win32/Rootkit.Agent.ODG trojan - ESET

View previous topic View next topic Go down

win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 6th May 2009, 2:27 am

I got this virus when i ran the ESET NOD32 Antivirus:
Operating memory - win32/Rootkit.Agent.ODG trojan
I checked for other posts but it was mentioned that a new log should be created and the procedure to clean the virus might be different for this computer.
Problems: (1) when using search (google/yahoo or others) I am linked to some other website. (2) IE freezes unexpectedly. (3) Windows freezes when using IE. (4) Cannot use system restore to revert the problem. (5) Cannot use windows update anymore (although every thing is up to date as of yesterday) Sad tearing

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:52 PM, on 05/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A674191-42F3-429D-AB8E-8BEE15132409}: NameServer = 85.255.112.148,85.255.112.108
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7775 bytes

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 6th May 2009, 2:59 am

Hello karananand,

My name is Origin and I am going to be helping you out today Smile



Fix HijackThis entries:

  • Launch HijackThis
  • Click on the "Scan" button
  • Put a "check" on all of the items below
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8A674191-42F3-429D-AB8E-8BEE15132409}: NameServer = 85.255.112.148,85.255.112.108
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108

  • Close all browsers, open windows, etc..
  • Click on the "Fix Checked" button
  • When the fixing has finished, close hijackthis




: Malwarebytes' Anti-Malware :

    Please download
    Code:
    http://www.besttechie.net/tools/mbam-setup.exe
    Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to

    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 6th May 2009, 3:34 am

I did what you said earlier however I came accross a new problem. I could not run the Malwarebytes. It downloads and installs. after i say finish it does not open Malwarebytes. I tried reinstalling, restarting my computer, and then running the software. even tried Safe mode to run the software. but I cant see it run. i can see the icon floating on my desktop and thats it.

however, the instructions on Hijackthis was successfully performed.

What should I do?

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 6th May 2009, 11:35 pm

Oh I see lets try a different approach, Please do the following:


Download ComboFix from one of these locations:

[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 7th May 2009, 2:42 am

i did as you said; the combofix log is as follows: (i divided it into 2 replies as it was long)

ComboFix 09-05-06.02 - Administrator 06/05/2009 22:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.678 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated)
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system\oeminfo.ini
c:\windows\system32\Cache
c:\windows\system32\drivers\gxvxcgtqltehtavywvkfrmljimppuydgxnkja.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcomiqewyulvcwspkwbrafkqpkwfafahxy.dll
D:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gxvxcserv.sys
-------\Legacy_IPRIP
-------\Service_Iprip


