Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

Backdoor.hupigon.26332

Options
dornestic
dornestic
in Logs analysis

75896709oy6.jpg


Bitdefender Scan Log


BitDefender Log File !!!!!


Product : BitDefender Total Security 2008


Version : BitDefender UIScanner v.11


Log date : 23:47:53 25/11/2008


Log path : D:\Documents and Settings\PC2\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1227685673_1_02.xml


Scan Paths:Path0000: G:\


Scan Options:Scan for viruses : Yes


Scan for adware : Yes


Scan for spyware : Yes


Scan for applications : Yes


Scan for dialers : Yes


Scan for rootkits : No


Target selection options:Scan registry keys : No


Scan cookies : No


Scan boot sectors : No


Scan memory processes : No


Scan archives : Yes


Scan runtime packers : Yes


Scan emails : Yes


Scan all files : Yes


Heuristic Scan : Yes


Scanned extensions :


Excluded extensions :


Target ProcessingDefault action for infected objects : Disinfect


Default action for suspicious objects : None


Default action for hidden objects : None


Scan engines summaryNumber of virus signatures : 2264220


Archive plugins : 43


Email plugins : 6


Scan plugins : 12


Archive plugins : 43


System plugins : 5


Unpack plugins : 7


Overall scan summaryScanned items : 98111


Infected items : 1


Suspicious items : 0


Resolved items : 0


Individual viruses found : 1


Scanned directories : 9140


Scanned boot sectors : 0


Scanned archives : 2297


Input-output errors : 0


Scan time : 00:00:35:05


Files per second : 46


Scanned processes summaryScanned : 0


Infected : 0


Scanned registry keys summaryScanned : 0


Infected : 0


Scanned cookies summaryScanned : 0


Infected : 0


Remaining issues:Object Name Threat Name Final Status


G:\System Volume Information\_restore{E3F55616-077B-4860-9612-BB815EEB2CC3}\RP388\A0032268.msi=](Embedded CAB)=]SDL.exe Backdoor.Hupigon.26332 Delete Failed (file was in an archive)


Resolved issues:Object Name Threat Name Final Status


Objects that were not scanned:Object Name Reason Final Status


HJT Log


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 11:48:14 PM, on 11/25/2008


Platform: Windows 2003 SP2 (WinNT 5.02.3790)


MSIE: Internet Explorer v7.00 (7.00.6000.16735)


Boot mode: Normal


Running processes:


D:\Program Files (x86)\Lavasoft\Ad-Aware\aawservice.exe


D:\WINDOWS\RTHDCPL.EXE


D:\Program Files (x86)\MSN Messenger\msnmsgr.exe


D:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe


D:\Program Files (x86)\Rainlendar2\Rainlendar2.exe


D:\WINDOWS\SysWOW64\ctfmon.exe


D:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe


D:\WINDOWS\SysWOW64\PnkBstrA.exe


D:\WINDOWS\SysWOW64\PnkBstrB.exe


D:\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe


D:\Program Files (x86)\foobar2000\foobar2000.exe


D:\Program Files (x86)\MSN Messenger\usnsvc.exe


D:\Program Files (x86)\Mozilla Firefox\firefox.exe


D:\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local


F2 - REG:system.ini: UserInit=userinit


O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll


O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll


O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)


O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll


O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefenderTS2008\Antispam32\IEToolbar.dll


O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"


O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background


O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe


O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"


O4 - HKCU\..\Run: [Rainlendar2] D:\Program Files (x86)\Rainlendar2\Rainlendar2.exe


O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')


O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')


O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')


O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')


O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')


O4 - Global Startup: UltraMon.lnk = ?


O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~2\Microsoft Office\OFFICE11\EXCEL.EXE/3000


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files (x86)\Java\jre1.6.0\bin\ssv.dll


O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\Microsoft Office\Office12\ONBttnIE.dll


O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\PROGRA~2\Microsoft Office\Office12\ONBttnIE.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~2\Microsoft Office\Office12\REFIEBAR.DLL


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe


O15 - ESC Trusted Zone: http://runonce.msn.com


O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab


O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab


O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab


O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab


O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181257918671


O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab


O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll


O20 - AppInit_DLLs: firewall\wl_hook.dll


O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files (x86)\Lavasoft\Ad-Aware\aawservice.exe


O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - D:\WINDOWS\System32\dmadmin.exe (file missing)


O23 - Service: Event Log (Eventlog) - Unknown owner - D:\WINDOWS\system32\services.exe (file missing)


O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - D:\WINDOWS\System32\lsass.exe (file missing)


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - D:\WINDOWS\system32\imapi.exe (file missing)


O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - D:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe


O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - D:\WINDOWS\system32\msdtc.exe (file missing)


O23 - Service: NBService - Nero AG - D:\Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe


O23 - Service: Net Logon (Netlogon) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)


O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)


O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - D:\WINDOWS\system32\nvsvc64.exe (file missing)


O23 - Service: Plug and Play (PlugPlay) - Unknown owner - D:\WINDOWS\system32\services.exe (file missing)


O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe


O23 - Service: PnkBstrB - Unknown owner - D:\WINDOWS\system32\PnkBstrB.exe


O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)


O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)


O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - D:\WINDOWS\system32\sessmgr.exe (file missing)


O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - D:\WINDOWS\system32\lsass.exe (file missing)


O23 - Service: ServiceLayer - Nokia. - D:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe


O23 - Service: Virtual Disk Service (vds) - Unknown owner - D:\WINDOWS\System32\vds.exe (file missing)


O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - D:\WINDOWS\System32\vssvc.exe (file missing)


O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefenderTS2008\vsserv.exe


O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - D:\WINDOWS\system32\wbem\wmiapsrv.exe (file missing)


O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - D:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe


--


End of file - 8674 bytes


I've tried scanning in Safe mode to delete it but still no avail. Tried ad-aware 2008, spyhunter, also to no avail.


It being a backdoor scares me even more as this is a personal computer with sensitive information on it.


Any insight/solutions would be GREATLY appreciated.


Thanks in advance

Comments

All Time Leaders

Categories

Defenders of the month