Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Google redirects in Firefox


  • Please log in to reply

#1
Anti-Everything

Anti-Everything

    New Member

  • Member
  • Pip
  • 1 posts
Hi,

I came across this topic which had the same problem as mine: http://www.geekstogo...us-t258535.html

As advised in that topic, I downloaded and ran ComboFix. As the scan initiated, it said that it found Rootkit activity in my computer.

Anyways, the scan finished and produced a log report which I am pasting below. I don't understand what the log report is saying or whether it solved anything at all. Any guidance will be much appreciated. Thank you.

ComboFix 09-12-20.08 - Asif Chowdhury 12/22/2009 10:26:22.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.510.189 [GMT 0:00]
Running from: d:\documents and settings\Asif Chowdhury\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
D:\Autorun.inf
d:\documents and settings\Asif Chowdhury\Application Data\inst.exe
d:\program files\WinPCap
d:\program files\WinPCap\daemon_mgm.exe
d:\program files\WinPCap\INSTALL.LOG
d:\program files\WinPCap\npf_mgm.exe
d:\program files\WinPCap\rpcapd.exe
d:\program files\WinPCap\Uninstall.exe
d:\recycler\S-1-5-21-4106738976-42288212-2389834452-1006
d:\windows\msacm32.drv
d:\windows\prefetch\explorer.exe
d:\windows\rasqervy.dll
d:\windows\sdfinacs.dll
d:\windows\sdfixwcs.dll
d:\windows\system32\_000006_.tmp.dll
d:\windows\system32\drivers\npf.sys
d:\windows\system32\Packet.dll
d:\windows\system32\pthreadVC.dll
d:\windows\system32\wpcap.dll
d:\windows\wuasirvy.dll

.
original MBR restored successfully !
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_msqpdxserv.sys
-------\Legacy_NPF
-------\Service_msqpdxserv.sys
-------\Service_NPF


((((((((((((((((((((((((( Files Created from 2009-11-22 to 2009-12-22 )))))))))))))))))))))))))))))))
.

2009-12-21 11:46 . 2009-06-18 12:55 18816 ------w- d:\windows\system32\SAVRKBootTasks.sys
2009-12-21 10:31 . 2009-12-21 10:31 -------- d-----w- d:\program files\Sophos
2009-12-21 09:52 . 2009-12-21 09:52 -------- d-----w- d:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-12-21 09:51 . 2009-12-21 09:52 -------- d-----w- d:\program files\SUPERAntiSpyware
2009-12-21 09:51 . 2009-12-21 09:51 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\SUPERAntiSpyware.com
2009-12-21 09:50 . 2009-12-21 09:50 -------- d-----w- d:\program files\Common Files\Wise Installation Wizard
2009-12-20 21:49 . 2009-12-21 12:09 56816 ----a-w- d:\windows\system32\drivers\avgntflt.sys
2009-12-20 21:49 . 2009-03-30 09:33 96104 ----a-w- d:\windows\system32\drivers\avipbb.sys
2009-12-20 21:49 . 2009-02-13 11:29 22360 ----a-w- d:\windows\system32\drivers\avgntmgr.sys
2009-12-20 21:49 . 2009-02-13 11:17 45416 ----a-w- d:\windows\system32\drivers\avgntdd.sys
2009-12-20 21:49 . 2009-12-20 21:49 -------- d-----w- d:\program files\Avira
2009-12-20 21:49 . 2009-12-20 21:49 -------- d-----w- d:\documents and settings\All Users\Application Data\Avira
2009-12-20 20:32 . 2009-12-20 20:32 -------- d-----w- d:\program files\ERUNT
2009-12-19 10:39 . 2009-12-19 10:39 -------- d-----w- d:\program files\iPod
2009-12-19 10:32 . 2009-12-19 10:33 -------- d-----w- d:\program files\QuickTime
2009-12-18 16:03 . 2009-12-18 16:03 -------- d-----w- d:\documents and settings\HelpAssistant\WINDOWS
2009-12-18 16:03 . 2009-12-18 16:03 -------- d-----w- d:\documents and settings\HelpAssistant\UserData
2009-12-18 16:03 . 2009-12-18 16:03 -------- d-----w- d:\documents and settings\HelpAssistant\Tracing
2009-12-18 15:55 . 2009-12-18 15:55 -------- d-----w- d:\documents and settings\HelpAssistant\Contacts
2009-11-23 18:58 . 2009-11-23 18:58 -------- d-----w- d:\program files\DoremiSoft
2009-11-23 18:55 . 2009-11-23 18:55 -------- d-----w- d:\documents and settings\All Users\Application Data\TEMP
2009-11-23 18:55 . 2009-11-23 18:57 -------- d-----w- d:\program files\AimOne_AlltoMP3
2009-11-22 17:46 . 2009-08-06 19:23 274288 ----a-w- d:\windows\system32\mucltui.dll
2009-11-22 17:46 . 2009-08-06 19:23 215920 ----a-w- d:\windows\system32\muweb.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2098-01-01 00:00 . 2008-01-08 00:50 9096 ----a-w- d:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\LUTPReg.dll
2098-01-01 00:00 . 2007-08-25 03:51 9584 ----a-w- d:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\WP20.dll
2098-01-01 00:00 . 2007-08-25 03:51 9584 ----a-w- d:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\IV20.dll
2098-01-01 00:00 . 2007-08-22 21:45 9048 ----a-w- d:\documents and settings\All Users\Application Data\Symantec\LiveUpdate\LuRegManifests\Static\FWLUReg.dll
2009-12-22 10:17 . 2009-12-18 18:11 24576 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Macromedia\Common\89b3601419.exe
2009-12-22 09:53 . 2007-09-14 16:40 -------- d-----w- d:\program files\Common Files\Symantec Shared
2009-12-22 00:18 . 2008-02-23 09:19 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\uTorrent
2009-12-21 23:59 . 2009-07-28 13:56 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\vlc
2009-12-21 21:57 . 2009-12-18 22:03 24576 ----a-w- d:\documents and settings\NetworkService\Application Data\Macromedia\Common\89b3601419.exe
2009-12-21 11:38 . 2009-12-20 22:14 24576 ----a-w- d:\documents and settings\LocalService\Application Data\Macromedia\Common\89b3601419.exe
2009-12-21 09:56 . 2009-12-21 09:56 117760 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-20 18:01 . 2007-09-14 14:39 1033216 ----a-w- d:\windows\explorer.exe
2009-12-20 15:24 . 2009-02-06 14:19 -------- d-----w- d:\program files\Malwarebytes' Anti-Malware
2009-12-20 15:24 . 2009-12-20 15:22 4844295 ----a-w- d:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-19 23:48 . 2009-12-18 18:11 113664 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Macromedia\Common\89b360141.dll
2009-12-19 10:40 . 2007-09-14 15:39 -------- d-----w- d:\program files\iTunes
2009-12-19 10:39 . 2008-03-21 12:13 -------- d-----w- d:\program files\Common Files\Apple
2009-12-19 10:22 . 2009-12-19 10:22 79144 ----a-w- d:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-12-18 16:14 . 2009-11-14 22:12 24576 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Macromedia\Common\89c2a01419.exe
2009-12-16 22:21 . 2009-11-14 22:12 113664 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Macromedia\Common\89c2a0141.dll
2009-12-05 00:30 . 2008-01-24 15:33 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\dvdcss
2009-12-04 10:03 . 2009-12-04 10:03 251376 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Mozilla\plugins\npgoogletalk.dll
2009-12-03 16:14 . 2009-02-06 14:19 38224 ----a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2009-12-03 16:13 . 2009-02-06 14:19 19160 ----a-w- d:\windows\system32\drivers\mbam.sys
2009-12-01 13:59 . 2007-09-27 21:56 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\Skype
2009-11-23 19:14 . 2009-10-09 09:44 57632 ---ha-w- d:\windows\system32\mlfcache.dat
2009-11-22 01:57 . 2007-09-14 14:37 55496 ----a-w- d:\documents and settings\Asif Chowdhury\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-22 01:56 . 2007-09-25 16:31 -------- d-----w- d:\program files\MSN Messenger
2009-11-22 01:55 . 2009-11-22 01:55 -------- d-----w- d:\program files\Microsoft
2009-11-22 01:55 . 2009-11-22 01:53 -------- d-----w- d:\program files\Windows Live
2009-11-22 01:54 . 2009-11-22 01:54 -------- d-----w- d:\program files\Windows Live SkyDrive
2009-11-22 01:39 . 2009-11-22 01:39 -------- d-----w- d:\program files\Common Files\Windows Live
2009-11-17 16:08 . 2008-11-14 17:09 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\skypePM
2009-11-15 10:40 . 2009-11-15 10:40 -------- d-----w- d:\program files\Common Files\Skype
2009-11-15 10:40 . 2007-09-27 21:55 -------- d-----r- d:\program files\Skype
2009-11-15 10:40 . 2007-09-27 21:55 -------- d-----w- d:\documents and settings\All Users\Application Data\Skype
2009-11-14 10:47 . 2009-11-14 10:45 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\Vso
2009-11-14 10:45 . 2009-11-14 10:45 47360 ----a-w- d:\windows\system32\drivers\pcouffin.sys
2009-11-14 10:45 . 2009-11-14 10:45 47360 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\pcouffin.sys
2009-11-14 10:45 . 2009-11-14 10:45 47360 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\pcouffin.sys
2009-11-14 10:45 . 2009-11-14 10:44 -------- d-----w- d:\program files\DVDFab 6
2009-11-07 14:32 . 2007-09-14 15:31 -------- d-----w- d:\program files\MediaCoder
2009-11-02 11:23 . 2009-11-02 11:20 -------- d-----w- d:\program files\Stata10
2009-10-29 05:48 . 2007-09-14 14:40 662016 ----a-w- d:\windows\system32\wininet.dll
2009-10-25 13:46 . 2007-09-22 12:50 -------- d-----w- d:\documents and settings\Asif Chowdhury\Application Data\AdobeUM
2009-10-21 06:00 . 2007-09-14 14:40 75776 ----a-w- d:\windows\system32\strmfilt.dll
2009-10-21 06:00 . 2007-09-14 14:39 25088 ----a-w- d:\windows\system32\httpapi.dll
2009-10-20 14:58 . 2004-08-03 23:00 263552 ----a-w- d:\windows\system32\drivers\http.sys
2009-10-13 21:26 . 2009-10-13 21:22 17208816 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\rp\RealPlayerSPGold.exe
2009-10-13 21:22 . 2009-10-13 21:21 8406648 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\gtb_us\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2009-10-13 21:19 . 2009-10-13 21:19 10309448 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\chr\ChromeInstaller.exe
2009-10-13 21:17 . 2009-10-13 21:17 52288 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\RUP\inst_config\gtapi.dll
2009-10-13 21:17 . 2009-10-13 21:17 64000 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\RUP\inst_config\gcapi_dll.dll
2009-10-13 21:17 . 2009-10-13 21:17 50688 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\RUP\inst_config\fftbapi.dll
2009-10-13 21:17 . 2009-10-13 21:17 114688 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\RUP\inst_config\compat.dll
2009-10-13 21:15 . 2008-08-11 07:21 488968 ----a-w- d:\documents and settings\Asif Chowdhury\Application Data\Real\Update\setup\setup.exe
2009-10-13 10:53 . 2007-09-14 14:40 266752 ----a-w- d:\windows\system32\oakley.dll
2009-10-12 13:54 . 2007-09-14 14:40 69632 ----a-w- d:\windows\system32\raschap.dll
2009-10-12 13:54 . 2007-09-14 14:40 112128 ----a-w- d:\windows\system32\rastls.dll
2009-09-25 05:56 . 2007-09-14 14:39 81920 ----a-w- d:\windows\system32\ieencode.dll
2007-08-25 03:52 . 2008-04-17 20:31 300400 ----a-w- d:\program files\mozilla firefox\components\coFFPlgn.dll
2009-02-24 19:34 . 2009-02-24 19:34 1044480 ----a-w- d:\program files\mozilla firefox\plugins\libdivx.dll
2009-02-24 19:34 . 2009-02-24 19:34 200704 ----a-w- d:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Avro Keyboard"="d:\program files\Avro Keyboard\Avro Keyboard.exe" [2007-07-02 1658880]
"SpybotSD TeaTimer"="d:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Google Update"="d:\documents and settings\Asif Chowdhury\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-11-15 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="d:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-22 339968]
"osCheck"="d:\program files\Norton Internet Security\osCheck.exe" [2007-08-25 714608]
"Apoint"="d:\program files\Apoint2K\Apoint.exe" [2003-10-30 192512]
"HWSetup"="d:\program files\TOSHIBA\TOSHIBA Applet\HWSetup.exe" [2004-12-24 28672]
"CeEKEY"="d:\program files\TOSHIBA\E-KEY\CeEKey.exe" [2005-04-28 675840]
"ccApp"="d:\program files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 51048]
"CanonMyPrinter"="d:\program files\Canon\MyPrinter\BJMyPrt.exe" [2008-03-03 1848648]
"QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"iTunesHelper"="d:\program files\iTunes\iTunesHelper.exe" [2009-11-12 141600]
"avgnt"="d:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

d:\documents and settings\Asif Chowdhury\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - d:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

d:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - d:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"HideClock"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "d:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 14:21 548352 ----a-w- d:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0smrgdf d:\documents and settings\Asif Chowdhury\Application Data\iolo\

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bijoy Classic Pro.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Bijoy Classic Pro.lnk
backup=d:\windows\pss\Bijoy Classic Pro.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Monitor.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth Monitor.lnk
backup=d:\windows\pss\Bluetooth Monitor.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=d:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^All Users^Start Menu^Programs^Startup^SANTIS USB and PC Card Utility.lnk]
path=d:\documents and settings\All Users\Start Menu\Programs\Startup\SANTIS USB and PC Card Utility.lnk
backup=d:\windows\pss\SANTIS USB and PC Card Utility.lnkCommon Startup

[HKLM\~\startupfolder\D:^Documents and Settings^Asif Chowdhury^Start Menu^Programs^Startup^DesktopVideoPlayer.LNK]
path=d:\documents and settings\Asif Chowdhury\Start Menu\Programs\Startup\DesktopVideoPlayer.LNK
backup=d:\windows\pss\DesktopVideoPlayer.LNKStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Asif Chowdhury^Start Menu^Programs^Startup^FIFA 09 Registration.lnk]
path=d:\documents and settings\Asif Chowdhury\Start Menu\Programs\Startup\FIFA 09 Registration.lnk
backup=d:\windows\pss\FIFA 09 Registration.lnkStartup

[HKLM\~\startupfolder\D:^Documents and Settings^Asif Chowdhury^Start Menu^Programs^Startup^VirtuaGirl HD.LNK]
path=d:\documents and settings\Asif Chowdhury\Start Menu\Programs\Startup\VirtuaGirl HD.LNK
backup=d:\windows\pss\VirtuaGirl HD.LNKStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\4oD]
2007-04-23 11:23 1032640 ----a-w- d:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-04-12 13:23 88358 ----a-w- d:\windows\agrsmmsg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2008-11-15 16:15 133104 ----atw- d:\documents and settings\Asif Chowdhury\Local Settings\Application Data\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
2007-04-23 11:23 1032640 ----a-w- d:\program files\Kontiki\KHost.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LtMoh]
2005-04-12 13:24 184320 ------w- d:\program files\ltmoh\ltmoh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3]
2007-09-25 16:32 190024 ----a-w- d:\program files\MessengerPlus! 3\MsgPlus.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-10-13 16:24 1694208 ------w- d:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2001-07-09 08:50 155648 ----a-w- d:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PadTouch]
2004-11-17 08:56 1077327 ----a-w- d:\program files\TOSHIBA\Touch and Launch\PadExe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 ----a-w- d:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2007-09-14 15:44 180269 ----a-w- d:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tvs]
2005-04-05 16:25 73728 ----a-w- d:\program files\TOSHIBA\Tvs\TvsTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
2007-08-30 17:43 4670704 ----a-w- d:\program files\Yahoo!\Messenger\YahooMessenger.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"LiveUpdate Notice"=2 (0x2)
"LiveUpdate"=3 (0x3)
"Automatic LiveUpdate Scheduler"=2 (0x2)
"Apple Mobile Device"=2 (0x2)
"usnjsvc"=3 (0x3)
"Pml Driver HPZ12"=2 (0x2)
"KService"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\Messenger\\msmsgs.exe"=
"d:\\Program Files\\Kontiki\\KService.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"d:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"d:\\Documents and Settings\\Asif Chowdhury\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"=
"d:\\Documents and Settings\\Asif Chowdhury\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"d:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"d:\\Program Files\\Spotify\\spotify.exe"=
"d:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"d:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"3246:TCP"= 3246:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"6293:TCP"= 6293:TCP:Services
"4356:TCP"= 4356:TCP:Services

