Post scanning on port 25

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:08:55 PM, on 10/16/2009
Platform: Windows 2003 SP2 (WinNT 5.02.3790)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
 
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Adaptec\SMBE\afaagent.exe
C:\Program Files\Adaptec\Adaptec Storage Manager\StorServ.exe
C:\WINNT\system32\serverappliance\appmgr.exe
C:\Program Files\Symantec\pcAnywhere\awhost32.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBAttachServer.exe
c:\centenn.ial\audit\CAgent32.exe
c:\centenn.ial\audit\xferwan.exe
C:\WINNT\system32\cisvc.exe
D:\Program Files\GFI\ContentSecurity\MiddleLayer\ContentSecurity.ML.SVC.Attendant.exe
C:\Program Files\Symantec\Backup Exec\DLO\dlomaintsvcu.exe
C:\WINNT\System32\dns.exe
C:\WINNT\system32\serverappliance\elementmgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\GFI\MailEssentials\msecatt.exe
C:\Program Files\GFI\MailEssentials\MiddleLayer\contentsecurity.as.attendant.exe
C:\Program Files\GFI\MailEssentials\mestrxsvc.exe
C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe
C:\iFtpSvc\iFtpSvc.exe
C:\WINNT\system32\inetsrv\inetinfo.exe
C:\iNtfySvc\intfysvc.exe
C:\Program Files\Adaptec\SMBE\iomgr.exe
C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\rcsvcmon.exe
C:\WINNT\system32\ntfrs.exe
C:\WINNT\system32\tcpsvcs.exe
C:\WINNT\System32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINNT\system32\serverappliance\srvcsurg.exe
C:\Program Files\SUPERMICRO\SDIII\NTService.exe
C:\WINNT\system32\SD3Service.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\TIMESYNC.EXE
C:\WINNT\System32\wins.exe
C:\WINNT\system32\WinVNC.exe
C:\Program Files\SUPERMICRO\SDIII\Xitami\xisrv32.exe
C:\Program Files\Adaptec\SMBE\arcpd.exe
C:\Program Files\Symantec\Backup Exec\beremote.exe
C:\WINNT\system32\Dfssvc.exe
C:\Program Files\GFI\MailEssentials\pop2exch.exe
D:\Exchsrvr\bin\exmgmt.exe
D:\Exchsrvr\bin\mad.exe
C:\WINNT\system32\mqsvc.exe
C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Adaptec\SMBE\notify.exe
D:\Program Files\GFI\ContentSecurity\MailSecurity\GFIScanM.exe
C:\Program Files\GFI\MailEssentials\listserv.exe
D:\Program Files\GFI\ContentSecurity\MailSecurity\MiddleLayer\ContentSecurity.ML.SVC.Attendant.exe
D:\Exchsrvr\bin\store.exe
D:\Exchsrvr\bin\emsmta.exe
C:\WINNT\system32\rsmsink.exe
D:\Program Files\GFI\ContentSecurity\contentsecurity.autoupdate.ausvc.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BlackBerryAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\dmadmin.exe
C:\WINNT\system32\cidaemon.exe
C:\WINNT\system32\cidaemon.exe
c:\winnt\system32\inetsrv\w3wp.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\rdpclip.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\G-VGA.exe
C:\Program Files\Print Audit Inc\Print Audit 5\Data\pa5clcfg.exe
C:\WINNT\system32\WDBtnMgr.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Symmetricom\SymmTime\GeTTime.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\GFI\MailEssentials\gfimntr.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBConvert.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = res://shdoclc.dll/hardAdmin.htm
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NVRTCLK] C:\WINNT\system32\NVRTCLK\NVRTClk.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VGAUtil] C:\WINNT\system32\G-VGA.exe
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [PA5 Comm Config] C:\Program Files\Print Audit Inc\Print Audit 5\Data\pa5clcfg.exe
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
O4 - HKLM\..\RunOnce: [PBEUninstAgent] cmd /C "del /F/Q C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\1\Set???.tmp C:\DOCUME~1\ADMINI~1.000\LOCALS~1\Temp\1\IEC???.tmp C:\WINNT\system32\APCSnmp.dll | rmdir /S/Q "C:\Program Files\InstallShield Installation Information\{BCE9F441-9027-4911-82E0-5FB28057897D}""
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-1202660629-1644491937-839522115-1021\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'brianh')
O4 - HKUS\S-1-5-21-1801674531-1275210071-682003330-2225\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe (User 'BESAdmin')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Supero Doctor III Client.lnk = C:\Program Files\SUPERMICRO\SDIII\SuperoDoctor.exe
O4 - Global Startup: SymmTime.lnk = C:\Program Files\Symmetricom\SymmTime\GeTTime.exe
O15 - ESC Trusted Zone: http://download.avgfree.com
O15 - ESC Trusted Zone: http://kbase.gfi.com
O15 - ESC Trusted Zone: http://software.gfi.com
O15 - ESC Trusted Zone: http://support.gfi.com
O15 - ESC Trusted Zone: http://www.gfi.com
O15 - ESC Trusted Zone: http://www.googleadservices.com
O15 - ESC Trusted Zone: http://runonce.msn.com
O15 - ESC Trusted Zone: http://*.vailsrv02
O15 - ESC Trusted Zone: http://*.windowsupdate.com
O15 - ESC Trusted Zone: http://vailsrv02.zerhen.com
O15 - ESC Trusted Zone: http://runonce.msn.com (HKLM)
O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM)
O15 - ESC Trusted IP range: http://127.0.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = zehren.com
O17 - HKLM\Software\..\Telephony: DomainName = zehren.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{3CCD2298-C54B-4D31-9B6B-482F49FCF139}: NameServer = 192.168.1.3,192.168.1.2
O17 - HKLM\System\CCS\Services\Tcpip\..\{B09C258D-BDCF-494A-9DA2-48ACB3A036CC}: Domain = zehren.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{B09C258D-BDCF-494A-9DA2-48ACB3A036CC}: NameServer = 192.168.1.8,192.168.1.2
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = zehren.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = zehren.com,santabarbara.zehren.com
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = zehren.com,santabarbara.zehren.com
O23 - Service: Adaptec RAID Remote Services Agent (AAC_AGENT) - Adaptec, Inc. - C:\Program Files\Adaptec\SMBE\afaagent.exe
O23 - Service: AdaptecStorageManagerAgent - Adaptec Incorporated - C:\Program Files\Adaptec\Adaptec Storage Manager\StorServ.exe
O23 - Service: Adaptec Web Server (ARCPD) - Unknown owner - C:\Program Files\Adaptec\SMBE\arcpd.exe
O23 - Service: Adaptec Storage Manager Notifier (ASMBENotify) - Unknown owner - C:\Program Files\Adaptec\SMBE\notify.exe
O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Program Files\Symantec\pcAnywhere\awhost32.exe
O23 - Service: Backup Exec Remote Agent for Windows Systems (BackupExecAgentAccelerator) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\beremote.exe
O23 - Service: Backup Exec Agent Browser (BackupExecAgentBrowser) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\benetns.exe
O23 - Service: Backup Exec Device & Media Service (BackupExecDeviceMediaService) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\pvlsvr.exe
O23 - Service: Backup Exec Job Engine (BackupExecJobEngine) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\bengine.exe
O23 - Service: Backup Exec Server (BackupExecRPCService) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\beserver.exe
O23 - Service: BlackBerry Attachment Service (BBAttachServer) - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\AttachServer\BBAttachServer.exe
O23 - Service: BelMonitor Service (BelMonitorService) - Belarc, Inc. - C:\PROGRA~1\Belarc\BelMonitor\BANTMonitorSvc.exe
O23 - Service: BlackBerry Controller - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BlackBerryController.exe
O23 - Service: BlackBerry Database Consistency Service - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\MDS\bin\DBConsistency.exe
O23 - Service: BlackBerry Dispatcher - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BlackBerryDispatcher.exe
O23 - Service: BlackBerry MDS Connection Service - Research In Motion - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\MDS\bin\bmds.exe
O23 - Service: BlackBerry Policy Service - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\ITAdminServer.exe
O23 - Service: BlackBerry Router - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BypassRouter\BlackberryRouter.exe
O23 - Service: BlackBerry Alert (BlackBerry Server Alert) - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\BESAlert.exe
O23 - Service: BlackBerry Synchronization Service (BlackBerry SyncServer) - Research In Motion Limited - C:\Program Files\Research In Motion\BlackBerry Enterprise Server\SyncServer\BlackBerrySyncServer.exe
O23 - Service: CentennialClientAgent - Centennial Software Limited  - c:\centenn.ial\audit\CAgent32.exe
O23 - Service: CentennialIPTransferAgent - Centennial Software Limited  - c:\centenn.ial\audit\xferwan.exe
O23 - Service: GFI Content Security Attendant Service (csecmlhost) -   - D:\Program Files\GFI\ContentSecurity\MiddleLayer\ContentSecurity.ML.SVC.Attendant.exe
O23 - Service: Backup Exec DLO Administration Service (DLOAdminSvcu) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\DLO\DLOAdminSvcu.exe
O23 - Service: Backup Exec DLO Maintenance Service (DLOMaintenanceSvc) - Symantec Corporation - C:\Program Files\Symantec\Backup Exec\DLO\dlomaintsvcu.exe
O23 - Service: GFI MailEssentials Legacy Attendant Service - GFI Software Ltd. - C:\Program Files\GFI\MailEssentials\msecatt.exe
O23 - Service: GFI POP2Exchange - GFI Software Ltd. - C:\Program Files\GFI\MailEssentials\pop2exch.exe
O23 - Service: GFI MailEssentials Managed Attendant Service (gfiasmlhost) - GFI Software Ltd - C:\Program Files\GFI\MailEssentials\MiddleLayer\contentsecurity.as.attendant.exe
O23 - Service: GFI MailEssentials Enterprise Transfer Service (GFIMETRXSVC) - GFI - C:\Program Files\GFI\MailEssentials\mestrxsvc.exe
O23 - Service: GFI MailSecurity Scan Engine (GFIScanM) - Unknown owner - D:\Program Files\GFI\ContentSecurity\MailSecurity\GFIScanM.exe
O23 - Service: GFI ReportCenter 3.5 (GFI_ReportCenter35) - GFI Software Ltd. - C:\Program Files\Common Files\GFI\ReportCenter\Framework v3.5\gfireporterservice.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Ipswitch WS_FTP Service (iFtpSvc) - Ipswitch, Inc.  10 Maguire Road - Suite 220 Lexington MA. - C:\iFtpSvc\iFtpSvc.exe
O23 - Service: Ipswitch Notification Server (inotifysvr) - Ipswitch, Inc.  10 Maguire Road - Suite 220 Lexington MA.  - C:\iNtfySvc\intfysvc.exe
O23 - Service: Adaptec I/O Manager Server (IOManager) - Unknown owner - C:\Program Files\Adaptec\SMBE\iomgr.exe
O23 - Service: GFI List Server (listserv) - GFI Software Ltd - C:\Program Files\GFI\MailEssentials\listserv.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: GFI Content Security Auto-Updater Service (msecavupdate) -   - D:\Program Files\GFI\ContentSecurity\contentsecurity.autoupdate.ausvc.exe
O23 - Service: GFI MailSecurity Attendant Service (msecmlhost) -   - D:\Program Files\GFI\ContentSecurity\MailSecurity\MiddleLayer\ContentSecurity.ML.SVC.Attendant.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINNT\system32\nvsvc32.exe
O23 - Service: Print Audit 5 Client Communicator (PA5ClientCommunicator) - PJLM Software Inc. - C:\Program Files\Print Audit Inc\Print Audit 5\Data\pa5clcom.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: SuperMicro Health Assistant - Unknown owner - C:\Program Files\SUPERMICRO\SDIII\NTService.exe
O23 - Service: Supero SD3Service Daemon - Unknown owner - C:\WINNT\system32\SD3Service.exe
O23 - Service: Time Synchronization (TimeSync) - Franz Krainer - C:\WINNT\System32\TIMESYNC.EXE
O23 - Service: TridiaVNC Server (winvnc) - Tridia Corporation - C:\WINNT\system32\WinVNC.exe
O23 - Service: Xitami Web Server (Xitami) - Unknown owner - C:\Program Files\SUPERMICRO\SDIII\Xitami\xisrv32.exe
 
--
End of file - 15050 bytes

                                  

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189: