WiredWX Hobby Weather ToolsLog in

 


win32/Rootkit.Agent.ODG trojan - ESET

3 posters

descriptionwin32/Rootkit.Agent.ODG trojan - ESET Emptywin32/Rootkit.Agent.ODG trojan - ESET

more_horiz
I got this virus when i ran the ESET NOD32 Antivirus:
Operating memory - win32/Rootkit.Agent.ODG trojan
I checked for other posts but it was mentioned that a new log should be created and the procedure to clean the virus might be different for this computer.
Problems: (1) when using search (google/yahoo or others) I am linked to some other website. (2) IE freezes unexpectedly. (3) Windows freezes when using IE. (4) Cannot use system restore to revert the problem. (5) Cannot use windows update anymore (although every thing is up to date as of yesterday) Sad tearing

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:52 PM, on 05/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\ALCMTR.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrator\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [AutoTBar] c:\Program Files\HP\Digital Imaging\bin\AUTOTBAR.EXE
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8A674191-42F3-429D-AB8E-8BEE15132409}: NameServer = 85.255.112.148,85.255.112.108
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7775 bytes

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Hello karananand,

My name is Origin and I am going to be helping you out today Smile...



Fix HijackThis entries:

  • Launch HijackThis
  • Click on the "Scan" button
  • Put a "check" on all of the items below
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
    O17 - HKLM\System\CCS\Services\Tcpip\..\{8A674191-42F3-429D-AB8E-8BEE15132409}: NameServer = 85.255.112.148,85.255.112.108
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.148,85.255.112.108

  • Close all browsers, open windows, etc..
  • Click on the "Fix Checked" button
  • When the fixing has finished, close hijackthis




: Malwarebytes' Anti-Malware :

    Please download

    Code:

    http://www.besttechie.net/tools/mbam-setup.exe
    Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to

    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is Checked (ticked) except items in the C:\System Volume Information folder and click on Remove Selected.
  • When completed, a log will open in Notepad. please copy and paste the log into your next reply
    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt


Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
I did what you said earlier however I came accross a new problem. I could not run the Malwarebytes. It downloads and installs. after i say finish it does not open Malwarebytes. I tried reinstalling, restarting my computer, and then running the software. even tried Safe mode to run the software. but I cant see it run. i can see the icon floating on my desktop and thats it.

however, the instructions on Hijackthis was successfully performed.

What should I do?

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Oh I see lets try a different approach, Please do the following:


Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

win32/Rootkit.Agent.ODG trojan - ESET RcAuto1


Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

win32/Rootkit.Agent.ODG trojan - ESET Whatnext

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
i did as you said; the combofix log is as follows: (i divided it into 2 replies as it was long)

ComboFix 09-05-06.02 - Administrator 06/05/2009 22:25.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.678 [GMT -4:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated)
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\windows\system\oeminfo.ini
c:\windows\system32\Cache
c:\windows\system32\drivers\gxvxcgtqltehtavywvkfrmljimppuydgxnkja.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxcomiqewyulvcwspkwbrafkqpkwfafahxy.dll
D:\Autorun.inf
G:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_gxvxcserv.sys
-------\Legacy_IPRIP
-------\Service_Iprip


((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.

