Don't Know What It Is...it Might Be A Vundo Virus..

TotalBalance
TotalBalance
edited June 2008 in Logs analysis

Hi again people of Bd!


So heres the story , my friend told me about some weird stuff going on with his computer , but he doesn't have a BD Anti-virus program(It's something else). I told him about the magnificent help i got from you guys last time my computer was in trouble. So he thought i might ask about it here , since he's too lazy to do it himself. :


His computer is really slow , other than usual(He has about 2 of ram and 4 ghz processor including Windows Vista.)


His Internet Explorer pops up some weird pages , and then opens up new tabs by itself , and those tabs don't show anything. (Blank pages)


His explorer.exe crashes occasionally (Desktop disappears leaving only the background to show...)


And his internet is pretty much slower than usual too (100mb/s internet connection speed)


His Hijackthis log :


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 15:28:31, on 17.06.2008


Platform: Windows Vista SP1 (WinNT 6.00.1905)


MSIE: Internet Explorer v7.00 (7.00.6001.18000)


Boot mode: Normal


Running processes:


C:\Windows\system32\taskeng.exe


C:\Windows\system32\Dwm.exe


C:\Program Files\Windows Defender\MSASCui.exe


C:\Windows\RtHDVCpl.exe


C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe


C:\Windows\RTHDCPL.exe


C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe


C:\Windows\System32\rundll32.exe


C:\Program Files\AVG\AVG8\avgtray.exe


C:\Program Files\Windows Sidebar\sidebar.exe


C:\Windows\System32\rundll32.exe


C:\Program Files\Windows Live\Messenger\msnmsgr.exe


C:\Windows\ehome\ehtray.exe


C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe


C:\Program Files\Windows Media Player\wmpnscfg.exe


C:\Windows\System32\rundll32.exe


C:\Windows\System32\rundll32.exe


C:\Windows\System32\rundll32.exe


C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe


C:\Windows\ehome\ehmsas.exe


C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe


C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe


C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe


C:\Windows\System32\mobsync.exe


C:\Program Files\Winamp\winamp.exe


C:\Program Files\Internet Explorer\ieuser.exe


C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\Program Files\FlashGet\flashget.exe


C:\Windows\explorer.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neti.ee/


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896


R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by ML Arvutid


R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =


O1 - Hosts: ::1 localhost


O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide


O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe


O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"


O4 - HKLM\..\Run: [Flashget] "C:\Program Files\FlashGet\FlashGet.exe" /min


O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\wianmpa.exe


O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE


O4 - HKLM\..\Run: [skyTel] Skytel.exe


O4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXE


O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime


O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe


O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"


O4 - HKLM\..\Run: [CTCheck] C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe


O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart


O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup


O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit


O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe


O4 - HKCU\..\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun


O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter


O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background


O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033


O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe


O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"


O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe


O4 - HKCU\..\Run: [MSServer] rundll32.exe C:\Users\Kalmu\AppData\Local\Temp\mlJYrqNf.dll,#1


O4 - HKCU\..\Run: [cmds] rundll32.exe C:\Users\Kalmu\AppData\Local\Temp\opnOGwTM.dll,c


O4 - HKCU\..\Run: [c88a927f] rundll32.exe "C:\Users\Kalmu\AppData\Local\Temp\pbjgmhli.dll",b


O4 - HKCU\..\Run: [bMcbb9a1e3] Rundll32.exe "C:\Users\Kalmu\AppData\Local\Temp\vacgoopm.dll",s


O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe


O4 - Global Startup: Bluetooth Manager.lnk = ?


O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm


O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm


O9 - Extra button: TrioBet Poker - {019BB34E-96AC-4aa7-A5DE-3CC7442D4E38} - C:\Microgaming\Poker\TriobetMPP\MPPoker.exe


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll


O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe


O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe


O13 - Gopher Prefix:


O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab


O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll


O20 - AppInit_DLLs: avgrsstx.dll


O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe


O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe


O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe


O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe


O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe


O23 - Service: TOSHIBA Bluetooth Service - TOSHIBA CORPORATION - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe


--


End of file - 6846 bytes


________________________________________________________________________________


__________________--


He also added that he downloaded a crack and after that this all started.


Thanks for your help !


Regards ,


Erik and his friend c(: .

Comments

  • rootkit
    rootkit ✭✭✭
    edited June 2008

    "Good" job with the crack !


    We should not help you for this ! <img class=" />


    Pack these files in a zip or rar archive protected with the password infected and attach it here !



    C:\Users\Kalmu\AppData\Local\Temp\mlJYrqNf.dll


    C:\Users\Kalmu\AppData\Local\Temp\opnOGwTM.dll


    C:\Users\Kalmu\AppData\Local\Temp\pbjgmhli.dll


    C:\Users\Kalmu\AppData\Local\Temp\vacgoopm.dll


    After this, download ComboFix from here: http://download.bleepingcomputer.com/sUBs/ComboFix.exe


    Then close all running programs, including web browser, instant messenger, etc and then run ComboFix.


    It will ask you whether it should start cleaning or not. Press 1 and hit Enter. Don't stop it while running. While doing this your screen may disappear but don't worry, it's a normal behaviour.


    At the end ComboFix will generate a log file. Save it and post it here.

  • TotalBalance
    TotalBalance
    edited June 2008

    Ok , he did all that you requested before (AND Is VERY greatful for your help even though you said that you shouldn't help us at all...)


    And the result is it's all OK at the moment.. But i'll inform as soon as i can if there are any changes..


    Here is the log of combofix:


    ComboFix 08-06-16.5 - Kalmu 2008-06-17 23:07:15.1 - NTFSx86


    Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1257.1.1033.18.1106 [GMT 3:00]


    Running from: C:\Downloads\ComboFix.exe


    * Created a new restore point


    .


    ((((((((((((((((((((((((( Files Created from 2008-05-17 to 2008-06-17 )))))))))))))))))))))))))))))))


    .


    2008-06-17 15:25 . 2008-06-17 15:25 <DIR> d-------- C:\Program Files\Trend Micro


    2008-06-17 15:08 . 2008-06-17 15:08 <DIR> d-------- C:\VundoFix Backups


    2008-06-15 13:29 . 2008-06-16 23:37 <DIR> d--h----- C:\$AVG8.VAULT$


    2008-06-15 13:25 . 2008-06-16 12:16 <DIR> d-------- C:\Windows\System32\drivers\Avg


    2008-06-15 13:25 . 2008-06-15 13:25 96,520 --a------ C:\Windows\System32\drivers\avgldx86.sys


    2008-06-15 13:25 . 2008-06-15 13:25 67,080 --a------ C:\Windows\System32\drivers\avgwfpx.sys


    2008-06-15 13:25 . 2008-06-15 13:25 10,520 --a------ C:\Windows\System32\avgrsstx.dll


    2008-06-15 13:24 . 2008-06-15 13:24 <DIR> d-------- C:\ProgramData\avg8


    2008-06-15 13:24 . 2008-06-15 13:24 <DIR> d-------- C:\Program Files\AVG


    2008-06-15 12:35 . 2008-06-15 12:35 <DIR> d-------- C:\Users\Kalmu\AppData\Roaming\Lavasoft


    2008-06-15 12:35 . 2008-06-15 12:35 <DIR> d-------- C:\Program Files\Lavasoft


    2008-06-11 20:05 . 2008-04-25 05:12 1,383,424 --a------ C:\Windows\System32\mshtml.tlb


    2008-06-11 20:05 . 2008-04-26 11:08 1,314,816 --a------ C:\Windows\System32\quartz.dll


    2008-06-11 20:05 . 2008-04-25 07:35 826,880 --a------ C:\Windows\System32\wininet.dll


    2008-06-11 20:05 . 2008-05-10 04:33 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys


    2008-06-09 23:53 . 2008-06-09 23:53 0 --ah----- C:\Windows\System32\drivers\Msft_User_WpdFs_01_00_00.Wdf


    2008-06-08 13:16 . 2008-06-08 13:16 <DIR> d-------- C:\PerfLogs


    2008-06-06 12:43 . 2008-01-19 10:35 9,847,296 --a------ C:\Windows\System32\NlsData000a.dll


    2008-06-06 12:42 . 2008-01-19 09:06 8,147,456 --a------ C:\Windows\System32\wmploc.DLL


    2008-06-06 12:41 . 2008-01-19 10:36 704,512 --a------ C:\Windows\System32\SmiEngine.dll


    2008-06-06 12:41 . 2008-01-19 10:36 357,888 --a------ C:\Windows\System32\wbemcomn.dll


    2008-06-06 12:41 . 2008-01-19 10:34 305,152 --a------ C:\Windows\System32\msdelta.dll


    2008-06-06 12:41 . 2008-01-19 10:34 258,560 --a------ C:\Windows\System32\dpx.dll


    2008-06-06 12:41 . 2008-01-19 10:34 246,784 --a------ C:\Windows\System32\drvstore.dll


    2008-06-06 12:41 . 2008-01-19 10:36 218,624 --a------ C:\Windows\System32\wdscore.dll


    2008-06-06 12:41 . 2008-01-19 10:36 139,264 --a------ C:\Windows\System32\SmiInstaller.dll


    2008-06-06 12:41 . 2008-01-19 10:33 130,560 --a------ C:\Windows\System32\PkgMgr.exe


    2008-06-06 12:41 . 2008-01-19 10:35 35,328 --a------ C:\Windows\System32\mspatcha.dll


    2008-05-23 01:20 . 2008-05-23 01:20 1,044,480 --a------ C:\Windows\System32\libdivx.dll


    2008-05-23 01:20 . 2008-05-23 01:20 200,704 --a------ C:\Windows\System32\ssldivx.dll


    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    2008-06-17 12:18 --------- d-----w C:\Program Files\DivX


    2008-06-16 22:43 --------- d-----w C:\Users\Kalmu\AppData\Roaming\Microgaming


    2008-06-16 18:17 --------- d-----w C:\ProgramData\Skype


    2008-06-15 16:58 --------- d-----w C:\Users\Kalmu\AppData\Roaming\LimeWire


    2008-06-15 10:39 --------- d-----w C:\Program Files\DivoCodec


    2008-06-08 10:23 174 --sha-w C:\Program Files\desktop.ini


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Sidebar


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Photo Gallery


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Mail


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Journal


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Defender


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Collaboration


    2008-06-08 10:17 --------- d-----w C:\Program Files\Windows Calendar


    2008-06-08 09:57 82,432 ----a-w C:\Windows\System32\axaltocm.dll


    2008-06-08 09:57 101,888 ----a-w C:\Windows\System32\ifxcardm.dll


    2008-06-07 20:47 --------- d-----w C:\Program Files\World of Warcraft


    2008-06-01 13:34 --------- d-----w C:\Program Files\Warcraft III


    2008-05-27 10:44 --------- d-----w C:\Users\Kalmu\AppData\Roaming\GetRightToGo


    2008-05-02 07:46 --------- d-----w C:\ProgramData\FreeRIP


    .


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    .