((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-06 03:19 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-06 03:19 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-06 03:19 . 2009-05-06 03:19 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-06 03:19 . 2009-05-06 03:36 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-06 02:52 . 2009-05-06 02:52 -------- d-----w c:\program files\Common Files\DivX Shared
2009-05-06 02:52 . 2009-05-06 02:52 -------- d-----w c:\program files\DivX
2009-05-06 02:51 . 2009-05-06 02:51 -------- d-----w c:\windows\Sun
2009-05-06 02:09 . 2009-05-06 02:09 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-05-06 01:56 . 2009-05-06 01:56 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-05-06 01:56 . 2009-05-06 01:56 -------- d-----w c:\program files\Common Files\Adobe
2009-05-06 01:53 . 2009-05-06 01:53 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-05-06 01:53 . 2009-05-06 02:01 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-06 01:53 . 2009-05-06 02:01 -------- d-----w c:\program files\NOS
2009-05-05 03:59 . 2009-05-05 03:59 -------- d-----w c:\program files\Microsoft.NET
2009-05-05 03:57 . 2009-05-05 03:58 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-05-05 03:57 . 2009-05-05 03:59 -------- d-----w c:\windows\SHELLNEW
2009-05-05 03:57 . 2009-05-05 03:57 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help
2009-05-05 03:57 . 2009-05-05 04:05 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-05 03:56 . 2009-05-05 03:56 -------- d--h--r C:\MSOCache
2009-05-05 03:45 . 2009-05-05 03:45 28816 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-05 03:26 . 2009-05-05 03:26 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-05 03:26 . 2009-05-05 03:26 -------- d-sh--w c:\documents and settings\LocalService\IECompatCache
2009-05-05 03:25 . 2009-05-05 03:25 -------- d-sh--w c:\documents and settings\LocalService\PrivacIE
2009-05-05 03:25 . 2009-05-05 03:25 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Cooliris
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\program files\iPod
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\program files\iTunes
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\program files\Bonjour
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ESET
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\program files\QuickTime
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\program files\Apple Software Update
2009-05-05 02:59 . 2009-03-26 19:23 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-05-05 02:59 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-05-05 02:59 . 2009-05-05 03:01 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-05 02:59 . 2009-05-05 03:01 -------- d-----w c:\program files\Common Files\Apple
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-05-04 03:17 . 2009-05-05 03:46 -------- d-----w c:\documents and settings\Administrator\Application Data\Apple Computer
2009-05-04 03:17 . 2009-05-05 02:48 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\program files\Windows Desktop Search
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\windows\system32\GroupPolicy
2009-05-04 02:56 . 2008-03-07 17:02 29696 -c----w c:\windows\system32\dllcache\mimefilt.dll
2009-05-04 02:56 . 2008-03-07 17:02 98304 -c----w c:\windows\system32\dllcache\nlhtml.dll
2009-05-04 02:56 . 2008-03-07 17:02 192000 -c----w c:\windows\system32\dllcache\offfilt.dll
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w c:\windows\system32\XPSViewer
2009-05-03 16:50 . 2009-05-05 04:00 -------- d-----w c:\program files\MSBuild
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w c:\program files\Reference Assemblies
2009-05-03 16:50 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-05-03 16:50 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-03 16:50 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-03 16:50 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-03 16:50 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-05-03 16:50 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-05-03 16:50 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w C:\fa4ac064455a00574fa4fa
2009-05-03 16:25 . 2009-05-03 16:25 -------- d-----w c:\documents and settings\Administrator\Application Data\WinBatch
2009-05-03 16:15 . 2009-05-03 16:15 -------- d-----w c:\documents and settings\Administrator\Application Data\Roxio
2009-05-03 16:04 . 2009-05-03 16:04 -------- d-----w c:\program files\LSI SoftModem
2009-05-03 16:01 . 2001-08-18 02:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-03 16:01 . 2008-04-13 18:45 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-03 16:01 . 2008-04-13 18:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-03 16:01 . 2008-04-14 00:12 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-03 15:54 . 2009-05-03 15:54 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Cooliris
2009-05-03 15:54 . 2009-05-03 15:54 -------- d-----w c:\program files\PicLensIE
2009-05-03 15:49 . 2009-05-03 15:49 -------- d-sh--w c:\documents and settings\Administrator\PrivacIE
2009-05-03 15:49 . 2009-05-03 15:49 -------- d-sh--w c:\documents and settings\Administrator\IECompatCache
2009-05-03 15:40 . 2009-05-03 15:40 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-03 15:40 . 2009-05-03 15:40 -------- d-sh--w c:\documents and settings\Administrator\IETldCache
2009-05-03 15:36 . 2009-05-03 15:36 -------- d-----w c:\windows\ie8updates
2009-05-03 15:36 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-03 15:35 . 2009-05-03 15:36 -------- dc-h--w c:\windows\ie8
2009-05-03 15:22 . 2009-05-03 15:22 -------- d-----w C:\temp
2009-05-03 15:19 . 2009-05-03 15:19 -------- d-sh--w c:\documents and settings\Administrator\UserData
2009-05-03 04:52 . 2004-11-25 01:10 516096 ------w c:\windows\system32\ati2sgag.exe
2009-05-03 04:47 . 2001-08-17 17:48 12160 -c--a-w c:\windows\system32\dllcache\mouhid.sys
2009-05-03 04:47 . 2001-08-17 17:48 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-05-03 04:46 . 2001-08-18 02:36 8704 -c--a-w c:\windows\system32\dllcache\kbdjpn.dll
2009-05-03 04:46 . 2001-08-18 02:36 8704 ----a-w c:\windows\system32\kbdjpn.dll
2009-05-03 04:46 . 2008-04-14 00:09 6144 -c--a-w c:\windows\system32\dllcache\kbd106.dll
2009-05-03 04:46 . 2008-04-14 00:09 6144 ----a-w c:\windows\system32\kbd106.dll
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\scripting
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\l2schemas
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\en
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\bits
2009-05-03 04:23 . 2009-05-03 04:29 -------- d-----w c:\windows\ServicePackFiles
2009-05-03 04:04 . 2005-09-22 17:36 14854144 ----a-w c:\windows\RTHDCPL.EXE
2009-05-03 04:04 . 2004-10-27 19:47 40960 ------w c:\windows\system32\ChCfg.exe
2009-05-03 04:04 . 2009-05-03 16:03 -------- d-----w c:\windows\system32\RTCOM
2009-05-03 04:04 . 2009-05-03 04:04 -------- d-----w c:\program files\Realtek
2009-05-03 04:04 . 2005-04-17 02:20 487424 ------w c:\windows\RtlExUpd.dll
2009-05-03 03:38 . 2009-05-03 03:38 -------- d-----w c:\program files\ESET
2009-05-03 03:38 . 2009-05-03 03:38 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-03 03:23 . 2009-05-03 03:23 -------- d-----w c:\program files\MSXML 4.0
2009-05-03 02:08 . 2009-05-03 03:42 -------- d-----w c:\windows\system32\NtmsData
2009-05-03 01:59 . 2008-06-13 11:05 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-03 01:59 . 2008-06-13 11:05 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-03 01:56 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-03 01:53 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-03 01:53 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-03 01:52 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-03 01:51 . 2008-04-11 19:04 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-03 01:48 . 2008-10-15 16:34 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-03 01:47 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-03 01:47 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-02 19:47 . 2009-05-03 15:36 -------- d--h--w c:\windows\$hf_mig$
2009-05-02 19:32 . 2009-05-02 19:32 -------- d-----w c:\program files\Common Files\InterVideo
2009-05-02 19:27 . 2004-11-25 04:26 200704 ----a-w c:\windows\system32\ATIDEMGR.dll
2009-05-02 19:18 . 2004-08-10 19:00 31232 -c--a-w c:\windows\system32\dllcache\weitekp9.sys
2009-05-02 19:18 . 2004-08-10 19:00 41600 -c--a-w c:\windows\system32\dllcache\weitekp9.dll
2009-05-02 19:18 . 2004-08-10 19:00 48256 -c--a-w c:\windows\system32\dllcache\w32.dll
2009-05-02 19:18 . 2008-04-14 00:11 86073 -c--a-w c:\windows\system32\dllcache\voicesub.dll
2009-05-02 19:18 . 2008-04-14 00:11 426041 -c--a-w c:\windows\system32\dllcache\voicepad.dll
2009-05-02 19:18 . 2008-04-14 00:11 76288 -c--a-w c:\windows\system32\dllcache\uniime.dll
2009-05-02 19:16 . 2004-08-10 19:00 14848 -c--a-w c:\windows\system32\dllcache\flattemp.exe
2009-05-02 19:14 . 2004-08-10 19:00 16384 -c--a-w c:\windows\system32\dllcache\isignup.exe
2009-05-02 19:14 . 2008-10-16 18:13 202776 ----a-w c:\windows\system32\wuweb.dll
2009-05-02 19:14 . 2008-10-16 18:12 323608 ----a-w c:\windows\system32\wucltui.dll
2009-05-02 19:14 . 2008-04-14 00:12 183296 ----a-w c:\windows\system32\wuaueng1.dll
2009-05-02 19:14 . 2008-10-16 18:08 34328 -c--a-w c:\windows\system32\dllcache\wups.dll
2009-05-02 19:14 . 2008-10-16 18:08 34328 ----a-w c:\windows\system32\wups.dll
2009-05-02 19:14 . 2008-04-14 00:12 165888 ----a-w c:\windows\system32\wuauclt1.exe
2009-05-02 19:14 . 2008-10-16 18:12 561688 ----a-w c:\windows\system32\wuapi.dll
2009-05-02 19:14 . 2008-04-14 00:11 7168 ----a-w c:\windows\system32\bitsprx3.dll

