It is currently Tue Sep 01, 2026 12:14 pm


trojan horse dropper.agent.git infection

Is your PC infected? Is it running slow? Just can't figure out what's making it sluggish? Here is the place to get some help.

Moderators: liljim, Gecko

Post a reply

trojan horse dropper.agent.git infection

Postby Daisydee08 » Wed Jan 16, 2008 6:14 pm

Please help, don't know how to get rid of these lot. I've ran HiJackThis and Combofix following the instructions on recent posts here. Will be grateful for your prompt replies.


Logfile of HijackThis v1.99.1
Scan saved at 3:54:51 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Grisoft\AVG7\avgwa.dat
C:\Program Files\Grisoft\AVG7\avgvv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F3 - REG:win.ini: load=C:\WINDOWS\system32\awtsr.exe
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe



ComboFix 08-01-16.4 - ARTWORKS 2008 2008-01-16 16:17:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.589 [GMT 0:00]
Running from: C:\Documents and Settings\ARTWORKS 2008\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtsr.dll
C:\WINDOWS\system32\awtsr.exe
C:\WINDOWS\system32\drvfubr.dll
C:\WINDOWS\system32\efcbawv.dll
C:\WINDOWS\system32\rstwa.ini
C:\WINDOWS\system32\rstwa.ini2
C:\WINDOWS\system32\winjvd32.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))
.

2008-01-16 16:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 14:23 . 2008-01-16 14:23 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-16 13:30 . 2008-01-16 13:30 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-01-16 12:07 . 2008-01-16 12:07 <DIR> d-------- C:\Program Files\QuickTime
2008-01-16 12:06 . 2007-02-20 16:04 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2008-01-16 12:06 . 2007-02-20 16:04 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2008-01-16 11:47 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-16 11:47 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-16 11:47 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 11:39 . 2008-01-16 11:39 145 --a------ C:\WINDOWS\system32\winver.bat
2008-01-16 09:39 . 2008-01-16 09:39 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-01-16 09:39 . 2008-01-16 09:39 <DIR> d-------- C:\Program Files\Autodesk
2008-01-16 03:01 . 2008-01-16 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-15 18:51 . 2008-01-16 12:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-15 18:44 . 2008-01-15 18:44 <DIR> d-------- C:\Program Files\Bonjour
2008-01-15 18:36 . 2008-01-15 18:36 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-01-15 18:35 . 2008-01-15 18:59 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-01-15 17:49 . 2008-01-16 00:19 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\LimeWire
2008-01-15 17:49 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-15 17:48 . 2008-01-15 17:49 <DIR> d-------- C:\Program Files\Java
2008-01-15 17:47 . 2008-01-15 17:49 <DIR> d-------- C:\Program Files\LimeWire
2008-01-15 17:47 . 2008-01-15 17:47 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-15 17:43 . 2008-01-15 17:43 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Contacts
2008-01-15 17:35 . 2008-01-15 17:35 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-15 17:14 . 2008-01-15 17:31 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-15 17:13 . 2008-01-15 17:35 <DIR> d-------- C:\Program Files\Windows Live
2008-01-15 17:13 . 2008-01-15 17:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-15 16:57 . 2008-01-15 16:57 <DIR> d-------- C:\Program Files\AnswerWorks 4.0
2008-01-15 16:55 . 2008-01-15 16:57 <DIR> d-------- C:\Program Files\AutoCAD 2007
2008-01-15 16:55 . 2008-01-16 09:40 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\Autodesk
2008-01-15 16:55 . 2008-01-16 11:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2008-01-15 16:54 . 2008-01-16 11:39 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-01-15 15:58 . 2008-01-15 15:58 <DIR> d-------- C:\Program Files\uTorrent
2008-01-15 15:58 . 2008-01-16 12:03 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\uTorrent
2008-01-15 15:53 . 2008-01-15 15:53 <DIR> d-------- C:\installation_files
2008-01-15 13:11 . 2008-01-15 13:11 <DIR> d-------- C:\Program Files\DScaler5
2008-01-15 12:38 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-01-15 12:38 . 2008-01-15 12:38 376 --a------ C:\WINDOWS\ODBC.INI
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-15 12:36 . 2008-01-15 12:37 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-15 12:36 . 2008-01-15 12:36 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-14 18:42 . 2008-01-14 18:42 25 --a------ C:\WINDOWS\mixerdef.ini
2008-01-14 18:40 . 2008-01-14 18:40 <DIR> d-------- C:\Program Files\C-Media
2008-01-13 15:12 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-13 15:08 . 2008-01-13 15:08 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-13 15:08 . 2008-01-16 13:39 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\AVG7
2008-01-13 15:08 . 2008-01-13 15:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 15:08 . 2008-01-16 15:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-13 15:08 . 2008-01-13 15:08 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-01-13 15:08 . 2008-01-13 15:08 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-01-13 15:06 . 2008-01-15 17:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 14:28 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F}]
C:\Program Files\Outerinfo\Outerinfo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-07-13 00:33 1581056 C:\WINDOWS\mixer.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-13 15:08 145920]

R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 16:24:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 16:26:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-16 16:26:46
.
2008-01-16 13:31:05 --- E O F ---
Daisydee08
Newbie
Newbie
 
Posts: 3
Joined: Wed Jan 16, 2008 5:12 pm

Thanks given:0
Thanks received:0
Top

Postby Gecko » Thu Jan 17, 2008 12:24 am

User avatar
Gecko
Super Moderator
Super Moderator
 
Posts: 5209
Joined: Thu Oct 25, 2001 1:00 am
Location: Florida, USA

Thanks given:1
Thanks received:23
Top

Postby Daisydee08 » Thu Jan 17, 2008 1:03 am

Greetings! Thanks for quick reply. Here's the new HijackThis log and the Combofix log:

Logfile of HijackThis v1.99.1
Scan saved at 11:57:29 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F} - C:\Program Files\Outerinfo\Outerinfo.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - Winlogon Notify: Antiwpa - C:\WINDOWS\SYSTEM32\antiwpa.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

ComboFix 08-01-16.4 - ARTWORKS 2008 2008-01-16 23:47:02.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.599 [GMT 0:00]
Running from: C:\Documents and Settings\ARTWORKS 2008\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\ARTWORKS 2008\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\Outerinfo\Outerinfo.bak
C:\Program Files\Outerinfo\Outerinfo.bak1
C:\Program Files\Outerinfo\Outerinfo.bak2
C:\Program Files\Outerinfo\Outerinfo.dll
C:\Program Files\Outerinfo\Outerinfo.ini
C:\Program Files\Outerinfo\Outerinfo.ini1
C:\WINDOWS\avp.bak
C:\WINDOWS\avp.bak2
C:\WINDOWS\avp.dll
C:\WINDOWS\avp.exe
C:\WINDOWS\avp.ini
C:\WINDOWS\avp.ini1
C:\WINDOWS\system32\drvfubr.bak
C:\WINDOWS\system32\drvfubr.bak2
.

((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))
.

2008-01-16 22:50 . 2008-01-16 22:50 <DIR> d---s---- C:\Documents and Settings\ARTWORKS 2008\UserData
2008-01-16 17:36 . 2008-01-16 17:40 <DIR> d-------- C:\Program Files\Windows Live
2008-01-16 16:15 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-16 14:23 . 2008-01-16 14:23 <DIR> d--h----- C:\WINDOWS\PIF
2008-01-16 13:30 . 2008-01-16 13:30 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-01-16 12:07 . 2008-01-16 12:07 <DIR> d-------- C:\Program Files\QuickTime
2008-01-16 12:06 . 2007-02-20 16:04 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
2008-01-16 12:06 . 2007-02-20 16:04 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
2008-01-16 11:47 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-16 11:47 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-16 11:47 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-16 11:39 . 2008-01-16 11:39 145 --a------ C:\WINDOWS\system32\winver.bat
2008-01-16 09:39 . 2008-01-16 09:39 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-01-16 09:39 . 2008-01-16 09:39 <DIR> d-------- C:\Program Files\Autodesk
2008-01-16 03:01 . 2008-01-16 03:01 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-15 18:51 . 2008-01-16 12:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-15 18:44 . 2008-01-15 18:44 <DIR> d-------- C:\Program Files\Bonjour
2008-01-15 18:36 . 2008-01-15 18:36 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2008-01-15 18:35 . 2008-01-15 18:59 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-01-15 17:49 . 2008-01-16 00:19 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\LimeWire
2008-01-15 17:49 . 2007-07-12 02:22 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-01-15 17:48 . 2008-01-15 17:49 <DIR> d-------- C:\Program Files\Java
2008-01-15 17:47 . 2008-01-15 17:49 <DIR> d-------- C:\Program Files\LimeWire
2008-01-15 17:47 . 2008-01-15 17:47 <DIR> d-------- C:\Program Files\Common Files\Java
2008-01-15 17:43 . 2008-01-15 17:43 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Contacts
2008-01-15 17:35 . 2008-01-15 17:35 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-15 17:14 . 2008-01-15 17:31 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-15 17:13 . 2008-01-16 17:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-01-15 16:57 . 2008-01-15 16:57 <DIR> d-------- C:\Program Files\AnswerWorks 4.0
2008-01-15 16:55 . 2008-01-15 16:57 <DIR> d-------- C:\Program Files\AutoCAD 2007
2008-01-15 16:55 . 2008-01-16 09:40 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\Autodesk
2008-01-15 16:55 . 2008-01-16 11:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Autodesk
2008-01-15 16:54 . 2008-01-16 11:39 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-01-15 15:58 . 2008-01-15 15:58 <DIR> d-------- C:\Program Files\uTorrent
2008-01-15 15:58 . 2008-01-16 12:03 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\uTorrent
2008-01-15 15:53 . 2008-01-15 15:53 <DIR> d-------- C:\installation_files
2008-01-15 13:11 . 2008-01-15 13:11 <DIR> d-------- C:\Program Files\DScaler5
2008-01-15 12:38 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-01-15 12:38 . 2008-01-15 12:38 376 --a------ C:\WINDOWS\ODBC.INI
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2008-01-15 12:37 . 2008-01-15 12:37 <DIR> d-------- C:\Program Files\Common Files\L&H
2008-01-15 12:36 . 2008-01-15 12:37 <DIR> d-------- C:\WINDOWS\SHELLNEW
2008-01-15 12:36 . 2008-01-15 12:36 <DIR> d-------- C:\Program Files\Microsoft Works
2008-01-14 18:42 . 2008-01-14 18:42 25 --a------ C:\WINDOWS\mixerdef.ini
2008-01-14 18:40 . 2008-01-14 18:40 <DIR> d-------- C:\Program Files\C-Media
2008-01-13 15:12 . 2005-06-28 10:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-01-13 15:08 . 2008-01-13 15:08 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-01-13 15:08 . 2008-01-16 13:39 <DIR> d-------- C:\Documents and Settings\ARTWORKS 2008\Application Data\AVG7
2008-01-13 15:08 . 2008-01-13 15:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 15:08 . 2008-01-16 15:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-01-13 15:08 . 2008-01-13 15:08 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2008-01-13 15:08 . 2008-01-13 15:08 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2008-01-13 15:06 . 2008-01-15 17:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$


.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 14:28 --------- d-----w C:\Program Files\microsoft frontpage
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 17:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-18 11:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-16_16.26.36.65 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-16 16:15:50 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-16 23:46:58 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-16 16:15:50 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-16 23:46:58 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-16 16:15:50 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-16 23:46:58 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-16 16:15:50 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-16 23:46:58 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-16 16:15:50 1,560,576 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-16 23:46:58 1,568,768 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-16 16:15:50 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-16 23:46:58 229,376 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-15 17:33:08 86,746 ----a-r C:\WINDOWS\Installer\{184E7118-0295-43C4-B72C-1D54AA75AAF7}\wlmail.exe
+ 2008-01-16 17:39:19 86,746 ----a-r C:\WINDOWS\Installer\{184E7118-0295-43C4-B72C-1D54AA75AAF7}\wlmail.exe
- 2008-01-15 17:35:34 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
+ 2008-01-16 17:40:24 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F}]
C:\Program Files\Outerinfo\Outerinfo.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C-Media Mixer"="Mixer.exe" [2002-07-13 00:33 1581056 C:\WINDOWS\mixer.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-13 15:08 145920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 2006-07-22 22:49 5376 C:\WINDOWS\system32\antiwpa.dll

R3 camvid20;Philips ToUcam Camera; Video;C:\WINDOWS\system32\DRIVERS\camdrv21.sys []

*Newly Created Service* - USNJSVC
*Newly Created Service* - WLSETUPSVC
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-16 23:49:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-16 23:49:35
ComboFix-quarantined-files.txt 2008-01-16 23:49:33
ComboFix2.txt 2008-01-16 16:26:48
.
2008-01-16 13:31:05 --- E O F ---
Daisydee08
Newbie
Newbie
 
Posts: 3
Joined: Wed Jan 16, 2008 5:12 pm

Thanks given:0
Thanks received:0
Top

Postby Gecko » Thu Jan 17, 2008 1:26 am

Daisydee08,

Start HijackThis and click "Do a system scan only" put a check next to each of the following entries:
O2 - BHO: (no name) - {2E9D4C81-9F27-4c14-B804-7B0F6BC88A4F} - C:\Program Files\Outerinfo\Outerinfo.dll (file missing)

Now click the "Fixed checked" button and then close HijackThis

Click Start, click My computer and then right click on your C: drive and select "Properties"
Now click the "Disk cleanup" button, in the next window put a check next to Recycle Bin, Temporary Internet Files and Temporary Files click OK and then click yes in the popup window.

That it you should be clean.
User avatar
Gecko
Super Moderator
Super Moderator
 
Posts: 5209
Joined: Thu Oct 25, 2001 1:00 am
Location: Florida, USA

Thanks given:1
Thanks received:23
Top

Postby Daisydee08 » Thu Jan 17, 2008 11:16 am

After re-installing AVG and full scan of my system, it detected a trojan horse dropper.agent.GIT in C:\QoBox\Quarantine\C\Windows\System32\ and the filename, awtsr.exe.vir but was successfully deleted.

I did another HijackThis log just to make sure i haven't got anymore of this malware:

Logfile of HijackThis v1.99.1
Scan saved at 9:54:29 AM, on 1/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\PROGRA~1\Grisoft\AVG7\avgwa.dat
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
---------------------------------E-O-F--------------------------------------------
Could you please confirm, and thanks a million for your time and expertise. I love your site! Would definitely recommend to peers! More power! :wink:
Daisydee08
Newbie
Newbie
 
Posts: 3
Joined: Wed Jan 16, 2008 5:12 pm

Thanks given:0
Thanks received:0
Top

Postby Gecko » Thu Jan 17, 2008 11:59 am

Daisydee08,

You log is clean

Thank you for your comments about our site.
User avatar
Gecko
Super Moderator
Super Moderator
 
Posts: 5209
Joined: Thu Oct 25, 2001 1:00 am
Location: Florida, USA

Thanks given:1
Thanks received:23
Top
Post a reply

Return to Malware Support

Who is online

Users browsing this forum: No registered users and 1 guest

cron