    *Note* empty entries & legit default entries are not shown


    REGEDIT4


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 10:33 1233920]


    "WindowsWelcomeCenter"="oobefldr.dll" [2008-01-19 10:36 2153472 C:\Windows\System32\oobefldr.dll]


    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]


    "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-21 07:56 171464]


    "ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 10:33 125952]


    "CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 12:03 868352]


    "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 10:33 202240]


    "cmds"="C:\Users\Kalmu\AppData\Local\Temp\opnOGwTM.dll" [2008-06-16 21:06 322560]


    "BMcbb9a1e3"="C:\Users\Kalmu\AppData\Local\Temp\vacgoopm.dll" [2008-06-16 21:07 90112]


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "RtHDVCpl"="RtHDVCpl.exe" [2007-04-23 15:51 4435968 C:\Windows\RtHDVCpl.exe]


    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]


    "Flashget"="C:\Program Files\FlashGet\FlashGet.exe" [2007-09-11 11:35 1998896]


    "WinampAgent"="C:\Program Files\Winamp\wianmpa.exe" [ ]


    "RTHDCPL"="RTHDCPL.EXE" [2006-11-14 12:21 16270848 C:\Windows\RTHDCPL.exe]


    "SkyTel"="Skytel.exe" [2007-04-13 15:36 1822720 C:\Windows\SkyTel.exe]


    "SoundMan"="SOUNDMAN.EXE" [2006-07-21 11:14 86016 C:\Windows\SoundMan.exe]


    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-12-11 11:56 286720]


    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]


    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]


    "CTCheck"="C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 12:08 397312]


    "NvSvc"="C:\Windows\system32\nvsvc.dll" [2007-07-06 13:15 86016]


    "NvCplDaemon"="C:\Windows\system32\NvCpl.dll" [2007-07-06 13:15 8466432]


    "NvMediaCenter"="C:\Windows\system32\NvMcTray.dll" [2007-07-06 13:15 81920]


    "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-06-15 13:25 1177368]


    C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\


    Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [9/9/2007 5:46:29 PM 113664]


    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [1/18/2007 3:48:42 PM 2752512]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]


    "EnableUIADesktopToggle"= 0 (0x0)


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]


    "AppInit_DLLs"=avgrsstx.dll


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]


    "VIDC.YV12"= yv12vfw.dll


    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]


    "TCP Query User{A67D9BD9-3CFB-4A2C-AB13-C091E5207661}C:\\program files\\flashget\\flashget.exe"= UDP:C:\program files\flashget\flashget.exe:FlashGet


    "UDP Query User{72F2693F-625D-4BAC-9F84-3F5D35467F9A}C:\\program files\\flashget\\flashget.exe"= TCP:C:\program files\flashget\flashget.exe:FlashGet


    "TCP Query User{08F49836-5A27-4C23-B4F5-5245B9D1CBA6}C:\\users\\kalmu\\desktop\\wow-burningcrusade-enus-installer-downloader.exe"= UDP:C:\users\kalmu\desktop\wow-burningcrusade-enus-installer-downloader.exe:wow-burningcrusade-enus-installer-downloader.exe


    "UDP Query User{29A4A136-2C8C-4493-9356-0AC4FEEFFB15}C:\\users\\kalmu\\desktop\\wow-burningcrusade-enus-installer-downloader.exe"= TCP:C:\users\kalmu\desktop\wow-burningcrusade-enus-installer-downloader.exe:wow-burningcrusade-enus-installer-downloader.exe


    "TCP Query User{956F19BF-35E2-4C74-AC57-6644ABCFEE6D}C:\\downloads\\wow-burningcrusade-enus-installer-downloader.exe"= UDP:C:\downloads\wow-burningcrusade-enus-installer-downloader.exe:Blizzard Downloader


    "UDP Query User{C4A37C44-1465-4EF7-8392-A09FBA90F560}C:\\downloads\\wow-burningcrusade-enus-installer-downloader.exe"= TCP:C:\downloads\wow-burningcrusade-enus-installer-downloader.exe:Blizzard Downloader


    "TCP Query User{58AD8BDC-DB2F-4D9A-9B6F-58AE3A0BD6F5}C:\\program files\\flashget\\flashget.exe"= UDP:C:\program files\flashget\flashget.exe:FlashGet


    "UDP Query User{596BEF15-106A-4794-9304-0322027BE936}C:\\program files\\flashget\\flashget.exe"= TCP:C:\program files\flashget\flashget.exe:FlashGet


    "TCP Query User{21F71782-13F6-4BA4-8036-009B54397750}C:\\program files\\world of warcraft\\repair.exe"= UDP:C:\program files\world of warcraft\repair.exe:Blizzard Repair Utility


    "UDP Query User{83A5B0BD-63F4-4F46-9BDD-17A427862103}C:\\program files\\world of warcraft\\repair.exe"= TCP:C:\program files\world of warcraft\repair.exe:Blizzard Repair Utility


    "TCP Query User{B3B1EC44-F656-4B13-A356-27BE7FC9E027}C:\\program files\\world of warcraft\\wow-1.12.0-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-1.12.0-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{3312FAA6-EF6A-4F41-AC6B-05477C531DE9}C:\\program files\\world of warcraft\\wow-1.12.0-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-1.12.0-enus-downloader.exe:Blizzard Downloader


    "{2B4FABF1-CA70-4D45-9CAF-85AC0C8BA243}"= UDP:3724:Blizzard Downloader


    "{CE55A773-A370-4C8C-B084-62C0F32CFD5B}"= UDP:6112:Blizzard Downloader


    "TCP Query User{A5131756-B75A-4844-BA38-F7FE8385C92A}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer


    "UDP Query User{57C19C8D-5C8B-4AE9-A1F7-89B2836D65F6}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer


    "TCP Query User{9F4DE367-30EF-42BB-A101-6303D110832C}C:\\users\\kalmu\\appdata\\local\\temp\\flashget.exe"= UDP:C:\users\kalmu\appdata\local\temp\flashget.exe:flashget.exe


    "UDP Query User{0C9B0C40-7E8A-46DF-B154-7F3C516351CD}C:\\users\\kalmu\\appdata\\local\\temp\\flashget.exe"= TCP:C:\users\kalmu\appdata\local\temp\flashget.exe:flashget.exe


    "TCP Query User{B6B957CB-515F-4F33-94A6-A03497D8FEAB}C:\\program files\\world of warcraft\\wow-2.1.3.6898-to-2.2.0.7272-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.3.6898-to-2.2.0.7272-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{3F3D29CF-FDFD-4568-8A57-8CBEA09279CE}C:\\program files\\world of warcraft\\wow-2.1.3.6898-to-2.2.0.7272-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.3.6898-to-2.2.0.7272-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{245D8CD8-555B-4245-80BD-622978F30415}C:\\users\\kalmu\\documents\\minu vastuvõetud failid\\wow-burningcrusade-enus-installer-downloader.exe"= UDP:C:\users\kalmu\documents\minu vastuvõetud failid\wow-burningcrusade-enus-installer-downloader.exe:wow-burningcrusade-enus-installer-downloader.exe


    "UDP Query User{B8F86CBE-46AF-4300-9A78-BC78061CE278}C:\\users\\kalmu\\documents\\minu vastuvõetud failid\\wow-burningcrusade-enus-installer-downloader.exe"= TCP:C:\users\kalmu\documents\minu vastuvõetud failid\wow-burningcrusade-enus-installer-downloader.exe:wow-burningcrusade-enus-installer-downloader.exe


    "TCP Query User{E0F2DDEF-A033-42A9-822E-76F6762423C1}C:\\program files\\world of warcraft\\wow-2.2.0.7272-to-2.2.2.7318-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.2.0.7272-to-2.2.2.7318-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{7BAB68DD-5F34-4E67-B979-F0178C71513D}C:\\program files\\world of warcraft\\wow-2.2.0.7272-to-2.2.2.7318-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.2.0.7272-to-2.2.2.7318-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{E3FBC4FD-A3E3-4F81-A56E-2276819A8DCB}C:\\windows\\system32\\solidstatenetworks\\solidstateion\\solidnm.exe"= UDP:C:\windows\system32\solidstatenetworks\solidstateion\solidnm.exe:solidnm


    "UDP Query User{BCE4DF20-A627-4308-A398-AB32D3220063}C:\\windows\\system32\\solidstatenetworks\\solidstateion\\solidnm.exe"= TCP:C:\windows\system32\solidstatenetworks\solidstateion\solidnm.exe:solidnm


    "TCP Query User{7F1CD308-F768-459E-BC78-585BD952E5C2}C:\\program files\\world of warcraft\\wow-2.2.2.7318-to-2.2.3.7359-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.2.2.7318-to-2.2.3.7359-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{AE764339-A03A-4BC6-BA1E-1F2C6F4F0ED9}C:\\program files\\world of warcraft\\wow-2.2.2.7318-to-2.2.3.7359-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.2.2.7318-to-2.2.3.7359-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{10F98101-BC57-4D2B-8204-FB11C89C3C60}C:\\program files\\ngd studios\\regnum online\\liveserver\\roclientgame.exe"= UDP:C:\program files\ngd studios\regnum online\liveserver\roclientgame.exe:RegnumOnline


    "UDP Query User{5F19EC95-55D1-4C5E-8D07-2B2EB9AF0664}C:\\program files\\ngd studios\\regnum online\\liveserver\\roclientgame.exe"= TCP:C:\program files\ngd studios\regnum online\liveserver\roclientgame.exe:RegnumOnline


    "{A76C2600-202F-45A4-A6D0-71F6016B73F6}"= UDP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire


    "{E018397F-D256-486C-B00A-A19B123FB8D7}"= TCP:C:\Program Files\LimeWire\LimeWire.exe:LimeWire


    "TCP Query User{5ED4295A-48DE-4543-8EAD-E5FE16C0AB9E}C:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= UDP:C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine


    "UDP Query User{F4940E7D-1BED-4032-8081-BECD718FD7A6}C:\\program files\\games-masters.com\\cabal online (europe)\\launcher\\update\\estdnheadless.exe"= TCP:C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe:EST! download engine


    "TCP Query User{D5B323E3-4019-4133-A502-5A4CF78F220B}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath


    "UDP Query User{FD2E09B0-937E-4D86-8FD2-879D17C225B9}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath


    "TCP Query User{ED272957-11FC-4003-A38E-AF8CD08C7B3F}C:\\program files\\world of warcraft\\backgrounddownloader.exe"= UDP:C:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader


    "UDP Query User{0CADEBEB-B9B6-499E-8829-DB4F79564FBA}C:\\program files\\world of warcraft\\backgrounddownloader.exe"= TCP:C:\program files\world of warcraft\backgrounddownloader.exe:Blizzard Downloader


    "TCP Query User{7D86F79F-4BE0-4596-BE62-92ED922B96B2}C:\\program files\\valve\\cstrike_1.6\\hl.exe"= UDP:C:\program files\valve\cstrike_1.6\hl.exe:Half-Life Launcher


    "UDP Query User{ACB1E08A-17C7-435B-9840-D644B7FA331F}C:\\program files\\valve\\cstrike_1.6\\hl.exe"= TCP:C:\program files\valve\cstrike_1.6\hl.exe:Half-Life Launcher


    "TCP Query User{92B7E2FD-5A86-4053-82AC-E64DCA0D1FED}C:\\program files\\world of warcraft\\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{5813C636-2958-4AA2-B95C-03436344DE1F}C:\\program files\\world of warcraft\\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{B2D4514C-5A3F-49E7-8978-71F35C3AB4DA}C:\\program files\\world of warcraft\\repair.exe"= UDP:C:\program files\world of warcraft\repair.exe:Blizzard Repair Utility


    "UDP Query User{D644191A-3B1C-4F67-BB6B-68036C038A35}C:\\program files\\world of warcraft\\repair.exe"= TCP:C:\program files\world of warcraft\repair.exe:Blizzard Repair Utility


    "TCP Query User{79C14041-E648-46C9-8784-EB59FF42CBAC}C:\\users\\kalmu\\desktop\\new folder\\wow-1.12.0-enus-downloader.exe"= UDP:C:\users\kalmu\desktop\new folder\wow-1.12.0-enus-downloader.exe:wow-1.12.0-enus-downloader.exe


    "UDP Query User{D9A37535-49BE-40D8-A5E3-504C4D31C07C}C:\\users\\kalmu\\desktop\\new folder\\wow-1.12.0-enus-downloader.exe"= TCP:C:\users\kalmu\desktop\new folder\wow-1.12.0-enus-downloader.exe:wow-1.12.0-enus-downloader.exe


    "TCP Query User{0E79E66D-512D-4F73-974B-C08DEB1B932A}C:\\users\\kalmu\\desktop\\new folder\\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe"= UDP:C:\users\kalmu\desktop\new folder\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe:wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe


    "UDP Query User{9B0EFDA9-CF15-4691-B507-6EF1609D8675}C:\\users\\kalmu\\desktop\\new folder\\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe"= TCP:C:\users\kalmu\desktop\new folder\wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe:wow-2.2.3.7359-to-2.3.0.7561-enus-downloader.exe


    "TCP Query User{144BA0F4-29A6-4BF7-945D-8D82A7ED8701}C:\\users\\kalmu\\desktop\\new folder\\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe"= UDP:C:\users\kalmu\desktop\new folder\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe:wow-1.12.x-to-2.0.1-enus-patch-downloader.exe


    "UDP Query User{CCDD5BF2-3B9F-4460-8791-6AFEE364F8D9}C:\\users\\kalmu\\desktop\\new folder\\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe"= TCP:C:\users\kalmu\desktop\new folder\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe:wow-1.12.x-to-2.0.1-enus-patch-downloader.exe


    "TCP Query User{728E6792-9B1D-4445-A180-F82E5B9B6D53}C:\\program files\\world of warcraft\\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe"= UDP:C:\program files\world of warcraft\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe:Blizzard Downloader


    "UDP Query User{43F2A8AF-FC58-493B-B11F-103BD4061A4C}C:\\program files\\world of warcraft\\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe"= TCP:C:\program files\world of warcraft\wow-1.12.x-to-2.0.1-enus-patch-downloader.exe:Blizzard Downloader


    "TCP Query User{52586688-0E78-46A9-97DF-002CD79849A7}C:\\program files\\world of warcraft\\wow-2.1.0.6692-to-2.1.0.6729-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.0.6692-to-2.1.0.6729-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{1926E98B-514A-4994-B495-71C2CE461D7E}C:\\program files\\world of warcraft\\wow-2.1.0.6692-to-2.1.0.6729-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.0.6692-to-2.1.0.6729-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{6049C711-6850-442A-AD58-1E7D256BC5E5}C:\\program files\\world of warcraft\\wow-2.1.0.6729-to-2.1.1.6739-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.0.6729-to-2.1.1.6739-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{13865377-B166-4BA8-B9FC-0A57B674CEE2}C:\\program files\\world of warcraft\\wow-2.1.0.6729-to-2.1.1.6739-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.0.6729-to-2.1.1.6739-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{2937A1F3-AAEF-41AB-9990-58A15EFC4D25}C:\\program files\\world of warcraft\\wow-2.1.0-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.0-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{BF7AA9F3-1358-47E7-92CA-DBAA7BC6C6D3}C:\\program files\\world of warcraft\\wow-2.1.0-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.0-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{06365DBA-09A3-4022-9E8B-43E02F298FD9}C:\\program files\\world of warcraft\\wow-2.1.1.6739-to-2.1.2.6803-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.1.6739-to-2.1.2.6803-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{1F512D76-FCE2-4D0A-B111-07E43BC997F1}C:\\program files\\world of warcraft\\wow-2.1.1.6739-to-2.1.2.6803-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.1.6739-to-2.1.2.6803-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{E42CCB46-B912-4F86-9A38-1861A38C8B35}C:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{BB82B80B-1177-408E-84D5-CF08A2307871}C:\\program files\\world of warcraft\\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.1.2.6803-to-2.1.3.6898-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{9705DB2E-16A0-47D1-9D79-F01B106B8E31}C:\\program files\\world of warcraft\\wow-2.2.0-enus-downloader.exe"= UDP:C:\program files\world of warcraft\wow-2.2.0-enus-downloader.exe:Blizzard Downloader


    "UDP Query User{26C2D05D-7100-4F40-8D54-0A105D79D4FF}C:\\program files\\world of warcraft\\wow-2.2.0-enus-downloader.exe"= TCP:C:\program files\world of warcraft\wow-2.2.0-enus-downloader.exe:Blizzard Downloader


    "TCP Query User{93FD1827-7998-4A65-9F0C-12CF29CF8C8E}C:\\program files\\raven software\\sof2\\sof2mp.exe"= UDP:C:\program files\raven software\sof2\sof2mp.exe:SoF2MP


    "UDP Query User{A7CC6559-9B39-47DF-926B-E54EAFC6DE2D}C:\\program files\\raven software\\sof2\\sof2mp.exe"= TCP:C:\program files\raven software\sof2\sof2mp.exe:SoF2MP


    "TCP Query User{10C3EF80-8DC0-4D6D-B994-DD2605C5FC33}C:\\program files\\skype\\phone\\skype.exe"= UDP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath


    "UDP Query User{A5A63D6B-E7E5-41D2-AD1C-68D5728AE5A5}C:\\program files\\skype\\phone\\skype.exe"= TCP:C:\program files\skype\phone\skype.exe:Skype. Take a deep breath


    "TCP Query User{B752FCBD-4858-4890-B60D-CE098C30E8AF}C:\\program files\\codemasters\\rf online;\\rf.exe"= UDP:C:\program files\codemasters\rf online;\rf.exe:RFLauncher


    "UDP Query User{2A52255B-418C-44DF-AE64-1011800FDE9D}C:\\program files\\codemasters\\rf online;\\rf.exe"= TCP:C:\program files\codemasters\rf online;\rf.exe:RFLauncher


    "TCP Query User{00AB5272-0497-4BD7-A738-3A5B22E99F62}C:\\program files\\toshiba\\bluetooth toshiba stack\\tosbtpcs.exe"= UDP:C:\program files\toshiba\bluetooth toshiba stack\tosbtpcs.exe:Bluetooth PAN Client


    "UDP Query User{E7C2C5CD-5EBF-40E8-928D-0E657E1D0D3E}C:\\program files\\toshiba\\bluetooth toshiba stack\\tosbtpcs.exe"= TCP:C:\program files\toshiba\bluetooth toshiba stack\tosbtpcs.exe:Bluetooth PAN Client


    "TCP Query User{4F671B67-4C6C-49EC-8844-9F1D08A8FCBD}C:\\program files\\codemasters\\operationflashpoint\\operationflashpoint.exe"= UDP:C:\program files\codemasters\operationflashpoint\operationflashpoint.exe:Operation Flashpoint


    "UDP Query User{43C0C517-9955-416F-85D9-DE7D61A478DC}C:\\program files\\codemasters\\operationflashpoint\\operationflashpoint.exe"= TCP:C:\program files\codemasters\operationflashpoint\operationflashpoint.exe:Operation Flashpoint


    "TCP Query User{B8644332-F14D-4021-BCB5-7B459699B441}C:\\windows\\system32\\dpnsvr.exe"= UDP:C:\windows\system32\dpnsvr.exe:Microsoft DirectPlay8 Server


    "UDP Query User{E9E1D88D-6EB2-42BB-B5B8-0CB2FA1FF927}C:\\windows\\system32\\dpnsvr.exe"= TCP:C:\windows\system32\dpnsvr.exe:Microsoft DirectPlay8 Server


    "{2D42CAA3-2677-4A63-B0A0-050131679634}"= UDP:C:\Program Files\utorrent\utorrent.exe:µTorrent


    "{8312E98E-23C4-4CA0-BED2-0C53A63FEDEA}"= TCP:C:\Program Files\utorrent\utorrent.exe:µTorrent


    "TCP Query User{F1B057F8-FFD9-4988-9632-1066764E02AE}C:\\program files\\darkeden\\darkeden.exe"= UDP:C:\program files\darkeden\darkeden.exe:DarkEden


    "UDP Query User{93D0E800-90B8-4C13-80F5-FD23BAF3CF80}C:\\program files\\darkeden\\darkeden.exe"= TCP:C:\program files\darkeden\darkeden.exe:DarkEden


    "TCP Query User{A6670441-1D72-4603-A76D-5F3C6D4DC1C4}C:\\program files\\valve\\cstrike_1.6\\hlds.exe"= UDP:C:\program files\valve\cstrike_1.6\hlds.exe:HLDS Launcher


    "UDP Query User{311C5D00-20D8-4092-A46E-B2ECD0FFD4F6}C:\\program files\\valve\\cstrike_1.6\\hlds.exe"= TCP:C:\program files\valve\cstrike_1.6\hlds.exe:HLDS Launcher


    "TCP Query User{4F69BF4E-5381-4A0F-A3AF-D7621CF79EC7}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox


    "UDP Query User{C510D7BE-E9E4-4C67-9692-F2D88334602E}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox


    "{AE72F508-69C3-43A6-83F3-3A4C44FDCA48}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)


    "TCP Query User{3C6A59F1-2E1B-40AD-BBDD-976B60CADC49}C:\\users\\kalmu\\documents\\minu vastuvõetud failid\\the all-seeing eye\\eye.exe"= UDP:C:\users\kalmu\documents\minu vastuvõetud failid\the all-seeing eye\eye.exe:eye.exe


    "UDP Query User{26C336B0-DFAB-4838-B64F-E09B57A8CC88}C:\\users\\kalmu\\documents\\minu vastuvõetud failid\\the all-seeing eye\\eye.exe"= TCP:C:\users\kalmu\documents\minu vastuvõetud failid\the all-seeing eye\eye.exe:eye.exe


    "TCP Query User{E9473AAA-70A3-490E-ADF9-A0289F2EF076}C:\\users\\kalmu\\desktop\\the all-seeing eye\\eye.exe"= UDP:C:\users\kalmu\desktop\the all-seeing eye\eye.exe:eye.exe


    "UDP Query User{441F6AB9-3160-4F0A-B84D-CCCA82421D11}C:\\users\\kalmu\\desktop\\the all-seeing eye\\eye.exe"= TCP:C:\users\kalmu\desktop\the all-seeing eye\eye.exe:eye.exe


    "TCP Query User{170448C7-0BEE-42CE-80A3-49D91E9253F1}C:\\program files\\codemasters\\rf online\\rf.exe"= UDP:C:\program files\codemasters\rf online\rf.exe:RFLauncher


    "UDP Query User{07C33D05-F491-4A82-9A4D-3359B58E86AE}C:\\program files\\codemasters\\rf online\\rf.exe"= TCP:C:\program files\codemasters\rf online\rf.exe:RFLauncher


    "{7F99167B-0861-461B-85FB-C77A30B097D5}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe


    "{9CB46944-7A45-4C76-AA49-E44251DC8679}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe


    R1 AvgLdx86;AVG AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-06-15 13:25]


    R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-15 13:25]


    R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-15 13:25]


    R3 AvgWfpX;AVG8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-06-15 13:25]


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc2796ae-5d3a-11dc-a5c7-0019dba593f5}]


    \shell\AutoRun\command - L:\Setup.exe


    *Newly Created Service* - CATCHME


    .


    Contents of the 'Scheduled Tasks' folder


    "2008-06-17 15:11:33 C:\Windows\Tasks\User_Feed_Synchronization-{143CBFC8-EC0D-42E0-8BB8-A3DB474EC6C6}.job"


    - C:\Windows\system32\msfeedssync.exe


    .


    **************************************************************************


    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net


    Rootkit scan 2008-06-17 23:10:10


    Windows 6.0.6001 Service Pack 1 NTFS


    scanning hidden processes ...


    [0] 0x000028E3


    [0] 0x20000000


    scanning hidden autostart entries ...


    scanning hidden files ...


    scan completed successfully


    hidden files: 0


    **************************************************************************


    .


    --------------------- DLLs Loaded Under Running Processes ---------------------


    PROCESS: C:\Windows\Explorer.exe


    -> C:\Users\Kalmu\AppData\Local\Temp\pbjgmhli.dll


    -> C:\Users\Kalmu\AppData\Local\Temp\vacgoopm.dll


    -> C:\Users\Kalmu\AppData\Local\Temp\opnOGwTM.dll


    .


    Completion time: 2008-06-17 23:11:17


    ComboFix-quarantined-files.txt 2008-06-17 20:10:56


    Pre-Run: 120,881,467,392 bytes free


    Post-Run: 132,799,787,008 bytes free


    229 --- E O F --- 2008-06-14 16:34:17



    And combofix also saved some "Bug.txt" file :


    pushd "C:\327882R2FWJFW\"


    =============================================


    ALLUSERSPROFILE=C:\ProgramData


    APPDATA=C:\Users\Kalmu\AppData\Roaming


    cfldr=327882R2FWJFW


    CLASSPATH=.;C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip


    CommonProgramFiles=C:\Program Files\Common Files


    COMPUTERNAME=KALMU-PC


    ComSpec=C:\Windows\system32\cmd.exe


    configsetroot=C:\Windows\ConfigSetRoot


    FP_NO_HOST_CHECK=NO


    HOMEDRIVE=C:


    HOMEPATH=\Users\Kalmu


    kmd=CF22653.exe


    LOCALAPPDATA=C:\Users\Kalmu\AppData\Local


    LOGONSERVER=\\KALMU-PC


    NUMBER_OF_PROCESSORS=2


    OS=Windows_NT


    Path=C:\327882R2FWJFW;C:\Windows\system32;C:\Windows;C:\Windows\system32\wbem;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Program Files\QuickTime\QTSystem\


    PATHEXT=.cfexe;.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC


    PROCESSOR_ARCHITECTURE=x86


    PROCESSOR_IDENTIFIER=x86 Family 6 Model 15 Stepping 2, GenuineIntel


    PROCESSOR_LEVEL=6


    PROCESSOR_REVISION=0f02


    ProgramData=C:\ProgramData


    ProgramFiles=C:\Program Files


    PROMPT=$


    PUBLIC=C:\Users\Public


    QTJAVA=C:\Program Files\Java\jre1.6.0_03\lib\ext\QTJava.zip


    sfxname=C:\Downloads\ComboFix.exe


    system=C:\Windows\system32


    SystemDrive=C:


    SystemRoot=C:\Windows


    TEMP=C:\Users\Kalmu\AppData\Local\Temp


    TMP=C:\Users\Kalmu\AppData\Local\Temp


    USERDOMAIN=Kalmu-PC


    USERNAME=Kalmu


    USERPROFILE=C:\Users\Kalmu


    windir=C:\Windows


    =============================================


    if not defined sfxname goto END


    If [] == [] Set "SfxCmd="


    if /I "C:\327882R2FWJFW" NEQ "C:\327882R2FWJFW" goto Abort


    if exist "C:\Users\Kalmu\AppData\Local\Temp\327882R2FWJFW327882R2FWJFW.log" del "C:\Users\Kalmu\AppData\Local\Temp\327882R2FWJFW327882R2FWJFW.log"


    SteelWerX Extended Configuration Access Control Lists


    Written by Bobbi Flekman 2006 ©


    Ownerchange for "C:\Windows\system32\cmd.exe" to Administrators group was successful


    copy /y "C:\Windows\system32\cmd.exe" "C:\Windows\system32\CF22653.exe"


    1 file(s) copied.


    if not exist "C:\Windows\system32\CF22653.exe" catchme -l nul -c "C:\Windows\system32\cmd.exe" "C:\Windows\system32\CF22653.exe"


    For /F "tokens=*" %g in ("C:\Downloads\ComboFix.exe") do @(


    set "FileName=%~ng"


    set "FilePath=%~dpg"


    )


    Set FileName 1>FileName 2>nul


    GREP -Gisqx "FileName=[-[:alnum:]@.]*" FileName || (


    nircmd infobox "You cannot rename ComboFix as ComboFix~n~nPlease use another name, preferbaly made up of alphanumeric characters" ""


    goto END


    )


    DIR /AD/B C:\* | Findstr -IVX ComboFix 1>dirname00


    Findstr -LIXC:"ComboFix" dirname00 1>nul && call :NameChk


    If exist dirname0? del /Q dirname0?


    If exist "\ComboFix" DIR /AD "\ComboFix" 1>nul && (


    rd /s/q "\ComboFix"


    If exist "\ComboFix" (


    PV -kf Findstr *.cfexe


    rd /s/q "\ComboFix"


    )


    If exist "\ComboFix" (


    handle "C:\ComboFix" | SED -r "/pid:/!d; s/.*: (.*): .*/\1/" 1>temp00


    for /F "tokens=1,2" %g in (temp00) do @echo.y | Handle -p %g -c %h


    del /q temp00


    rd /s/q "\ComboFix"


    )


    )


    If exist "\ComboFix" rd /s/q "\ComboFix"


    If exist "\ComboFix" goto :eof


    VER | Findstr -ic:"[Version 6.0" && (Call :Vista ) ||


    Microsoft Windows [Version 6.0.6001]


    type nul 1>Vista.mac


    swxcacls "C:\Windows\system32\cmd.exe" /g SID#S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:f /ga:x /gs:x /gp:x /gu:x /q


    swxcacls "C:\Windows\system32\cmd.exe" /o SID#S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 /q


    swreg query "hkcu\control panel\international" /v localename | SED "/.*\t/!d;s///" 1>MUI00


    swreg query "hku\.default\control panel\international" /v localename | SED "/.*\t/!d;s///" 1>>MUI00


    SED -r "$!N; /^(.*)\n\1$/!P; D" MUI00 1>MUI01


    For /F "tokens=*" %g in (MUI01) do @if exist "C:\Windows\system32\%~g\cmd.exe.mui" (


    swxcacls "C:\Windows\system32\%~g\cmd.exe.mui" /oa /q


    swxcacls "C:\Windows\system32\%~g\cmd.exe.mui" /p /ga:f /gs:f /gp:x /gu:x /q


    Copy /y "C:\Windows\system32\%~g\cmd.exe.mui" "C:\Windows\system32\en-us\CF22653.exe.mui"


    swxcacls "C:\Windows\system32\%~g\cmd.exe.mui" /g SID#S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464:f /ga:x /gs:x /gp:x /gu:x /q


    swxcacls "C:\Windows\system32\%~g\cmd.exe.mui" /o SID#S-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464 /q


    )


    GREP -sq . MUI01 && (


    del /q MUI0? 2>nul


    goto :eof


    )


    CD ..


    Set "comspec=C:\Windows\system32\CF22653.exe"


    (


    echo.md "\ComboFix"


    echo.Move /y "\327882R2FWJFW\*" "\ComboFix"


    echo.RD /S/Q "\327882R2FWJFW"


    echo.Start "." /d"C:\ComboFix" "C:\Windows\system32\CF22653.exe" /k c.bat


    echo.pv -kf cmd.exe


    ) 1>Start_.cmd


    NirCmd exec hide "C:\Windows\system32\CF22653.exe" /f:off /d /c call Start_.cmd


    NirCmd execmd del "\327882R2FWJFW\prep.cmd"


    EXIT


    Thanks in forward from my friend...

  • TotalBalance
    TotalBalance

    And heres the zip file of the infected files:


    [Password: Infected]


    /applications/core/interface/file/attachment.php?id=2262" data-fileid="2262" rel="">Infected.zip


    And heres his latest Hijackthis log :


    Logfile of Trend Micro HijackThis v2.0.2


    Scan saved at 23:47:22, on 17.06.2008


    Platform: Windows Vista SP1 (WinNT 6.00.1905)


    MSIE: Internet Explorer v7.00 (7.00.6001.18000)


    Boot mode: Normal


    Running processes:


    C:\Windows\system32\taskeng.exe


    C:\Windows\system32\Dwm.exe


    C:\Windows\RtHDVCpl.exe


    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe


    C:\Windows\RTHDCPL.exe


    C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe


    C:\Windows\System32\rundll32.exe


    C:\Program Files\AVG\AVG8\avgtray.exe


    C:\Program Files\Windows Sidebar\sidebar.exe


    C:\Program Files\Windows Live\Messenger\msnmsgr.exe


    C:\Windows\System32\rundll32.exe


    C:\Program Files\DAEMON Tools\daemon.exe


    C:\Windows\ehome\ehtray.exe


    C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe


    C:\Program Files\Windows Media Player\wmpnscfg.exe


    C:\Windows\System32\rundll32.exe


    C:\Windows\System32\rundll32.exe


    C:\Windows\System32\rundll32.exe


    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe


    C:\Windows\ehome\ehmsas.exe


    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe


    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe


    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe


    C:\Windows\System32\mobsync.exe


    C:\Windows\system32\rundll32.exe


    C:\Windows\system32\rundll32.exe


    C:\Windows\system32\rundll32.exe


    C:\Users\Kalmu\Desktop\VundoFix.exe


    C:\Windows\Explorer.exe


    C:\Program Files\Trend Micro\HijackThis\clear.exe


    --


    End of file - 1503 bytes

  • TotalBalance
    TotalBalance

    Now the internet explorer and Mozilla are both popping trash up again...blank windows , blank tabs and sometimes some advertising tabs and windows..


    Erik.

All Time Leaders

Categories

Defenders of the month