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 7th May 2009, 2:43 am

---- Cont. from above:
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 01:51 . 2004-05-11 10:32 -------- d-----w c:\program files\Java
2009-05-05 04:00 . 2004-05-11 12:58 -------- d-----w c:\program files\Microsoft Works
2009-05-03 16:30 . 2004-05-11 12:27 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-03 16:29 . 2004-05-11 11:17 -------- d-----w c:\program files\HP
2009-05-03 16:28 . 2004-05-11 12:26 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-03 16:28 . 2004-05-11 12:27 -------- d-----w c:\program files\InterVideo
2009-05-03 16:13 . 2004-05-11 13:39 -------- d-----w c:\program files\PC-Doctor for Windows
2009-05-03 04:34 . 2004-05-11 09:28 92627 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-03 04:30 . 2009-05-03 04:30 356352 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Pavilion\XPENABS4EN\plugin\bin\jsharpde\client_motkt.dll
2009-05-03 02:04 . 2004-05-11 12:29 -------- d-----w c:\program files\Common Files\Real
2009-05-02 19:15 . 2004-05-11 09:10 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-02 19:12 . 2004-05-11 09:25 27580 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-02 06:29 . 2009-05-02 06:29 4036 --sha-r c:\windows\system32\drivers\HP_PC098A-ABA M1070N_YW_Pavi_QMXK433_E43NAhmEPT6_4_IPuffer_SASUSTeK Computer INC._V1.xx_B3.28_T060123_WXP1_L409_M1024_J500_7Intel_8Pentium 4_92.8_111063044_N10EC8139_P_Z11C1048C_K_A_U80862658_G10025B60_O_DBNQ7665.MRK
2009-03-25 10:29 . 2009-03-25 10:29 130432 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
2009-03-19 20:32 . 2003-11-04 02:47 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-13 17:28 . 2009-03-13 14:06 357101 ----a-w c:\windows\reset.exe
2009-03-08 22:06 . 2008-09-29 10:57 284 ----a-w c:\windows\esettrialreset.reg
2009-03-08 08:34 . 2004-08-10 19:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2004-08-10 19:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2004-08-10 19:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2004-08-10 19:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2004-08-10 19:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2004-08-10 19:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2004-08-10 19:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2004-08-10 19:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2004-08-10 19:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2004-08-10 19:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2004-08-10 19:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 16:18 . 2009-03-03 16:18 73728 ----a-w c:\windows\system32\RtNicProp32.dll
2009-02-09 12:10 . 2004-08-10 19:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-10 19:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-10 19:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-10 19:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-10 19:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 18:24 . 2009-02-06 18:24 93336 ----a-w c:\windows\system32\drivers\epfwtdir.sys
2009-02-06 18:23 . 2009-02-06 18:23 106208 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-02-06 18:19 . 2009-02-06 18:19 113448 ----a-w c:\windows\system32\drivers\eamon.sys
2009-02-06 11:11 . 2004-08-10 19:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-10 19:00 2145280 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-10 19:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe
2004-01-15 22:51 . 2009-05-02 09:10 0 --sha-w c:\windows\SMINST\HPCD.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-25 344064]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2005-09-21 2807808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^IMStart.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\IMStart.lnk
backup=c:\windows\pss\IMStart.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06/02/2009 2:23 PM 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06/02/2009 2:24 PM 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06/02/2009 2:23 PM 727720]
S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [10/08/2004 3:00 PM 3584]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\User_Feed_Synchronization-{9F069B90-FE0C-4ECE-BFE2-ED508F3C36C6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]

