ComboFix 09-09-05.03 - Bebanito 09/06/2009 10:12.2.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1063 [GMT -4:00] Running from: c:\documents and settings\Bebanito\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Bebanito\Desktop\CFScript.txt AV: avast! antivirus 4.8.1351 [VPS 090905-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D} FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B} FILE :: "c:\windows\Installer\1a4ce0.msi" "c:\windows\Installer\64570b.msi" "c:\windows\Installer\645712.msi" "f:\diverse programe\botu lu beba\winmech.exe" "f:\diverse programe\dvd rip.exe" "f:\diverse programe\omsetup.exe" "f:\diverse programe\Password.Cracking\aw2000passwd\AW2000PR.ZIP" "f:\diverse programe\Password.Cracking\aw2000passwd\SETUP.EXE" . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . f:\diverse programe\botu lu beba\winmech.exe . . . . failed to delete f:\diverse programe\dvd rip.exe . . . . failed to delete f:\diverse programe\omsetup.exe . . . . failed to delete f:\diverse programe\Password.Cracking\aw2000passwd\AW2000PR.ZIP . . . . failed to delete f:\diverse programe\Password.Cracking\aw2000passwd\SETUP.EXE . . . . failed to delete . ((((((((((((((((((((((((( Files Created from 2009-08-06 to 2009-09-06 ))))))))))))))))))))))))))))))) . 2009-09-02 01:20 . 2009-09-02 01:20 -------- d-----w- c:\program files\Trend Micro 2009-09-01 02:02 . 2009-09-01 02:02 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2009-09-01 02:02 . 2009-09-06 13:45 -------- d-----w- c:\program files\SUPERAntiSpyware 2009-09-01 02:02 . 2009-09-01 02:02 -------- d-----w- c:\documents and settings\Bebanito\Application Data\SUPERAntiSpyware.com 2009-09-01 02:01 . 2009-09-01 02:01 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard 2009-09-01 01:52 . 2009-09-01 01:52 -------- d-----w- c:\documents and settings\Bebanito\Application Data\Malwarebytes 2009-09-01 01:52 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-09-01 01:52 . 2009-09-01 01:52 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-09-01 01:52 . 2009-09-01 01:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-09-01 01:52 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-08-31 01:29 . 2009-09-01 01:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-08-30 03:05 . 2009-08-30 03:05 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache 2009-08-30 02:27 . 2009-08-30 02:27 -------- d-----w- c:\program files\Microsoft ActiveSync 2009-08-30 02:26 . 2009-08-30 02:26 -------- d-----w- c:\program files\Microsoft.NET 2009-08-30 01:26 . 2009-08-17 16:04 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys 2009-08-30 01:26 . 2009-08-17 16:04 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys 2009-08-30 01:26 . 2009-08-17 16:03 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys 2009-08-30 01:26 . 2009-08-17 16:06 93392 ----a-w- c:\windows\system32\drivers\aswmon.sys 2009-08-30 01:26 . 2009-08-17 16:06 94160 ----a-w- c:\windows\system32\drivers\aswmon2.sys 2009-08-30 01:26 . 2009-08-17 16:05 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys 2009-08-30 01:26 . 2009-08-17 16:05 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys 2009-08-30 01:26 . 2009-08-17 16:02 97480 ----a-w- c:\windows\system32\AvastSS.scr 2009-08-30 01:25 . 2009-08-17 16:10 1279456 ----a-w- c:\windows\system32\aswBoot.exe 2009-08-27 06:03 . 2009-08-27 06:03 -------- d-----w- c:\documents and settings\Clara\Local Settings\Application Data\Temp 2009-08-23 20:59 . 2009-08-23 20:59 -------- d-----w- C:\Nova tools 2009-08-12 23:18 . 2008-04-14 12:42 221184 ----a-w- c:\windows\system32\wmpns.dll 2009-08-12 20:24 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll 2009-08-10 23:46 . 2009-08-10 23:46 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google 2009-08-10 23:44 . 2009-08-10 23:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-06 13:32 . 2009-06-20 03:25 -------- d-----w- c:\program files\FileSubmit 2009-08-30 18:47 . 2009-04-30 07:34 54872 ----a-w- c:\documents and settings\Bebanito\Local Settings\Application Data\GDIPFONTCACHEV1.DAT 2009-08-23 21:16 . 2009-04-30 06:48 -------- d-----w- c:\program files\Google 2009-08-17 00:17 . 2009-08-02 20:38 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP 2009-08-16 22:52 . 2009-08-01 12:54 -------- d-----w- c:\program files\Garmin 2009-08-05 09:01 . 2009-04-30 03:50 204800 ----a-w- c:\windows\system32\mswebdvd.dll 2009-08-02 15:37 . 2009-08-01 12:56 -------- d-----w- c:\documents and settings\Bebanito\Application Data\GARMIN 2009-08-01 13:19 . 2009-08-01 12:56 -------- d-----w- c:\documents and settings\All Users\Application Data\GARMIN 2009-08-01 12:54 . 2009-05-28 13:59 -------- d-----w- c:\program files\DIFX 2009-07-31 19:23 . 2009-05-08 17:13 411368 ----a-w- c:\windows\system32\deploytk.dll 2009-07-24 19:54 . 2009-07-24 19:54 -------- d-----w- c:\program files\Common Files\snpp106 2009-07-24 19:54 . 2009-04-30 03:14 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-07-24 19:53 . 2009-04-30 03:14 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-17 19:01 . 2002-08-29 12:00 58880 ----a-w- c:\windows\system32\atl.dll 2009-07-14 03:43 . 2009-04-30 07:20 286208 ------w- c:\windows\system32\wmpdxm.dll 2009-07-03 17:09 . 2002-08-29 12:00 915456 ------w- c:\windows\system32\wininet.dll 2009-06-25 08:25 . 2002-08-29 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll 2009-06-25 08:25 . 2002-08-29 12:00 56832 ----a-w- c:\windows\system32\secur32.dll 2009-06-25 08:25 . 2002-08-29 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll 2009-06-25 08:25 . 2002-08-29 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll 2009-06-25 08:25 . 2002-08-29 12:00 147456 ----a-w- c:\windows\system32\schannel.dll 2009-06-25 08:25 . 2002-08-29 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll 2009-06-24 11:18 . 2002-08-29 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys 2009-06-20 04:44 . 2009-06-20 04:44 361984 ----a-w- c:\windows\system32\Beach Tranquility.scr 2009-06-16 14:36 . 2002-08-29 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll 2009-06-16 14:36 . 2002-08-29 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll 2009-06-12 12:31 . 2002-08-29 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe 2009-06-12 12:31 . 2002-08-29 12:00 76288 ----a-w- c:\windows\system32\telnet.exe 2009-06-10 14:13 . 2002-08-29 12:00 84992 ----a-w- c:\windows\system32\avifil32.dll 2009-06-10 13:19 . 2009-04-29 21:51 2066432 ----a-w- c:\windows\system32\mstscax.dll 2009-06-10 06:14 . 2002-08-29 12:00 132096 ----a-w- c:\windows\system32\wkssvc.dll 2009-06-09 14:15 . 2009-06-09 14:15 61208 ----a-w- c:\windows\system32\MPEG4E-uninstall.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-08-10 39408] "Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-03-19 4363504] "Google Update"="c:\documents and settings\Bebanito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-05 133104] "SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-08-05 1830128] "gStart"="c:\garmin\gStart.exe" [2008-08-13 1891416] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064] "NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384] "BTCMBattery"="c:\m_maestro\MBattery.exe" [2002-07-19 335872] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688] "QuickTime Task"="d:\program files\QuickTime\QTTask.exe" [2009-01-05 413696] "SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 210472] "PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2007-01-30 30248] "IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2007-01-30 46632] "PPort11reminder"="c:\program files\ScanSoft\PaperPort\Ereg\Ereg.exe" [2007-02-01 255528] "BrMfcWnd"="c:\program files\Brother\Brmfcmon\BrMfcWnd.exe" [2007-03-05 663552] "ControlCenter3"="c:\program files\Brother\ControlCenter3\brctrcen.exe" [2007-01-26 65536] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696] "avast!"="d:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-08-17 81000] "SunJavaUpdateSched"="d:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280] c:\documents and settings\Nicoleta\Start Menu\Programs\Startup\ OpenOffice.org 3.0.lnk - d:\program files\OpenOffice.org 3\program\quickstart.exe [2008-12-15 384000] c:\documents and settings\All Users\Start Menu\Programs\Startup\ REALTEK RTL8192U Wireless LAN Utility.lnk - c:\program files\REALTEK\8192U Wireless LAN Utility\RtWLan.exe [2009-4-29 880640] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Documents and Settings\\Bebanito\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.dll"= "c:\\Documents and Settings\\Bebanito\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "12298:TCP"= 12298:TCP:BitComet 12298 TCP "12298:UDP"= 12298:UDP:BitComet 12298 UDP "27215:TCP"= 27215:TCP:BitComet 27215 TCP "27215:UDP"= 27215:UDP:BitComet 27215 UDP R0 WinRoute;WinRoute;\SystemRoot\\SystemRoot\system32\drivers\winroute.sys --> \SystemRoot\\SystemRoot\system32\drivers\winroute.sys [?] R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [8/29/2009 9:26 PM 114768] R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [8/5/2009 4:06 PM 9968] R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [8/5/2009 4:06 PM 74480] R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [8/29/2009 9:26 PM 20560] R2 WinRServ;Softex WinRoute Service;d:\program files\softex\WinRServ.exe [5/3/2009 4:13 AM 63920] R3 NmPar;PCI Parallel Port;c:\windows\system32\drivers\NmPar.sys [12/24/2008 8:40 AM 80256] R3 nmserial;PCI Serial Port;c:\windows\system32\drivers\NmSerial.sys [12/16/2008 9:10 AM 70016] R3 RTL8192u;Realtek RTL8192U Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8192u.sys [4/29/2009 11:57 PM 431616] R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [8/5/2009 4:06 PM 7408] S2 gupdate1ca1a14b9d6292e;Google Update Service (gupdate1ca1a14b9d6292e);c:\program files\Google\Update\GoogleUpdate.exe [8/10/2009 7:45 PM 133104] S2 OxSer;PCI Serial Driver;c:\windows\system32\drivers\OxSer.sys [5/3/2009 5:56 AM 54584] S3 chimou2k;WHEEL MOUSE PS2 MOUSE Filter Driver;c:\windows\system32\drivers\bcm8042p.sys [5/1/2009 1:53 AM 4428] --- Other Services/Drivers In Memory --- *NewlyCreated* - SASDIFSV [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}] "c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP . Contents of the 'Scheduled Tasks' folder 2009-09-06 c:\windows\Tasks\avast! Antivirus.job - d:\program files\Alwil Software\Avast4\ashQuick.exe [2009-08-30 16:02] 2009-09-04 c:\windows\Tasks\diskdefrag.job - d:\program files\Auslogics\AusLogics Disk Defrag\diskdefrag.exe [2009-05-09 20:51] 2009-09-06 c:\windows\Tasks\Google Software Updater.job - c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-04-30 23:44] 2009-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 23:45] 2009-09-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job - c:\program files\Google\Update\GoogleUpdate.exe [2009-08-10 23:45] 2009-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1220945662-682003330-1003Core.job - c:\documents and settings\Bebanito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-05 17:51] 2009-09-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-299502267-1220945662-682003330-1003UA.job - c:\documents and settings\Bebanito\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-05 17:51] 2009-09-04 c:\windows\Tasks\RegCure Program Check.job - d:\program files\RegCure\RegCure.exe [2007-08-02 17:14] 2009-09-04 c:\windows\Tasks\RegCure.job - d:\program files\RegCure\RegCure.exe [2007-08-02 17:14] 2009-09-04 c:\windows\Tasks\regdefrag.job - d:\program files\Auslogics\AusLogics Registry Defrag\regdefrag.exe [2009-05-09 19:43] 2009-09-04 c:\windows\Tasks\User_Feed_Synchronization-{7512D86B-5D76-4430-8A61-506BD4001F28}.job - c:\windows\system32\msfeedssync.exe [2009-03-08 11:31] 2009-09-06 c:\windows\Tasks\WGASetup.job - c:\windows\system32\KB905474\wgasetup.exe [2009-05-03 05:18] . - - - - ORPHANS REMOVED - - - - ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://ca.yahoo.com uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&xport to Microsoft Excel - d:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Bebanito\Application Data\Mozilla\Firefox\Profiles\6pfr9rf8.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com FF - component: c:\documents and settings\Bebanito\Application Data\Mozilla\Firefox\Profiles\6pfr9rf8.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll FF - plugin: c:\documents and settings\Bebanito\Application Data\Mozilla\plugins\npgoogletalk.dll FF - plugin: c:\documents and settings\Bebanito\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: c:\program files\Google\Google Updater\2.4.1636.7222\npCIDetect13.dll FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: d:\program files\Adobe\Reader\Browser\nppdf32.dll FF - plugin: d:\program files\DivX\DivX Player\npDivxPlayerPlugin.dll FF - plugin: d:\program files\DivX\DivX Web Player\npdivx32.dll FF - plugin: d:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF - plugin: d:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin2.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin3.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin4.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin5.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin6.dll FF - plugin: d:\program files\QuickTime\Plugins\npqtplugin7.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ ---- FIREFOX POLICIES ---- FF - user.js: yahoo.homepage.dontask - true. ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-06 10:17 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(692) c:\program files\SUPERAntiSpyware\SASWINLO.dll c:\windows\system32\WININET.dll c:\windows\system32\Ati2evxx.dll - - - - - - - > 'explorer.exe'(2884) c:\windows\system32\WININET.dll c:\windows\system32\ieframe.dll c:\windows\system32\webcheck.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe d:\program files\Alwil Software\Avast4\aswUpdSv.exe d:\program files\Alwil Software\Avast4\ashServ.exe c:\windows\system32\ati2evxx.exe d:\program files\Java\jre6\bin\jqs.exe c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE d:\program files\softex\WinRoute.exe c:\program files\Brother\ControlCenter3\BrccMCtl.exe c:\program files\Brother\Brmfcmon\BrMfcMon.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2009-09-06 10:22 - machine was rebooted ComboFix-quarantined-files.txt 2009-09-06 14:22 ComboFix2.txt 2009-09-04 02:02 Pre-Run: 22,521,020,416 bytes free Post-Run: 22,573,027,328 bytes free 264 --- E O F --- 2009-09-02 09:25