need some help with a remote desktop trojan

Advertise at AfterDawn.com

Link to us!

Private messages

Compose a private message

List of all updated threads

Threads without replies

Search messages

Friday 5.9.2025 / 17:10

Search AfterDawn Forums:

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > need some help with a remote desktop trojan

Browse by topic

Forums

Start a new thread

need some help with a remote desktop trojan

Jump to:

Posted

Message

Xevlys

Member

5. August 2007 @ 16:06

Link to this message

ok, a friend of mine has had a remote desktop trojan installed on her pc. It came from a file that someone sent her via IM and was intentionally put there. The person now seems to have control over her pc, at least enough to type on her screen. Her antivirus hasnt detected anything, but she says she watched letters appear on her screen as he typed them and her pc has been acting very weird, freezing and crashing, etc, so im assuming theres something on there.

heres a hijack this log that i just had her make:

Logfile of HijackThis v1.99.1
Scan saved at 5:59:15 PM, on 8/5/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Executive Software\Diskeeper\DkService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe
C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\MultiRes\MultiRes.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\MSN Messenger\livecall.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\DOCUME~1\Hello\LOCALS~1\Temp\Rar$EX00.828\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customiz...rch/search.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {b00a2d93-a2c4-48aa-a6d9-e78835eaefc8} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [D-Link AirPlus Xtreme G] C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe
O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [\\JOHN-COMP\EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P35 "\\JOHN-COMP\EPSON Stylus C86 Series" /O6 "USB001" /M "Stylus C86"
O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Auto EPSON Stylus C86 Series on JOHN-COMP] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P41 "Auto EPSON Stylus C86 Series on JOHN-COMP" /O22 "\\JOHN-COMP\EPSON-JOHN" /M "Stylus C86"
O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize
O4 - HKLM\..\Run: [\\JOHN\EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P30 "\\JOHN\EPSON Stylus C86 Series" /O6 "USB001" /M "Stylus C86"
O4 - HKLM\..\Run: [Auto EPSON Stylus C86 Series on JOHN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P36 "Auto EPSON Stylus C86 Series on JOHN" /O15 "\\JOHN\EPSONSty" /M "Stylus C86"
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} (CodeAx Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/c...s/CM_CodeAx.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {3C611C53-3468-4F9D-8C2E-ADA0338F9E79} (AcubeComm Control) - http://ezhub.hanyang.ac.kr:8080/EP/web/c...s/AcubeComm.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedown...Plugin11USA.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdat...b?1120681114483
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v8.cab
O16 - DPF: {710E4921-F77C-4D42-8EC4-4DFDEE52508F} (ictPrintXForm Control) - http://211.35.57.161/web_kiosk_3/activeX/ictPrintX.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/20040...all/xscan53.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab31267.cab
O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedown...GPlugin7USA.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx2.6.1.7_en_dl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {BC5E698E-77CF-45EF-80A3-090A4B6AAF83} (HGPlugin8USA Class) - http://gamedownload.ijjimax.com/gamedown...GPlugin8USA.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Mes...nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedown...GPlugin9USA.cab
O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedown...Plugin10USA.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/we...aploader_v6.cab
O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: acldit - acldit.dll (file missing)
O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing)
O20 - Winlogon Notify: disldp - disldp.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

Any help would be greatly appreciated so thanks in advance. :]

Also, let me know if theres anyother information i could provide you with.

[ + quote]

"Religion is the opium of the masses" - Karl Marx

Auttaja

Suspended permanently

6. August 2007 @ 00:35

Link to this message

Download and Run ComboFix
*Download this file from either of the two below listed places :

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe

*Then double click combofix.exe & follow the prompts.
*When finished, it shall produce a log for you. Post that log in your next reply
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[ + quote]

Don´t send your HijackThis log to another user topic. Remember to describe what kind of problems you have. (In my opinion afterdawn has very unsupportive attitude against malware fighters)
How to send HijackThis log (step 3-5)Hijackthis login lähettämisohjeet (Finland)
My profile "Therefore I say to you, do not worry about your life, what you will eat or what you will drink; nor about your body, what you will put on."
My home forum (Finland) Geeks To Go - Another place
List of rogue programs. (Finland) For exampe MSG+ is there. Another list

Auttaja

Suspended permanently

6. August 2007 @ 00:35

Link to this message

Sorry.. Double post..