2009-05-07 c:\windows\Tasks\User_Feed_Synchronization-{CD255A74-B48B-4AAC-8110-D984260E1314}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-AutoTBar - c:\program files\HP\Digital Imaging\bin\AUTOTBAR.EXE


.
------- Supplementary Scan -------
.
uStart Page = about:blank
mSearch Bar = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = localhost;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-05-06 22:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ae,53,b3,7a,30,eb,39,4d,a4,39,a7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ae,53,b3,7a,30,eb,39,4d,a4,39,a7,\

[HKEY_USERS\S-1-5-21-2645035035-2345060998-798247177-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,53,9c,bc,b9,ae,17,cb,45,a9,66,04,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,53,9c,bc,b9,ae,17,cb,45,a9,66,04,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2668)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\msdtc.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\dllhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-05-07 22:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 02:30

Pre-Run: 299,896,999,936 bytes free
Post-Run: 300,157,919,232 bytes free

330 --- E O F --- 2009-05-03 17:14

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 7th May 2009, 4:48 am

1. Please download The Avenger by Swandog46 to your Desktop
Link: [You must be registered and logged in to see this link.] or [You must be registered and logged in to see this link.].

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 7th May 2009, 10:44 pm

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:00 pm

bounce

I did post the avenger log.. is the virus completely out of my system? I still have some mishaps on my computer but most of the problems are solved.

one of the problem is when i ask the computer to shut down it doesnot shut completely. It says "saving my settings" while shutting and freezes on that screen. And, when i restart, sometimes it freezes on the windows boot screen (the blue bar keeps on running but the computer does not start)

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 9th May 2009, 5:05 pm

We are still not done here ;)

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Belahzur on 9th May 2009, 5:07 pm

Hello.
Sorry for the delay.

The Combofix log looks good, no malware that I can see.

I'm gonna put down your issue to all the un-needed stuff you have running in the background, hogging your processor.

Post a new Hijack This log please.

[edit]
Ah, Origin jumps back online. LMBO or ROFL


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:28 pm

Malwarebytes' Anti-Malware 1.36
Database version: 2099
Windows 5.1.2600 Service Pack 3

09/05/2009 1:23:36 PM
mbam-log-2009-05-09 (13-23-36).txt

Scan type: Quick Scan
Objects scanned: 80679
Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8a674191-42f3-429d-ab8e-8bee15132409}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.148,85.255.112.108 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 9th May 2009, 5:28 pm

Please post a new HijackThis log

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:32 pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:30 PM, on 09/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - [You must be registered and logged in to see this link.]
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7122 bytes

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 9th May 2009, 5:35 pm


  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll



  • Press "Fix Checked"
  • Close Hijack This.





  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:51 pm

DDS (Ver_09-03-16.01) - NTFSx86
Run by Administrator at 13:39:37.01 on 09/05/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.519 [GMT -4:00]

AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
svchost.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = about:blank
mSearch Bar = [You must be registered and logged in to see this link.]
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: Cooliris Plug-In for Internet Explorer: {eaee5c74-6d0d-4aca-9232-0da4a7b866ba} - c:\program files\piclensie\cooliris.dll
TB: {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - No File
EB: {8F4902B6-6C04-4ade-8052-AA58578A21BD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [ehTray] c:\windows\ehome\ehtray.exe
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [AlcWzrd] ALCWZRD.EXE
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {3437D640-C91A-458f-89F5-B9095EA4C28B} - {04F93351-81D2-4484-9982-0D55DEFFFAE6} - c:\program files\piclensie\cooliris.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - [You must be registered and logged in to see this link.]
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - [You must be registered and logged in to see this link.]
Notify: AtiExtEvent - Ati2evxx.dll
Notify: igfxcui - igfxsrvc.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:53 pm

============= SERVICES / DRIVERS ===============

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-2-6 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-2-6 93336]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2009-2-6 727720]
S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [2004-8-10 3584]

=============== Created Last 30 ================

2009-05-09 13:18 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-05-09 13:18 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-09 13:18 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-05-09 11:12 --d-h--- c:\windows\PIF
2009-05-09 10:39 --d----- c:\documents and settings\administrator\Tracing
2009-05-09 10:16 --d----- c:\program files\Microsoft Office Outlook Connector
2009-05-09 10:16 --d----- c:\program files\Windows Live SkyDrive
2009-05-09 10:10 --d----- c:\program files\common files\Windows Live
2009-05-09 10:03 --d----- c:\program files\Microsoft
2009-05-08 23:15 --d----- c:\docume~1\admini~1\applic~1\Windows Search
2009-05-08 23:13 --d----- c:\docume~1\admini~1\applic~1\Malwarebytes
2009-05-07 20:19 --d----- c:\program files\MSECache
2009-05-06 22:20 161,792 a------- c:\windows\SWREG.exe
2009-05-06 22:20 98,816 a------- c:\windows\sed.exe
2009-05-05 23:19 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-05-05 22:52 --d----- c:\program files\DivX
2009-05-05 22:52 --d----- c:\program files\common files\DivX Shared
2009-05-05 21:29 73,728 a------- c:\windows\system32\javacpl.cpl
2009-05-04 23:57 --d----- c:\program files\Microsoft Visual Studio 8
2009-05-04 23:57 --d----- c:\windows\SHELLNEW
2009-05-04 23:01 --d----- c:\program files\iPod
2009-05-04 23:01 --d----- c:\program files\iTunes
2009-05-04 23:01 --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-04 23:00 --d----- c:\program files\Bonjour
2009-05-04 22:59 1,900,544 a------- c:\windows\system32\usbaaplrc.dll
2009-05-04 22:59 36,864 a------- c:\windows\system32\drivers\usbaapl.sys
2009-05-03 22:57 --d----- c:\docume~1\admini~1\applic~1\Windows Desktop Search
2009-05-03 22:57 --d----- c:\program files\Windows Desktop Search
2009-05-03 22:57 --d----- c:\windows\system32\GroupPolicy
2009-05-03 22:56 192,000 -c------ c:\windows\system32\dllcache\offfilt.dll
2009-05-03 22:56 98,304 -c------ c:\windows\system32\dllcache\nlhtml.dll
2009-05-03 22:56 29,696 -c------ c:\windows\system32\dllcache\mimefilt.dll
2009-05-03 13:12 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-05-03 12:50 --d----- c:\windows\system32\XPSViewer
2009-05-03 12:50 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-05-03 12:50 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-03 12:50 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-03 12:50 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-03 12:50 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-05-03 12:50 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-05-03 12:50 117,760 -------- c:\windows\system32\prntvpt.dll
2009-05-03 12:50 --d----- C:\fa4ac064455a00574fa4fa
2009-05-03 12:25 --d----- c:\docume~1\admini~1\applic~1\WinBatch
2009-05-03 12:04 --d----- c:\program files\LSI SoftModem
2009-05-03 12:01 5,632 a------- c:\windows\system32\ptpusb.dll
2009-05-03 12:01 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
2009-05-03 12:01 159,232 a------- c:\windows\system32\ptpusd.dll
2009-05-03 12:01 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-05-03 11:54 --d----- c:\program files\PicLensIE
2009-05-03 11:49 --dsh--- c:\documents and settings\administrator\PrivacIE
2009-05-03 11:49 --dsh--- c:\documents and settings\administrator\IECompatCache
2009-05-03 11:40 --dsh--- c:\documents and settings\administrator\IETldCache
2009-05-03 11:36 --d----- c:\windows\ie8updates
2009-05-03 11:36 102,400 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-05-03 11:35 -cd-h--- c:\windows\ie8
2009-05-03 11:22 --d----- C:\temp
2009-05-03 11:19 --dsh--- c:\documents and settings\administrator\UserData
2009-05-03 00:52 516,096 -------- c:\windows\system32\ati2sgag.exe
2009-05-03 00:47 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-05-03 00:47 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-05-03 00:46 8,704 ac------ c:\windows\system32\dllcache\kbdjpn.dll
2009-05-03 00:46 8,704 a------- c:\windows\system32\kbdjpn.dll
2009-05-03 00:46 6,144 ac------ c:\windows\system32\dllcache\kbd106.dll
2009-05-03 00:46 6,144 a------- c:\windows\system32\kbd106.dll
2009-05-03 00:28 --d----- c:\windows\system32\scripting
2009-05-03 00:28 --d----- c:\windows\l2schemas
2009-05-03 00:28 --d----- c:\windows\system32\en
2009-05-03 00:28 --d----- c:\windows\system32\bits
2009-05-03 00:23 --d----- c:\windows\ServicePackFiles
2009-05-03 00:20 --d----- c:\windows\network diagnostic
2009-05-03 00:04 14,854,144 a------- c:\windows\RTHDCPL.EXE
2009-05-03 00:04 266,240 a------- c:\windows\system32\RTSndMgr.CPL
2009-05-03 00:04 --d----- c:\windows\system32\RTCOM
2009-05-03 00:04 40,960 -------- c:\windows\system32\ChCfg.exe
2009-05-03 00:04 --d----- c:\program files\Realtek
2009-05-03 00:04 487,424 -------- c:\windows\RtlExUpd.dll
2009-05-02 23:38 --d----- c:\program files\ESET
2009-05-02 23:23 --d----- c:\program files\MSXML 4.0
2009-05-02 22:08 --d----- c:\windows\system32\NtmsData
2009-05-02 21:59 272,128 -c------ c:\windows\system32\dllcache\bthport.sys
2009-05-02 21:59 272,128 -------- c:\windows\system32\drivers\bthport.sys
2009-05-02 21:56 729,088 -c------ c:\windows\system32\dllcache\lsasrv.dll
2009-05-02 21:56 714,752 -c------ c:\windows\system32\dllcache\ntdll.dll
2009-05-02 21:56 617,472 -c------ c:\windows\system32\dllcache\advapi32.dll
2009-05-02 21:56 473,600 -c------ c:\windows\system32\dllcache\fastprox.dll
2009-05-02 21:56 453,120 -c------ c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-02 21:56 401,408 -c------ c:\windows\system32\dllcache\rpcss.dll
2009-05-02 21:56 284,160 -c------ c:\windows\system32\dllcache\pdh.dll
2009-05-02 21:56 227,840 -c------ c:\windows\system32\dllcache\wmiprvse.exe
2009-05-02 21:56 110,592 -c------ c:\windows\system32\dllcache\services.exe
2009-05-02 21:56 2,189,056 -c------ c:\windows\system32\dllcache\ntoskrnl.exe
2009-05-02 21:56 2,145,280 -c------ c:\windows\system32\dllcache\ntkrnlmp.exe
2009-05-02 21:56 2,023,936 -c------ c:\windows\system32\dllcache\ntkrpamp.exe
2009-05-02 21:53 203,136 -c------ c:\windows\system32\dllcache\rmcast.sys
2009-05-02 21:53 455,296 -c------ c:\windows\system32\dllcache\mrxsmb.sys
2009-05-02 21:52 1,396 a------- c:\windows\system32\wpa.bak
2009-05-02 21:52 333,952 -c------ c:\windows\system32\dllcache\srv.sys
2009-05-02 21:51 691,712 -c------ c:\windows\system32\dllcache\inetcomm.dll
2009-05-02 21:48 337,408 -c------ c:\windows\system32\dllcache\netapi32.dll
2009-05-02 21:47 215,552 -c------ c:\windows\system32\dllcache\wordpad.exe
2009-05-02 21:47 2,560 -------- c:\windows\system32\xpsp4res.dll
2009-05-02 15:47 --d----- c:\windows\system32\PreInstall
2009-05-02 15:47 --d-h--- c:\windows\$hf_mig$
2009-05-02 15:32 --d----- c:\program files\common files\InterVideo
2009-05-02 15:27 200,704 a------- c:\windows\system32\ATIDEMGR.dll
2009-05-02 15:27 9,054 a------- c:\windows\system32\atifglpf.xml
2009-05-02 15:21 --d----- c:\windows\system32\SoftwareDistribution
2009-05-02 15:17 14,336 ac------ c:\windows\system32\dllcache\tsprof.exe
2009-05-02 15:16 14,848 ac------ c:\windows\system32\dllcache\flattemp.exe
2009-05-02 15:15 488 a---hr-- c:\windows\system32\logonui.exe.manifest
2009-05-02 15:15 749 a---hr-- c:\windows\WindowsShell.Manifest
2009-05-02 15:15 749 a---hr-- c:\windows\system32\wuaucpl.cpl.manifest
2009-05-02 15:15 749 a---hr-- c:\windows\system32\sapi.cpl.manifest
2009-05-02 15:15 749 a---hr-- c:\windows\system32\nwc.cpl.manifest
2009-05-02 15:15 749 a---hr-- c:\windows\system32\ncpa.cpl.manifest
2009-05-02 15:11 11,452 a------- c:\windows\system32\mypixdx.chm
2009-05-02 15:11 --d----- c:\program files\Windows Plus
2009-05-02 15:11 1,742,336 a------- c:\windows\system32\mypixdx.scr
2009-05-02 15:11 7,093,760 a------- c:\windows\system32\space.scr
2009-05-02 15:11 4,396,544 a------- c:\windows\system32\wpgldfsh.scr
2009-05-02 15:11 3,343,360 a------- c:\windows\system32\nature.scr
2009-05-02 15:11 5,068,800 a------- c:\windows\system32\davinci.scr
2009-05-02 15:11 85,504 a------- c:\windows\system32\mhn.dll
2009-05-02 15:11 11,008 a------- c:\windows\system32\drivers\mhndrv.sys
2009-05-02 15:11 8,704 a------- c:\windows\system32\igdetect.dll
2009-05-02 15:11 9,728 ac------ c:\windows\system32\dllcache\wmm2eres.dll
2009-05-02 15:10 7,680 ac------ c:\windows\system32\dllcache\inetmgr.exe
2009-05-02 15:07 28,672 a------- c:\windows\system32\vidcap.ax
2009-05-02 15:02 13,753 a----r-- c:\windows\SET92.tmp
2009-05-02 15:02 1,086,058 a----r-- c:\windows\SET86.tmp
2009-05-02 15:02 106,147 a----r-- c:\windows\SET85.tmp
2009-05-02 14:50 53,760 a------- c:\windows\system32\vfwwdm32.dll
2009-05-02 14:46 297,344 a------- c:\windows\system32\drivers\cx88enc.sys
