Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

automatic updates disabled and unknown infections


  • Please log in to reply

#1
Brett K

Brett K

    New Member

  • Member
  • Pip
  • 3 posts
Here are the combofix and hijack this logs after using combofix. It seems like the automatic updates is back and running and the computer seems faster. Hopefully you guys can say the same--Brett K:

ComboFix 09-01-07.03 - Bkap 2009-01-08 12:13:57.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1012.617 [GMT -5:00]
Running from: c:\documents and settings\Bkap\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Outdated)
FW: McAfee Personal Firewall *enabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\eqsaknab.ini
c:\windows\system32\gkcohaoh.ini
c:\windows\system32\gwndfxyh.ini
c:\windows\system32\hsujbxxj.dll
c:\windows\system32\pappipbf.ini
c:\windows\system32\rogvxv.dll
c:\windows\system32\rYaKRqss.ini
c:\windows\system32\rYaKRqss.ini2

.
((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2009-01-08 12:07 . 2009-01-08 12:08 <DIR> d-------- C:\32788R22FWJFW
2009-01-07 21:32 . 2009-01-07 21:32 <DIR> d-------- c:\documents and settings\Bkap\Tracing
2009-01-07 13:34 . 2009-01-07 13:34 <DIR> d-------- c:\documents and settings\Bkap\Application Data\Malwarebytes
2009-01-07 13:34 . 2009-01-04 18:38 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-07 13:33 . 2009-01-07 13:34 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-07 13:33 . 2009-01-07 13:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-07 13:33 . 2009-01-04 18:38 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-07 00:26 . 2009-01-07 00:26 <DIR> d-------- c:\program files\Trend Micro
2009-01-06 23:57 . 2009-01-07 11:28 <DIR> d-------- c:\program files\SpywareGuard
2009-01-06 23:19 . 2009-01-06 23:19 <DIR> d-------- c:\program files\CCleaner
2009-01-06 23:19 . 2009-01-06 23:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-01-06 23:18 . 2009-01-06 23:18 <DIR> d-------- c:\program files\SUPERAntiSpyware
2009-01-06 23:18 . 2009-01-06 23:18 <DIR> d-------- c:\documents and settings\Bkap\Application Data\SUPERAntiSpyware.com
2009-01-06 23:16 . 2009-01-06 23:16 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2009-01-06 19:06 . 2009-01-06 22:42 250 --a------ c:\windows\gmer.ini
2009-01-06 18:41 . 2009-01-06 18:39 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-01-06 18:39 . 2009-01-06 18:43 <DIR> d-------- c:\documents and settings\Bkap\.housecall6.6
2009-01-06 18:36 . 2009-01-06 18:36 <DIR> d-------- c:\program files\Panda Security
2009-01-06 17:30 . 2009-01-06 17:30 2,317 --a------ c:\windows\DefLang.ini
2009-01-02 16:05 . 2006-06-20 03:56 225,280 --a------ c:\windows\system32\rewire.dll
2009-01-02 16:04 . 2002-07-07 17:14 1,294,336 --a------ c:\windows\system32\vorbis.acm
2009-01-02 16:02 . 2009-01-02 16:02 <DIR> d-------- c:\program files\Outsim
2009-01-02 15:56 . 2009-01-06 16:15 <DIR> d-------- c:\program files\Image-Line
2008-12-31 15:42 . 2008-12-31 15:42 <DIR> d-------- c:\program files\Common Files\Tmp
2008-12-31 15:42 . 2008-12-31 15:42 <DIR> d-------- c:\documents and settings\All Users\Application Data\Celemony Software GmbH
2008-12-31 15:35 . 2008-12-31 15:37 <DIR> d-------- c:\program files\Acoustica Mixcraft 4
2008-12-31 14:16 . 2008-12-31 14:16 <DIR> d-------- c:\program files\Celemony
2008-12-31 14:16 . 2006-02-16 10:09 200,704 --a------ c:\windows\system32\libguide40.dll
2008-12-30 21:36 . 2009-01-05 13:30 <DIR> d-------- c:\program files\VST
2008-12-30 21:31 . 2003-06-20 12:28 1,777,664 --a------ c:\windows\system32\gdiplus.dll
2008-12-30 18:39 . 2009-01-02 16:28 <DIR> d-------- c:\program files\Acoustica Shared Effects
2008-12-30 18:39 . 2008-12-30 18:39 <DIR> d-------- c:\documents and settings\Bkap\Application Data\Acoustica
2008-12-30 18:39 . 2007-08-07 10:32 57,344 --a------ c:\windows\system32\Wnaspint.dll
2008-12-30 18:38 . 2008-12-30 18:38 <DIR> d-------- c:\program files\Common Files\Download Manager
2008-12-30 18:38 . 2009-01-02 16:08 <DIR> d-------- c:\program files\Acoustica Mixcraft 3
2008-12-30 18:38 . 2008-12-30 18:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica
2008-12-30 18:23 . 2009-01-05 13:29 <DIR> d-------- c:\program files\Antares Audio Technologies
2008-12-30 18:23 . 2009-01-05 13:29 <DIR> d-------- c:\documents and settings\Bkap\Application Data\Antares
2008-12-30 17:28 . 2008-12-30 17:28 <DIR> d-------- c:\program files\Common Files\PACE Anti-Piracy
2008-12-30 17:28 . 2008-12-30 17:28 <DIR> d-------- c:\documents and settings\Bkap\Application Data\PACE Anti-Piracy
2008-12-30 17:28 . 2008-12-30 17:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2008-12-30 11:12 . 2008-12-30 11:13 1 --a------ c:\windows\system32\sav950231.sys
2008-12-30 11:12 . 2008-12-30 11:12 1 --a------ c:\windows\system32\sav80231.sys
2008-12-30 11:11 . 2008-12-30 11:11 1 --a------ c:\windows\system32\sav970451.sys
2008-12-29 23:39 . 2008-12-29 23:39 <DIR> d-------- c:\windows\Sun
2008-12-29 23:29 . 2008-12-29 23:29 1 --a------ c:\windows\system32\sav87312.sys
2008-12-28 20:13 . 2008-12-28 20:13 <DIR> d-------- c:\documents and settings\Brett1\Application Data\Yahoo!
2008-12-19 22:19 . 2008-12-19 22:19 <DIR> d-------- c:\documents and settings\Brett1\Application Data\Apple Computer
2008-12-19 22:17 . 2008-07-08 12:54 <DIR> d-------- c:\documents and settings\Brett1\Application Data\SiteAdvisor
2008-12-19 22:17 . 2008-08-01 18:32 <DIR> d-------- c:\documents and settings\Brett1\Application Data\InstallShield
2008-12-19 22:17 . 2008-12-19 22:17 <DIR> d-------- c:\documents and settings\Brett1
2008-12-19 22:17 . 2008-04-14 22:00 221,184 --a------ c:\windows\system32\wmpns.dll
2008-12-19 21:54 . 2008-12-19 21:54 141 --a------ c:\windows\wininit.ini
2008-12-19 18:16 . 2009-01-06 16:28 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-12-19 18:16 . 2009-01-06 16:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-12-18 14:37 . 2008-12-18 14:37 <DIR> d-------- c:\program files\AskSearch
2008-12-18 14:28 . 2008-12-18 14:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\InstallShield
2008-12-18 14:22 . 2008-12-18 14:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Nero
2008-12-13 17:51 . 2008-12-13 17:51 <DIR> d-------- c:\documents and settings\Bkap\Application Data\InterVideo
2008-12-12 15:10 . 2008-12-12 15:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\131F
2008-12-11 15:16 . 2008-12-11 15:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\19167
2008-12-11 13:37 . 2008-12-18 14:17 <DIR> d-------- c:\program files\Microsoft Office Communicator
2008-12-11 13:33 . 2008-12-11 13:33 <DIR> d-------- c:\program files\MSBuild
2008-12-11 10:55 . 2008-12-11 10:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\LightScribe
2008-12-11 10:48 . 2009-01-05 14:50 69 --a------ c:\windows\NeroDigital.ini
2008-12-10 21:03 . 2008-12-10 21:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\D114
2008-12-10 21:02 . 2008-12-10 21:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\22329
2008-12-10 16:01 . 2008-12-10 16:01 <DIR> d-------- c:\documents and settings\All Users\Application Data\1134B
2008-12-10 15:29 . 2008-12-10 15:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\133A9

