ComboFix 09-07-04.04 - CHUCK 07/04/2009 15:53.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.616 [GMT -7:00]
Running from: c:\documents and settings\CHUCK\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\-2134493953
c:\windows\010112010146118114.dat
c:\windows\Installer\13d491.msi
c:\windows\Installer\63fc0.msi
c:\windows\Installer\6bdfd.msi
c:\windows\Installer\c244b.msi
c:\windows\Installer\e6727.msi
c:\windows\Installer\WinRMSrv.msi
c:\windows\kb913800.exe
c:\windows\system32\proquota.exe was missing
Restored copy from - c:\windows\ServicePackFiles\i386\proquota.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_DRV
-------\Service_drv
((((((((((((((((((((((((( Files Created from 2009-06-04 to 2009-07-04 )))))))))))))))))))))))))))))))
.
2009-07-04 22:57 . 2008-04-14 00:12 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-07-04 22:57 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-07-04 22:31 . 2009-07-04 22:31 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-07-04 06:47 . 2009-07-04 06:47 -------- d-----w- C:\Rooter$
2009-07-02 05:14 . 2009-07-02 05:14 1 ---h--w- c:\windows\bf23567.dat
2009-06-10 02:41 . 2009-06-10 02:41 152576 ----a-w- c:\documents and settings\CHUCK\Application Data\Sun\Java\jre1.6.0_14\lzma.dll
2009-06-10 02:23 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-10 02:23 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-06 08:11 . 2009-06-06 08:11 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-07-04 22:45 . 2009-03-19 01:48 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-07-04 22:34 . 2006-09-14 20:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-07-04 22:34 . 2006-09-14 20:20 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-07-03 03:37 . 2009-05-18 22:36 117760 ----a-w- c:\documents and settings\CHUCK\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\ UIREPAIR.DLL
2009-07-03 03:37 . 2009-05-18 22:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-06-16 23:49 . 2007-07-20 06:12 -------- d-----w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-06-10 02:42 . 2006-08-10 09:13 -------- d-----w- c:\program files\Java
2009-05-23 02:58 . 2006-09-14 20:29 43464 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-05-23 02:21 . 2009-05-23 02:21 -------- d-----w- c:\program files\MSBuild
2009-05-23 02:21 . 2009-05-23 02:21 -------- d-----w- c:\program files\Reference Assemblies
2009-05-23 01:56 . 2009-05-23 01:55 -------- d-----w- c:\program files\QuickTime
2009-05-23 01:54 . 2009-05-23 01:54 -------- d-----w- c:\program files\Apple Software Update
2009-05-23 01:50 . 2007-01-20 08:46 -------- d-----w- c:\documents and settings\CHUCK\Application Data\AdobeUM
2009-05-23 01:16 . 2009-05-23 01:16 152576 ----a-w- c:\documents and settings\CHUCK\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 20:31 . 2009-05-11 02:10 -------- d-----w- c:\program files\SpywareBlaster
2009-05-21 18:33 . 2008-12-08 07:16 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-05-21 07:17 . 2009-05-21 07:17 -------- d-----w- c:\program files\Avira
2009-05-21 07:17 . 2009-05-21 07:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-05-19 03:09 . 2006-09-14 20:19 -------- d-----w- c:\program files\Trend Micro
2009-05-18 22:36 . 2009-05-18 22:36 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-18 22:36 . 2009-05-18 22:36 -------- d-----w- c:\documents and settings\CHUCK\Application Data\SUPERAntiSpyware.com
2009-05-18 22:34 . 2009-05-18 22:34 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-18 21:22 . 2009-05-18 21:22 -------- d-----w- c:\program files\CCleaner
2009-05-13 05:15 . 2006-08-10 07:32 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-11 05:18 . 2009-05-11 05:18 -------- d-----w- c:\program files\Panda Security
2009-05-11 02:38 . 2009-04-09 00:50 -------- d-----w- c:\program files\Windows Live Safety Center
2009-05-11 02:13 . 2009-03-31 23:32 -------- d-----w- c:\program files\Trojan Guarder Gold Version
2009-05-10 23:39 . 2009-05-10 23:39 -------- d-----w- c:\documents and settings\CHUCK\Application Data\Malwarebytes
2009-05-10 23:39 . 2009-05-10 23:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-05-10 23:39 . 2009-05-10 23:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-10 10:17 . 2006-08-10 07:32 -------- d-----w- c:\program files\Common Files\Mozilla Shared
2009-05-07 15:32 . 2006-08-10 07:32 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 12:26 . 2006-08-10 07:32 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2006-08-10 07:32 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-06 22:32 . 2009-05-10 23:39 38496 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-06 22:32 . 2009-05-10 23:39 15504 ----a-w- c:\windows\system32\drivers\mbam.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"SsAAD.exe"="c:\progra~1\Sony\SONICS~1\SsAAD.e xe" [2006-05-08 81920]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-04-05 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-04-05 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-04-05 118784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 53248]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-08-27 217088]
"Switcher.exe"="c:\program files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2006-02-14 176128]
"NeroCheck"="c:\windows\system32\NeroCheck.exe " [2003-07-13 155648]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"EPSON Stylus Photo R300 Series"="c:\windows\System32\spool\DRIVERS\W32X86\ 3\E_S4I2F1.EXE" [2003-06-04 99840]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-17 2879488]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-1-21 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
[HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
"NoSMMyDocs"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 19:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-06-20 23:11 73728 ----a-w- c:\windows\system32\VESWinlogon.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"midi1"=ma_cmidn.dll
"midi2"=ma_cmidn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"= 9420:TCP:Red Swoosh
"5000:UDP"= 5000:UDP:Red Swoosh
"8085:TCP"= 8085:TCP:drv
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboo t.sys [5/10/2009 10:19 PM 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [5/14/2009 2:22 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [5/14/2009 2:22 PM 72944]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [5/21/2009 12:17 AM 108289]
R3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21 sony.sys [8/10/2006 12:33 AM 226304]
S1 drvdrv;drvdrv;\??\c:\program files\drv\drv.sys --> c:\program files\drv\drv.sys [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [5/14/2009 2:22 PM 7408]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
drv REG_MULTI_SZ drv
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-05-23 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.sony.com/vaiopeople
uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\CHUCK\Application Data\Mozilla\Firefox\Profiles\8ehdyjug.default\
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.
************************************************** ************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
GMER - Rootkit Detector and Remover
Rootkit scan 2009-07-04 15:59
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S AVRT]
"ImagePath"="-"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\S NDSrvc]
"ImagePath"="-"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(900)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\VESWinlogon.dll
- - - - - - - > 'explorer.exe'(2832)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\M-Audio MA_CMIDI\MA_CMIDI_Inst.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\windows\system32\igfxext.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\iPod\bin\iPodService.exe
.
************************************************** ************************
.
Completion time: 2009-07-04 16:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-04 23:05
ComboFix2.txt 2009-05-21 03:18
Pre-Run: 14,039,044,096 bytes free
Post-Run: 14,239,248,384 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windo ws XP Media Center Edition" /noexecute=optin /fastdetect
233 --- E O F --- 2009-06-10 02:31