2009-05-06 03:19 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-06 03:19 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-06 03:19 . 2009-05-06 03:19 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-06 03:19 . 2009-05-06 03:36 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-06 02:52 . 2009-05-06 02:52 -------- d-----w c:\program files\Common Files\DivX Shared
2009-05-06 02:52 . 2009-05-06 02:52 -------- d-----w c:\program files\DivX
2009-05-06 02:51 . 2009-05-06 02:51 -------- d-----w c:\windows\Sun
2009-05-06 02:09 . 2009-05-06 02:09 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2009-05-06 01:56 . 2009-05-06 01:56 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-05-06 01:56 . 2009-05-06 01:56 -------- d-----w c:\program files\Common Files\Adobe
2009-05-06 01:53 . 2009-05-06 01:53 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2009-05-06 01:53 . 2009-05-06 02:01 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-06 01:53 . 2009-05-06 02:01 -------- d-----w c:\program files\NOS
2009-05-05 03:59 . 2009-05-05 03:59 -------- d-----w c:\program files\Microsoft.NET
2009-05-05 03:57 . 2009-05-05 03:58 -------- d-----w c:\program files\Microsoft Visual Studio 8
2009-05-05 03:57 . 2009-05-05 03:59 -------- d-----w c:\windows\SHELLNEW
2009-05-05 03:57 . 2009-05-05 03:57 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft Help
2009-05-05 03:57 . 2009-05-05 04:05 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-05 03:56 . 2009-05-05 03:56 -------- d--h--r C:\MSOCache
2009-05-05 03:45 . 2009-05-05 03:45 28816 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-05 03:26 . 2009-05-05 03:26 -------- d-sh--w c:\documents and settings\LocalService\IETldCache
2009-05-05 03:26 . 2009-05-05 03:26 -------- d-sh--w c:\documents and settings\LocalService\IECompatCache
2009-05-05 03:25 . 2009-05-05 03:25 -------- d-sh--w c:\documents and settings\LocalService\PrivacIE
2009-05-05 03:25 . 2009-05-05 03:25 -------- d-----w c:\documents and settings\LocalService\Local Settings\Application Data\Cooliris
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\program files\iPod
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-05 03:01 . 2009-05-05 03:01 -------- d-----w c:\program files\iTunes
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\program files\Bonjour
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\ESET
2009-05-05 03:00 . 2009-05-05 03:00 -------- d-----w c:\program files\QuickTime
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\program files\Apple Software Update
2009-05-05 02:59 . 2009-03-26 19:23 36864 ----a-w c:\windows\system32\drivers\usbaapl.sys
2009-05-05 02:59 . 2009-03-26 19:23 1900544 ----a-w c:\windows\system32\usbaaplrc.dll
2009-05-05 02:59 . 2009-05-05 03:01 -------- dc----w c:\windows\system32\DRVSTORE
2009-05-05 02:59 . 2009-05-05 03:01 -------- d-----w c:\program files\Common Files\Apple
2009-05-05 02:59 . 2009-05-05 02:59 -------- d-----w c:\documents and settings\All Users\Application Data\Apple
2009-05-04 03:17 . 2009-05-05 03:46 -------- d-----w c:\documents and settings\Administrator\Application Data\Apple Computer
2009-05-04 03:17 . 2009-05-05 02:48 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Identities
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\program files\Windows Desktop Search
2009-05-04 02:57 . 2009-05-04 02:57 -------- d-----w c:\windows\system32\GroupPolicy
2009-05-04 02:56 . 2008-03-07 17:02 29696 -c----w c:\windows\system32\dllcache\mimefilt.dll
2009-05-04 02:56 . 2008-03-07 17:02 98304 -c----w c:\windows\system32\dllcache\nlhtml.dll
2009-05-04 02:56 . 2008-03-07 17:02 192000 -c----w c:\windows\system32\dllcache\offfilt.dll
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w c:\windows\system32\XPSViewer
2009-05-03 16:50 . 2009-05-05 04:00 -------- d-----w c:\program files\MSBuild
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w c:\program files\Reference Assemblies
2009-05-03 16:50 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-05-03 16:50 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-05-03 16:50 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-05-03 16:50 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-05-03 16:50 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-05-03 16:50 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-05-03 16:50 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-05-03 16:50 . 2009-05-03 16:50 -------- d-----w C:\fa4ac064455a00574fa4fa
2009-05-03 16:25 . 2009-05-03 16:25 -------- d-----w c:\documents and settings\Administrator\Application Data\WinBatch
2009-05-03 16:15 . 2009-05-03 16:15 -------- d-----w c:\documents and settings\Administrator\Application Data\Roxio
2009-05-03 16:04 . 2009-05-03 16:04 -------- d-----w c:\program files\LSI SoftModem
2009-05-03 16:01 . 2001-08-18 02:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-05-03 16:01 . 2008-04-13 18:45 15104 -c--a-w c:\windows\system32\dllcache\usbscan.sys
2009-05-03 16:01 . 2008-04-13 18:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-05-03 16:01 . 2008-04-14 00:12 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-05-03 15:54 . 2009-05-03 15:54 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Cooliris
2009-05-03 15:54 . 2009-05-03 15:54 -------- d-----w c:\program files\PicLensIE
2009-05-03 15:49 . 2009-05-03 15:49 -------- d-sh--w c:\documents and settings\Administrator\PrivacIE
2009-05-03 15:49 . 2009-05-03 15:49 -------- d-sh--w c:\documents and settings\Administrator\IECompatCache
2009-05-03 15:40 . 2009-05-03 15:40 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-05-03 15:40 . 2009-05-03 15:40 -------- d-sh--w c:\documents and settings\Administrator\IETldCache
2009-05-03 15:36 . 2009-05-03 15:36 -------- d-----w c:\windows\ie8updates
2009-05-03 15:36 . 2009-02-28 04:55 105984 -c----w c:\windows\system32\dllcache\iecompat.dll
2009-05-03 15:35 . 2009-05-03 15:36 -------- dc-h--w c:\windows\ie8
2009-05-03 15:22 . 2009-05-03 15:22 -------- d-----w C:\temp
2009-05-03 15:19 . 2009-05-03 15:19 -------- d-sh--w c:\documents and settings\Administrator\UserData
2009-05-03 04:52 . 2004-11-25 01:10 516096 ------w c:\windows\system32\ati2sgag.exe
2009-05-03 04:47 . 2001-08-17 17:48 12160 -c--a-w c:\windows\system32\dllcache\mouhid.sys
2009-05-03 04:47 . 2001-08-17 17:48 12160 ----a-w c:\windows\system32\drivers\mouhid.sys
2009-05-03 04:46 . 2001-08-18 02:36 8704 -c--a-w c:\windows\system32\dllcache\kbdjpn.dll
2009-05-03 04:46 . 2001-08-18 02:36 8704 ----a-w c:\windows\system32\kbdjpn.dll
2009-05-03 04:46 . 2008-04-14 00:09 6144 -c--a-w c:\windows\system32\dllcache\kbd106.dll
2009-05-03 04:46 . 2008-04-14 00:09 6144 ----a-w c:\windows\system32\kbd106.dll
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\scripting
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\l2schemas
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\en
2009-05-03 04:28 . 2009-05-03 04:28 -------- d-----w c:\windows\system32\bits
2009-05-03 04:23 . 2009-05-03 04:29 -------- d-----w c:\windows\ServicePackFiles
2009-05-03 04:04 . 2005-09-22 17:36 14854144 ----a-w c:\windows\RTHDCPL.EXE
2009-05-03 04:04 . 2004-10-27 19:47 40960 ------w c:\windows\system32\ChCfg.exe
2009-05-03 04:04 . 2009-05-03 16:03 -------- d-----w c:\windows\system32\RTCOM
2009-05-03 04:04 . 2009-05-03 04:04 -------- d-----w c:\program files\Realtek
2009-05-03 04:04 . 2005-04-17 02:20 487424 ------w c:\windows\RtlExUpd.dll
2009-05-03 03:38 . 2009-05-03 03:38 -------- d-----w c:\program files\ESET
2009-05-03 03:38 . 2009-05-03 03:38 -------- d-----w c:\documents and settings\All Users\Application Data\ESET
2009-05-03 03:23 . 2009-05-03 03:23 -------- d-----w c:\program files\MSXML 4.0
2009-05-03 02:08 . 2009-05-03 03:42 -------- d-----w c:\windows\system32\NtmsData
2009-05-03 01:59 . 2008-06-13 11:05 272128 -c----w c:\windows\system32\dllcache\bthport.sys
2009-05-03 01:59 . 2008-06-13 11:05 272128 ------w c:\windows\system32\drivers\bthport.sys
2009-05-03 01:56 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll
2009-05-03 01:53 . 2008-05-08 14:02 203136 -c----w c:\windows\system32\dllcache\rmcast.sys
2009-05-03 01:53 . 2008-10-24 11:21 455296 -c----w c:\windows\system32\dllcache\mrxsmb.sys
2009-05-03 01:52 . 2008-12-11 10:57 333952 -c----w c:\windows\system32\dllcache\srv.sys
2009-05-03 01:51 . 2008-04-11 19:04 691712 -c----w c:\windows\system32\dllcache\inetcomm.dll
2009-05-03 01:48 . 2008-10-15 16:34 337408 -c----w c:\windows\system32\dllcache\netapi32.dll
2009-05-03 01:47 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-03 01:47 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-05-02 19:47 . 2009-05-03 15:36 -------- d--h--w c:\windows\$hf_mig$
2009-05-02 19:32 . 2009-05-02 19:32 -------- d-----w c:\program files\Common Files\InterVideo
2009-05-02 19:27 . 2004-11-25 04:26 200704 ----a-w c:\windows\system32\ATIDEMGR.dll
2009-05-02 19:18 . 2004-08-10 19:00 31232 -c--a-w c:\windows\system32\dllcache\weitekp9.sys
2009-05-02 19:18 . 2004-08-10 19:00 41600 -c--a-w c:\windows\system32\dllcache\weitekp9.dll
2009-05-02 19:18 . 2004-08-10 19:00 48256 -c--a-w c:\windows\system32\dllcache\w32.dll
2009-05-02 19:18 . 2008-04-14 00:11 86073 -c--a-w c:\windows\system32\dllcache\voicesub.dll
2009-05-02 19:18 . 2008-04-14 00:11 426041 -c--a-w c:\windows\system32\dllcache\voicepad.dll
2009-05-02 19:18 . 2008-04-14 00:11 76288 -c--a-w c:\windows\system32\dllcache\uniime.dll
2009-05-02 19:16 . 2004-08-10 19:00 14848 -c--a-w c:\windows\system32\dllcache\flattemp.exe
2009-05-02 19:14 . 2004-08-10 19:00 16384 -c--a-w c:\windows\system32\dllcache\isignup.exe
2009-05-02 19:14 . 2008-10-16 18:13 202776 ----a-w c:\windows\system32\wuweb.dll
2009-05-02 19:14 . 2008-10-16 18:12 323608 ----a-w c:\windows\system32\wucltui.dll
2009-05-02 19:14 . 2008-04-14 00:12 183296 ----a-w c:\windows\system32\wuaueng1.dll
2009-05-02 19:14 . 2008-10-16 18:08 34328 -c--a-w c:\windows\system32\dllcache\wups.dll
2009-05-02 19:14 . 2008-10-16 18:08 34328 ----a-w c:\windows\system32\wups.dll
2009-05-02 19:14 . 2008-04-14 00:12 165888 ----a-w c:\windows\system32\wuauclt1.exe
2009-05-02 19:14 . 2008-10-16 18:12 561688 ----a-w c:\windows\system32\wuapi.dll
2009-05-02 19:14 . 2008-04-14 00:11 7168 ----a-w c:\windows\system32\bitsprx3.dll

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
---- Cont. from above:
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-06 01:51 . 2004-05-11 10:32 -------- d-----w c:\program files\Java
2009-05-05 04:00 . 2004-05-11 12:58 -------- d-----w c:\program files\Microsoft Works
2009-05-03 16:30 . 2004-05-11 12:27 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-03 16:29 . 2004-05-11 11:17 -------- d-----w c:\program files\HP
2009-05-03 16:28 . 2004-05-11 12:26 -------- d-----w c:\program files\Common Files\InstallShield
2009-05-03 16:28 . 2004-05-11 12:27 -------- d-----w c:\program files\InterVideo
2009-05-03 16:13 . 2004-05-11 13:39 -------- d-----w c:\program files\PC-Doctor for Windows
2009-05-03 04:34 . 2004-05-11 09:28 92627 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-05-03 04:30 . 2009-05-03 04:30 356352 ----a-w c:\windows\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Pavilion\XPENABS4EN\plugin\bin\jsharpde\client_motkt.dll
2009-05-03 02:04 . 2004-05-11 12:29 -------- d-----w c:\program files\Common Files\Real
2009-05-02 19:15 . 2004-05-11 09:10 67 --sha-w c:\windows\Fonts\desktop.ini
2009-05-02 19:12 . 2004-05-11 09:25 27580 ----a-w c:\windows\system32\emptyregdb.dat
2009-05-02 06:29 . 2009-05-02 06:29 4036 --sha-r c:\windows\system32\drivers\HP_PC098A-ABA M1070N_YW_Pavi_QMXK433_E43NAhmEPT6_4_IPuffer_SASUSTeK Computer INC._V1.xx_B3.28_T060123_WXP1_L409_M1024_J500_7Intel_8Pentium 4_92.8_111063044_N10EC8139_P_Z11C1048C_K_A_U80862658_G10025B60_O_DBNQ7665.MRK
2009-03-25 10:29 . 2009-03-25 10:29 130432 ----a-w c:\windows\system32\drivers\Rtnicxp.sys
2009-03-19 20:32 . 2003-11-04 02:47 23400 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
2009-03-13 17:28 . 2009-03-13 14:06 357101 ----a-w c:\windows\reset.exe
2009-03-08 22:06 . 2008-09-29 10:57 284 ----a-w c:\windows\esettrialreset.reg
2009-03-08 08:34 . 2004-08-10 19:00 914944 ----a-w c:\windows\system32\wininet.dll
2009-03-08 08:34 . 2004-08-10 19:00 43008 ----a-w c:\windows\system32\licmgr10.dll
2009-03-08 08:33 . 2004-08-10 19:00 18944 ----a-w c:\windows\system32\corpol.dll
2009-03-08 08:33 . 2004-08-10 19:00 420352 ----a-w c:\windows\system32\vbscript.dll
2009-03-08 08:32 . 2004-08-10 19:00 72704 ----a-w c:\windows\system32\admparse.dll
2009-03-08 08:32 . 2004-08-10 19:00 71680 ----a-w c:\windows\system32\iesetup.dll
2009-03-08 08:31 . 2004-08-10 19:00 34816 ----a-w c:\windows\system32\imgutil.dll
2009-03-08 08:31 . 2004-08-10 19:00 48128 ----a-w c:\windows\system32\mshtmler.dll
2009-03-08 08:31 . 2004-08-10 19:00 45568 ----a-w c:\windows\system32\mshta.exe
2009-03-08 08:22 . 2004-08-10 19:00 156160 ----a-w c:\windows\system32\msls31.dll
2009-03-06 14:22 . 2004-08-10 19:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 16:18 . 2009-03-03 16:18 73728 ----a-w c:\windows\system32\RtNicProp32.dll
2009-02-09 12:10 . 2004-08-10 19:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-10 19:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-10 19:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-10 19:00 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-10 19:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-06 18:24 . 2009-02-06 18:24 93336 ----a-w c:\windows\system32\drivers\epfwtdir.sys
2009-02-06 18:23 . 2009-02-06 18:23 106208 ----a-w c:\windows\system32\drivers\ehdrv.sys
2009-02-06 18:19 . 2009-02-06 18:19 113448 ----a-w c:\windows\system32\drivers\eamon.sys
2009-02-06 11:11 . 2004-08-10 19:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-10 19:00 2145280 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-10 19:00 35328 ----a-w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-03 22:59 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe
2004-01-15 22:51 . 2009-05-02 09:10 0 --sha-w c:\windows\SMINST\HPCD.SYS
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-25 344064]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-02-06 2021400]
"KBD"="c:\hp\KBD\KBD.EXE" [2005-02-02 61440]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-06 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2004-06-29 88363]
"MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2008-04-14 177152]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" - c:\windows\ALCWZRD.EXE [2005-09-21 2807808]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]

[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^IMStart.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\IMStart.lnk
backup=c:\windows\pss\IMStart.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk
backup=c:\windows\pss\Updates from HP.lnkCommon Startup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [06/02/2009 2:23 PM 106208]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [06/02/2009 2:24 PM 93336]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [06/02/2009 2:23 PM 727720]
S2 .EsetTrialReset;Eset Trial Reset;c:\windows\system32\regedt32.exe [10/08/2004 3:00 PM 3584]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\User_Feed_Synchronization-{9F069B90-FE0C-4ECE-BFE2-ED508F3C36C6}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]

2009-05-07 c:\windows\Tasks\User_Feed_Synchronization-{CD255A74-B48B-4AAC-8110-D984260E1314}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-AutoTBar - c:\program files\HP\Digital Imaging\bin\AUTOTBAR.EXE


.
------- Supplementary Scan -------
.
uStart Page = about:blank
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
uInternet Settings,ProxyOverride = localhost;*.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-06 22:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ae,53,b3,7a,30,eb,39,4d,a4,39,a7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,ae,53,b3,7a,30,eb,39,4d,a4,39,a7,\

[HKEY_USERS\S-1-5-21-2645035035-2345060998-798247177-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,53,9c,bc,b9,ae,17,cb,45,a9,66,04,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,53,9c,bc,b9,ae,17,cb,45,a9,66,04,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2668)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\OneX.DLL
c:\windows\system32\eappprxy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\msdtc.exe
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\system32\snmp.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\mqtgsvc.exe
c:\windows\eHome\ehmsas.exe
c:\windows\system32\dllhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-05-07 22:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 02:30

Pre-Run: 299,896,999,936 bytes free
Post-Run: 300,157,919,232 bytes free

330 --- E O F --- 2009-05-03 17:14

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


2. Now, start The Avenger program by clicking on its icon on your desktop.

  • Leave the script box empty.
  • Leave the ticked box "Scan for rootkit" ticked.
  • Then tick "Disable any rootkits found"
  • Now click on the Execute to begin execution of the script.
  • Answer "Yes" twice when prompted.

    The Avenger will automatically do the following:

  • It will Restart your computer.
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
3. Please copy/paste the content of c:\avenger.txt into your reply.

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
bounce

I did post the avenger log.. is the virus completely out of my system? I still have some mishaps on my computer but most of the problems are solved.

one of the problem is when i ask the computer to shut down it doesnot shut completely. It says "saving my settings" while shutting and freezes on that screen. And, when i restart, sometimes it freezes on the windows boot screen (the blue bar keeps on running but the computer does not start)

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
We are still not done here Wink

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Hello.
Sorry for the delay.

The Combofix log looks good, no malware that I can see.

I'm gonna put down your issue to all the un-needed stuff you have running in the background, hogging your processor.

Post a new Hijack This log please.

[edit]
Ah, Origin jumps back online. LMBO or ROFL

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Malwarebytes' Anti-Malware 1.36
Database version: 2099
Windows 5.1.2600 Service Pack 3

09/05/2009 1:23:36 PM
mbam-log-2009-05-09 (13-23-36).txt

Scan type: Quick Scan
Objects scanned: 80679
Time elapsed: 2 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{8a674191-42f3-429d-ab8e-8bee15132409}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.148,85.255.112.108 -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Please post a new HijackThis log

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:31:30 PM, on 09/05/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\HP\KBD\KBD.EXE
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\mqsvc.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\System32\mqtgsvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Administrator\Desktop\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=Q304&bd=pavilion&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Cooliris Plug-In for Internet Explorer - {EAEE5C74-6D0D-4aca-9232-0DA4A7B866BA} - C:\Program Files\PicLensIE\cooliris.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [UpdateManager] "c:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Launch Cooliris - {3437D640-C91A-458f-89F5-B9095EA4C28B} - C:\Program Files\PicLensIE\cooliris.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1241839540734
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Program Files\LSI SoftModem\agrsmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 7122 bytes

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz

  • Open HijackThis
  • Choose "Do a system scan only"
  • Check the boxes in front of these lines:


    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost;*.local
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll



  • Press "Fix Checked"
  • Close Hijack This.





  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    Link 1
    Link 2
  • Double click DDS.scr to run
  • When complete, two logs will open. Save both of the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.

descriptionwin32/Rootkit.Agent.ODG trojan - ESET EmptyRe: win32/Rootkit.Agent.ODG trojan - ESET

more_horiz
privacy_tip Permissions in this forum:
You cannot reply to topics in this forum