|
|
|
|
|||||
|
|
|
|
|
|
|||
| Welcome
to Tech Support Forum home to more then 136,000 problems solved. Issues
have included: Spyware, Malware, Virus Issues, Windows, Microsoft,
Linux, Networking, Security, Hardware, and Gaming Getting your
problem solved is as easy as: 1. Registering for a free account 2. Asking your question 3. Receiving an answer Registered members: * See fewer ads. * And much more..
|
| Want to know how to post a question? click here | Having problems with spyware and pop-ups? First Steps |
|
|||||||
| General Computer Security Get Help With System Security - This forum is not for malware removal assistance. For malware removal assistance, read the sticky topic at the top of the Virus/Trojan/Spyware Help forum, or the "First Steps" link at the top right of each page. |
 |
|
|
LinkBack | Thread Tools |
09-07-2008, 03:05 AM
|
#1 (permalink) |
|
Registered User
Join Date: Sep 2008
Posts: 1
OS: xp sp3 professional
|
Combofix Log
Can someone analyze this log for me and let me know if there is anything else I need to do? - Thanks!
ComboFix 08-09-05.02 - Administrator 2008-09-07 1:37:34.1 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.108 [GMT -7:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\Administrator\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Cookies\administrator@2o7[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@revsci[1].txt C:\Documents and Settings\Administrator\Cookies\administrator@serving-sys[2].txt C:\Documents and Settings\Administrator\Cookies\administrator@track.bestbuy[2].txt . ((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))) . 2008-08-15 15:00 . 2008-08-15 15:03 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared 2008-08-13 16:21 . 2008-05-01 07:33 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-13 16:18 . 2008-04-11 12:04 691,712 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-07 03:54 --------- d-----w C:\Program Files\Microsoft Windows OneCare Live 2008-09-06 07:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater 2008-08-29 14:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-08-15 22:00 --------- d-----w C:\Program Files\Norton Security Scan 2008-07-24 02:37 --------- d-----w C:\Documents and Settings\Administrator\Application Data\MSNInstaller 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2008-07-19 05:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-19 05:10 53,448 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2008-07-19 05:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-19 05:10 36,552 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-19 05:09 563,912 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-19 05:09 325,832 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-19 05:09 205,000 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-19 05:09 1,811,656 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2008-07-19 05:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-19 05:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-18 20:08 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield 2008-07-14 18:57 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Talkback 2008-07-13 06:48 --------- d-----w C:\Program Files\Google 2008-07-12 17:03 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-07-12 17:03 --------- d-----w C:\Program Files\Common Files\PC Tools 2008-07-12 16:37 --------- d-----w C:\Documents and Settings\Administrator\Application Data\AdwareAlert 2008-07-08 16:01 --------- d-----w C:\Program Files\QuickTime 2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:26 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-06-24 17:57 3,592,192 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-24 16:43 74,240 ------w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:43 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe 2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe 2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:46 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:46 147,968 ------w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 11:51 361,600 ------w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 11:40 138,496 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 11:08 225,856 ------w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-12 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CPQEASYACC"="C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2003-12-17 40960] "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-01-30 81920] "ChkAdmin"="C:\PROGRA~1\Compaq\COMPAQ~1\CHKADMIN.EXE" [2002-01-24 81920] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 126976] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-07-08 413696] "Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-07-12 29744] "OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-08-08 67112] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016] "PROMon.exe"="PROMon.exe" [2002-03-25 C:\WINDOWS\system32\PROMon.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices] "CPQDFWAG"="C:\WINDOWS\Cpqdiag\CpqDfwAg.exe" [2001-10-25 212992] C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 98632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= R1 ClntMgmt;Compaq Client Management Driver;C:\WINDOWS\system32\Drivers\ClntMgmt.sys [2002-01-16 54222] R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-04-10 159880] R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;C:\WINDOWS\Cpqdiag\Cpqdfwag.exe [2001-10-25 212992] R2 cpqWebDmi;Compaq DMI Web Agent;C:\PROGRA~1\Compaq\COMPAQ~1\CPQWEB~1\WebDmi.exe [2002-01-24 24576] R2 OcHealthMon;Windows Live OneCare Health Monitor;C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-08-08 28200] S3 GoogleDesktopManager-022208-143751;Google Desktop Manager 5.7.802.22438;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-07-12 29744] *Newly Created Service* - NMSCFG . Contents of the 'Scheduled Tasks' folder . . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\piib2qt1.default\ FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q= FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 01:42:53 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe C:\Compaq\ACLIENT\AClient.exe C:\Program Files\COMPAQ\Compaq Management Agents\Cpqalert.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\WINDOWS\system32\NMSSvc.Exe C:\Program Files\COMPAQ\Compaq Management Agents\Dmi\Win32\bin\Win32sl.exe C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe C:\PROGRA~1\COMPAQ\COMPAQ~1\Cpqdmi.exe C:\Program Files\COMPAQ\Easy Access Button Support\CpqEAKSystemTray.exe C:\Program Files\COMPAQ\Easy Access Button Support\CPQEADM.exe C:\Compaq\eakdrv\EAUSBKBD.exe C:\PROGRA~1\COMPAQ\EASYAC~1\BttnServ.exe C:\Program Files\COMPAQ\Easy Access Button Support\CPQEADM.exe C:\Program Files\Microsoft Windows OneCare Live\winss.exe C:\WINDOWS\system32\verclsid.exe . ************************************************************************** . Completion time: 2008-09-07 1:51:08 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-07 08:50:35 Pre-Run: 501,108,736 bytes free Post-Run: 417,255,424 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 158 --- E O F --- 2008-08-30 10:04:34 |
|
     |
| Important Information |
|
Join the #1 Tech Support Forum Today - It's Totally Free!
TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free. Join TechSupportforum.com Today - Click Here |
|
09-07-2008, 07:16 AM
|
#2 (permalink) |
|
Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic
|
Re: Combofix Log
Hi and welcome.
Firstly. combofix should not be run without the supervision and instructions from a trained analyst - it is more powerful than you realise. Secondly, we do not analyse logs in this section. Please follow this sticky If you think your computer is infected.... Thread closed.
__________________
Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums.   PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner |
|
|
|
|
| Thread Tools | |
|
|