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 21:56 --------- d-----w c:\program files\ThinkFree Office
2009-01-05 19:00 --------- d-----w c:\program files\Yahoo!
2009-01-05 18:45 --------- d-----w c:\program files\OpenOffice.org 2.3
2009-01-05 18:37 --------- d-----w c:\documents and settings\Bkap\Application Data\OpenOffice.org2
2008-12-31 19:16 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-27 17:46 --------- d-----w c:\documents and settings\Bkap\Application Data\LimeWire
2008-12-18 19:37 --------- d-----w c:\program files\BearShare Applications
2008-12-18 19:28 --------- d-----w c:\documents and settings\Bkap\Application Data\InstallShield
2008-12-18 19:27 --------- d-----w c:\program files\Common Files\LightScribe
2008-12-18 19:21 --------- d-----w c:\program files\Common Files\Ahead
2008-12-18 19:20 --------- d-----w c:\program files\EZ-DUB
2008-12-18 19:18 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-11 15:48 --------- d-----w c:\documents and settings\Bkap\Application Data\Ahead
2008-12-08 00:06 --------- d-----w c:\documents and settings\All Users\Application Data\10148
2008-12-04 23:48 --------- d-----w c:\documents and settings\All Users\Application Data\27167
2008-12-04 23:24 --------- d-----w c:\program files\Java
2008-12-04 23:23 --------- d-----w c:\program files\Common Files\Java
2008-12-04 22:37 737,280 ----a-w c:\windows\iun6002.exe
2008-12-04 22:25 --------- d-----w c:\program files\INITIO
2008-12-04 22:25 --------- d-----w c:\program files\Common Files\InstallShield
2008-12-04 22:22 --------- d-----w c:\program files\McAfee
2008-12-04 22:13 --------- d-----w c:\program files\Nero
2008-12-02 15:45 --------- d-----w c:\documents and settings\All Users\Application Data\22213
2008-12-02 05:34 --------- d-----w c:\documents and settings\All Users\Application Data\32AB
2008-11-28 16:25 --------- d-----w c:\program files\iTunes
2008-11-28 16:25 --------- d-----w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-26 20:49 410,976 ----a-w c:\windows\system32\deploytk.dll
2008-11-25 23:42 --------- d-----w c:\documents and settings\Bkap\Application Data\BitTorrent(2)
2008-11-22 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\263E
2008-11-22 08:06 --------- d-----w c:\documents and settings\All Users\Application Data\3B232
2008-11-21 03:15 --------- d-----w c:\documents and settings\All Users\Application Data\28261
2008-11-18 00:25 --------- d-----w c:\program files\iPod
2008-11-13 00:16 --------- d-----w c:\documents and settings\Bkap\Application Data\Ruckus Network
2008-11-12 22:03 --------- d-----w c:\documents and settings\LocalService\Application Data\SACore
2008-11-12 07:33 --------- d-----w c:\documents and settings\All Users\Application Data\SiteAdvisor
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 01:00 666,112 ----a-w c:\windows\system32\wininet.dll
2008-10-15 16:34 337,408 ----a-w c:\windows\system32\netapi32(3)(2).dll
2008-09-28 01:20 0 ----a-w c:\documents and settings\Bkap\Application Data\wklnhst.dat
2005-05-26 19:35 1,422 ----a-w c:\program files\ReadMe.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-10-18 455968]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-12-14 148776]
"ISUSPM"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 218032]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-22 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" [X]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"AzMixerSel"="c:\program files\Realtek\Audio\InstallShield\AzMixerSel.exe" [2006-07-17 53248]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-04-24 1044480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-03-08 40048]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 208952]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 59392]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 455168]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-08-04 582992]
"LManager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2008-05-13 821768]
"PLFSetL"="c:\windows\PLFSetL.exe" [2007-07-05 94208]
"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2008-05-22 425984]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-11-07 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-26 136600]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-12-14 161064]

c:\documents and settings\Bkap\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 101784]
SpywareGuard.lnk - c:\program files\SpywareGuard\sgmain.exe [2003-08-29 360448]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
EZ-DUB Finder.lnk - c:\program files\INITIO\EZ-DUB Finder v1.3.45\inihid.exe [2008-12-04 176128]
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2008-06-04 114688]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
R4 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [2008-10-09 198944]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-09-04 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5a964f9f-7c98-11dd-a3e0-0022691922ee}]
\Shell\Auto\command - Start.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Start.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-01-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-10-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2008-07-08 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 12:32]

2009-01-08 c:\windows\Tasks\vgejfpjm.job
- c:\windows\system32\rundll32.exe [2008-04-14 22:00]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
HKCU-Run-Aim6 - (no file)
HKLM-Run-RTHDCPL - RTHDCPL.EXE


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com/?o=101760&l=dis
mStart Page = hxxp://en.us.acer.yahoo.com
uInternet Connection Wizard,ShellNext = hxxp://en.us.acer.yahoo.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://toolbar.ask.com/toolbarv/askRedirect?o=101757&gct=&gc=1&q=%s
IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Bkap\Application Data\Mozilla\Firefox\Profiles\jvswqmxo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT1814311&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - prefs.js: browser.startup.homepage - hxxp://my.alfred.edu/
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&query=
FF - component: c:\documents and settings\Bkap\Application Data\Mozilla\Firefox\Profiles\jvswqmxo.default\extensions\{7affbfae-c4e2-4915-8c0f-00fa3ec610a1}\components\WinampPlayer.dll
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

---- FIREFOX POLICIES ----
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 12:25:30
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\DJZERO]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\JKWL]
@DACL=(02 0000)

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\metajuan]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000
"LBL"=hex:00,00,00,00,00,00,00,00
"MN"=hex:00,00,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\meta_mg]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\profiling4]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:78,52,96,c7,af,70,c9,01
"CNT"=dword:00000000

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\superjuan]
@DACL=(02 0000)
"LTM"=hex:78,52,96,c7,af,70,c9,01
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Microsoft\MS Juan\TrackDJuan]
@DACL=(02 0000)
"LTM"=hex:00,00,00,00,00,00,00,00
"CDY"=hex:00,00,00,00,00,00,00,00
"CNT"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(732)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\progra~1\McAfee.com\Agent\mcagent.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\windows\system32\igfxsrvc.exe
c:\windows\system32\igfxext.exe
c:\progra~1\McAfee\VIRUSS~1\mcsysmon.exe
c:\progra~1\McAfee\MSC\mcuimgr.exe
c:\program files\SpywareGuard\sgbhp.exe
c:\program files\Java\jre6\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2009-01-08 12:33:02 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-08 17:32:57

Pre-Run: 94,273,200,128 bytes free
Post-Run: 94,332,698,624 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

334 --- E O F --- 2008-12-18 21:16:58



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:39:03 PM, on 1/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
c:\PROGRA~1\mcafee\msc\mcuimgr.exe
C:\Program Files\INITIO\EZ-DUB Finder v1.3.45\inihid.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101760&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://toolbar.ask.c...c...amp;gc=1&q=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://toolbar.ask.c...c...p;gc=1&q=%s
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://en.us.acer.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\Audio\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [PLFSetL] C:\WINDOWS\PLFSetL.exe
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: EZ-DUB Finder.lnk = C:\Program Files\INITIO\EZ-DUB Finder v1.3.45\inihid.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 10025 bytes
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP