|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| Resolved HJT Threads Resolved spyware and popup issues. |
|
|
LinkBack | Thread Tools |
04-12-2009, 02:51 PM
|
#1 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
flipboi15 thread
hey guys, i have ESET NOD32 and it detects a virus that is called "win32/agent.odg" in system memory i think, it redirects me to different websites when i use google. my logs are attached, any help would be greatly appreciated.
=======DDS SCAN ======== DDS (Ver_09-03-16.01) - NTFSx86 Run by user at 13:41:55.62 on Sun 04/12/2009 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_12 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.459 [GMT -7:00] AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\Ati2evxx.exe svchost.exe C:\WINDOWS\Explorer.EXE svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\Program Files\Analog Devices\SoundMAX\smax4.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe C:\WINDOWS\System32\svchost.exe -k HTTPFilter C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Java\jre6\bin\jucheck.exe C:\Documents and Settings\user\Desktop\gmer.exe C:\Documents and Settings\user\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Settings,ProxyServer = 202.115.130.23:8080 uInternet Settings,ProxyOverride = *.local BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar3.dll TB: Veoh Browser Plug-in: {d0943516-5076-4020-a3b5-aefaf26ab263} - c:\program files\veoh networks\veoh\plugins\reg\VeohToolbar.dll TB: {724D43A0-0D85-11D4-9908-00400523E39A} - No File TB: {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - No File TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File uRun: [msnmsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe uRun: [ISUSPM] "c:\program files\common files\installshield\updateservice\ISUSPM.exe" -scheduler uRun: [nodenable] c:\program files\eset\nodenable.exe /s mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName mRun: [ATICCC] "c:\program files\ati technologies\ati.ace\CLIStart.exe" mRun: [SoundMAXPnP] c:\program files\analog devices\soundmax\SMax4PNP.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [SoundMax] "c:\program files\analog devices\soundmax\smax4.exe" /tray mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice mRun: [NodLogin] c:\program files\eset\eset nod32 antivirus\nodlogin.exe dRun: [Nokia.PCSync] c:\program files\nokia\nokia pc suite 6\PcSync2.exe /NoDialog IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {00000055-9980-0010-8000-00AA00389B71} - hxxp://codecs.microsoft.com/codecs/i386/fhg.CAB DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} - hxxp://www.kaspersky.com/kos/english/kavwebscan_unicode.cab DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} - hxxp://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab DPF: {48884C41-EFAC-433D-958A-9FADAC41408E} - hxxps://www.e-games.com.my/com/EGamesPlugin.cab DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} - hxxp://messenger.zone.msn.com/binary/SolitaireShowdown.cab56986.cab DPF: {5D6F45B3-9043-443D-A792-115447494D24} - hxxp://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1199579636421 DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} - hxxp://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} - hxxp://acs.pandasoftware.com/activescan/as5free/asinst.cab DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} - hxxp://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab TCP: {B4CE450E-4BEF-4918-9B2D-B7B96E99E2C6} = 208.67.222.222,208.67.220.220 Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\user\applic~1\mozilla\firefox\profiles\83g36ng6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/webhp?rls=ig FF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\veoh networks\veoh\plugins\noreg\NPVeohVersion.dll ============= SERVICES / DRIVERS =============== R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336] R1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2008-11-28 33824] R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720] R2 procguard;procguard;c:\windows\system32\drivers\procguard.sys [2007-2-4 26688] R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2008-9-7 23064] S2 DCSPGSRV;DiamondCS ProcessGuard Service v3.410;"c:\program files\processguard\dcsuserprot.exe" --> c:\program files\processguard\dcsuserprot.exe [?] S3 CEDRIVER53;CEDRIVER53;\??\c:\program files\cheat engine\dbk32.sys --> c:\program files\cheat engine\dbk32.sys [?] S3 DADriv1;DADriv1;\??\c:\documents and settings\user\desktop\daengine\dak32.sys --> c:\documents and settings\user\desktop\daengine\DAK32.sys [?] S3 geebers12;geebers12;\??\c:\documents and settings\user\desktop\vicious engine 5.0\nvid888.sys --> c:\documents and settings\user\desktop\vicious engine 5.0\nvid888.sys [?] S3 IlvMoneyDRIVER53;IlvMoneyDRIVER53;\??\c:\documents and settings\user\desktop\akash's v.46 hackpack\ilvmoney1083.sys --> c:\documents and settings\user\desktop\akash's v.46 hackpack\IlvMoney1083.sys [?] S3 MzBot.sys;MzBot.sys;c:\windows\system32\MzBot.sys [2007-4-1 3584] S3 白目國中生1;白目國中生1;\??\c:\documents and settings\user\desktop\ve5 1032\nvid999.sys --> c:\documents and settings\user\desktop\ve5 1032\nvid999.sys [?] S3 Networktemple01;Networktemple01;\??\c:\documents and settings\user\my documents\nt 11.3\networktemple.sys --> c:\documents and settings\user\my documents\nt 11.3\Networktemple.sys [?] S3 phun1;phun1;\??\c:\documents and settings\user\my documents\hax0r\ugkit.sys --> c:\documents and settings\user\my documents\hax0r\ugkit.sys [?] S3 Revolution1;Revolution1;\??\c:\documents and settings\user\desktop\rev\shak3.sys --> c:\documents and settings\user\desktop\rev\SHAK3.sys [?] S3 saruen;saruen;\??\c:\akumaengine33\applications\sg\saruen.sys --> c:\akumaengine33\applications\sg\saruen.sys [?] S3 saruenGang;saruenGang;\??\c:\documents and settings\user\my documents\bypassing msbot\saruengang.sys --> c:\documents and settings\user\my documents\bypassing msbot\saruenGang.sys [?] S3 sejt1;sejt1;\??\c:\akumaengine33\sejt.sys --> c:\akumaengine33\sejt.sys [?] S3 SHAK31;SHAK31;\??\c:\documents and settings\user\desktop\re 4.2\shak3.sys --> c:\documents and settings\user\desktop\re 4.2\SHAK3.sys [?] S3 SoRa01;SoRa01;\??\c:\documents and settings\user\desktop\haxingkoekjehack pack\engine\sora remak engine 2.6\sora.sys --> c:\documents and settings\user\desktop\haxingkoekjehack pack\engine\sora remak engine 2.6\SoRa.sys [?] S3 sys_com001;sys_com001;\??\c:\documents and settings\user\desktop\syscomengine_1059\syscom.sys --> c:\documents and settings\user\desktop\syscomengine_1059\syscom.sys [?] ============== File Associations =============== regfile=regedit.exe "%1" %* =============== Created Last 30 ================ 2009-04-10 19:09 155 a------- c:\windows\system32\SelfDel.bat 2009-04-10 19:09 84,045 a------- c:\windows\system32\ftp_non_crp.exe 2009-04-10 18:54 109,010 a------- c:\windows\system32\drivers\d30ece49.sys 2009-04-10 18:38 <DIR> --d----- c:\program files\I-Doser 2009-03-30 00:13 <DIR> --d----- c:\program files\iPhone Tunnel Suite 2009-03-18 12:44 <DIR> --d----- c:\program files\ESET 2009-03-18 12:35 124,688 a------- c:\windows\system32\MSWINSCK.OCX 2009-03-17 19:32 <DIR> --d----- c:\docume~1\user\applic~1\TortoiseSVN 2009-03-17 19:30 <DIR> --d----- c:\docume~1\user\applic~1\Subversion 2009-03-17 19:21 <DIR> --d----- c:\program files\TortoiseSVN 2009-03-17 19:21 <DIR> --d----- c:\program files\common files\TortoiseOverlays 2009-03-16 12:17 320 a------- c:\windows\WPE PRO.INI 2009-03-15 09:42 <DIR> --d----- c:\program files\Gravity 2009-03-15 09:36 <DIR> --d----- c:\windows\XileROFull 2009-03-15 09:36 <DIR> --d----- c:\program files\Uninstall ==================== Find3M ==================== 2009-02-10 23:17 410,984 a------- c:\windows\system32\deploytk.dll 2008-07-10 09:37 1,175,552 a------- c:\documents and settings\user\iTunesMobileDevice.dll 2008-06-06 20:37 68,608 a------- c:\documents and settings\user\iphone_tunnel.exe 2008-01-28 09:08 91 a------- c:\documents and settings\user\fix.reg 2007-01-10 14:19 24,192 a------- c:\documents and settings\user\usbsermptxp.sys 2007-01-10 14:19 22,768 a------- c:\documents and settings\user\usbsermpt.sys 2006-05-03 03:06 163,328 a--shr-- c:\windows\system32\flvDX.dll 2007-02-21 04:47 31,232 a--shr-- c:\windows\system32\msfDX.dll 2007-12-17 06:43 27,648 a--sh--- c:\windows\system32\Smab0.dll ============= FINISH: 13:42:26.89 =============== please guys, im in dire of help .. |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
04-15-2009, 08:23 AM
|
#2 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Hello and Welcome to TSF.
Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed. ------------------------------------------------------ Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate. Please stay with me until given the 'all clear' even if symptoms seemingly abate. Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper. ------------------------------------------------------ Your hard drive is almost full. Having too little free space on your hard drive can compromise system performance. Quote:
------------------------------------------------------ Please visit this webpage for download links, and instructions for running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix * Ensure you have disabled all antivirus and antimalware programs so they do not interfere with the running of ComboFix. Get help here Please post the C:\ComboFix.txt in your next reply for further review. ------------------------------------------------------ |
|
|
|
|
|
04-18-2009, 07:26 PM
|
#3 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Due to lack of response, this topic will now be closed. If you need continued support, please begin a new thread, and provide a link to this topic. This applies only to the original topic starter. Everyone else please begin a New Topic, after following the steps outlined here:
IMPORTANT - Read This Before Posting For Malware Removal Help ------------------------------------------------------ |
|
|
|
|
04-20-2009, 12:10 AM
|
#4 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
continued support
hey i would please like to re-open this thread as i was away for a while, thanks.
http://www.techsupportforum.com/secu...ml#post2077462 also this was my combo fix result. ComboFix 09-04-20.02 - user 04/19/2009 23:04.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.655 [GMT -7:00] Running from: c:\documents and settings\user\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) * Resident AV is active . /wow section not completed ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ovfsthsdyhkbgcoaiwvlpencpvnhmwoudvioei ------- Sigcheck ------- [-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2gdr\tcpip.sys [-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2qfe\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\dllcache\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\drivers\TCPIP.SYS . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-11 148888] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^hamachi.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^iPhoneRingToneMaker.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\iPhoneRingToneMaker.lnk backup=c:\windows\pss\iPhoneRingToneMaker.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Xfire.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Xfire.lnk backup=c:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "avast!"=c:\progra~1\ALWILS~1\Avast4\ashDisp.exe "RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16882:TCP"= 16882:TCP:BitComet 16882 TCP "16882:UDP"= 16882:UDP:BitComet 16882 UDP "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundTimestampRequest"= 1 (0x1) "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) "AllowOutboundDestinationUnreachable"= 1 (0x1) "AllowOutboundSourceQuench"= 1 (0x1) "AllowOutboundParameterProblem"= 1 (0x1) "AllowOutboundTimeExceeded"= 1 (0x1) "AllowRedirect"= 1 (0x1) "AllowOutboundPacketTooBig"= 1 (0x1) R2 DCSPGSRV;DiamondCS ProcessGuard Service v3.410; [x] R3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [2007-12-27 35840] R3 DADriv1;DADriv1; [x] R3 geebers12;geebers12; [x] R3 IlvMoneyDRIVER53;IlvMoneyDRIVER53; [x] R3 MzBot.sys;MzBot.sys;c:\windows\system32\MzBot.sys [2007-04-01 3584] R3 白目國中生1;白目國中生1; [x] R3 phun1;phun1; [x] R3 Revolution1;Revolution1; [x] R3 saruen;saruen; [x] R3 saruenGang;saruenGang; [x] R3 sejt1;sejt1; [x] R3 SHAK31;SHAK31; [x] R3 SoRa01;SoRa01; [x] R3 sys_com001;sys_com001; [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208] S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336] S1 oreans32;oreans32;c:\windows\system32\drivers\oreans32.sys [2008-11-28 33824] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720] S2 procguard;procguard;c:\windows\system32\drivers\procguard.sys [2006-08-09 26688] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2008-11-22 23064] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04F9B72B-5ABA-8512-0200-070002040608}] c:\windows\system32\drvr.exe . Contents of the 'Scheduled Tasks' folder 2009-04-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Settings,ProxyServer = socks= IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {B4CE450E-4BEF-4918-9B2D-B7B96E99E2C6} = 64.59.144.90,64.59.144.91 FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\83g36ng6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/webhp?rls=ig FF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-19 23:05 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\d30ece49] "ImagePath"="\SystemRoot\System32\drivers\d30ece49.sys" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\s-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9595C0C7-A69A-D3E5-218F-7C3B7881AA2B}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iambbelelimbdlpomj"=hex:6a,61,61,64,6e,64,70,6c,62,6e,70,6f,62,62,69,68,6f,64, 67,66,00,00 "hagdcnhiffdflcbe"=hex:69,61,6f,63,69,66,6b,68,69,64,62,66,6a,6e,66,6b,6a,65, 00,00 [HKEY_USERS\s-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A050F2A7-E38B-6983-8B61-868F7ED85AE2}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "abjidabokcegchcjoihbfgffahjcknboci"=hex:61,61,00,a7 "maiiaapmipiimllpplpbgcljob"=hex:61,61,00,a7 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\|"|閩w*] "AB141C35E9F4BF344B9FC010BB17F68A"="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(808) c:\windows\system32\Ati2evxx.dll . Completion time: 2009-04-20 23:07 ComboFix-quarantined-files.txt 2009-04-20 06:06 Pre-Run: 10,243,821,568 bytes free Post-Run: 10,231,095,296 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 208 |
|
|
|
|
04-20-2009, 06:34 AM
|
#7 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Hello again, flipboi15.
Delete ComboFix.exe from your desktop. Download ComboFix and save it to your desktop. Please disable NOD32 and double-click ComboFix.exe to run it again. Please post the ComboFix.txt log in your next reply. ------------------------------------------------------ Go to Start > Run and copy/paste the following into the Run box and click OK: C:\QooBox\ComboFix-quarantined-files.txt A text file should open. Please post the contents of that file in your next reply. ------------------------------------------------------ |
|
|
|
|
04-20-2009, 05:37 PM
|
#8 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
Re: win32/agent.odg
ComboFix 09-04-21.06 - user 04/20/2009 15:05.10 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.542 [GMT -7:00] Running from: c:\documents and settings\user\Desktop\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\tmp.reg . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ILVMONEYDRIVER53 -------\Legacy_NPF -------\Legacy_OREANS32 -------\Service_IlvMoneyDRIVER53 -------\Service_oreans32 ((((((((((((((((((((((((( Files Created from 2009-03-20 to 2009-04-20 ))))))))))))))))))))))))))))))) . 2009-04-20 05:51 . 2009-04-20 06:15 -------- d-----w c:\program files\Hide IP Platinum 2009-04-20 05:43 . 2009-04-20 05:43 -------- d-----w c:\windows\LastGood.Tmp 2009-04-20 05:39 . 2009-04-20 05:51 -------- d-----w c:\documents and settings\user\Application Data\HideIP 2009-04-19 16:21 . 2009-01-22 09:40 163840 ----a-w c:\windows\system32\SecureNet.dll 2009-04-19 16:21 . 2008-11-03 12:45 204800 ----a-w c:\windows\system32\ssleay32.dll 2009-04-19 16:21 . 2008-11-03 12:45 1126400 ----a-w c:\windows\system32\libeay32.dll 2009-04-19 05:14 . 2009-04-20 05:51 32 ----a-w c:\windows\go 2009-04-19 00:30 . 2009-04-19 00:30 -------- d-----w c:\documents and settings\user\Application Data\Ufasoft 2009-04-19 00:29 . 2009-04-19 00:29 -------- d-----w c:\program files\Ufasoft 2009-04-17 23:21 . 2009-04-17 23:37 110592 ----a-w c:\windows\system32\winsetup66.exe 2009-04-16 13:34 . 2009-04-16 15:35 20480 ----a-w c:\windows\system32\ak1.exe 2009-04-16 05:38 . 2007-12-27 00:30 679936 ----a-w c:\windows\system32\D3DX81ab.dll 2009-04-16 05:38 . 2007-12-27 00:30 1970176 ----a-w c:\windows\system32\d3dx9.dll 2009-04-16 05:38 . 2009-04-16 05:38 -------- d-----w c:\program files\Cheat Engine 2009-04-16 01:08 . 2009-04-16 01:08 -------- d-----w c:\program files\No-IP 2009-04-16 00:57 . 2009-04-16 00:57 -------- d-----w c:\program files\Apple Computer 2009-04-16 00:47 . 2009-04-16 07:25 -------- d-----w c:\program files\Jugaari 2009-04-16 00:45 . 2009-04-16 00:45 -------- d-----w c:\program files\TightVNC 2009-04-14 23:17 . 1997-06-06 21:52 11264 ----a-w c:\windows\system32\SPORDER.DLL 2009-04-12 22:16 . 2009-04-12 22:17 1269620 ----a-w C:\cc_20090412_1516.reg 2009-04-12 21:05 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-12 21:05 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-12 21:05 . 2009-04-12 21:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-11 02:09 . 2009-04-11 02:09 155 ----a-w c:\windows\system32\SelfDel.bat 2009-04-11 01:54 . 2009-04-20 22:10 109010 ----a-w c:\windows\system32\drivers\d30ece49.sys 2009-04-11 01:38 . 2009-04-11 01:38 -------- d-----w c:\program files\I-Doser 2009-03-30 07:13 . 2009-03-30 07:13 -------- d-----w c:\program files\iPhone Tunnel Suite 2009-03-22 23:34 . 2009-03-22 23:34 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-18 23:57 . 2007-11-04 04:41 -------- d-----w c:\documents and settings\user\Application Data\uTorrent 2009-04-12 22:19 . 2007-01-04 23:28 -------- d-----w c:\program files\Steam 2009-04-12 22:18 . 2009-03-12 06:52 -------- d-----w c:\program files\Screaming Bee 2009-04-12 19:53 . 2006-12-14 01:24 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-01 09:45 . 2007-04-17 03:13 -------- d-----w c:\documents and settings\user\Application Data\LimeWire 2009-03-28 23:33 . 2008-07-23 21:05 -------- d-----w c:\program files\StuffPlug3 2009-03-25 05:44 . 2009-03-10 05:30 0 ----a-w C:\fftoutput.txt 2009-03-21 01:31 . 2009-03-12 06:52 -------- d-----w c:\documents and settings\All Users\Application Data\Screaming Bee 2009-03-21 01:27 . 2009-03-10 05:29 -------- d-----w c:\documents and settings\user\Application Data\Screaming Bee 2009-03-18 19:47 . 2009-03-18 19:44 -------- d-----w c:\program files\ESET 2009-03-18 19:44 . 2009-03-18 19:44 -------- d-----w c:\documents and settings\All Users\Application Data\ESET 2009-03-18 02:34 . 2009-03-18 02:32 -------- d-----w c:\documents and settings\user\Application Data\TortoiseSVN 2009-03-18 02:30 . 2009-03-18 02:30 -------- d-----w c:\documents and settings\user\Application Data\Subversion 2009-03-18 02:21 . 2009-03-18 02:21 -------- d-----w c:\program files\TortoiseSVN 2009-03-18 02:21 . 2009-03-18 02:21 -------- d-----w c:\program files\Common Files\TortoiseOverlays 2009-03-16 19:11 . 2008-01-25 05:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-03-15 16:53 . 2009-03-15 16:36 -------- d-----w c:\program files\Uninstall 2009-03-15 16:42 . 2009-03-15 16:42 -------- d-----w c:\program files\Gravity 2009-03-07 09:39 . 2009-03-07 09:39 -------- d-----w c:\documents and settings\user\Application Data\Kaspersky_Key_Finder_(KKF 2009-03-06 00:01 . 2009-03-06 00:01 -------- d-----w c:\program files\Xponaut 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\program files\iTunes 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\program files\iPod 2009-02-28 19:37 . 2008-01-25 02:11 -------- d-----w c:\program files\Common Files\Apple 2009-02-28 19:35 . 2009-02-28 19:35 -------- d-----w c:\program files\Bonjour 2009-02-28 19:34 . 2009-02-28 19:34 -------- d-----w c:\program files\QuickTime 2009-02-22 01:08 . 2007-01-11 04:06 -------- d-----w c:\program files\Winamp 2009-02-11 06:17 . 2008-12-26 06:36 410984 ----a-w c:\windows\system32\deploytk.dll 2009-01-23 21:46 . 2009-01-23 21:38 3552378880 ----a-w C:\NEW.ISO 2008-12-01 08:11 . 2007-01-05 14:00 46984 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2008-07-10 16:37 . 2008-09-30 06:13 1175552 ----a-w c:\documents and settings\user\iTunesMobileDevice.dll 2008-06-07 03:37 . 2008-09-30 06:13 68608 ----a-w c:\documents and settings\user\iphone_tunnel.exe 2008-01-28 16:08 . 2008-01-28 16:08 91 ----a-w c:\documents and settings\user\fix.reg 2008-01-24 00:20 . 2008-01-24 00:20 97656 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2007-08-20 16:24 . 2007-08-20 16:24 127 ----a-w c:\documents and settings\user\Local Settings\Application Data\fusioncache.dat 2007-01-10 21:19 . 2007-01-10 21:19 24192 ----a-w c:\documents and settings\user\usbsermptxp.sys 2007-01-10 21:19 . 2007-01-10 21:19 22768 ----a-w c:\documents and settings\user\usbsermpt.sys 2006-05-03 10:06 . 2008-02-03 19:10 163328 --sha-r c:\windows\system32\flvDX.dll 2007-02-21 11:47 . 2008-02-03 19:10 31232 --sha-r c:\windows\system32\msfDX.dll 2007-12-17 13:43 . 2008-02-03 19:10 27648 --sha-w c:\windows\system32\Smab0.dll . ------- Sigcheck ------- [-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2gdr\tcpip.sys [-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2qfe\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\dllcache\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\drivers\TCPIP.SYS . ((((((((((((((((((((((((((((( SnapShot@2009-04-20_06.05.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-20 22:09 . 2009-04-20 22:09 16384 c:\windows\temp\Perflib_Perfdata_700.dat + 2009-04-20 22:10 . 2009-04-20 22:10 42496 c:\windows\temp\2E319E75.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-11 148888] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^hamachi.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^iPhoneRingToneMaker.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\iPhoneRingToneMaker.lnk backup=c:\windows\pss\iPhoneRingToneMaker.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Xfire.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Xfire.lnk backup=c:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "avast!"=c:\progra~1\ALWILS~1\Avast4\ashDisp.exe "RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16882:TCP"= 16882:TCP:BitComet 16882 TCP "16882:UDP"= 16882:UDP:BitComet 16882 UDP "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundTimestampRequest"= 1 (0x1) "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) "AllowOutboundDestinationUnreachable"= 1 (0x1) "AllowOutboundSourceQuench"= 1 (0x1) "AllowOutboundParameterProblem"= 1 (0x1) "AllowOutboundTimeExceeded"= 1 (0x1) "AllowRedirect"= 1 (0x1) "AllowOutboundPacketTooBig"= 1 (0x1) R2 DCSPGSRV;DiamondCS ProcessGuard Service v3.410; [x] R3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [2007-12-27 35840] R3 DADriv1;DADriv1; [x] R3 geebers12;geebers12; [x] R3 MzBot.sys;MzBot.sys;c:\windows\system32\MzBot.sys [2007-04-01 3584] R3 白目國中生1;白目國中生1; [x] R3 phun1;phun1; [x] R3 Revolution1;Revolution1; [x] R3 saruen;saruen; [x] R3 saruenGang;saruenGang; [x] R3 sejt1;sejt1; [x] R3 SHAK31;SHAK31; [x] R3 SoRa01;SoRa01; [x] R3 sys_com001;sys_com001; [x] S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2009-02-06 106208] S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2009-02-06 93336] S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-02-06 727720] S2 procguard;procguard;c:\windows\system32\drivers\procguard.sys [2006-08-09 26688] S3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2008-11-22 23064] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04F9B72B-5ABA-8512-0200-070002040608}] c:\windows\system32\drvr.exe . Contents of the 'Scheduled Tasks' folder 2009-04-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Settings,ProxyServer = 61.175.135.52:80 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {B4CE450E-4BEF-4918-9B2D-B7B96E99E2C6} = 64.59.144.90,64.59.144.91 FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\83g36ng6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/webhp?rls=ig FF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-20 15:10 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\d30ece49] "ImagePath"="\SystemRoot\System32\drivers\d30ece49.sys" . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\s-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9595C0C7-A69A-D3E5-218F-7C3B7881AA2B}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iambbelelimbdlpomj"=hex:6a,61,61,64,6e,64,70,6c,62,6e,70,6f,62,62,69,68,6f,64, 67,66,00,00 "hagdcnhiffdflcbe"=hex:69,61,6f,63,69,66,6b,68,69,64,62,66,6a,6e,66,6b,6a,65, 00,00 [HKEY_USERS\s-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A050F2A7-E38B-6983-8B61-868F7ED85AE2}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "abjidabokcegchcjoihbfgffahjcknboci"=hex:61,61,00,a7 "maiiaapmipiimllpplpbgcljob"=hex:61,61,00,a7 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|"•€|閩w*] "AB141C35E9F4BF344B9FC010BB17F68A"="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(808) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2504) c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng-us.nlr c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr c:\program files\WinSCP\DragExt.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\iPod\bin\iPodService.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\windows\temp\2E319E75.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-04-20 15:16 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-20 22:15 ComboFix2.txt 2009-04-20 06:07 Pre-Run: 10,724,261,888 bytes free Post-Run: 10,713,284,608 bytes free 314 2009-04-20 22:07:05 . 2009-04-20 22:07:05 2,602 ----a-w C:\Qoobox\Quarantine\Registry_backups\Service_oreans32.reg.dat 2009-04-20 22:07:05 . 2009-04-20 22:07:05 3,156 ----a-w C:\Qoobox\Quarantine\Registry_backups\Service_IlvMoneyDRIVER53.reg.dat 2009-04-20 22:07:04 . 2009-04-20 22:07:04 1,276 ----a-w C:\Qoobox\Quarantine\Registry_backups\Legacy_OREANS32.reg.dat 2009-04-20 22:07:04 . 2009-04-20 22:07:04 276 ----a-w C:\Qoobox\Quarantine\Registry_backups\Legacy_NPF.reg.dat 2009-04-20 22:07:04 . 2009-04-20 22:07:04 1,430 ----a-w C:\Qoobox\Quarantine\Registry_backups\Legacy_ILVMONEYDRIVER53.reg.dat 2009-04-20 22  58 . 2009-04-20 2258 5,685 ----a-w C:\Qoobox\Quarantine\Registry_backups\tcpip.reg2009-04-20 06:02:02 . 2009-04-20 06:02:02 80,888 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_ovfsthauikedxthdgmaclbjgiriuoibhxpdvdw_.sys.zip 2009-04-20 06:02:00 . 2009-04-20 06:02:03 2,228 ----a-w C:\Qoobox\Quarantine\Registry_backups\Service_ovfsthsdyhkbgcoaiwvlpencpvnhmwoudvioei.reg.dat 2009-04-20 05:57:38 . 2009-04-20 22:04:37 733 ----a-w C:\Qoobox\Quarantine\catchme.log 2009-04-11 01:40:39 . 2009-04-20 05:35:23 43 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthpytjrpswkbufonqdjtluyislnabdcedo.dat.vir 2009-04-11 01:39:35 . 2009-04-11 01:39:35 19,456 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthhccaikrcwofwohipqrkcinfhpxknbxug.dll.vir 2009-04-11 01:39:35 . 2009-04-11 01:39:35 17,920 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthxcqklifvswnpodgsckfexuwojfpiyiok.dll.vir 2009-04-11 01:39:35 . 2009-04-20 05:35:23 115,188 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthgycjjwbiudseocparxtsovplbgrptibs.dat.vir 2009-04-11 01:39:35 . 2009-04-11 01:39:35 61,440 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\ovfsthqyqablliuvbvohvosfcfoestdrxseyxb.dll.vir 2008-01-18 02:03:24 . 2008-01-28 04:24:28 2,578 ----a-w C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp.reg.vir |
|
|
|
|
04-20-2009, 06:30 PM
|
#9 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Hello flipboi15.
Please go to: VirusTotal
|
|
|
|
|
04-20-2009, 06:44 PM
|
#10 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
Re: win32/agent.odg
Antivirus Version Last Update Result
AhnLab-V3 - - - AntiVir - - - Antiy-AVL - - - Authentium - - W32/Damaged_File.gen!Eldorado Avast - - - AVG - - - BitDefender - - - CAT-QuickHeal - - - ClamAV - - - Comodo - - - DrWeb - - - eSafe - - Suspicious File eTrust-Vet - - - F-Prot - - W32/Damaged_File.gen!Eldorado Fortinet - - - GData - - - Ikarus - - - K7AntiVirus - - - Kaspersky - - - McAfee - - - McAfee+Artemis - - Generic!Artemis McAfee-GW-Edition - - - Microsoft - - - NOD32 - - - Norman - - - nProtect - - - Panda - - - PCTools - - - Prevx1 - - - Rising - - - Sophos - - - Sunbelt - - VIPRE.Suspicious Symantec - - Suspicious.MH690.A TheHacker - - - TrendMicro - - - VBA32 - - - ViRobot - - - VirusBuster - - - Additional information MD5: cd9eeaf08fcaa5b372e9fbabbb787bea SHA1: e64dc632ba49fa2180f20dcce8580f2f4f479756 SHA256: 5a857e790fed8d56a3bc8cb74ad5552827f59919e2fc9b04b1e9cd6347d458dc SHA512: ddd3f5fa13e94ec520d06d8fe6257fb083b474e146132eac74322779f8f1c016dfbf714b34a2f8c556bbb52617ee0dbcf4e4d32b2de2f5248206428d27893a73 ========================================== when i tried for the other file it showed me this message: 0 bytes size received / Se ha recibido un archivo vacio |
|
|
|
|
04-20-2009, 07:09 PM
|
#11 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Hello again, flipboi15.
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions. Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ I see you have P2P software ( uTorrent and LimeWire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information. Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares. References for the risk of these programs are here, here, and here. I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs. ------------------------------------------------------ Close any open browsers. Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix. Open Notepad and copy/paste all the text in the codebox below into Notepad: Code:
http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/366052-win32-agent-odg.html#post2092471
Collect::
c:\windows\system32\winsetup66.exe
c:\windows\system32\ak1.exe
c:\windows\system32\drivers\d30ece49.sys
File::
c:\windows\system32\SelfDel.bat
Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{04F9B72B-5ABA-8512-0200-070002040608}]
Folder::
c:\documents and settings\user\Application Data\Kaspersky_Key_Finder_(KKF
DirLook::
c:\documents and settings\user\Application Data\uTorrent
Driver::
DCSPGSRV
DADriv1
geebers12
白目國中生1
phun1
Revolution1
saruen
saruenGang
sejt1
SHAK31
SoRa01
sys_com001
KillAll::
 Referring to the picture above, drag CFScript onto ComboFix If you are prompted to update ComboFix and have an internet connection, please choose Yes Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal. When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply. ------------------------------------------------------ **Note** When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
There should be a file named [4]-Submit_date@time.zip with today's date, located here: C:\QooBox\Quarantine\[4]-Submit_date@time.zip Using the 'Browse' button, please submit it to this site ==> http://www.bleepingcomputer.com/subm....php?channel=4 Please let me know if you successfully submitted the file. Thanks. ------------------------------------------------------ |
|
|
|
|
04-20-2009, 10:35 PM
|
#12 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
Re: win32/agent.odg
ComboFix 09-04-21.07 - user 04/20/2009 21:23.11 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.507 [GMT -7:00] Running from: c:\documents and settings\user\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\user\Desktop\CFScript.txt AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) * Created a new restore point FILE :: c:\windows\system32\SelfDel.bat . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\user\Application Data\Kaspersky_Key_Finder_(KKF c:\documents and settings\user\Application Data\Kaspersky_Key_Finder_(KKF\Kaspersky_Key_Finder_V1.5_Url_is2ydiopg04xtx4epbk5ouxfvt1aqjch\1.5.0.0\user.config c:\windows\system32\ak1.exe c:\windows\system32\drivers\d30ece49.sys c:\windows\system32\SelfDel.bat c:\windows\system32\winsetup66.exe . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_DADRIV1 -------\Legacy_DCSPGSRV -------\Legacy_GEEBERS12 -------\Legacy_PHUN1 -------\Legacy_REVOLUTION1 -------\Legacy_SARUEN -------\Legacy_SARUENGANG -------\Legacy_SEJT1 -------\Legacy_SHAK31 -------\Legacy_SORA01 -------\Legacy_SYS_COM001 -------\Service_DADriv1 -------\Service_DCSPGSRV -------\Service_geebers12 -------\Service_白目國中生1 -------\Service_phun1 -------\Service_Revolution1 -------\Service_saruen -------\Service_saruenGang -------\Service_sejt1 -------\Service_SHAK31 -------\Service_SoRa01 -------\Service_sys_com001 -------\Service_d30ece49 ((((((((((((((((((((((((( Files Created from 2009-03-21 to 2009-04-21 ))))))))))))))))))))))))))))))) . 2009-04-20 05:51 . 2009-04-20 06:15 -------- d-----w c:\program files\Hide IP Platinum 2009-04-20 05:39 . 2009-04-20 05:51 -------- d-----w c:\documents and settings\user\Application Data\HideIP 2009-04-19 16:21 . 2009-01-22 09:40 163840 ----a-w c:\windows\system32\SecureNet.dll 2009-04-19 16:21 . 2008-11-03 12:45 204800 ----a-w c:\windows\system32\ssleay32.dll 2009-04-19 16:21 . 2008-11-03 12:45 1126400 ----a-w c:\windows\system32\libeay32.dll 2009-04-19 05:14 . 2009-04-20 05:51 32 ----a-w c:\windows\go 2009-04-19 00:30 . 2009-04-19 00:30 -------- d-----w c:\documents and settings\user\Application Data\Ufasoft 2009-04-19 00:29 . 2009-04-19 00:29 -------- d-----w c:\program files\Ufasoft 2009-04-16 05:38 . 2007-12-27 00:30 679936 ----a-w c:\windows\system32\D3DX81ab.dll 2009-04-16 05:38 . 2007-12-27 00:30 1970176 ----a-w c:\windows\system32\d3dx9.dll 2009-04-16 05:38 . 2009-04-16 05:38 -------- d-----w c:\program files\Cheat Engine 2009-04-16 01:08 . 2009-04-16 01:08 -------- d-----w c:\program files\No-IP 2009-04-16 00:57 . 2009-04-16 00:57 -------- d-----w c:\program files\Apple Computer 2009-04-16 00:47 . 2009-04-16 07:25 -------- d-----w c:\program files\Jugaari 2009-04-16 00:45 . 2009-04-16 00:45 -------- d-----w c:\program files\TightVNC 2009-04-14 23:17 . 1997-06-06 21:52 11264 ----a-w c:\windows\system32\SPORDER.DLL 2009-04-12 22:16 . 2009-04-12 22:17 1269620 ----a-w C:\cc_20090412_1516.reg 2009-04-12 21:05 . 2009-04-06 22:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-04-12 21:05 . 2009-04-06 22:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-04-12 21:05 . 2009-04-12 21:05 -------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-04-11 01:38 . 2009-04-11 01:38 -------- d-----w c:\program files\I-Doser 2009-03-30 07:13 . 2009-03-30 07:13 -------- d-----w c:\program files\iPhone Tunnel Suite 2009-03-22 23:34 . 2009-03-22 23:34 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\ESET . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-04-18 23:57 . 2007-11-04 04:41 -------- d-----w c:\documents and settings\user\Application Data\uTorrent 2009-04-12 22:19 . 2007-01-04 23:28 -------- d-----w c:\program files\Steam 2009-04-12 22:18 . 2009-03-12 06:52 -------- d-----w c:\program files\Screaming Bee 2009-04-12 19:53 . 2006-12-14 01:24 -------- d--h--w c:\program files\InstallShield Installation Information 2009-04-01 09:45 . 2007-04-17 03:13 -------- d-----w c:\documents and settings\user\Application Data\LimeWire 2009-03-28 23:33 . 2008-07-23 21:05 -------- d-----w c:\program files\StuffPlug3 2009-03-25 05:44 . 2009-03-10 05:30 0 ----a-w C:\fftoutput.txt 2009-03-21 01:31 . 2009-03-12 06:52 -------- d-----w c:\documents and settings\All Users\Application Data\Screaming Bee 2009-03-21 01:27 . 2009-03-10 05:29 -------- d-----w c:\documents and settings\user\Application Data\Screaming Bee 2009-03-18 19:47 . 2009-03-18 19:44 -------- d-----w c:\program files\ESET 2009-03-18 19:44 . 2009-03-18 19:44 -------- d-----w c:\documents and settings\All Users\Application Data\ESET 2009-03-18 02:34 . 2009-03-18 02:32 -------- d-----w c:\documents and settings\user\Application Data\TortoiseSVN 2009-03-18 02:30 . 2009-03-18 02:30 -------- d-----w c:\documents and settings\user\Application Data\Subversion 2009-03-18 02:21 . 2009-03-18 02:21 -------- d-----w c:\program files\TortoiseSVN 2009-03-18 02:21 . 2009-03-18 02:21 -------- d-----w c:\program files\Common Files\TortoiseOverlays 2009-03-16 19:11 . 2008-01-25 05:31 -------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab 2009-03-15 16:53 . 2009-03-15 16:36 -------- d-----w c:\program files\Uninstall 2009-03-15 16:42 . 2009-03-15 16:42 -------- d-----w c:\program files\Gravity 2009-03-06 00:01 . 2009-03-06 00:01 -------- d-----w c:\program files\Xponaut 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\program files\iTunes 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2009-02-28 19:37 . 2009-02-28 19:37 -------- d-----w c:\program files\iPod 2009-02-28 19:37 . 2008-01-25 02:11 -------- d-----w c:\program files\Common Files\Apple 2009-02-28 19:35 . 2009-02-28 19:35 -------- d-----w c:\program files\Bonjour 2009-02-28 19:34 . 2009-02-28 19:34 -------- d-----w c:\program files\QuickTime 2009-02-22 01:08 . 2007-01-11 04:06 -------- d-----w c:\program files\Winamp 2009-02-11 06:17 . 2008-12-26 06:36 410984 ----a-w c:\windows\system32\deploytk.dll 2009-01-23 21:46 . 2009-01-23 21:38 3552378880 ----a-w C:\NEW.ISO 2008-12-01 08:11 . 2007-01-05 14:00 46984 ----a-w c:\documents and settings\user\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2008-07-10 16:37 . 2008-09-30 06:13 1175552 ----a-w c:\documents and settings\user\iTunesMobileDevice.dll 2008-06-07 03:37 . 2008-09-30 06:13 68608 ----a-w c:\documents and settings\user\iphone_tunnel.exe 2008-01-28 16:08 . 2008-01-28 16:08 91 ----a-w c:\documents and settings\user\fix.reg 2008-01-24 00:20 . 2008-01-24 00:20 97656 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat 2007-08-20 16:24 . 2007-08-20 16:24 127 ----a-w c:\documents and settings\user\Local Settings\Application Data\fusioncache.dat 2007-01-10 21:19 . 2007-01-10 21:19 24192 ----a-w c:\documents and settings\user\usbsermptxp.sys 2007-01-10 21:19 . 2007-01-10 21:19 22768 ----a-w c:\documents and settings\user\usbsermpt.sys 2006-05-03 10:06 . 2008-02-03 19:10 163328 --sha-r c:\windows\system32\flvDX.dll 2007-02-21 11:47 . 2008-02-03 19:10 31232 --sha-r c:\windows\system32\msfDX.dll 2007-12-17 13:43 . 2008-02-03 19:10 27648 --sha-w c:\windows\system32\Smab0.dll . (((((((((((((((((((((((((((((((((((((((((((( Look ))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ---- Directory of c:\documents and settings\user\Application Data\uTorrent ---- 2009-04-12 19:19 . 2009-04-12 19:19 21844 ------w c:\documents and settings\user\Application Data\uTorrent\26-50.torrent 2009-04-12 19:18 . 2009-04-12 19:18 20972 ------w c:\documents and settings\user\Application Data\uTorrent\1-25.torrent 2009-03-07 08:45 . 2009-03-07 08:45 21182 ------w c:\documents and settings\user\Application Data\uTorrent\KIS_2009(v8)_FINAL_FULL_ENG.torrent 2009-02-07 07:17 . 2009-02-07 07:17 681000 ------w c:\documents and settings\user\Application Data\uTorrent\One Piece 1 - 300.1.torrent 2009-01-22 03:09 . 2009-01-22 03:09 681000 ------w c:\documents and settings\user\Application Data\uTorrent\One Piece 1 - 300.torrent 2008-12-09 08:40 . 2008-12-09 08:40 1976 ------w c:\documents and settings\user\Application Data\uTorrent\Malwarebytes' Anti-Malware 1.30 Full.torrent 2008-11-28 02:33 . 2009-04-18 23:57 99 ----a-w c:\documents and settings\user\Application Data\uTorrent\rss.dat 2008-11-28 02:33 . 2009-04-12 19:20 99 ----a-w c:\documents and settings\user\Application Data\uTorrent\rss.dat.old 2008-11-28 00:32 . 2008-11-28 00:32 508218 ----a-w c:\documents and settings\user\Application Data\uTorrent\utorrent.lng 2008-11-23 02:36 . 2008-11-23 02:36 20013 ----a-r c:\documents and settings\user\Application Data\uTorrent\Adobe.Audition.v3.WinAll.Cracked-NoPE.torrent 2008-11-17 08:34 . 2008-11-17 08:33 534 ----a-r c:\documents and settings\user\Application Data\uTorrent\2.1 Patched Mobile Installation.torrent 2008-09-20 20:04 . 2008-09-20 20:04 13525 ----a-r c:\documents and settings\user\Application Data\uTorrent\The.Game-L.A.X-(DIRTY.)-2008-[NoFS].torrent 2008-04-05 07:59 . 2008-04-05 07:59 16503 ----a-w c:\documents and settings\user\Application Data\uTorrent\21.2008.VOB.CAM-2Bros.[www.torrentfive.com].torrent 2007-11-04 04:41 . 2009-04-18 23:57 58 ----a-w c:\documents and settings\user\Application Data\uTorrent\resume.dat 2007-11-04 04:41 . 2009-04-18 23:57 2221 ----a-w c:\documents and settings\user\Application Data\uTorrent\resume.dat.old 2007-11-04 04:41 . 2009-04-18 23:57 3884 ----a-w c:\documents and settings\user\Application Data\uTorrent\dht.dat 2007-11-04 04:41 . 2009-04-12 19:20 138 ----a-w c:\documents and settings\user\Application Data\uTorrent\dht.dat.old 2007-11-04 04:41 . 2007-09-20 05:05 17598 ----a-w c:\documents and settings\user\Application Data\uTorrent\SilkroadOnline_GlobalOfficial_v1_110.exe.torrent 2007-09-11 07:56 . 2009-04-18 23:57 2678 ----a-w c:\documents and settings\user\Application Data\uTorrent\settings.dat 2007-09-11 07:56 . 2009-04-18 23:45 2683 ----a-w c:\documents and settings\user\Application Data\uTorrent\settings.dat.old ------- Sigcheck ------- [-] 2006-04-20 11:51 359808 1DBF125862891817F374F407626967F4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2gdr\tcpip.sys [-] 2006-04-20 12:18 360576 B2220C618B42A2212A59D91EBD6FC4B4 c:\windows\SoftwareDistribution\Download\556eb98436b65a8c1ffae674c83d197f\sp2qfe\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\dllcache\tcpip.sys [-] 2007-06-03 19:06 359040 EC95F10EFA90CB7DCFDAB5998345B7E7 c:\windows\system32\drivers\TCPIP.SYS . ((((((((((((((((((((((((((((( SnapShot@2009-04-20_06.05.14 ))))))))))))))))))))))))))))))))))))))))) . + 2009-04-21 04:28 . 2009-04-21 04:28 16384 c:\windows\temp\Perflib_Perfdata_154.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal] @="{C5994560-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified] @="{C5994561-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict] @="{C5994562-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked] @="{C5994563-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly] @="{C5994564-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted] @="{C5994565-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded] @="{C5994566-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored] @="{C5994567-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned] @="{C5994568-53D9-4125-87C9-F193FC689CB2}" [HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}] 2008-01-17 01:52 80384 ----a-w c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-28 68856] "ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 218032] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112] "SoundMAXPnP"="c:\program files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-11 148888] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-06 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 1241088] [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Adobe Gamma.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Adobe Gamma.lnk backup=c:\windows\pss\Adobe Gamma.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^hamachi.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^iPhoneRingToneMaker.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\iPhoneRingToneMaker.lnk backup=c:\windows\pss\iPhoneRingToneMaker.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Xfire.lnk] path=c:\documents and settings\user\Start Menu\Programs\Startup\Xfire.lnk backup=c:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" "avast!"=c:\progra~1\ALWILS~1\Avast4\ashDisp.exe "RemoteControl"="c:\program files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_02\bin\jusched.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\TVersity\\Media Server\\MediaServer.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "16882:TCP"= 16882:TCP:BitComet 16882 TCP "16882:UDP"= 16882:UDP:BitComet 16882 UDP "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings] "AllowInboundTimestampRequest"= 1 (0x1) "AllowInboundMaskRequest"= 1 (0x1) "AllowInboundRouterRequest"= 1 (0x1) "AllowOutboundDestinationUnreachable"= 1 (0x1) "AllowOutboundSourceQuench"= 1 (0x1) "AllowOutboundParameterProblem"= 1 (0x1) "AllowOutboundTimeExceeded"= 1 (0x1) "AllowRedirect"= 1 (0x1) "AllowOutboundPacketTooBig"= 1 (0x1) R3 CEDRIVER53;CEDRIVER53;c:\program files\Cheat Engine\dbk32.sys [2007-12-27 35840] . Contents of the 'Scheduled Tasks' folder 2009-04-17 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 19:34] . . ------- Supplementary Scan ------- . uStart Page = hxxp://www.google.com mStart Page = hxxp://www.google.com uInternet Settings,ProxyServer = 61.175.135.52:80 IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: {B4CE450E-4BEF-4918-9B2D-B7B96E99E2C6} = 64.59.144.90,64.59.144.91 FF - ProfilePath - c:\documents and settings\user\Application Data\Mozilla\Firefox\Profiles\83g36ng6.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/webhp?rls=ig FF - prefs.js: keyword.URL - hxxp://ca.search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-04-20 21:28 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_USERS\S-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9595C0C7-A69A-D3E5-218F-7C3B7881AA2B}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "iambbelelimbdlpomj"=hex:6a,61,61,64,6e,64,70,6c,62,6e,70,6f,62,62,69,68,6f,64, 67,66,00,00 "hagdcnhiffdflcbe"=hex:69,61,6f,63,69,66,6b,68,69,64,62,66,6a,6e,66,6b,6a,65, 00,00 [HKEY_USERS\S-1-5-21-1659004503-484763869-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{A050F2A7-E38B-6983-8B61-868F7ED85AE2}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "abjidabokcegchcjoihbfgffahjcknboci"=hex:61,61,00,a7 "maiiaapmipiimllpplpbgcljob"=hex:61,61,00,a7 [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\•€|"•€|閩w*] "AB141C35E9F4BF344B9FC010BB17F68A"="" . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(800) c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(3908) c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll c:\program files\TortoiseSVN\bin\TortoiseStub.dll c:\program files\TortoiseSVN\bin\TortoiseSVN.dll c:\program files\TortoiseSVN\bin\intl3_tsvn.dll c:\progra~1\WINDOW~2\wmpband.dll c:\windows\system32\WPDShServiceObj.dll c:\program files\Nokia\Nokia PC Suite 6\PhoneBrowser.dll c:\program files\Nokia\Nokia PC Suite 6\PCSCM.dll c:\program files\Nokia\Nokia PC Suite 6\Lang\PhoneBrowser_eng-us.nlr c:\program files\Nokia\Nokia PC Suite 6\Resource\PhoneBrowser_Nokia.ngr c:\program files\WinSCP\DragExt.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\Java\jre6\bin\jqs.exe c:\program files\Analog Devices\SoundMAX\SMAgent.exe c:\program files\Windows Media Player\wmpnetwk.exe c:\program files\iPod\bin\iPodService.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-04-21 21:32 - machine was rebooted ComboFix-quarantined-files.txt 2009-04-21 04:32 ComboFix2.txt 2009-04-20 22:16 ComboFix3.txt 2009-04-20 06:07 Pre-Run: 10,642,046,976 bytes free Post-Run: 10,633,953,280 bytes free 338 ================================================================= file is submitted |
|
|
|
|
04-21-2009, 06:05 AM
|
#13 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Hello again, flipboi15. Thanks for submitting the file.
Disable the real-time protections of your antivirus and antispyware applications, usually via a right-click on the System Tray icon. Please re-enable them after the scan.
|
|
|
|
|
04-21-2009, 07:55 AM
|
#14 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
Re: win32/agent.odg
-----------\\ ToolBar S&D 1.2.8 XP/Vista
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel(R) Core(TM)2 CPU 6300 @ 1.86GHz ) BIOS : Rev 1.00 USER : user ( Administrator ) BOOT : Normal boot Antivirus : ESET NOD32 Antivirus 4.0 4.0 (Not Activated) A:\ (USB) C:\ (Local Disk) - NTFS - Total:78 Go (Free:9 Go) D:\ (CD or DVD) E:\ (Local Disk) - NTFS - Total:75 Go (Free:46 Go) "C:\ToolBar SD" ( MAJ : 21-12-2008|20:47 ) Option : [1] ( Tue 04/21/2009| 6:52 ) -----------\\ Searching for Files - Folders ... -----------\\ Extensions (user) - {3112ca9c-de6d-4884-a869-9855de68056c} => google-toolbar (user) - {b9db16a4-6edc-47ec-a1f4-b86292ed211d} => dwhelper -----------\\ [..\Internet Explorer\Main] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main] "Local Page"="C:\\windows\\system32\\blank.htm" "Start Page"="http://www.google.com" "Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" "Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch" [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main] "Default_Page_URL"="http://go.microsoft.com/fwlink/?LinkId=69157" "Default_Search_URL"="http://go.microsoft.com/fwlink/?LinkId=54896" "Search Page"="http://go.microsoft.com/fwlink/?LinkId=54896" "Local Page"="C:\\windows\\system32\\blank.htm" "Start Page"="http://www.google.com" --------------------\\ Searching for other infections --------------------\\ Cracks & Keygens .. C:\DOCUME~1\user\Local Settings\Application Data\Microsoft\Messenger\lil_flipboi1502@hotmail.com\Sharing Folders\hidontknow@hotmail.com\Warcraft 3 good cd crack C:\DOCUME~1\user\Local Settings\Application Data\Microsoft\Messenger\lil_flipboi1502@hotmail.com\Sharing Folders\hidontknow@hotmail.com\Warcraft 3 good cd crack\v1.21a Loader C:\DOCUME~1\user\Local Settings\Application Data\Microsoft\Messenger\lil_flipboi1502@hotmail.com\Sharing Folders\hidontknow@hotmail.com\Warcraft 3 good cd crack\Warcraft III v1.21a Battle.net & No-CD Loader.nfo C:\DOCUME~1\user\Local Settings\Application Data\Microsoft\Messenger\lil_flipboi1502@hotmail.com\Sharing Folders\hidontknow@hotmail.com\Warcraft 3 good cd crack\v1.21a Loader\Files C:\DOCUME~1\user\Local Settings\Application Data\Microsoft\Messenger\lil_flipboi1502@hotmail.com\Sharing Folders\hidontknow@hotmail.com\Warcraft 3 good cd crack\v1.21a Loader\Original Files C:\DOCUME~1\user\My Documents\My Music\Cool Edit Pro V 2.0 with crack ( good editing - recording program,much smaller than cubase, or reason)(wOrKs).zip C:\DOCUME~1\user\My Documents\My Music\Eminem - Presents The Re-Up - 08 - Eminem 50 Cent - Jimmy Crack Corn-easymp3s.mp3 C:\DOCUME~1\user\Recent\Hide_IP_Platinum_4.02+Crack.lnk C:\DOCUME~1\user\Recent\Hide_IP_Platinum_4.02_Crack.rar.lnk 1 - "C:\ToolBar SD\TB_1.txt" - Tue 04/21/2009| 6:54 - Option : [1] -----------\\ Scan completed at 6:54:21.23 |
|
|
|
|
04-21-2009, 10:03 AM
|
#15 (permalink) | |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Quote:
Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore. If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer. Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications. Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine. In 2006, a study revealed that 59% of keygens and crack tools downloaded from peer-to-peer networks contained malicious or "unwanted" software. ------------------------------------------------------ ==== Installed Programs ==== Adobe Audition 3.0 ------------------------------------------------------ |
|
|
|
|
|
04-23-2009, 05:42 AM
|
#19 (permalink) |
|
Moderator, Analyst, Security Team; Rangemaster, TSF Academy
Join Date: Oct 2007
Location: Georgia
Posts: 10,590
OS: XP SP3
|
Re: win32/agent.odg
Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.
Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding. Ensure that there aren't any opened browsers when you are carrying out the procedures below. It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence. ------------------------------------------------------ Your Java is out of date. Java(TM) 6 Update 12 can be updated from the Java Control Panel. Go Start > Control Panel(Classic View) > Java (looks like a coffee cup) > Update Tab > Update Now. An update should begin; follow the prompts. Make sure you untick the box next to Yahoo Toolbar for Firefox/Mozilla or MSN Toolbar unless you want it. ------------------------------------------------------ Please download ATF-Cleaner by Atribune and Save it to your Desktop.
For Technical Support, double-click the e-mail address located at the bottom of each menu. ------------------------------------------------------ Please run this online scan to help look for remnants. Establish an internet connection & perform an online scan at Kaspersky Online Scanner Ensure your external and/or USB drives are inserted during the scan. Click Accept, when prompted to download and install the program files and database of malware definitions.
 **Note** To optimize scanning time and produce a more sensible report for review:
------------------------------------------------------ Run gmer again and attach the log to your next reply. ------------------------------------------------------ |
|
|
|
|
04-25-2009, 12:14 AM
|
#20 (permalink) |
|
Registered User
Join Date: Nov 2006
Posts: 38
OS: XP SP2
|
Re: win32/agent.odg
it wont update, it said update failed :S
sorry i wasnt being specific enough it said, Java failed to start, i think. java.lang.nullpointerexception Last edited by flipboi15; 04-25-2009 at 12:28 AM. |
|
|
|
| Thread Tools | |
|
|