[ + quote]

This message has been edited since posting. Last time this message was edited on 7. August 2007 @ 09:01

Xevlys

Member

6. August 2007 @ 19:38

Link to this message

ok, she got it and ran it, here is the log:

ComboFix 07-08-04.3 - "Hello" 2007-08-06 21:20:01.1 [GMT -6:00] - NTFS
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\Hello\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\Hello\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\Hello\Desktop\internet.lnk
C:\Program Files\Common Files\ladu.dll
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\MSN Gaming Zone\horefoqe83122.dll
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\tsks~1
C:\Program Files\tsks~1\m?config.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\mbbgrls.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\system32\abadd.ini
C:\WINDOWS\system32\aqqtgqln.dll
C:\WINDOWS\system32\bkqwkeft.exe
C:\WINDOWS\system32\ddaba.dll
C:\WINDOWS\system32\driver
C:\WINDOWS\system32\driver\w717.exe
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\ehkmp.bak1
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ehkmp.tmp
C:\WINDOWS\system32\euccrptn.exe
C:\WINDOWS\system32\F2
C:\WINDOWS\system32\F3
C:\WINDOWS\system32\F3\n553.exe
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\jlkkj.bak1
C:\WINDOWS\system32\jlkkj.ini2
C:\WINDOWS\system32\jlkkj.tmp
C:\WINDOWS\system32\rppxtvro.exe
C:\WINDOWS\system32\ssqpmlk.dll
C:\WINDOWS\system32\ubkgkpse.exe
C:\WINDOWS\system32\urqqrsq.dll
C:\WINDOWS\system32\vftrlrag.exe
C:\WINDOWS\system32\vvvwa.bak1
C:\WINDOWS\system32\vvvwa.bak2
C:\WINDOWS\system32\vvvwa.ini
C:\WINDOWS\system32\vvvwa.ini2
C:\WINDOWS\system32\vvvwa.tmp
C:\WINDOWS\system32\wcpicomsv32.exe
C:\WINDOWS\system32\yayxuuv.dll
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\TISKY009.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\wnsxs~1
C:\WINDOWS\wnsxs~1\arpa.exe

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_FOPN
-------\LEGACY_NET_AGENT
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
-------\Net Agent

((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 )))))))))))))))))))))))))))))))

2007-08-06 21:06 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-06 20:51 125,504 --a------ C:\WINDOWS\system32\yfinuqvb.dll
2007-08-06 19:02 9,769 --a------ C:\WINDOWS\vfpiy0578.exe
2007-08-06 03:28 60,928 --a------ C:\WINDOWS\system32\qzuv.dll
2007-08-06 03:28 169,147 --a------ C:\WINDOWS\TTC-4444.exe
2007-08-06 03:27 586,352 -r-hs---- C:\WINDOWS\mbbgrlsA.exe
2007-08-06 03:27 d-------- C:\WINDOWS\system32\f02WtR
2007-08-06 03:27 d-------- C:\WINDOWS\system32\configs
2007-08-06 03:27 d-------- C:\temp\fse
2007-08-06 03:27 d-------- C:\temp\1cb
2007-08-05 18:16 d-------- C:\Program Files\AruaROSE
2007-08-05 18:16 d-------- C:\DOCUME~1\Hello\APPLIC~1\InstallShield
2007-08-05 17:06 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-08-05 17:06 208,248 --a------ C:\WINDOWS\system32\muweb.dll
2007-08-05 00:24 d-------- C:\Program Files\MSXML 4.0
2007-08-04 17:33 d-------- C:\Program Files\iTunes
2007-08-02 19:16 d-------- C:\WINDOWS\Windows
2007-08-02 18:43 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Musicnotes
2007-07-31 21:03 d-------- C:\WINDOWS\system32\appmgmt
2007-07-23 00:41 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm
2007-07-08 00:53 d-------- C:\DOCUME~1\Hello\havenROp
2007-07-07 02:38 d-------- C:\Program Files\Common Files\Apple
2007-07-07 02:38 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-06 21:26 --------- d-------- C:\Program Files\MSN Gaming Zone
2007-08-06 09:16 246 --a------ C:\Program Files\Common Files\ladu
2007-08-05 18:16 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-04 17:33 --------- d-------- C:\Program Files\iPod
2007-08-02 20:04 --------- d-------- C:\Program Files\XoftSpy
2007-08-01 00:22 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\Apple Computer
2007-07-28 03:06 135 --a------ C:\Program Files\Common Files\promy.html
2007-07-21 17:54 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\AdobeUM
2007-07-14 00:07 --------- d-------- C:\Program Files\QuickTime
2007-07-08 01:32 --------- d-------- C:\Program Files\Gravity
2007-07-04 18:29 65536 --a------ C:\WINDOWS\IFinst27.exe
2007-07-04 11:46 1051442874 --a------ C:\Program Files\SAK_SETUP0417.exe
2007-07-03 15:21 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\Canon
2007-06-26 22:28 --------- d--h----- C:\DOCUME~1\Hello\APPLIC~1\ijjigame
2007-06-19 02:24 --------- d-------- C:\Program Files\Windows Journal Viewer
2007-05-16 09:12 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 09:12 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 09:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 09:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 09:12 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 09:12 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 03:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll
2007-04-23 15:57 75040 --a------ C:\DOCUME~1\Hello\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-04-06 20:30 7961888 --a------ C:\Program Files\AnimaRO_Setup_2006-12-23.zip
2007-04-04 23:18 959387001 --a------ C:\Program Files\SAK_SETUP0711.exe
2007-03-29 13:27 621154168 --a------ C:\Program Files\dance_3-28-2007.exe
2007-03-28 21:22 262411 --a------ C:\Program Files\endless_love-reason.zip
2007-03-26 13:18 1367553 --a------ C:\Program Files\mirc621.exe

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{192D6E8A-5CB8-47AF-958E-A29E3BDA374D}]
2007-08-02 07:43 282624 --a------ C:\Program Files\MSN Gaming Zone\horefoqe4444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C8CF897-6571-4881-2900-34B67D4DFECE}]
2007-08-01 07:43 60928 --a------ C:\WINDOWS\system32\qzuv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{991EF04C-93CF-469b-A2BE-CC1B3347566F}]
C:\Program Files\BHO\plugin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b00a2d93-a2c4-48aa-a6d9-e78835eaefc8}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"D-Link AirPlus Xtreme G"="C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe" [2003-11-04 17:00]
"ANIWZCSService"="C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 16:12]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 C:\WINDOWS\SOUNDMAN.EXE]
"\\JOHN-COMP\EPSON Stylus C86 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00]
"MultiRes"="C:\Program Files\MultiRes\MultiRes.exe" [2005-01-26 16:40]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-03-24 11:04]
"nwiz"="nwiz.exe" [2004-03-24 11:04 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-03-24 11:04]
"DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2005-06-10 15:46]
"Auto EPSON Stylus C86 Series on JOHN-COMP"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00]
"KAVPersonal50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" [2005-08-30 07:20]
"\\JOHN\EPSON Stylus C86 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00]
"Auto EPSON Stylus C86 Series on JOHN"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 12:00]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"mbbgrlsA"="C:\WINDOWS\mbbgrlsA.exe" [1989-12-12 10:10]
"{E1-12-23-31-ZN}"="c:\windows\system32\lodsregj.exe" []

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2005-07-20 16:57]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56]
"Aim6"="" []
"Wuch"="C:\WINDOWS\WNSXS~1\arpa.exe" []
"Qca"="C:\Program Files\T?sks\m?config.exe" []
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05]

C:\Documents and Settings\Hello\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"=1 (0x1)
"AllowUnhashedWebView"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acldit]
acldit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\disldp]
disldp.dll

R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys
R1 Klmc;Klmc;C:\WINDOWS\system32\drivers\klmc.sys
R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys
S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys
S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe"
S3 TIEHDUSB;TIEHDUSB;C:\WINDOWS\system32\drivers\tiehdusb.sys
S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe"

Contents of the 'Scheduled Tasks' folder
2007-08-04 04:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
2007-08-07 02:34:41 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-06 21:30:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 2239

**************************************************************************

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"\\\\JOHN-COMP\\EPSON Stylus C86 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P35 \"\\\\JOHN-COMP\\EPSON Stylus C86 Series\" /O6 \"USB001\" /M \"Stylus C86\""
"\\\\JOHN\\EPSON Stylus C86 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P30 \"\\\\JOHN\\EPSON Stylus C86 Series\" /O6 \"USB001\" /M \"Stylus C86\""

Completion time: 2007-08-06 21:32:55 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-06 21:32

--- E O F ---

anything else i need to have her do? thanks for your help :]

[ + quote]

"Religion is the opium of the masses" - Karl Marx

Auttaja

Suspended permanently

7. August 2007 @ 09:29

Link to this message

Open notepad and copy/paste the text in the quotebox below into it:

Quote:
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C8CF897-6571-4881-2900-34B67D4DFECE}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b00a2d93-a2c4-48aa-a6d9-e78835eaefc8}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mbbgrlsA"=-
"{E1-12-23-31-ZN}"=-
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wuch"=-
"Qca"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acldit]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\disldp]

Collect::[4]
C:\Program Files\T?sks\m?config.exe
C:\WINDOWS\WNSXS~1\arpa.exe
C:\WINDOWS\mbbgrlsA.exe
c:\windows\system32\lodsregj.exe
C:\WINDOWS\system32\yfinuqvb.dll
C:\WINDOWS\vfpiy0578.exe
C:\WINDOWS\system32\qzuv.dll
C:\WINDOWS\TTC-4444.exe
C:\WINDOWS\mbbgrlsA.exe
Folder::
C:\WINDOWS\system32\f02WtR

Save this as CFScript. (Check the spelling)

Refering to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.

[ + quote]

Start a new thread

afterdawn.com > forums > software, operating systems and more > windows - virus and spyware problems > need some help with a remote desktop trojan


		User name	Password

		Not registered yet? Register here. Lost your password? Click here.