2009-05-02 14:46 160,128 a------- c:\windows\system32\drivers\cx88vid.sys
2009-05-02 14:46 57,344 a------- c:\windows\system32\cxtvrate.dll
2009-05-02 14:46 49,152 a------- c:\windows\system32\prxypage.ax
2009-05-02 14:46 40,270 a------- c:\windows\system32\cpnotify.ax
2009-05-02 14:46 30,976 a------- c:\windows\system32\drivers\cx88tune.sys
2009-05-02 14:46 9,344 a------- c:\windows\system32\drivers\cxavxbar.sys
2009-05-02 14:26 221,184 a------- c:\windows\system32\wmpns.dll
2009-05-02 13:03 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-02 12:57 --d----- c:\windows\pss
2009-05-02 12:47 0 a------- c:\windows\frontpg.ini
2009-05-02 12:44 --d----- c:\windows\IIS Temporary Compressed Files
2009-05-02 12:27 --d----- c:\windows\system32\appmgmt
2009-05-02 10:55 --d----- c:\windows\Provisioning
2009-05-02 10:55 --d----- c:\windows\PeerNet
2009-05-02 10:55 --d----- c:\windows\java
2009-05-02 05:22 182 a------- c:\windows\system\hpsysdrv.DAT
2009-05-02 05:20 52,864 a------- c:\windows\system32\drivers\dmusic.sys
2009-05-02 05:20 6,272 a------- c:\windows\system32\drivers\splitter.sys
2009-05-02 05:19 6,400 a------- c:\windows\system32\drivers\enum1394.sys
2009-05-02 05:11 9,710,592 a------- c:\windows\RTLCPL.EXE
2009-05-02 05:11 3,966,976 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-05-02 05:11 2,807,808 a------- c:\windows\ALCWZRD.EXE
2009-05-02 05:11 299,008 a------- c:\windows\system32\ALSNDMGR.CPL
2009-05-02 05:11 86,016 a------- c:\windows\SOUNDMAN.EXE
2009-05-02 05:11 69,632 a------- c:\windows\ALCMTR.EXE
2009-05-02 05:10 --d----- c:\windows\I386
2009-05-02 05:02 --d--r-- c:\documents and settings\all users\Documents
2009-05-02 05:01 --d--r-- c:\windows\Offline Web Pages
2009-05-02 05:01 -cdshr-- c:\windows\system32\dllcache
2009-05-02 04:32 59,904 ac------ c:\windows\system32\dllcache\wbemdisp.tlb
2009-05-02 04:31 364,544 ac------ c:\windows\system32\dllcache\npdsplay.dll
2009-05-02 04:30 12,876 a------- c:\windows\system32\korean.uce
2009-05-02 04:29 176,157 ac------ c:\windows\system32\dllcache\dgrpsetu.dll
2009-05-02 04:25 227,840 ac------ c:\windows\system32\dllcache\avtapi.dll
2009-05-02 04:25 73,216 ac------ c:\windows\system32\dllcache\avwav.dll
2009-05-02 04:25 16,384 ac------ c:\windows\system32\dllcache\avmeter.dll
2009-05-02 04:25 227,840 a------- c:\windows\system32\avtapi.dll
2009-05-02 04:25 73,216 a------- c:\windows\system32\avwav.dll
2009-05-02 04:25 69,584 a------- c:\windows\system\AVICAP.DLL
2009-05-02 04:25 16,384 a------- c:\windows\system32\avmeter.dll
2009-05-02 04:25 11,264 ac------ c:\windows\system32\dllcache\atrace.dll
2009-05-02 04:25 11,264 a------- c:\windows\system32\atrace.dll
2009-05-02 04:25 64,512 ac------ c:\windows\system32\dllcache\acctres.dll
2009-05-02 04:25 68,608 a------- c:\windows\system32\access.cpl
2009-05-02 04:25 64,512 a------- c:\windows\system32\acctres.dll
2009-05-02 02:35 146,650 a------- c:\windows\system32\BuzzingBee.wav
2009-05-02 02:35 125,690 a------- c:\windows\system32\LoopyMusic.wav
2009-05-02 02:35 60,416 a------- c:\windows\ALCFDRTM.VER
2009-05-02 02:33 --dshr-- C:\cmdcons
2009-05-02 02:33 --d----- c:\windows\setup.pss
2009-05-02 02:29 --d----- c:\windows\system32\Lang
2009-05-02 02:29 4,036 a--shr-- c:\windows\system32\drivers\HP_PC098A-ABA M1070N_YW_Pavi_QMXK433_E43NAhmEPT6_4_IPuffer_SASUSTeK Computer INC._V1.xx_B3.28_T060123_WXP1_L409_M1024_J500_7Intel_8Pentium 4_92.8_111063044_N10EC8139_P_Z11C1048C_K_A_U80862658_G10025B60_O_DBNQ7665.MRK
2009-05-02 02:28 21,060 a------- c:\windows\system32\drivers\iviaspi.sys
2009-05-02 02:28 10,368 a------- c:\windows\system32\drivers\pfc.sys
2009-05-02 02:27 204,800 a------- c:\windows\system32\IVIresizeW7.dll
2009-05-02 02:27 200,704 a------- c:\windows\system32\IVIresizeA6.dll
2009-05-02 02:27 192,512 a------- c:\windows\system32\IVIresizeP6.dll
2009-05-02 02:27 192,512 a------- c:\windows\system32\IVIresizeM6.dll
2009-05-02 02:27 188,416 a------- c:\windows\system32\IVIresizePX.dll
2009-05-02 02:27 20,480 a------- c:\windows\system32\IVIresize.dll
2009-05-02 02:27 --d----- c:\program files\common files\Sonic
2009-05-02 02:27 --d----- c:\program files\common files\SureThing Shared
2009-05-02 02:27 --d----- c:\program files\Sonic
2009-05-02 02:27 --d----- c:\program files\RecordNow!
2009-05-02 02:26 --d----- c:\program files\ATI Technologies

