ComboFix 08-12-01.03 - Chris 2008-12-03 11:45:52.5 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.691 [GMT 8:00]
Running from: e:\documents and settings\Chris\Desktop\ComboFix.exe
* Created a new restore point
[COLOR=RED][B]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/B][/COLOR]
.
((((((((((((((((((((((((( Files Created from 2008-11-03 to 2008-12-03 )))))))))))))))))))))))))))))))
.
2008-11-29 11:22 . 2008-11-29 11:22
d-------- e:\documents and settings\All Users\Application Data\Avg8
2008-11-29 10:50 . 2008-11-29 10:50 d--hs---- E:\FOUND.005
2008-11-29 09:39 . 2006-08-21 17:14 128,896 --------- e:\windows\system32\dllcache\fltmgr.sys
2008-11-29 09:39 . 2006-08-21 17:14 23,040 --------- e:\windows\system32\dllcache\fltmc.exe
2008-11-29 09:39 . 2006-08-21 20:21 16,896 --------- e:\windows\system32\dllcache\fltlib.dll
2008-11-29 09:36 . 2008-11-29 09:37 d-------- e:\program files\MSXML 4.0
2008-11-29 09:35 . 2004-03-12 02:18 217,088 --a------ e:\windows\system32\wmpns.dll
2008-11-21 13:22 . 2008-11-21 13:22 d--hs---- E:\FOUND.004
2008-11-20 19:31 . 2008-11-20 19:31 d-------- e:\documents and settings\Chris\Application Data\PCToolsFirewallPlus
2008-11-20 19:26 . 2008-11-20 19:26 d-------- e:\program files\PC Tools Firewall Plus
2008-11-18 20:00 . 2008-11-18 19:59 1,851,544 --a------ e:\program files\install_flash_player.exe
2008-11-18 19:45 . 2008-11-18 19:45 d-------- e:\program files\Spybot - Search & Destroy
2008-11-18 09:28 . 2008-09-05 00:42 1,106,944 --------- e:\windows\system32\dllcache\msxml3.dll
2008-11-16 00:16 . 2002-09-27 16:31 40,960 --------- e:\windows\system32\IsUser11b.dll
2008-11-12 10:25 . 2008-11-12 10:25 d-------- e:\program files\MSN Messenger
2008-11-09 16:50 . 2008-11-09 16:50 d-------- e:\program files\Malwarebytes' Anti-Malware
2008-11-09 16:50 . 2008-11-09 16:50 d-------- e:\documents and settings\Chris\Application Data\Malwarebytes
2008-11-09 16:50 . 2008-11-09 16:50 d-------- e:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-09 16:50 . 2008-10-22 16:10 38,496 --a------ e:\windows\system32\drivers\mbamswissarmy.sys
2008-11-09 16:50 . 2008-10-22 16:10 15,504 --a------ e:\windows\system32\drivers\mbam.sys
2008-11-09 15:21 . 2008-11-09 15:21 244 --ah----- E:\sqmnoopt00.sqm
2008-11-09 15:21 . 2008-11-09 15:21 232 --ah----- E:\sqmdata00.sqm
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-26 05:23 --------- d-----w e:\program files\Apple Software Update
2008-10-25 16:09 --------- d-----w e:\documents and settings\Chris\Application Data\Comodo
2008-10-25 04:48 --------- d-----w e:\program files\Common Files\Adobe AIR
2008-10-25 04:46 --------- d-----w e:\documents and settings\Chris\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
2008-10-25 04:40 --------- d-----w e:\documents and settings\All Users\Application Data\NOS
2008-10-25 04:39 --------- d-----w e:\program files\NOS
2008-10-25 04:38 410,976 ----a-w e:\windows\system32\deploytk.dll
2008-10-25 04:29 249,592 ----a-w e:\windows\system32\cssdll32.dll
2008-10-25 04:29 --------- d-----w e:\program files\AskSearch
2008-10-25 04:25 25,831,688 ----a-w e:\program files\CIS_Setup_3.5.53896.424_XP_Vista_x32.exe
2008-10-25 04:25 --------- d-----w e:\program files\JavaRa
2008-10-25 04:15 --------- d-----w e:\program files\Google
2008-10-24 11:10 453,632 ----a-w e:\windows\system32\drivers\mrxsmb.sys
2008-10-24 11:10 453,632 ------w e:\windows\system32\dllcache\mrxsmb.sys
2008-10-20 10:52 --------- d-----w e:\documents and settings\All Users\Application Data\NortonInstaller
2008-10-16 06:13 202,776 ----a-w e:\windows\system32\wuweb.dll
2008-10-16 06:13 202,776 ----a-w e:\windows\system32\dllcache\wuweb.dll
2008-10-16 06:13 1,809,944 ----a-w e:\windows\system32\wuaueng.dll
2008-10-16 06:13 1,809,944 ----a-w e:\windows\system32\dllcache\wuaueng.dll
2008-10-16 06:12 561,688 ----a-w e:\windows\system32\wuapi.dll
2008-10-16 06:12 561,688 ----a-w e:\windows\system32\dllcache\wuapi.dll
2008-10-16 06:12 323,608 ----a-w e:\windows\system32\wucltui.dll
2008-10-16 06:12 323,608 ----a-w e:\windows\system32\dllcache\wucltui.dll
2008-10-16 06:09 92,696 ----a-w e:\windows\system32\dllcache\cdm.dll
2008-10-16 06:09 92,696 ----a-w e:\windows\system32\cdm.dll
2008-10-16 06:09 51,224 ----a-w e:\windows\system32\wuauclt.exe
2008-10-16 06:09 51,224 ----a-w e:\windows\system32\dllcache\wuauclt.exe
2008-10-16 06:09 43,544 ----a-w e:\windows\system32\wups2.dll
2008-10-16 06:08 34,328 ----a-w e:\windows\system32\wups.dll
2008-10-16 06:08 34,328 ----a-w e:\windows\system32\dllcache\wups.dll
2008-10-15 16:57 332,800 ------w e:\windows\system32\dllcache\netapi32.dll
2008-10-06 03:48 --------- d-----w e:\documents and settings\Chris\Application Data\EBookSys
2008-09-30 08:43 1,286,152 ----a-w e:\windows\system32\msxml4.dll
2008-09-15 11:57 1,846,016 ----a-w e:\windows\system32\win32k.sys
2008-09-15 11:57 1,846,016 ------w e:\windows\system32\dllcache\win32k.sys
2008-09-05 15:30 241,704 ------w e:\windows\system32\dllcache\wgaLogon.dll
2008-09-05 15:29 917,032 ------w e:\windows\system32\dllcache\WgaTray.exe
2008-09-04 16:42 1,106,944 ----a-w e:\windows\system32\msxml3.dll
2008-08-19 02:50 189,016 ----a-w e:\documents and settings\Chris\Application Data\GDIPFONTCACHEV1.DAT
2008-05-04 15:50 4 --sh--r e:\documents and settings\All Users\Application Data\sysqcl1129139270.dat
2007-10-13 18:43 18,040,176 ----a-w e:\program files\Install_Messenger_nous.exe
2003-11-04 18:54 5,406,945 ------w e:\program files\Setupligh.exe
2005-06-26 22:32 616,448 --sha-r e:\windows\system32\cygwin1.dll
2005-06-22 05:37 45,568 --sha-r e:\windows\system32\cygz.dll
2005-07-14 19:31 27,648 --sha-w e:\windows\system32\AVSredirect.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PlaxoUpdate"="e:\program files\Plaxo\3.17.0.16\PlaxoHelper_en.exe" [2008-11-19 369223]
"Eraser"="c:\misc installers\Protection tools\Eraser\Eraser.exe" [2007-12-23 916240]
"Sony Ericsson PC Suite"="e:\program files\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" [2008-02-20 356352]
"msnmsgr"="e:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
"PlaxoSysTray"="e:\program files\Plaxo\3.17.0.16\PlaxoSysTray.exe" [2008-11-19 20480]
"SUPERAntiSpyware"="e:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-19 1805552]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliType"="e:\program files\Microsoft Hardware\Keyboard\type32.exe" [2002-03-22 94208]
"ATIPTA"="e:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-01 335872]
"NeroFilterCheck"="e:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"Easy-PrintToolBox"="e:\program files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE" [2004-01-14 409600]
"SunJavaUpdateSched"="e:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="e:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
e:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - e:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Acrobat Assistant.lnk - e:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "e:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-11-19 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-11-19 13:57 352256 e:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Misc installers\\Limewire\\LimeWire.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"e:\\Program Files\\Sony Ericsson\\Sony Ericsson Media Manager 1.0\\MediaManager.exe"=
"e:\\Program Files\\Macromedia\\Dreamweaver MX 2004\\Dreamweaver.exe"=
"e:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"e:\\Program Files\\MSN Messenger\\livecall.exe"=
R1 SASDIFSV;SASDIFSV;\??\e:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2006-10-10 8944]
R1 SASKUTIL;SASKUTIL;\??\e:\program files\SUPERAntiSpyware\SASKUTIL.sys [2007-02-27 55024]
R2 ssoftnt4;ssoftnt4;\??\e:\windows\system32\Drivers\ssoftnt4.sys [2008-02-18 100728]
R3 SASENUM;SASENUM;\??\e:\program files\SUPERAntiSpyware\SASENUM.SYS [2006-02-16 4096]
R3 USBNET_XP;Instant Wireless XP USB Network Adapter ver.2.6 Driver;e:\windows\system32\DRIVERS\netusbxp.sys [2007-10-14 72576]
S3 ggflt;SEMC USB Flash Driver Filter;e:\windows\system32\DRIVERS\ggflt.sys [2008-02-27 13352]
.
Contents of the 'Scheduled Tasks' folder
2008-10-26 e:\windows\Tasks\AppleSoftwareUpdate.job
- e:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - e:\documents and settings\Chris\Application Data\Mozilla\Firefox\Profiles\[u]0[/u]g2wi5w8.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.facebook.com/index.php?
FF -: plugin - e:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - e:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - e:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - e:\program files\Mozilla Firefox\plugins\np_gp.dll
FF -: plugin - e:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - e:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-03 11:47:00
Windows 5.1.2600 Service Pack 2, v.3427 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(408)
e:\windows\system32\ODBC32.dll
e:\windows\system32\msctfime.ime
e:\program files\SUPERAntiSpyware\SASWINLO.DLL
e:\windows\system32\Ati2evxx.dll
- - - - - - - > 'lsass.exe'(464)
e:\windows\system32\dssenh.dll
.
Completion time: 2008-12-03 11:49:09
ComboFix-quarantined-files.txt 2008-12-03 03:47:34
Pre-Run: 3,976,937,472 bytes free
Post-Run: 4,109,287,424 bytes free
164 --- E O F --- 2008-11-29 01:49:56