trojan agents that won't go away

alexinc · May 18, 2012

ComboFix 12-05-18.03 - Administrator 05/18/2012 16:16:44.4.2 - x86

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

.

FILE ::

"c:\windows\system32\02000000c27ec2a91406C.manifest"

"c:\windows\system32\02000000c27ec2a91406O.manifest"

"c:\windows\system32\02000000c27ec2a91406P.manifest"

"c:\windows\system32\02000000c27ec2a91406S.manifest"

"c:\windows\system32\atipdlxx32.dll"

c:\windows\system32\vbscript.dll is missing

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\02000000c27ec2a91406C.manifest

c:\windows\system32\02000000c27ec2a91406O.manifest

c:\windows\system32\02000000c27ec2a91406P.manifest

c:\windows\system32\02000000c27ec2a91406S.manifest

c:\windows\system32\atipdlxx32.dll

.

((((((((((((((((((((((((( Files Created from 2012-04-18 to 2012-05-18 )))))))))))))))))))))))))))))))

.

2012-05-18 22:47 . 2011-08-16 22:08 1208832 ----a-w- c:\windows\system32\odpdx3232.exe

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\windows\system32\wbem\snmp

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\windows\system32\xircom

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\windows\system32\oobe

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\windows\srchasst

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\windows\msagent

2012-05-16 22:38 . 2012-05-16 22:38 -------- d-----w- c:\program files\microsoft frontpage

2012-05-14 23:57 . 2012-05-14 23:57 -------- d-----w- C:\TDSSKiller_Quarantine

2012-05-14 23:17 . 2012-05-14 23:22 -------- d-----w- c:\windows\SxsCaPendDel

2012-05-14 23:14 . 2012-05-14 23:14 -------- d-----w- c:\windows\system32\syncdb

2012-04-29 23:41 . 2012-04-29 23:41 -------- d-----w- c:\program files\Common Files\Java

2012-04-29 23:40 . 2012-04-29 23:40 73728 ----a-w- c:\windows\system32\javacpl.cpl

2012-04-29 23:40 . 2012-04-29 23:40 476960 ----a-w- c:\windows\system32\npdeployJava1.dll

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-04-29 23:40 . 2010-08-02 04:07 472864 -c--a-w- c:\windows\system32\deployJava1.dll

2012-04-04 22:56 . 2010-02-08 23:45 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-03-26 21:24 . 2012-03-30 21:48 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(5).sys

2012-03-26 21:24 . 2012-03-30 21:48 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(4).sys

2012-03-26 21:24 . 2012-03-30 21:48 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(3).sys

2012-03-26 21:24 . 2012-03-30 21:48 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(2).sys

2012-03-26 21:24 . 2012-03-30 21:47 25704 ----a-w- c:\windows\system32\drivers\WsAudio_DeviceS(1).sys

.

------- Sigcheck -------

Note: Unsigned files aren't necessarily malware.

.

[-] 2009-03-03 . A29E1209F925A0E9B330E11DA5FC7BAB . 361600 . . [5.1.2600.5625] . . c:\windows\system32\drivers\tcpip.sys

.

((((((((((((((((((((((((((((( SnapShot@2012-05-16_22.38.27 )))))))))))))))))))))))))))))))))))))))))

.

+ 2012-05-18 23:21 . 2012-05-18 23:21 16384 c:\windows\Temp\Perflib_Perfdata_730.dat

+ 2001-08-23 13:00 . 2012-05-18 23:12 58170 c:\windows\system32\perfc009.dat

- 2001-08-23 13:00 . 2012-05-16 22:29 58170 c:\windows\system32\perfc009.dat

+ 2001-08-23 13:00 . 2012-05-18 23:12 392690 c:\windows\system32\perfh009.dat

- 2001-08-23 13:00 . 2012-05-16 22:29 392690 c:\windows\system32\perfh009.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]

@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]

@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]

@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]

@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"

[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]

2011-02-18 05:12 94208 ----a-w- c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.14.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-02-11 61440]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-21 59240]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2012-03-27 421736]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]

.

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"_nltide_3"="advpack.dll" [2008-04-14 99840]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"DisableCAD"= 1 (0x1)

.

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]

"NoResolveTrack"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

.

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoSMHelp"= 1 (0x1)

"ForceClassicControlPanel"= 1 (0x1)

"NoResolveTrack"= 1 (0x1)

"NoSMMyPictures"= 1 (0x1)

"NoSMConfigurePrograms"= 1 (0x1)

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]

2008-10-17 03:35 87352 ----a-w- c:\windows\system32\LMIinit.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"midi1"=ma_cmidn.dll

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

.

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Documents and Settings\\Administrator\\Application Data\\Dropbox\\bin\\Dropbox.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

.

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]

R3 WsAudio_DeviceS(1);WsAudio_DeviceS(1);c:\windows\system32\drivers\WsAudio_DeviceS(1).sys [2012-03-26 25704]

R3 WsAudio_DeviceS(2);WsAudio_DeviceS(2);c:\windows\system32\drivers\WsAudio_DeviceS(2).sys [2012-03-26 25704]

R3 WsAudio_DeviceS(3);WsAudio_DeviceS(3);c:\windows\system32\drivers\WsAudio_DeviceS(3).sys [2012-03-26 25704]

R3 WsAudio_DeviceS(4);WsAudio_DeviceS(4);c:\windows\system32\drivers\WsAudio_DeviceS(4).sys [2012-03-26 25704]

R3 WsAudio_DeviceS(5);WsAudio_DeviceS(5);c:\windows\system32\drivers\WsAudio_DeviceS(5).sys [2012-03-26 25704]

S0 mv614x;mv614x;c:\windows\system32\DRIVERS\mv614x.sys [2006-01-06 34432]

S0 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2010-09-30 691696]

S2 iPod Service32;iPod Service ;c:\windows\system32\atipdlxx32.exe [2011-08-16 1208832]

S3 LynxWDM;LynxWDM;c:\windows\system32\DRIVERS\LynxWDM.sys [2008-06-27 196744]

S3 SynasUSB;SynasUSB;c:\windows\system32\drivers\SynasUSB.sys [2007-10-24 23288]

.

Contents of the 'Scheduled Tasks' folder

.

2012-05-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-02 00:57]

.

2012-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1425521274-1177238915-500Core.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-22 21:52]

.

2012-05-18 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1708537768-1425521274-1177238915-500UA.job

- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-08-22 21:52]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://gmail.com/

uInternet Settings,ProxyOverride = *.local

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000

TCP: DhcpNameServer = 192.168.0.1

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-05-18 16:21

Windows 5.1.2600 Service Pack 3 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

.

- - - - - - - > 'winlogon.exe'(892)

c:\windows\system32\Ati2evxx.dll

c:\windows\system32\LMIinit.dll

.

- - - - - - - > 'explorer.exe'(3968)

c:\documents and settings\Administrator\Application Data\Dropbox\bin\DropboxExt.14.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\Ati2evxx.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\windows\system32\odpdx3232.exe

c:\windows\system32\wdfmgr.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

.

**************************************************************************

.

Completion time: 2012-05-18 16:23:24 - machine was rebooted

ComboFix-quarantined-files.txt 2012-05-18 23:23

ComboFix2.txt 2012-05-18 22:34

ComboFix3.txt 2012-05-16 22:40

.

Pre-Run: 34,929,643,520 bytes free

Post-Run: 34,985,824,256 bytes free

.

- - End Of File - - F082CB6E869ED7D6170F1D4124FAE054

MrCharlie · May 18, 2012

Please upload this file to one of these free virus scan sires:

c:\windows\system32\odpdx3232.exe

http://www.virustotal.com/

http://virusscan.jotti.org/en

Let me know the results, just copy back the url.

MrC

alexinc · May 18, 2012

http://virusscan.jotti.org/en/scanresult/3ab910e3c25c889e1e5be6a048c8d72f943da4e3

same result as before basically..

MrCharlie · May 18, 2012

OK, I want you to run VIPRE Rescue Program.

Please create a new system restore point before you run it.

I may take 2 or more hours to run.

http://live.sunbeltsoftware.com/

Just download and run it to start the program.

Let me know, MrC

alexinc · May 18, 2012

Thanks, I'll run it and report back Monday.

MrCharlie · May 18, 2012

OK...Thanks, MrC

alexinc · May 21, 2012

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2 Samples\DevinePlong2.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2 Samples\DevinePlong5.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2 Samples\DevineRuck.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2 Samples\Devinesnit.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2 Samples\metal 20.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Richard Devine Kit 2\Ric

hard Devine Kit 2.kt2:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\40_wingbit1.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\45_bollydrum3.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\46_birdslice_hi.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\50_zither_hit.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\55_wings_procnoise.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\58_zitherstrumcut.nov:AFP_RESOURCE

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\63_trumpetnomore.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\67_bowlamp.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\71_erp_02.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\77_pianopedal_01.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\80_waterwind_01.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\crash_01.wav:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\crash_04.wav

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit

Samples\tom_h.nov:AFP_AFPINFO

D:\Sample Libraries\Battery 3 Library\Synthetic Drums 2\Schmutz Kit\Schmutz Kit.

kt2:AFP_AFPINFO