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 9th May 2009, 5:54 pm

Cont from previous (2):
==================== Find3M ====================

2009-05-03 00:34 92,627 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-05-03 00:30 356,352 a------- c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\pavilion\xpenabs4en\plugin\bin\jsharpde\client_motkt.dll
2009-05-02 15:12 27,580 a------- c:\windows\system32\emptyregdb.dat
2009-03-25 06:29 130,432 a------- c:\windows\system32\drivers\Rtnicxp.sys
2009-03-19 16:32 23,400 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-13 13:28 357,101 a------- c:\windows\reset.exe
2009-03-08 04:34 914,944 a------- c:\windows\system32\wininet.dll
2009-03-08 04:34 43,008 a------- c:\windows\system32\licmgr10.dll
2009-03-08 04:33 18,944 a------- c:\windows\system32\corpol.dll
2009-03-08 04:33 420,352 a------- c:\windows\system32\vbscript.dll
2009-03-08 04:32 72,704 a------- c:\windows\system32\admparse.dll
2009-03-08 04:32 71,680 a------- c:\windows\system32\iesetup.dll
2009-03-08 04:31 34,816 a------- c:\windows\system32\imgutil.dll
2009-03-08 04:31 48,128 a------- c:\windows\system32\mshtmler.dll
2009-03-08 04:31 45,568 a------- c:\windows\system32\mshta.exe
2009-03-08 04:22 156,160 a------- c:\windows\system32\msls31.dll
2009-03-06 10:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-03 12:18 73,728 a------- c:\windows\system32\RtNicProp32.dll
2009-02-27 00:56 177,152 a------- c:\windows\system32\SETA00.tmp
2009-02-09 08:10 729,088 a------- c:\windows\system32\lsasrv.dll
2009-02-09 08:10 714,752 a------- c:\windows\system32\ntdll.dll
2009-02-09 08:10 617,472 a------- c:\windows\system32\advapi32.dll
2009-02-09 08:10 401,408 a------- c:\windows\system32\rpcss.dll
2009-02-09 07:13 1,846,784 a------- c:\windows\system32\win32k.sys
2004-01-15 18:51 0 a--sh--- c:\windows\sminst\HPCD.SYS

============= FINISH: 13:39:55.17 ===============

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 9th May 2009, 6:24 pm

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    SET92.tmp
    SET86.tmp
    SET85.tmp


    :processes
    sed.exe




  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 10th May 2009, 3:23 am

========== FILES ==========
File/Folder SET92.tmp not found.
File/Folder SET86.tmp not found.
File/Folder SET85.tmp not found.
========== PROCESSES ==========
Unable to kill process: sed.exe

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05092009_232303

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 10th May 2009, 3:31 am

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    c:\windows\SET92.tmp
    c:\windows\SET85.tmp
    c:\windows\SET86.tmp




  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.




1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+CCrying



Files to delete:
c:\windows\sed.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Under "Input script here:", paste in the script from the quote box above.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 10th May 2009, 3:55 am

========== FILES ==========
c:\windows\SET92.tmp moved successfully.
c:\windows\SET85.tmp moved successfully.
c:\windows\SET86.tmp moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05092009_235313

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 10th May 2009, 4:02 am

Logfile of The Avenger Version 2.0, (c) by Swandog46
[You must be registered and logged in to see this link.]

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\sed.exe" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Origin on 10th May 2009, 4:48 pm

How are things on your end? Is the computer running smoother?

Origin
Master
Master

Posts Posts : 2685
Joined Joined : 2009-05-05
Gender Gender : Male
OS OS : Windows Xp Sp3
Points Points : 31493
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 11th May 2009, 3:54 am

oh yea .. it is getting better every time..
(as in no shut down problems now or starting problems; no problem with search engines or going to the windows update website and installing updates, so freezing or anything like it.. thx very much) but is it all done? and "Belahzur" replied once stating:
"I'm gonna put down your issue to all the un-needed stuff you have running in the background, hogging your processor."
are these processes still hogging my processor? could you please help me with what programs should be deleted from my system esp startup processes.. Thx a lot, Origin, for the same.

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 13th May 2009, 10:01 pm

bounce

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by Belahzur on 13th May 2009, 10:10 pm

Hello.

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
    O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


  • Press "Fix Checked"
  • Close Hijack This.

I recommend you remove the Java Quick Starter because it's not needed.
To do so, follow these instructions.

Go to Start > Control Panel > Java.
In the Java control panel, open the click the Advanced tab. Click the + in front of Miscellaneous and uncheck the Java Quick Starter box.

See [You must be registered and logged in to see this link.] for more info.

Reboot normally.
Let me know if performance is any faster.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245079
# Likes # Likes : 1

View user profile

Back to top Go down

Re: win32/Rootkit.Agent.ODG trojan - ESET

Post by karananand on 13th May 2009, 11:26 pm

The computer boots faster now and the processing speed has increased.. Thx!
But has the virus been completely eradicated from my computer?

karananand
Intermediate
Intermediate

Posts Posts : 74
Joined Joined : 2009-05-06
OS OS : XP
Points Points : 28482
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum