Virtumonde - HiJackThis Log File

Deckard's System Scanner v20071014.68
Run by XXX on 2008-06-20 18:55:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2008-06-20 16:55:25 UTC - RP1 - Systemprüfpunkt


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 256 MiB (512 MiB recommended).


-- HijackThis (run as XXX.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:00:39, on 20.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\WINDOWS\system32\rmctrl.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWAgent.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\Dokumente und Einstellungen\XXX\Desktop\dss.exe
C:\WINDOWS\system32\cidaemon.exe
C:\DOKUME~1\XXX\Desktop\HIJACK~1\XXX.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.at/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {979741AE-13BB-479B-9259-952609511619} - C:\WINDOWS\system32\tuvSkKBQ.dll
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\bin\npjpi150.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=h**p://www.google.at
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFD9EE8C-2191-498A-84A4-DFB9F42743BE}: NameServer = 213.153.32.1,213.153.32.129
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4821 bytes

-- HijackThis Fixed Entries (C:\DOKUME~1\XXX\Desktop\HIJACK~1\backups\) -----

backup-20080620-184451-643 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://register.spss.com/prod_reg/1.cfm?prod_id=spss
backup-20080620-184451-685 O2 - BHO: (no name) - {172FC286-641A-495A-ABF9-4F964DF7D8AF} - C:\WINDOWS\system32\tuvSkKBQ.dll

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 ssmdrv - c:\windows\system32\drivers\ssmdrv.sys <Not Verified; AVIRA GmbH; >

S3 A3AB (D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB)) - c:\windows\system32\drivers\a3ab.sys <Not Verified; D-Link Corporation; D-Link Wireless Network adapter>
S3 aaudstum - c:\dokume~1\XXX\lokale~1\temp\aaudstum.sys (file missing)
S3 Ext2Fsd (Ext2 File System Driver for NT) - c:\windows\system32\drivers\ext2fsd.sys <Not Verified; Tuning Software (tuningsoft.com); Ext2 File System Driver>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (AntiVir PersonalEdition Classic Planer) - "c:\programme\avira\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; AntiVir Workstation>
R2 MWAgent - c:\programme\gemeinsame dateien\microworld\agent\mwaser.exe <Not Verified; MicroWorld Technologies Inc.; eScan>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Files created between 2008-05-20 and 2008-06-20 -----------------------------

2008-06-20 18:47:38         0 d------c- C:\WINDOWS\Prefetch
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\zts2.exe
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\vcmgcd32.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\systems.txt
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\iifgfgf.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\rundll16.exe
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\rundl132.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\logo1_.exe
2008-06-17 21:02:38  65335772 --a----c- C:\WINDOWS\hklmSW.reg
2008-06-17 21:00:32  43139406 --a----c- C:\WINDOWS\hkcrRT.reg
2008-06-17 20:53:29         0 d------c- C:\WINDOWS\system32\winpdc32.dll
2008-06-17 18:12:44         0 d------c- C:\PUB
2008-06-17 18:12:08    105888 --a----c- C:\WINDOWS\winsbak2.reg
2008-06-17 18:12:08     14866 --a----c- C:\WINDOWS\winsbak.reg
2008-06-17 18:11:57         0 d------c- C:\Programme\Gemeinsame Dateien\MicroWorld
2008-06-17 18:10:46     43520 --a----c- C:\WINDOWS\killproc.exe <Not Verified; MicroWorld Technologies Inc.; KILLPROC>
2008-06-17 18:10:24   1044480 --a----c- C:\WINDOWS\system32\contfilt.dll <Not Verified; MicroWorld Technologies Inc.; contfilt>
2008-06-17 18:10:23    126976 --a----c- C:\WINDOWS\system32\mwnsp.dll <Not Verified; MicroWorld Technologies Inc.; MicroWorld Internet Traffic Scanner>
2008-06-17 18:10:18      7680 --a----c- C:\WINDOWS\sporder.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System>
2008-06-17 18:10:18      9488 --a----c- C:\WINDOWS\sporder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System>
2008-06-17 18:10:17    130560 --a----c- C:\WINDOWS\system32\ZIPDLL.DLL <Not Verified; ; BCB/Delphi Zip>
2008-06-17 18:10:17    125440 --a----c- C:\WINDOWS\system32\UNZDLL.DLL <Not Verified; ; BCB/Delphi UnZip>
2008-06-17 18:10:16    356352 --a----c- C:\WINDOWS\system32\mwtsp.dll <Not Verified; MicroWorld Technologies Inc.; MicroWorld Internet Traffic Scanner>
2008-06-17 18:10:16     44032 --a----c- C:\WINDOWS\inst_tsp.exe <Not Verified; MicroWorld Technologies Inc.; eScan/MailScan/eConceal/X-Spam>
2008-06-17 18:10:11         0 d------c- C:\WINDOWS\system32\FLCSS.EXE
2008-06-17 15:12:47         0 d------c- C:\VIRUSfighter
2008-06-14 17:23:22   3407872 --a------ C:\Dokumente und Einstellungen\XXX\ntuser.dat
2008-06-14 17:21:26      2075 --ahs--c- C:\WINDOWS\system32\QBKkSvut.ini2
2008-06-14 17:20:53    285696 --a----c- C:\WINDOWS\system32\tuvSkKBQ.dll
2008-06-08 18:41:25         0 --a----c- C:\Programme\temp01
2008-05-22 10:52:45         0 d------c- C:\WINDOWS\system32\DRVSTORE
2008-05-22 10:48:23         0 d------c- C:\Programme\Gemeinsame Dateien\Sony Ericsson Shared
2008-05-22 10:48:13         0 d------c- C:\Programme\Gemeinsame Dateien\Teleca Shared
2008-05-22 10:48:04         0 d------c- C:\Programme\Sony Ericsson


-- Find3M Report ---------------------------------------------------------------

2008-06-20 18:59:46         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Skype
2008-06-19 19:39:22         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Help
2008-06-17 18:11:57         0 d------c- C:\Programme\Gemeinsame Dateien
2008-06-17 15:12:44         0 d--h---c- C:\Programme\InstallShield Installation Information
2008-06-12 20:27:48         0 d------c- C:\Programme\SPSSEVAL
2008-06-12 19:13:59        73 --a----c- C:\WINDOWS\system32\ssprs.dll
2008-06-12 19:13:48       341 --a----c- C:\WINDOWS\system32\lsprst7.dll
2008-06-08 18:49:16         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Adobe
2008-05-22 11:00:35         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Teleca
2008-05-22 10:49:23         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Sony Ericsson
2008-05-15 20:21:42    408618 --a----c- C:\WINDOWS\system32\perfh007.dat
2008-05-15 20:21:42     71598 --a----c- C:\WINDOWS\system32\perfc007.dat
2008-05-07 22:29:38         0 d------c- C:\Programme\Microsoft SQL Server
2008-05-07 20:55:03         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\ESRI
2008-05-07 13:23:25         0 d------c- C:\Programme\ESRI
2008-05-07 13:14:14         0 d------c- C:\Programme\Gemeinsame Dateien\ESRI
2008-05-07 13:13:22         0 d------c- C:\Programme\ArcGIS
2008-05-07 13:06:30         0 d------c- C:\Programme\Leica Geosystems
2008-05-07 12:34:11         0 d------c- C:\Programme\Gemeinsame Dateien\AnswerWorks 4.0
2008-04-22 19:36:40         0 d------c- C:\Programme\f4
2008-04-22 16:02:24  15532238 --a----c- C:\Programme\f4-v303.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{979741AE-13BB-479B-9259-952609511619}]
14.06.2008 17:21	285696	--a--c---	C:\WINDOWS\system32\tuvSkKBQ.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [19.03.2002 18:30]
"NVMixerTray"="C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [03.06.2004 21:51]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [15.06.2005 18:20]
"nwiz"="nwiz.exe" [15.06.2005 18:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [15.06.2005 18:20]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09.07.2001 12:50]
"RemoteControl"="C:\WINDOWS\system32\rmctrl.exe" [09.11.2001 21:17]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [27.04.2008 19:23]
"Sony Ericsson PC Suite"="C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [28.05.2007 10:14]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 01:57]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [13.09.2007 13:31]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [14.12.2004 05:44:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"=0 (0x0)
"SynchronousUserGroupPolicy"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\tuvSkKBQ




-- End of Deckard's System Scanner: finished at 2008-06-20 19:02:00 ------------