Virtumonde - HiJackThis Log File

Logfile of The Avenger Version 2.0, (c) by Swandog46
h**p://swandog46.geekstogo.com

Platform:  Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "C:\WINDOWS\hklmSW.reg" deleted successfully.
File "C:\WINDOWS\hkcrRT.reg" deleted successfully.
File "C:\WINDOWS\winsbak2.reg" deleted successfully.
File "C:\WINDOWS\winsbak.reg" deleted successfully.
File "C:\WINDOWS\system32\tuvSkKBQ.dll" deleted successfully.
File "C:\WINDOWS\system32\QBKkSvut.ini2" deleted successfully.

Completed script processing.

*******************

Finished!  Terminate.
         

Deckard's System Scanner v20071014.68
Run by XXX on 2008-06-26 16:23:40
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Total Physical Memory: 256 MiB (512 MiB recommended).


-- HijackThis (run as XXX.exe) ----------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:23:56, on 26.06.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\taskswitch.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\rmctrl.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWAgent.exe
C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Programme\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Skype\Phone\Skype.exe
C:\Programme\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Dokumente und Einstellungen\XXX\Desktop\dss.exe
C:\DOKUME~1\XXX\Desktop\HIJACK~1\XXX.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.at/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: (no name) - {942206EF-5F60-45A3-918A-3415EA766D84} - C:\WINDOWS\system32\tuvSkKBQ.dll (file missing)
O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
O4 - HKLM\..\Run: [NVMixerTray] "C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] C:\WINDOWS\system32\rmctrl.exe
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Programme\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\MSMSGS.EXE
O14 - IERESET.INF: START_PAGE_URL=h**p://www.google.at
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFD9EE8C-2191-498A-84A4-DFB9F42743BE}: NameServer = 213.153.32.1,213.153.32.129
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: MWAgent - MicroWorld Technologies Inc. - C:\Programme\Gemeinsame Dateien\MicroWorld\Agent\MWASER.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 4956 bytes

-- Files created between 2008-05-26 and 2008-06-26 -----------------------------

2008-06-26 15:05:12         0 d------c- C:\Programme\Java
2008-06-26 15:05:04         0 d------c- C:\Programme\Gemeinsame Dateien\Java
2008-06-20 18:47:38         0 d------c- C:\WINDOWS\Prefetch
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\zts2.exe
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\vcmgcd32.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\systems.txt
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\system32\iifgfgf.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\rundll16.exe
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\rundl132.dll
2008-06-17 23:15:30         0 d-a----c- C:\WINDOWS\logo1_.exe
2008-06-17 20:53:29         0 d------c- C:\WINDOWS\system32\winpdc32.dll
2008-06-17 18:12:44         0 d------c- C:\PUB
2008-06-17 18:11:57         0 d------c- C:\Programme\Gemeinsame Dateien\MicroWorld
2008-06-17 18:10:46     43520 --a----c- C:\WINDOWS\killproc.exe <Not Verified; MicroWorld Technologies Inc.; KILLPROC>
2008-06-17 18:10:24   1044480 --a----c- C:\WINDOWS\system32\contfilt.dll <Not Verified; MicroWorld Technologies Inc.; contfilt>
2008-06-17 18:10:23    126976 --a----c- C:\WINDOWS\system32\mwnsp.dll <Not Verified; MicroWorld Technologies Inc.; MicroWorld Internet Traffic Scanner>
2008-06-17 18:10:18      7680 --a----c- C:\WINDOWS\sporder.exe <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System>
2008-06-17 18:10:18      9488 --a----c- C:\WINDOWS\sporder.dll <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(R) Operating System>
2008-06-17 18:10:17    130560 --a----c- C:\WINDOWS\system32\ZIPDLL.DLL <Not Verified; ; BCB/Delphi Zip>
2008-06-17 18:10:17    125440 --a----c- C:\WINDOWS\system32\UNZDLL.DLL <Not Verified; ; BCB/Delphi UnZip>
2008-06-17 18:10:16    356352 --a----c- C:\WINDOWS\system32\mwtsp.dll <Not Verified; MicroWorld Technologies Inc.; MicroWorld Internet Traffic Scanner>
2008-06-17 18:10:16     44032 --a----c- C:\WINDOWS\inst_tsp.exe <Not Verified; MicroWorld Technologies Inc.; eScan/MailScan/eConceal/X-Spam>
2008-06-17 18:10:11         0 d------c- C:\WINDOWS\system32\FLCSS.EXE
2008-06-14 17:23:22   3407872 --a------ C:\Dokumente und Einstellungen\XXX\ntuser.dat
2008-06-08 18:41:25         0 --a----c- C:\Programme\temp01


-- Find3M Report ---------------------------------------------------------------

2008-06-26 16:08:58         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Skype
2008-06-26 15:05:04         0 d------c- C:\Programme\Gemeinsame Dateien
2008-06-21 01:35:12         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Teleca
2008-06-21 01:34:29         0 d------c- C:\Programme\Gemeinsame Dateien\Teleca Shared
2008-06-19 19:39:22         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Help
2008-06-17 15:12:44         0 d--h---c- C:\Programme\InstallShield Installation Information
2008-06-12 20:27:48         0 d------c- C:\Programme\SPSSEVAL
2008-06-12 19:13:59        73 --a----c- C:\WINDOWS\system32\ssprs.dll
2008-06-12 19:13:48       341 --a----c- C:\WINDOWS\system32\lsprst7.dll
2008-06-08 18:49:16         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Adobe
2008-05-22 10:49:23         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\Sony Ericsson
2008-05-15 20:21:42    408618 --a----c- C:\WINDOWS\system32\perfh007.dat
2008-05-15 20:21:42     71598 --a----c- C:\WINDOWS\system32\perfc007.dat
2008-05-07 22:29:38         0 d------c- C:\Programme\Microsoft SQL Server
2008-05-07 20:55:03         0 d------c- C:\Dokumente und Einstellungen\XXX\Anwendungsdaten\ESRI
2008-05-07 13:23:25         0 d------c- C:\Programme\ESRI
2008-05-07 13:14:14         0 d------c- C:\Programme\Gemeinsame Dateien\ESRI
2008-05-07 13:13:22         0 d------c- C:\Programme\ArcGIS
2008-05-07 13:06:30         0 d------c- C:\Programme\Leica Geosystems
2008-05-07 12:34:11         0 d------c- C:\Programme\Gemeinsame Dateien\AnswerWorks 4.0
2008-04-22 16:02:24  15532238 --a----c- C:\Programme\f4-v303.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{942206EF-5F60-45A3-918A-3415EA766D84}]
			C:\WINDOWS\system32\tuvSkKBQ.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CoolSwitch"="C:\WINDOWS\system32\taskswitch.exe" [19.03.2002 18:30]
"NVMixerTray"="C:\Programme\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [03.06.2004 21:51]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [15.06.2005 18:20]
"nwiz"="nwiz.exe" [15.06.2005 18:20 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [15.06.2005 18:20]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09.07.2001 12:50]
"RemoteControl"="C:\WINDOWS\system32\rmctrl.exe" [09.11.2001 21:17]
"avgnt"="C:\Programme\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [27.04.2008 19:23]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_06\bin\jusched.exe" [25.03.2008 04:28]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 01:57]
"Skype"="C:\Programme\Skype\Phone\Skype.exe" [13.09.2007 13:31]

C:\Dokumente und Einstellungen\All Users\Startmen�\Programme\Autostart\
Adobe Reader - Schnellstart.lnk - C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe [14.12.2004 05:44:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"SynchronousMachineGroupPolicy"=0 (0x0)
"SynchronousUserGroupPolicy"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\tuvSkKBQ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{777853af-fe42-11d5-929b-000c7613516b}]
AutoRun\command- F:\AutoRun.exe




-- End of Deckard's System Scanner: finished at 2008-06-26 16:24:42 ------------