DVDFab 5
2008-05-12 16:18:47 0 d-------- C:\Program Files\Acro Software
2008-05-12 16:18:25 0 d-------- C:\Program Files\GPLGS
2008-05-11 19:07:13 0 d-------- C:\Program Files\Photo Collage Maker
2008-05-09 20:26:04 0 d-------- C:\WINDOWS\Prefetch
2008-05-09 19:24:58 0 d-------- C:\WINDOWS\system32\scripting
2008-05-09 19:24:57 0 d-------- C:\WINDOWS\system32\bits
2008-05-09 19:24:57 0 d-------- C:\WINDOWS\l2schemas
2008-05-09 19:23:32 0 d-------- C:\WINDOWS\ServicePackFiles
2008-05-09 18:58:51 0 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-05-09 15:07:10 0 d-------- C:\WINDOWS\system32\Lang
2008-05-07 22:10:50 0 d-------- C:\WINDOWS\system32\RTCOM


-- Find3M Report ---------------------------------------------------------------

2008-06-06 20:20:30 0 d-------- C:\Documents and Settings\Nick\Application Data\Key Folder
2008-06-06 04:40:06 0 d-------- C:\Documents and Settings\Nick\Application Data\Xfire
2008-06-06 04:32:56 0 d-------- C:\Program Files\Mozilla Firefox 3 Beta 5
2008-06-06 02:44:26 0 d-------- C:\Documents and Settings\Nick\Application Data\uTorrent
2008-06-04 18:06:44 0 d-------- C:\Program Files\Common Files
2008-06-04 16:14:00 0 d-------- C:\Program Files\Xfire
2008-05-29 19:58:14 0 d-------- C:\Documents and Settings\Nick\Application Data\dvdcss
2008-05-29 14:23:56 0 d-------- C:\Program Files\mplayer
2008-05-29 14:17:37 0 d-------- C:\Program Files\QuickTime
2008-05-24 23:34:42 0 d-------- C:\Program Files\Orb Networks
2008-05-19 16:01:46 34 --a------ C:\Documents and Settings\Nick\Application Data\pcouffin.log
2008-05-19 16:01:41 1144 --a------ C:\Documents and Settings\Nick\Application Data\pcouffin.inf
2008-05-19 16:01:41 7887 --a------ C:\Documents and Settings\Nick\Application Data\pcouffin.cat
2008-05-11 18:54:12 0 d-------- C:\Program Files\MSN Messenger
2008-05-09 20:27:50 71200 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
2008-05-09 20:25:40 0 d-------- C:\Program Files\Messenger
2008-05-09 19:24:56 0 d-------- C:\Program Files\Movie Maker
2008-05-09 19:23:20 0 d-------- C:\Program Files\Windows NT
2008-05-08 16:05:16 0 d-------- C:\Program Files\Microsoft ActiveSync
2008-05-07 14:39:16 0 d-------- C:\Documents and Settings\Nick\Application Data\Adobe
2008-05-02 02:45:07 86016 --a------ C:\WINDOWS\system32\OpenAL32.dll <Not Verified; Portions Creative Labs Inc. and NVIDIA Corp.; Standard OpenAL™ Library>
2008-05-02 02:43:24 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-02 02:43:24 0 d-------- C:\Program Files\Futuremark
2008-05-02 00:18:19 0 d-------- C:\Program Files\directx
2008-05-01 22:26:15 0 d-------- C:\Program Files\NVIDIA Corporation
2008-05-01 21:18:34 8 --a------ C:\WINDOWS\system32\nvModes.dat
2008-05-01 20:37:58 1324 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-01 01:27:02 1648 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-05-01 01:11:51 0 d-------- C:\Program Files\DriverCleanerDotNET
2008-04-17 03:10:57 0 d-------- C:\Program Files\Nokia
2008-04-16 21:02:29 0 d-------- C:\Program Files\Google
2008-04-13 09:49:55 0 d-------- C:\Documents and Settings\Nick\Application Data\Mozilla
2008-04-13 04:11:01 58536 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-04-10 22:26:11 0 d-------- C:\Documents and Settings\Nick\Application Data\Apple Computer
2008-04-10 02:05:57 0 d-------- C:\Program Files\Microsoft Silverlight
2008-04-07 09:59:10 0 d-------- C:\Documents and Settings\Nick\Application Data\IrfanView
2008-04-07 09:03:00 0 d-------- C:\Program Files\uTorrent
2008-04-06 13:20:05 0 d-------- C:\Program Files\Logitech
2008-04-06 13:19:49 0 d-------- C:\Documents and Settings\Nick\Application Data\InstallShield
2008-04-06 13:19:27 0 d-------- C:\Program Files\CHM To PDF Converter
2008-04-06 13:18:53 0 d-------- C:\Program Files\TechSmith
2008-04-06 13:16:23 0 d-------- C:\Program Files\AviSynth 2.5
2008-04-06 13:15:30 0 d-------- C:\Program Files\Electronic Arts
2008-04-06 06:22:21 0 d-------- C:\Program Files\Yahoo!
2008-04-06 05:55:13 0 d-------- C:\Program Files\Handbrake
2008-04-06 05:53:29 0 d-------- C:\Program Files\Flock
2008-04-06 05:53:27 0 d-------- C:\Documents and Settings\Nick\Application Data\Flock
2008-04-06 05:51:25 0 d-------- C:\Documents and Settings\Nick\Application Data\LimeWire
2008-04-06 05:50:09 0 d-------- C:\Program Files\Opera
2008-04-06 05:49:18 0 d-------- C:\Program Files\N800 Video Convert
2008-04-06 05:47:14 0 d-------- C:\Program Files\MediaCoder
2008-04-06 05:43:39 0 d-------- C:\Program Files\Audacity


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [08/17/2006 11:32 AM C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [08/17/2006 11:32 AM C:\WINDOWS\system32\CTXFIHLP.EXE]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [03/20/2007 02:36 PM]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [05/25/2007 02:07 PM]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [12/05/2007 01:41 AM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [01/12/2006 04:40 PM]
"kav"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [03/24/2006 07:09 PM]
"@"="" []
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [04/11/2007 03:32 PM C:\WINDOWS\KHALMNPR.Exe]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 01:47 AM]
"ControlCenter2.0"="C:\Program Files\Brother\ControlCenter2\brctrcen.exe" [05/17/2005 06:42 PM]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [10/25/2007 05:37 PM]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [10/25/2007 05:33 PM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"Key"="C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe" [03/08/2008 08:12 PM]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" []
"nwiz"="nwiz.exe" [12/05/2007 01:41 AM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [12/05/2007 01:41 AM]
"RTHDCPL"="RTHDCPL.EXE" [09/22/2005 01:36 PM C:\WINDOWS\RTHDCPL.EXE]
"SoundMan"="SOUNDMAN.EXE" [09/21/2005 10:24 AM C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [09/21/2005 03:32 PM C:\WINDOWS\ALCWZRD.EXE]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 06:43 PM C:\WINDOWS\ALCMTR.EXE]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [03/28/2008 11:37 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [10/09/2006 11:28 AM]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [04/14/2008 05:42 AM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/14/2008 05:42 AM]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [11/13/2006 02:39 PM]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" []
"Key"="C:\Documents and Settings\Nick\Application Data\Key Folder\svschosts.exe" [03/08/2008 08:12 PM]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [02/13/2008 04:09 PM]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector" []
"Orb"="C:\Program Files\Orb Networks\Orb\bin\OrbTray.exe" [03/31/2008 06:54 PM]
"XNeat Windows Manager"="C:\Program Files\XNeat Windows Manager\xnViewer.exe" []
"AutoVer"="C:\Program Files\AutoVer\AutoVer.exe" [04/30/2008 11:46 AM]

C:\Documents and Settings\Nick\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 8:16:50 PM]
MagicDisc.lnk - C:\Program Files\MagicDisc\MagicDisc.exe [11/6/2007 2:28:25 PM]
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [5/13/2008 6:29:28 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe [3/20/2008 7:26:50 PM]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [10/29/2007 11:14:39 PM]
Status Monitor.lnk - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [12/16/2007 1:34:42 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ffed4b7-6f60-11dc-b496-806d6172696f}]
AutoRun\command- K:\setup.exe




-- End of Deckard's System Scanner: finished at 2008-06-06 20:22:07 ------------

Attached Files


Edited by calador, 07 June 2008 - 01:31 PM.


BC AdBot (Login to Remove)

 


#2 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:09:36 PM

Posted 03 July 2008 - 07:50 AM

Welcome to the BleepingComputer Forums. Since it has been a few days, please post a new HijackThis log. Thank you for your patience.

If you have already posted this log at another forum or if you decide to seek help at another forum, please let us know. There is a shortage of helpers and taking the time of two volunteer helpers means that someone else may not be helped.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.

#3 suebaby41

suebaby41

    W.A.M. (Women Against Malware)


  • Malware Response Team
  • 6,248 posts
  • OFFLINE
  •  
  • Gender:Female
  • Location:South Carolina, USA
  • Local time:09:36 PM

Posted 13 July 2008 - 10:03 PM

This subject is now closed. If you need this topic reopened, please contact a member of the HJT Team and we will reopen it for you. Include the address of this thread in your request. If you should have a new issue, please start a new topic. This applies only to the original topic starter. Everyone else please begin a New Topic.
You don't stop laughing when you get old; you get old when you stop laughing.
A Member of U-N-I-T-E (Unified Network of Instructors and Trained Eliminators)
Malware Removal University Masters Graduate

Posted Image
Join The Fight Against Malware
No reply within 5 days will result in your topic being closed. If you need more time, please let me know by posting in this topic so that your topic will not be closed.




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users