R1 SASDIFSV;SASDIFSV;d:\program files\SUPERAntiSpyware\sasdifsv.sys [12/16/2009 4:26 PM 9968]
R1 SASKUTIL;SASKUTIL;d:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/16/2009 4:26 PM 74480]
R1 SAVRKBootTasks;Boot Tasks Driver;d:\windows\system32\SAVRKBootTasks.sys [12/21/2009 11:46 AM 18816]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;d:\program files\Avira\AntiVir Desktop\sched.exe [12/20/2009 9:49 PM 108289]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;d:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [9/9/2008 8:42 PM 99376]
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;d:\windows\system32\drivers\ManyCam.sys [3/22/2007 12:17 PM 21632]
S3 ASPI;Advanced SCSI Programming Interface Driver;d:\windows\system32\drivers\ASPI32.SYS [4/1/2008 6:47 PM 16512]
S3 ATMEL FVNETusbASKEY (AR);ATMEL FVNETusbASKEY (AR) Service for SANTIS WLAN USB Adapter;d:\windows\system32\drivers\vnetusbk.sys [2/20/2003 4:15 PM 93184]
S3 ATMEL WinXP PCMCIAFVNETR (2ARC);ATMEL WinXP PCMCIAFVNETR (2ARC) Service for SANTIS WLAN PC Card;d:\windows\system32\drivers\fvnetr51.sys [1/14/2003 10:44 AM 91648]
S3 COH_Mon;COH_Mon;d:\windows\system32\drivers\COH_Mon.sys [5/29/2007 8:55 PM 23888]
S3 MEMSWEEP2;MEMSWEEP2;\??\d:\windows\system32\29.tmp --> d:\windows\system32\29.tmp [?]
S3 SASENUM;SASENUM;d:\program files\SUPERAntiSpyware\SASENUM.SYS [12/16/2009 4:27 PM 7408]
S4 LiveUpdate Notice;LiveUpdate Notice;d:\program files\Common Files\Symantec Shared\CCSVCHST.EXE [8/25/2007 5:07 AM 149864]
S4 sptd;sptd;d:\windows\system32\drivers\sptd.sys [12/19/2007 10:44 PM 715248]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - COMHOST
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: &WordWeb... - d:\windows\system32\wweb32.dll/lookup.html
IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - d:\documents and settings\Asif Chowdhury\Application Data\Mozilla\Firefox\Profiles\417j4vdy.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.type - 4
FF - component: d:\program files\Mozilla Firefox\components\coFFPlgn.dll
FF - plugin: d:\documents and settings\Asif Chowdhury\Application Data\Mozilla\plugins\npgoogletalk.dll
FF - plugin: d:\documents and settings\Asif Chowdhury\Local Settings\Application Data\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: d:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
.
.
------- File Associations -------
.
JSEFile=NOTEPAD.EXE %1
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-userini - d:\windows\system32\userini.exe
HKCU-Run-rundll32.exe - (no file)
HKLM-Run-userini - d:\windows\system32\userini.exe
HKLM-Explorer_Run-userini - d:\windows\system32\userini.exe
HKCU-Explorer_Run-userini - d:\windows\system32\userini.exe
ShellExecuteHooks-{BD344AF4-67AB-4E19-A630-7435587D320B} - d:\windows\system32\ahndoor0.dll
ShellExecuteHooks-{B03A4BE6-5E5A-483E-B9B3-C484D4B20B72} - d:\windows\SYSTEM32\SOFTQQ0.DLL
MSConfigStartUp-msnmsgr - d:\program files\MSN Messenger\msnmsgr.exe
AddRemove-AVI Codec Pack - d:\program files\AVI Codec Pack\uninstall.exe
AddRemove-WinPcapInst - d:\program files\WinPcap\Uninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-22 10:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\d:\windows\system32\29.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1148)
d:\program files\SUPERAntiSpyware\SASWINLO.dll
d:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1304)
d:\windows\system32\WPDShServiceObj.dll
d:\windows\system32\PortableDeviceTypes.dll
d:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
d:\windows\system32\Ati2evxx.exe
d:\windows\system32\Ati2evxx.exe
d:\program files\Avira\AntiVir Desktop\avguard.exe
d:\program files\Bonjour\mDNSResponder.exe
d:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
d:\program files\Apoint2K\Apntex.exe
d:\windows\system32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2009-12-22 10:51:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-22 10:51

Pre-Run: 24,984,473,600 bytes free
Post-Run: 24,878,018,560 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP dition familiale" /fastdetect

- - End Of File - - E76AE0EC10C7AA285507D16A4568A72D

Edited by Anti-Everything, 22 December 2009 - 06:11 AM.

  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP