msconfig start up items with no name or command

hello
msconfig shows two start up items with no name or command
the location is HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

this seems suspicous to me
could i be infected?

running windows XP Pro SP3

thanks for reading my first post

-bill w

background
having never had a virus or trojan infection
i've been getting numerous trojan/virus alerts for the past year
started around 9/08 when i got pop ups prompting me for virus software
while browsing. trendmicro antivirus/antispyware detected nothing. so i in installed super antispyware which detected several trojans which were removed (see log below). since that time, i've had several other trojan detections with both programs, although i haven't noticed any problems with function. but i'm suspicious that something hasn't been removed.

9/08 superantispyware log:
Trojan.Dropper/Gen-NV
C:\WINDOWS\SYSTEM32\__C002C34C.DAT
C:\WINDOWS\SYSTEM32\__C002C34C.DAT
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\__c002C34C

Trojan.Unclassified/C00-WL
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C#Asynchronous
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C#DllName
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C#Impersonate
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C#Startup
HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINLOGON\NOTIFY\__C002C34C#Logon

Trojan.Unknown Origin
C:\DOCUMENTS AND SETTINGS\(username redacted)\LOCAL SETTINGS\TEMP\_A00F10C0D46.EXE
C:\DOCUMENTS AND SETTINGS\(username redacted)\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\ARZ5W502\I1[1].EXE

5/09 trendmicro antivirus log:
TROJ_TIBS.IW

Please update SAS and run another scan
Also do a Mbam scan




The process of cleaning your computer may require you to temporarily disable some security programs. If you are using SpyBot Search and Destroy, please refer to Note 2 at the bottom of this page.

Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note:
-- If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

Note 2:
-- MBAM may make changes to your registry as part of its disinfection routine. If you're using other security programs that detect registry changes (like Spybot's Teatimer), they may interfere with the fix or alert you after scanning with MBAM. Please disable such programs until disinfection is complete or permit them to allow the changes. To disable these programs, please view this topic: How To Temporarily Disable Your Anti-virus, Firewall And Anti-malware Programs

Thanks!
my last SAS (current version) showed what seemed like lowgrade stuff (see log)
running another now.
the MBAM log (see below) indicates that several items were found, quarantined and deleted successfully
however, the quarantine tab lists 3 objects in quarantine.
should i delete them?
(a follow up quickscan detected no malware)

-bill w

Log 1:
Malwarebytes' Anti-Malware 1.36
Database version: 2107
Windows 5.1.2600 Service Pack 3

5/11/2009 12:09:18 AM
mbam-log-2009-05-11 (00-09-18).txt

Scan type: Quick Scan
Objects scanned: 103912
Time elapsed: 9 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{bd4f7a6d-0107-4bdf-b72b-021b717b06ce} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{549b5ca7-4a86-11d7-a4df-000874180bb3} (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Log 2:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 05/09/2009 at 08:36 PM

Application Version : 4.26.1002

Core Rules Database Version : 3885
Trace Rules Database Version: 1833

Scan type : Complete Scan
Total Scan Time : 00:44:19

Memory items scanned : 431
Memory threats detected : 0
Registry items scanned : 7094
Registry threats detected : 0
File items scanned : 30303
File threats detected : 2

Adware.Tracking Cookie
C:\Documents and Settings\(name redacted)\Cookies\william_warden@statse.webtrendslive[2].txt

Trace.Known Threat Sources
C:\Documents and Settings\(name redacted)\Local Settings\Temporary Internet Files\Content.IE5\DP3LCZH2\favicon[3].ico

msconfig shows two start up items with no name or command

A blank entry in MSConfig is typically the result of an improper install/uninstall which never updated the registry "Run" keys or from a malware infection. See Why is there a blank entry in my msconfig startup entries?.

msconfig shows two start up items with no name or command

A blank entry in MSConfig is typically the result of an improper install/uninstall which never updated the registry "Run" keys or from a malware infection. See Why is there a blank entry in my msconfig startup entries?.

thanks for the reply
my concern was that the entries were from malware, hence the post here
MBAM turned up several entries in log above
after cleaning them, running a full scan with trendmicro AV and SAS
two days later MBAM is turning up new items (see log below)
despite running trend micro AV/AS and SASpro
are these overcalls
or is something constantly infecting my PC with trojans?


thanks

-bill w

ps using the link you provided it appears as though one of the blank items is related to nero cd burning software. the other is listed as default and doesn't seem to be a big deal. my concern now is repeated positive scans with MBAM.

Malwarebytes' Anti-Malware 1.36
Database version: 2107
Windows 5.1.2600 Service Pack 3

5/12/2009 1:30:22 PM
mbam-log-2009-05-12 (13-30-13).txt

Scan type: Quick Scan
Objects scanned: 104420
Time elapsed: 22 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Documents and Settings\(name redacted)\Application Data\RBXML550.dll (Trojan.Agent) -> No action taken.

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\(name redacted)\Application Data\RBMD5550.dll (Trojan.Agent) -> No action taken.
C:\Documents and Settings\(name redacted)\Application Data\RBXML550.dll (Trojan.Agent) -> No action taken.

Edited by whwiii, 12 May 2009 - 04:47 PM.

I believe that you should post a submit a HJT log


Please read the pinned topic titled "Preparation Guide For Use Before Posting A Hijackthis Log". If you cannot complete a step, then skip it and continue with the next. In Step 6 there are instructions for downloading and running DDS which will create a Pseudo HJT Report as part of its log.

When you have done that, post your log in the HijackThis Logs and Malware Removal forum, NOT here, for assistance by the HJT Team Experts. A member of the Team will walk you through, step by step, on how to clean your computer. If you post your log back in this thread, the response from the HJT Team will be delayed because your post will have to be moved. This means it will fall in line behind any others posted that same day.

Start a new topic, give it a relevant title and post your log along with a brief description of your problem, a summary of any anti-malware tools you have used and a summary of any steps that you have performed on your own. An expert will analyze your log and reply with instructions advising you what to fix. After doing this, we would appreciate if you post a link to your log back here so we know that your getting help from the HJT Team.

Please be patient. It may take a while to get a response because the HJT Team members are very busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT "bump" your post or make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond.

Hello,

Now that you have posted a log here: http://www.bleepingcomputer.com/forums/t/226539/multiple-recurrant-trojan-infections/ you should NOT make further changes to your computer (install/uninstall programs, use special fix tools, delete files, edit the registry, etc) unless advised by a HJT Team member, nor should you continue to ask for help elsewhere. Doing so can result in system changes which may not show in the log you already posted. Further, any modifications you make on your own may cause confusion for the helper assisting you and could complicate the malware removal process which would extend the time it takes to clean your computer.

From this point on the HJT Team should be the only members that you take advice from, until they have verified your log as clean.

Please be patient. It may take a while to get a response because the HJT Team members are EXTREMELY busy working logs posted before yours. They are volunteers who will help you out as soon as possible. Once you have made your post and are waiting, please DO NOT make another reply until it has been responded to by a member of the HJT Team. Generally the staff checks the forum for postings that have 0 replies as this makes it easier for them to identify those who have not been helped. If you post another response there will be 1 reply. A team member, looking for a new log to work may assume another HJT Team member is already assisting you and not open the thread to respond. Please be patient. It may take a while to get a response but your log will be reviewed and answered as soon as possible

To avoid confusion, I am closing this topic. Good luck with your log.

Orange Blossom

Edited by Orange Blossom, 13 May 2009 - 06:11 PM.
Add link. ~ OB