Trojan Downloader Problems

188461.1

Dear all,
I got a bit of a problem. Avg came up when I went to a game site and said I have a virus. ..Trojanhorse Downloader.Agent.2.F
It said the infected file is Windows\System32\ODBC16GT.exe
(Is this a real System file or is it just fooling AVG into thinking it is?)

And it cannot be healed or removed. I did an online scan and it found nothing. When I ask for Detailed info on the virus it says it don't have any more info on it.

I ran Adaware and saved the log. I am not sure what is suppose to be there but I didn't find anything unusual I don't think.

I also ran hijackthis! and have the log from it. If anyone wants to see these I will post them. I went to the computer cops site and people have been posting logs all weekend and no-one is answering them. So I decided to come to you guys first.

I turned off System Restore and am ready to proceed to the next step. I am running Windows XP Home edition. I am posting the log from Ad Aware first and if need be, I can post the Log from hijack this.
Thanks.

Please Help!
Thanks,
star****





Lavasoft Ad-aware Personal Build 6.181
Logfile created on :Saturday, July 17, 2004 1:54:02 PM
Created with Ad-aware Personal, free for private use.
Using reference-file :01R217 08.09.2003
______________________________________________________

Ad-aware Settings
=========================
Set : Activate in-depth scan (Recommended)
Set : Safe mode (always request confirmation)
Set : Scan active processes
Set : Scan registry
Set : Deep scan registry


7-17-2004 1:54:02 PM - Scan started. (Smart mode)

Listing running processes
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ThreadCreationTime : 7-15-2004 6:48:07 AM
BasePriority : Normal


#:2 [winlogon.exe]
FilePath : \??\C:\WINDOWS\system32\
ThreadCreationTime : 7-15-2004 6:48:10 AM
BasePriority : High


#:3 [services.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 7-15-2004 6:48:10 AM
BasePriority : Normal
FileSize : 99 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
OriginalFilename : services.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:38 AM
Last accessed : 7/17/2004 6:07:42 PM
Last modified : 8/18/2001 5:36:56 AM

#:4 [lsass.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 7-15-2004 6:48:10 AM
BasePriority : Normal
FileSize : 11 KB
FileVersion : 5.1.2600.1106 (xpsp1.020828-1920)
ProductVersion : 5.1.2600.1106
CompanyName : Microsoft Corporation
FileDescription : LSA Shell (Export Version)
InternalName : lsass.exe
OriginalFilename : lsass.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:19 AM
Last accessed : 7/17/2004 6:07:13 PM
Last modified : 8/29/2002 10:41:26 AM

#:5 [svchost.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 7-15-2004 6:48:11 AM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:41 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 8/18/2001 5:36:58 AM

#:6 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-15-2004 6:48:11 AM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:41 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 8/18/2001 5:36:58 AM

#:7 [sdmcp.exe]
FilePath : C:\Program Files\Common Files\Stardock\
ThreadCreationTime : 7-15-2004 6:48:13 AM
BasePriority : Normal
FileSize : 248 KB
FileVersion : 0, 0, 5, 8
ProductVersion : 0, 0, 5, 8
Copyright : Copyright
CompanyName : Stardock
FileDescription : MCPServer
InternalName : MCP
OriginalFilename : SDMCP.exe
ProductName : Stardock MCP Core Services (System Extensions and Hooks)
Created on : 4/27/2004 2:50:33 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 11/13/2003 9:51:56 PM

#:8 [spoolsv.exe]
FilePath : C:\WINDOWS\system32\
ThreadCreationTime : 7-15-2004 6:48:14 AM
BasePriority : Normal
FileSize : 50 KB
FileVersion : 5.1.2600.0 (XPClient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolsv.exe
OriginalFilename : spoolsv.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:40 AM
Last accessed : 7/17/2004 6:07:45 PM
Last modified : 8/18/2001 5:36:58 AM

#:9 [explorer.exe]
FilePath : C:\WINDOWS\
ThreadCreationTime : 7-15-2004 6:48:17 AM
BasePriority : Normal
FileSize : 980 KB
FileVersion : 6.00.2800.1106 (xpsp1.020828-1920)
ProductVersion : 6.00.2800.1106
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
OriginalFilename : EXPLORER.EXE
ProductName : Microsoft
Created on : 4/25/2004 6:01:56 PM
Last accessed : 7/17/2004 6:08:15 PM
Last modified : 8/29/2002 10:41:24 AM

#:10 [hpsysdrv.exe]
FilePath : C:\windows\system\
ThreadCreationTime : 7-15-2004 6:48:18 AM
BasePriority : Normal
FileSize : 51 KB
FileVersion : 1, 7, 0, 0
ProductVersion : 1, 7, 0, 0
Copyright : Copyright
CompanyName : Hewlett-Packard Company
FileDescription : hpsysdrv
InternalName : hpsysdrv
OriginalFilename : hpsysdrv.exe
ProductName : hpsysdrv
Created on : 2/6/2002 1:01:00 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 5/8/1998 12:04:38 AM

#:11 [kbd.exe]
FilePath : C:\HP\KBD\
ThreadCreationTime : 7-15-2004 6:48:19 AM
BasePriority : High
FileSize : 60 KB
FileVersion : 1.0.2.0
ProductVersion : 1.0.2.0
Copyright : Copyright
CompanyName : Hewlett-Packard Company
FileDescription : KBD EXE
InternalName : KBD EXE
OriginalFilename : Kbd.exe
ProductName : Hewlett-Packard Company KBD EXE
Created on : 2/6/2002 1:19:35 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 7/7/2001 4:56:56 AM

#:12 [s3apphk.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-15-2004 6:48:19 AM
BasePriority : Normal
FileSize : 28 KB
Created on : 12/5/2001 7:02:44 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 12/5/2001 7:02:44 AM

#:13 [pnxservr.exe]
FilePath : C:\Program Files\Common Files\Canopus Shared\ProCoder 2\Kernel\
ThreadCreationTime : 7-15-2004 6:48:20 AM
BasePriority : Normal
FileSize : 184 KB
Created on : 7/15/2004 2:34:49 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 4/28/2004 6:41:18 AM

#:14 [supint.exe]
FilePath : C:\Program Files\Start UP INTerrogator\
ThreadCreationTime : 7-15-2004 6:48:21 AM
BasePriority : Normal
FileSize : 385 KB
FileVersion : 0.0.6.0
ProductVersion : Beta
Copyright : Copyright
CompanyName : Mike Bouffler
FileDescription : Start Up Checker
InternalName : SupInt
OriginalFilename : Sup Int
ProductName : Start Up Interrogator
Created on : 9/24/2003 4:42:40 PM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 9/24/2003 4:42:40 PM

#:15 [avgserv.exe]
FilePath : C:\PROGRA~1\Grisoft\AVG6\
ThreadCreationTime : 7-15-2004 6:48:21 AM
BasePriority : Normal
FileSize : 16 KB
FileVersion : 6.0.1.696
ProductVersion : 6.0.1.696
Copyright : Copyright (c) GRISOFT 1998-2004
CompanyName : GRISOFT s.r.o
FileDescription : AvgServ - displays notification message
InternalName : AvgServ
OriginalFilename : AvgServ
ProductName : AVG6
Created on : 6/17/2004 3:05:31 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 6/17/2004 3:05:31 AM

#:16 [sagent2.exe]
FilePath : C:\Program Files\Common Files\EPSON\EBAPI\
ThreadCreationTime : 7-15-2004 6:48:21 AM
BasePriority : Normal
FileSize : 88 KB
FileVersion : 2, 1, 0, 0
ProductVersion : 1, 0, 0, 0
Copyright : Copyright (C) SEIKO EPSON CORP. 2000-2001
CompanyName : SEIKO EPSON CORPORATION
FileDescription : EPSON Printer Status Agent
InternalName : SAgent2
OriginalFilename : SAgent2.exe
ProductName : EPSON Bidirectional Printer
Created on : 5/17/2004 2:16:25 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 8/9/2001 7:01:00 AM

#:17 [nvsvc32.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-15-2004 6:48:26 AM
BasePriority : Normal
FileSize : 56 KB
FileVersion : 6.13.10.1630
ProductVersion : 6.13.10.1630
Copyright : Copyright
CompanyName : NVIDIA Corporation
FileDescription : NVIDIA Driver Helper Service, Version 16.30
InternalName : NVSVC
OriginalFilename : nvsvc32.exe
ProductName : NVIDIA Driver Helper Service, Version 16.30
Created on : 11/2/2001 1:48:00 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 11/2/2001 1:48:00 AM

#:18 [svchost.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-15-2004 6:48:34 AM
BasePriority : Normal
FileSize : 12 KB
FileVersion : 5.1.2600.0 (xpclient.010817-1148)
ProductVersion : 5.1.2600.0
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
OriginalFilename : svchost.exe
ProductName : Microsoft
Created on : 4/25/2004 4:01:41 AM
Last accessed : 7/17/2004 6:54:02 PM
Last modified : 8/18/2001 5:36:58 AM

#:19 [mspmspsv.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-15-2004 6:48:34 AM
BasePriority : Normal
FileSize : 52 KB
FileVersion : 7.01.00.3055
ProductVersion : 7.01.00.3055
Copyright : Copyright (C) Microsoft Corp. 1981-2000
CompanyName : Microsoft Corporation
FileDescription : WMDM PMSP Service
InternalName : MSPMSPSV.EXE
OriginalFilename : MSPMSPSV.EXE
ProductName : Microsoft (R) DRM
Created on : 5/1/2001 10:06:22 PM
Last accessed : 7/17/2004 6:54:03 PM
Last modified : 5/1/2001 10:06:22 PM

#:20 [odbc16gt.exe]
FilePath : C:\WINDOWS\System32\
ThreadCreationTime : 7-17-2004 6:52:21 PM
BasePriority : Normal
FileSize : 51 KB
Created on : 4/22/2004 1:02:03 AM
Last accessed : 7/17/2004 6:48:07 PM
Last modified : 4/22/2004 1:02:03 AM

#:21 [ad-aware.exe]
FilePath : C:\Program Files\Lavasoft\Ad-aware 6\
ThreadCreationTime : 7-17-2004 6:53:45 PM
BasePriority : Normal
FileSize : 668 KB
FileVersion : 6.0.1.181
ProductVersion : 6.0.0.0
Copyright : Copyright
CompanyName : Lavasoft Sweden
FileDescription : Ad-aware 6 core application
InternalName : Ad-aware.exe
OriginalFilename : Ad-aware.exe
ProductName : Lavasoft Ad-aware Plus
Created on : 7/17/2004 6:53:29 PM
Last accessed : 7/17/2004 6:53:29 PM
Last modified : 7/13/2003 3:00:20 AM

Memory scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 0


Started registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Alexa Object recognized!
Type : RegKey
Data :
Rootkey : HKEY_LOCAL_MACHINE
Object : SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a}


Windows Object recognized!
Type : RegData
Data :
Rootkey : HKEY_CURRENT_USER
Object : Software\Microsoft\MediaPlayer\Player\Settings
Value : Client ID
Data :


Registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 2
Objects found so far: 2


Started deep registry scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Deep registry scan result :
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 2


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Tracking Cookie Object recognized!
Type : File
Data : owner@advertising[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/16/2004 7:45:12 AM
Last accessed : 7/17/2004 6:55:06 PM
Last modified : 7/16/2004 8:19:50 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@atdmt[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/6/2004 7:27:53 AM
Last accessed : 7/17/2004 6:55:06 PM
Last modified : 7/6/2004 7:27:53 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@bluestreak[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/16/2004 8:19:36 AM
Last accessed : 7/17/2004 6:55:06 PM
Last modified : 7/16/2004 8:19:36 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@centrport[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/15/2004 5:20:02 AM
Last accessed : 7/17/2004 6:55:06 PM
Last modified : 7/15/2004 5:20:02 AM



Other Object recognized!
Type : File
Data : owner@cgi-bin[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 6/14/2004 8:22:10 AM
Last accessed : 7/17/2004 6:55:06 PM
Last modified : 6/14/2004 8:22:10 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@doubleclick[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/6/2004 7:09:12 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/6/2004 7:10:16 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@ehg-space.hitbox[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/14/2004 8:11:47 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/14/2004 8:11:47 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@fastclick[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/14/2004 9:20:16 PM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/14/2004 9:20:16 PM



Tracking Cookie Object recognized!
Type : File
Data : owner@gator[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/15/2004 5:21:33 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/17/2004 8:41:28 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@hitbox[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/14/2004 8:11:46 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/14/2004 8:11:47 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@mediaplex[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/7/2004 1:35:46 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/7/2004 1:35:46 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@overture[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/6/2004 10:02:29 PM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/6/2004 10:02:29 PM



Tracking Cookie Object recognized!
Type : File
Data : owner@qksrv[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/14/2004 6:53:01 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/17/2004 12:40:01 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@servedby.advertising[1].txt
Object : C:\Documents and Settings\Owner\Cookies\
FileSize : 2 KB
Created on : 7/16/2004 4:33:54 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/16/2004 8:19:50 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@targetnet[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/17/2004 8:41:23 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/17/2004 8:41:24 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@tmpad[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 6/14/2004 8:36:19 PM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 6/14/2004 8:36:19 PM



Tracking Cookie Object recognized!
Type : File
Data : owner@trafficmp[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/15/2004 5:13:17 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/16/2004 7:26:24 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@valueclick[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/16/2004 4:43:02 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/16/2004 4:43:02 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@web4.realtracker[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/15/2004 6:51:19 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/15/2004 6:51:19 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@[url]www.directnetadvertising[/url][1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/14/2004 6:02:01 PM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/14/2004 6:02:01 PM



Tracking Cookie Object recognized!
Type : File
Data : owner@z1.adserver[1].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/12/2004 1:08:01 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/16/2004 7:26:24 AM



Tracking Cookie Object recognized!
Type : File
Data : owner@zedo[2].txt
Object : C:\Documents and Settings\Owner\Cookies\

Created on : 7/17/2004 12:39:53 AM
Last accessed : 7/17/2004 6:55:07 PM
Last modified : 7/17/2004 12:39:53 AM


¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Deep scanning and examining files (C
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯


Performing conditional scans..
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯

Conditional scan result:
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
New objects : 0
Objects found so far: 24


1:55:16 PM Scan complete

Summary of this scan
¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯¯
Total scanning time :00:01:13:375
Objects scanned :37892
Objects identified :24
Objects ignored :0
New objects :24