I've been playing around with my malware honeypot for some days now and collected logs when malware installed through security holes. I've pasted the FreeFixer logs below, and marked the malware with red.
I'm currently running this honeypot on Windows XP service pack 1. I'll runs some test with Service Pack 2 or 3 later on to see if I get the same installs, or if something new turns up.
FreeFixer v0.40 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-23 12:38 Registry Startups HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background HKCU\..\Run, Roger = C:\Documents and Settings\Roger\Roger.exe /i Processes (19 whitelisted) C:\Program\Messenger\msmsgs.exe C:\Documents and Settings\Roger\Roger.exe C:\Documents and Settings\Roger\Roger.exe C:\Program\FreeFixer\freefixer.exe Services (34 whitelisted) NetDDEdsdmThemes, Network DDE DSDM NetDDEdsdmThemes, c:\windows\system32\1037l.exe Drivers (27 whitelisted) ws2_32sik, ws2_32sik, c:\windows\system32\drivers\ws2_32sik.sys
FreeFixer v0.40 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-22 19:47 Browser Helper Objects {D6E0FAFC-2B61-4753-B3DA-D83BE96A2C39}, MS extension, mashtuic32.dll(file is missing) Registry Startups HKLM\..\Run, WinDLL (service.exe) = service.exe HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background HKCU\..\Run, Roger = C:\Documents and Settings\Roger\Roger.exe /i Processes (17 whitelisted) C:\Program\Messenger\msmsgs.exe C:\Program\FreeFixer\freefixer.exe C:\WINDOWS\System32\wininet.exe C:\Documents and Settings\Roger\Roger.exe C:\Documents and Settings\Roger\Roger.exe C:\Documents and Settings\Roger\Skrivbord\tools\gmer.exe C:\WINDOWS\service.exe C:\tmp\sleep.exe Shell services (4 whitelisted) SysRun, {D7FFD784-5276-42D1-887B-00267870A4C7}, C:\WINDOWS\System32\svshost.dll Drivers (27 whitelisted) acpi32, acpi32, c:\windows\system32\drivers\acpi32.sys
FreeFixer v0.40 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-21 21:49 Browser Helper Objects {C420CF9F-D9D6-421F-958F-AA59906C2B12}, SpyPsy, C:\WINDOWS\System32\gopfa.dll Registry Startups HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background Autostart shortcuts MS-0905-upd211833.exe, , C:\Documents and Settings\All Users\Start-meny\Program\Autostart\MS-0905-upd211833.exe Processes (14 whitelisted) C:\Program\Messenger\msmsgs.exe C:\Program\FreeFixer\freefixer.exe
FreeFixer v0.40 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-21 11:22 UserInits (1 whitelisted) C:\DOCUME~1\Roger\LOKALA~1\Temp\init.exe Registry Startups HKLM\..\Run, WinAccestor = C:\WINDOWS\winaccestor.exe HKLM\..\Run, mssysif = C:\WINDOWS\system32\LIAR6.EXE HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background Processes (15 whitelisted) C:\Program\Messenger\msmsgs.exe C:\Program\FreeFixer\freefixer.exe C:\WINDOWS\winaccestor.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\LIAR6.EXE C:\Documents and Settings\Roger\Skrivbord\tools\gmer.exe Services (34 whitelisted) NetlogonUPS, Net Logon NetlogonUPS, c:\windows\system32\advpackl.exe
FreeFixer v0.39 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-18 12:48 Registry Startups HKLM\..\Run, PromoReg = C:\WINDOWS\Temp\wpv351242765100.exe HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background Processes (16 whitelisted) C:\Program\Messenger\msmsgs.exe C:\WINDOWS\Temp\wpv351242765100.exe C:\Program\FreeFixer\freefixer.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\TMP4.tmp ns9.tmp (file is missing) net.exe (file is missing) net1.exe (file is missing) Services (34 whitelisted) VSSlanmanserver, Volume Shadow Copy VSSlanmanserver, c:\windows\system32\advpackv.exe
FreeFixer v0.39 log http://www.freefixer.com/ Operating system: Windows XP Service Pack 1 Log dated 2009-05-18 12:53 System policies HKCU\..\policies\system, DisableTaskMgr = 1 HKCU\..\policies\system, DisableRegistryTools = 1 Registry Startups HKLM\..\Run, WinDLL (service.exe) = service.exe HKCU\..\Run, MSMSGS = "C:\Program\Messenger\msmsgs.exe" /background Processes (15 whitelisted) C:\Program\Messenger\msmsgs.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\winDDRYcZBRBIkB.exe C:\WINDOWS\System32\wininet.exe C:\WINDOWS\service.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\winfismyj.exe C:\DOCUME~1\Roger\LOKALA~1\Temp\aeilmk.exe C:\Documents and Settings\Roger\Skrivbord\gmer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program\Trend Micro\HijackThis\HijackThis.exe C:\Program\FreeFixer\freefixer.exe Shell services (4 whitelisted) SysRun, {D7FFD784-5276-42D1-887B-00267870A4C7}, C:\WINDOWS\System32\svshost.dll