Backdoor.hupigon.26332

dornestic

Bitdefender Scan Log

BitDefender Log File !!!!!

Product : BitDefender Total Security 2008

Version : BitDefender UIScanner v.11

Log date : 23:47:53 25/11/2008

Log path : \Documents and Settings\PC2\Application Data\BitDefender\Desktop\Profiles\Logs\contextual\1227685673_1_02.xml

Scan Paths:Path0000: G:\

Scan Options:Scan for viruses : Yes

Scan for adware : Yes

Scan for spyware : Yes

Scan for applications : Yes

Scan for dialers : Yes

Scan for rootkits : No

Target selection options:Scan registry keys : No

Scan cookies : No

Scan boot sectors : No

Scan memory processes : No

Scan archives : Yes

Scan runtime packers : Yes

Scan emails : Yes

Scan all files : Yes

Heuristic Scan : Yes

Scanned extensions :

Excluded extensions :

Target ProcessingDefault action for infected objects : Disinfect

Default action for suspicious objects : None

Default action for hidden objects : None

Scan engines summaryNumber of virus signatures : 2264220

Archive plugins : 43

Email plugins : 6

Scan plugins : 12

Archive plugins : 43

System plugins : 5

Unpack plugins : 7

Overall scan summaryScanned items : 98111

Infected items : 1

Suspicious items : 0

Resolved items : 0

Individual viruses found : 1

Scanned directories : 9140

Scanned boot sectors : 0

Scanned archives : 2297

Input-output errors : 0

Scan time : 00:00:35:05

Files per second : 46

Scanned processes summaryScanned : 0

Infected : 0

Scanned registry keys summaryScanned : 0

Infected : 0

Scanned cookies summaryScanned : 0

Infected : 0

Remaining issues:Object Name Threat Name Final Status

G:\System Volume Information\_restore{E3F55616-077B-4860-9612-BB815EEB2CC3}\RP388\A0032268.msi=](Embedded CAB)=]SDL.exe Backdoor.Hupigon.26332 Delete Failed (file was in an archive)

Resolved issues:Object Name Threat Name Final Status

Objects that were not scanned:Object Name Reason Final Status

HJT Log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:48:14 PM, on 11/25/2008

Platform: Windows 2003 SP2 (WinNT 5.02.3790)

MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Boot mode: Normal

Running processes:

\Program Files (x86)\Lavasoft\Ad-Aware\aawservice.exe

\WINDOWS\RTHDCPL.EXE

\Program Files (x86)\MSN Messenger\msnmsgr.exe

\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe

\Program Files (x86)\Rainlendar2\Rainlendar2.exe

\WINDOWS\SysWOW64\ctfmon.exe

\Program Files (x86)\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

\WINDOWS\SysWOW64\PnkBstrA.exe

\WINDOWS\SysWOW64\PnkBstrB.exe

\Program Files (x86)\Common Files\Realtime Soft\RTSHookInterop\x32\RTSHookInterop.exe

\Program Files (x86)\foobar2000\foobar2000.exe

\Program Files (x86)\MSN Messenger\usnsvc.exe

\Program Files (x86)\Mozilla Firefox\firefox.exe

\Program Files (x86)\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

F2 - REG:system.ini: UserInit=userinit

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - \Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - \Program Files (x86)\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - \Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - C:\Program Files\BitDefenderTS2008\Antispam32\IEToolbar.dll

O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files (x86)\K-Lite Codec Pack\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files (x86)\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [msnmsgr] "D:\Program Files (x86)\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [ctfmon.exe] \WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "D:\Program Files (x86)\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [Rainlendar2] \Program Files (x86)\Rainlendar2\Rainlendar2.exe

O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user')

O4 - Global Startup: UltraMon.lnk = ?

O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~2\Microsoft Office\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - \Program Files (x86)\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - \Program Files (x86)\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - \PROGRA~2\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - \PROGRA~2\Microsoft Office\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - \PROGRA~2\Microsoft Office\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - \Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - \Program Files\Messenger\msmsgs.exe

O15 - ESC Trusted Zone: http://runonce.msn.com

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab

O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit...wn.cab56986.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1181257918671

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - \PROGRA~2\COMMON~1\Skype\Skype4COM.dll

O20 - AppInit_DLLs: firewall\wl_hook.dll

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - \Program Files (x86)\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - \WINDOWS\System32\dmadmin.exe (file missing)

O23 - Service: Event Log (Eventlog) - Unknown owner - \WINDOWS\system32\services.exe (file missing)

O23 - Service: HTTP SSL (HTTPFilter) - Unknown owner - \WINDOWS\System32\lsass.exe (file missing)

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - \Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: IMAPI CD-Burning COM Service (ImapiService) - Unknown owner - \WINDOWS\system32\imapi.exe (file missing)

O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - \Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe

O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - \WINDOWS\system32\msdtc.exe (file missing)

O23 - Service: NBService - Nero AG - \Program Files (x86)\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: Net Logon (Netlogon) - Unknown owner - \WINDOWS\system32\lsass.exe (file missing)

O23 - Service: NT LM Security Support Provider (NtLmSsp) - Unknown owner - \WINDOWS\system32\lsass.exe (file missing)

O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - \WINDOWS\system32\nvsvc64.exe (file missing)

O23 - Service: Plug and Play (PlugPlay) - Unknown owner - \WINDOWS\system32\services.exe (file missing)

O23 - Service: PnkBstrA - Unknown owner - \WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - \WINDOWS\system32\PnkBstrB.exe

O23 - Service: IPSEC Services (PolicyAgent) - Unknown owner - \WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Protected Storage (ProtectedStorage) - Unknown owner - \WINDOWS\system32\lsass.exe (file missing)

O23 - Service: Remote Desktop Help Session Manager (RDSessMgr) - Unknown owner - \WINDOWS\system32\sessmgr.exe (file missing)

O23 - Service: Security Accounts Manager (SamSs) - Unknown owner - \WINDOWS\system32\lsass.exe (file missing)

O23 - Service: ServiceLayer - Nokia. - \Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe

O23 - Service: Virtual Disk Service (vds) - Unknown owner - \WINDOWS\System32\vds.exe (file missing)

O23 - Service: Volume Shadow Copy (VSS) - Unknown owner - \WINDOWS\System32\vssvc.exe (file missing)

O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - C:\Program Files\BitDefenderTS2008\vsserv.exe

O23 - Service: WMI Performance Adapter (WmiApSrv) - Unknown owner - \WINDOWS\system32\wbem\wmiapsrv.exe (file missing)

O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - \Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--

End of file - 8674 bytes

I've tried scanning in Safe mode to delete it but still no avail. Tried ad-aware 2008, spyhunter, also to no avail.

It being a backdoor scares me even more as this is a personal computer with sensitive information on it.

Any insight/solutions would be GREATLY appreciated.

Thanks in advance

rootkit

Please read this: http://forum.bitdefender.com/index.php?showtopic=3575

Duuude...you are usin' a workstation antivirus on a server...not good !