ComboFix 09-05-07.06 - Owner 05/07/2009 17:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.254.90 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: AVG Anti-Virus *On-access scanning disabled* (Updated)
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\nfr.assembly
c:\windows\system32\pakbvqe.dll . . . . failed to delete
Infected copy of c:\windows\system32\drivers\ndis.sys was found and disinfected
Restored copy from - The cat ate it .
((((((((((((((((((((((((( Files Created from 2009-04-07 to 2009-05-07 )))))))))))))))))))))))))))))))
.
2009-05-06 17:44 . 2009-05-06 17:44 -------- d-----w c:\windows\Cache
2009-05-06 17:44 . 2009-05-06 17:44 -------- d-----w c:\program files\Coupons
2009-05-03 04:14 . 2009-05-03 04:14 -------- d-----w c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com
2009-05-03 04:00 . 2009-05-07 20:33 -------- d--h--w C:\$AVG8.VAULT$
2009-05-03 03:21 . 2009-05-03 03:21 -------- d-----w C:\VundoFix Backups
2009-05-03 02:44 . 2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-03 02:44 . 2009-05-03 02:44 12552 ----a-w c:\windows\system32\drivers\avgrkx86.sys
2009-05-03 02:44 . 2009-05-03 02:44 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-03 02:43 . 2009-05-03 02:43 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-03 02:43 . 2009-05-07 21:28 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-03 02:41 . 2009-05-03 02:41 -------- d-----w c:\program files\AVG
2009-05-03 02:41 . 2009-05-07 20:41 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-03 02:32 . 2009-05-03 02:32 -------- d-----w c:\documents and settings\Owner\Application Data\GetRightToGo
2009-05-03 01:22 . 2009-05-03 01:22 -------- d-----w c:\windows\CD95F661A5C444F5A6AAECDD91C240B5.TMP
2009-05-03 00:11 . 2009-05-03 00:11 -------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\Owner\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-04-06 19:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 23:29 . 2009-04-06 19:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-02 23:26 . 2009-05-02 23:26 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:26 -------- d-----w c:\program files\SUPERAntiSpyware
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\documents and settings\Owner\Application Data\SUPERAntiSpyware.com
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-02 23:25 . 2009-05-02 23:25 -------- d-----w c:\program files\CCleaner
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Application Data\nwhkuejs
2009-05-02 22:20 . 2009-05-02 22:20 -------- d-----w c:\documents and settings\Owner\Local Settings\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Application Data\nwhkuejs
2009-04-27 16:32 . 2009-04-27 16:32 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\nwhkuejs
2009-04-17 11:54 . 2009-03-06 14:44 283648 -c----w c:\windows\system32\dllcache\pdh.dll
2009-04-17 11:54 . 2005-07-26 04:39 60416 -c----w c:\windows\system32\dllcache\colbact.dll
2009-04-17 11:54 . 2009-02-09 10:20 399360 -c----w c:\windows\system32\dllcache\rpcss.dll
2009-04-17 11:54 . 2009-02-06 17:14 110592 -c----w c:\windows\system32\dllcache\services.exe
2009-04-17 11:54 . 2009-02-09 10:20 473088 -c----w c:\windows\system32\dllcache\fastprox.dll
2009-04-17 11:54 . 2009-02-06 16:39 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-17 11:54 . 2009-02-09 10:20 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-17 11:54 . 2009-02-09 10:20 616960 -c----w c:\windows\system32\dllcache\advapi32.dll
2009-04-17 11:54 . 2009-02-09 10:20 714752 -c----w c:\windows\system32\dllcache\ntdll.dll
2009-04-17 11:54 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-12 02:30 . 2009-04-12 02:30 -------- d-----w c:\program files\Google
2009-04-12 02:30 . 2009-04-12 17:07 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-12 02:29 . 2009-04-12 17:07 -------- d-----w c:\program files\NOS
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-07 21:42 . 2002-09-03 16:50 104448 ----a-w c:\windows\system32\mouizhu.dll
2009-05-07 21:37 . 2002-09-03 16:47 182912 ----a-w c:\windows\system32\drivers\ndis.sys
2009-03-29 18:23 . 2007-05-26 04:51 -------- d-----w c:\program files\QUICKENW
2009-03-06 14:44 . 2002-09-03 16:51 283648 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 15:33 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 10:20 . 2005-07-26 04:31 399360 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 10:20 . 2002-09-03 16:39 723456 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 10:20 . 2002-09-03 16:49 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 10:20 . 2002-09-03 16:27 616960 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 10:19 . 2002-09-03 17:11 1846272 ----a-w c:\windows\system32\win32k.sys
2002-09-03 17:07 . 2002-09-03 17:07 94784 --sh--w c:\windows\twain.dll
2004-08-04 07:56 . 2002-09-03 17:07 50688 --sh--w c:\windows\twain_32.dll
2004-08-04 07:56 . 2002-09-03 16:41 1028096 --sh--w c:\windows\system32\mfc42.dll
2004-08-04 07:56 . 2002-09-03 16:46 54784 --sh--w c:\windows\system32\msvcirt.dll
2004-08-04 07:56 . 2002-09-03 16:46 413696 --sh--w c:\windows\system32\msvcp60.dll
2004-08-04 07:56 . 2002-09-03 16:46 343040 --sh--w c:\windows\system32\msvcrt.dll
2007-12-04 18:38 . 2002-09-03 16:51 550912 --sh--w c:\windows\system32\oleaut32.dll
2004-08-04 07:56 . 2002-09-03 16:51 83456 --sh--w c:\windows\system32\olepro32.dll
2004-08-04 07:56 . 2002-09-03 16:56 11776 --sh--w c:\windows\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7B13B443-BEC9-4942-ABE3-6C9028587E08}]
2002-09-03 16:50 104448 ----a-w c:\windows\system32\pakbvqe.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-01-13 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-01-13 114688]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-03 1947928]
"BCMSMMSG"="BCMSMMSG.exe" - c:\windows\BCMSMMSG.exe [2003-08-29 122880]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HPAiODevice(hp psc 900 series) - 1.lnk - c:\program files\Hewlett-Packard\AiO\hp psc 900 series\Bin\hpobrt07.exe [2002-9-26 487484]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-03 02:44 11952 ----a-w c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dgkkchch]
2002-09-03 16:50 104448 ----a-w c:\windows\system32\pakbvqe.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgam.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"39453:TCP"= 39453:TCP:@xpsp2res.dll,-22009
R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [5/2/2009 10:44 PM 12552]
R0 xysxbauo;xysxbauo;c:\windows\system32\drivers\xysxbauo.sys [9/3/2002 12:50 PM 23424]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/2/2009 10:43 PM 325896]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/2/2009 10:44 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/2/2009 10:41 PM 298776]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]
--- Other Services/Drivers In Memory ---
*Deregistered* - MDM
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - PolicyAgent
*Deregistered* - ProtectedStorage
*Deregistered* - RasMan
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - seclogon
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - srservice
*Deregistered* - SSDPSRV
*Deregistered* - stisvc
*Deregistered* - TapiSrv
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - W32Time
*Deregistered* - WebClient
*Deregistered* - winmgmt
*Deregistered* - wscsvc
*Deregistered* - wuauserv
*Deregistered* - WZCSVC
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
kzjaxcqp
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.charter.net/index.php
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;
uInternet Settings,ProxyServer = http=localhost:7171
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-07 17:45
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(660)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\progra~1\AVG\AVG8\avgam.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\progra~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hposts07.exe
c:\program files\Hewlett-Packard\AiO\Shared\Bin\hpofxm07.exe
.
**************************************************************************
.
Completion time: 2009-05-07 17:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-07 21:51
Pre-Run: 51,788,951,552 bytes free
Post-Run: 51,960,651,776 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
214 --- E O F --- 2009-04-29 23:26