ComboFix 08-12-01.01 - jack 2008-12-02 6:10:44.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1350 [GMT -8:00]
Running from: c:\documents and settings\jack\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\jack\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\jack\Application Data\inst.exe
c:\windows\system32\awukaguw.ini
c:\windows\system32\etinemur.ini
c:\windows\system32\mumenawo.dll
c:\windows\system32\owanemum.ini
c:\windows\system32\vobuturi.dll
c:\windows\system32\wipotazi.dll
c:\windows\system32\wugakuwa.dll
.
((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.
2008-12-01 12:31 . 2008-12-01 12:31 250 --a------ c:\windows\gmer.ini
2008-12-01 05:51 . 2008-12-01 05:51 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-30 12:36 . 2008-11-30 12:36 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-30 12:36 . 2008-11-30 12:36 <DIR> d-------- c:\documents and settings\jack\Application Data\Malwarebytes
2008-11-30 12:36 . 2008-11-30 12:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-30 12:36 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-30 12:36 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-30 07:46 . 2008-11-30 07:46 <DIR> d-------- c:\documents and settings\jack\Application Data\McAfee
2008-11-29 22:50 . 2008-11-30 20:41 <DIR> d-------- c:\documents and settings\LocalService\Application Data\SACore
2008-11-29 22:39 . 2008-11-29 22:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-11-29 22:39 . 2008-12-02 05:49 10,347 --a------ c:\windows\system32\Config.MPF
2008-11-29 22:35 . 2008-06-02 14:55 120,136 --a------ c:\windows\system32\drivers\Mpfp.sys
2008-11-29 22:35 . 2008-06-27 06:08 79,240 --a------ c:\windows\system32\drivers\mfeavfk.sys
2008-11-29 22:35 . 2008-06-27 06:08 40,488 --a------ c:\windows\system32\drivers\mfesmfk.sys
2008-11-29 22:35 . 2008-06-27 06:08 35,240 --a------ c:\windows\system32\drivers\mfebopk.sys
2008-11-29 22:34 . 2008-11-29 22:34 <DIR> d-------- c:\program files\McAfee.com
2008-11-29 22:34 . 2008-12-01 05:28 <DIR> d-------- c:\program files\McAfee
2008-11-29 22:34 . 2008-11-29 22:35 <DIR> d-------- c:\program files\Common Files\McAfee
2008-11-29 22:29 . 2008-06-20 05:41 34,152 --a------ c:\windows\system32\drivers\mferkdk.sys
2008-11-29 10:34 . 2008-12-01 05:51 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-29 10:34 . 2008-12-01 05:51 <DIR> d-------- c:\documents and settings\jack\Application Data\SUPERAntiSpyware.com
2008-11-29 10:34 . 2008-11-29 10:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-28 09:30 . 2008-11-29 10:03 326 --a------ c:\windows\wininit.ini
2008-11-16 16:34 . 2008-11-16 16:34 <DIR> d-------- C:\pemicro
2008-11-13 18:24 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-13 18:23 . 2008-09-04 09:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-11 05:31 . 2008-11-11 05:31 0 --a------ C:\LOG22.tmp
2008-11-05 06:56 . 2008-11-05 06:56 0 --a------ C:\LOG4A.tmp
2008-11-04 20:13 . 2008-11-04 20:13 0 --a------ C:\LOG6E.tmp
2008-11-03 09:28 . 2008-04-13 17:11 21,504 --a------ c:\windows\system32\hidserv.dll
2008-11-03 09:28 . 2008-04-13 17:11 21,504 --a--c--- c:\windows\system32\dllcache\hidserv.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-01 18:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2008-11-30 19:07 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-30 19:05 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-30 15:46 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2008-11-29 17:14 --------- d-----w c:\program files\Lavasoft
2008-11-29 16:57 44,544 ----a-w c:\windows\system32\alg.exe
2008-11-11 13:38 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-11-11 13:37 --------- d-----w c:\documents and settings\jack\Application Data\U3
2008-11-10 18:10 --------- d-----w c:\program files\MSECACHE
2008-10-28 00:22 --------- d-----w c:\documents and settings\All Users\Application Data\SQL Anywhere 10
2008-10-27 20:12 --------- d-----w c:\program files\Common Files\Intuit
2008-10-27 20:11 --------- d-----w c:\documents and settings\All Users\Application Data\Intuit
2008-10-27 19:40 --------- d-----w c:\documents and settings\jack\Application Data\Download Manager
2008-10-27 17:31 --------- d--h--w c:\program files\InstallShield Installation Information
2008-10-27 17:31 --------- d-----w c:\program files\Quicken
2008-10-27 17:31 --------- d-----w c:\program files\Common Files\AnswerWorks 5.0
2008-10-27 16:54 --------- d-----w c:\program files\Common Files\Palo Alto Software
2008-10-24 21:57 --------- d-----w c:\program files\Trend Micro
2008-10-24 12:11 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 01:33 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-19 21:17 --------- d-----w c:\documents and settings\All Users\Application Data\YesVideo
2008-10-16 22:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 22:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 22:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 22:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 22:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-11 00:16 --------- d-----w c:\program files\Windows Installer Clean Up
2008-10-10 17:27 60,744 ----a-w c:\documents and settings\jack\g2mdlhlpx.exe
2008-10-05 21:54 --------- d-----w c:\program files\Akamai
2008-10-01 00:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-03-05 03:57 3,902,784 ----a-w c:\documents and settings\jack\gosetup.exe
2007-10-27 04:22 47,360 ----a-w c:\documents and settings\jack\Application Data\pcouffin.sys
2008-08-31 23:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008083120080901\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8704e416-1511-46f3-9c95-96eb732f922f}]
c:\windows\system32\soyeviwa.dll [BU]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 1289000]
"Nero PhotoShow Media Manager"="c:\progra~1\Nero\PHOTOS~1\data\Xtras\mssysmgr.exe" [2007-04-27 312848]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-26 160592]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-17 1805552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-01-24 7311360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-01-24 86016]
"nTrayFw"="c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exe" [2006-02-17 270336]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2006-11-17 136768]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-13 143360]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2007-05-09 925696]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 623992]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"dvd43"="c:\program files\dvd43\dvd43_tray.exe" [2006-05-22 694272]
"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2007-09-20 1836328]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"Intuit SyncManager"="c:\program files\Common Files\Intuit\Sync\IntuitSyncManager.exe" [2008-09-09 623880]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2008-07-11 641208]
"McENUI"="c:\progra~1\McAfee\MHN\McENUI.exe" [2008-06-13 1176808]
"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2004-11-12 245760]
"nwiz"="nwiz.exe" [2006-01-24 c:\windows\system32\nwiz.exe]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 c:\windows\system32\HdAShCut.exe]
"USRpdA"="" [BU]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-11-26 160592]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-20 984352]
VPN Client.lnk - c:\windows\Installer\{14FCFE7C-AB86-428A-9D2E-BFB6F5A7AA6E}\Icon3E5562ED7.ico [2008-02-09 6144]
Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 118784]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2008-04-28 415072]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2007-02-05 294400]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Network Associates\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"f:\\download\\FatSpaniel\\cgConfig_MSW-lite\\cgConfig-lite.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2007\\QBDBMgrN.exe"=
"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=
"c:\\Program Files\\Ipswitch\\WS_FTP Professional\\ftpsync.exe"=
"c:\\Program Files\\Ipswitch\\WS_FTP Professional\\wsftpgui.exe"=
"c:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\bin\\nSvcIp.exe"=
"c:\\WINDOWS\\system32\\cisvc.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\system32\\services.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\program files\McAfee\SiteAdvisor\McSACore.exe" [2008-11-29 203280]
R3 xpvcom;XPVCOM Port;c:\windows\system32\DRIVERS\XPVCOM.sys [2007-03-23 30032]
S2 0086891228138165mcinstcleanup;McAfee Application Installer Cleanup (0086891228138165);c:\windows\TEMP\
008689~1.EXE c:\progra~1\COMMON~1\McAfee\INSTAL~1\cleanup.ini -cleanup -nolog -service []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0066b7a-8668-11dd-98ae-000d88240d79}]
\Shell\AutoRun\command - M:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2008-11-30 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]
2008-11-30 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-07-09 18:10]
2008-12-01 c:\windows\Tasks\User_Feed_Synchronization-{A5AFDE3E-AD7B-4679-92D6-BD41DEDD0126}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 10:58]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\jack\Application Data\Mozilla\Firefox\Profiles\5iwzbocg.default\
FF -: plugin - c:\documents and settings\jack\Application Data\Mozilla\plugins\npPxPlay.dll
FF -: plugin - c:\program files\Adobe\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF -: plugin - c:\program files\Google\Google Updater\2.2.1202.1501\npCIDetect11.dll
FF -: plugin - c:\program files\Real\RhapsodyPlayerEngine\nprhapengine.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-12-02 06:12:57
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(800)
c:\windows\system32\sxs.dll
- - - - - - - > 'lsass.exe'(856)
c:\windows\system32\nvappfilter.dll
.
Completion time: 2008-12-02 6:15:06
ComboFix-quarantined-files.txt 2008-12-02 14:13:48
Pre-Run: 22,474,219,520 bytes free
Post-Run: 22,483,578,880 bytes free
222 --- E O F --- 2008-11-14 02:30:03
Thanks,
Jack