ComboFix 08-10-14.07 - psce 2008-10-15 19:17:02.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1256.966.1033.18.542 [GMT 0:00]
Running from: C:\Documents and Settings\psce\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-09-15 to 2008-10-15 )))))))))))))))))))))))))))))))
.
2008-10-15 04:18 . 2008-10-15 04:18 <DIR> d-------- C:\Program Files\Alwil Software
2008-10-15 02:52 . 2008-10-15 02:52 <DIR> d-------- C:\Sandbox
2008-10-15 02:52 . 2008-10-15 02:52 <DIR> d-------- C:\Program Files\Sandboxie
2008-10-15 02:52 . 2008-10-15 04:04 1,422 --a------ C:\WINDOWS\Sandboxie.ini
2008-10-14 08:34 . 2008-10-14 08:34 <DIR> d-------- C:\Program Files\CCleaner
2008-10-14 03:12 . 2008-10-14 03:18 <DIR> d-------- C:\Documents and Settings\psce\.housecall6.6
2008-10-14 01:38 . 2008-10-14 01:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-10-14 01:36 . 2008-10-15 04:00 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-10-14 01:36 . 2008-10-15 04:00 <DIR> d-------- C:\Documents and Settings\psce\Application Data\SUPERAntiSpyware.com
2008-10-14 01:23 . 2008-10-14 01:23 <DIR> d-------- C:\Documents and Settings\Administrator
2008-10-09 07:15 . 2008-10-09 07:19 <DIR> d-------- C:\Program Files\Any Video Converter Professional
2008-10-09 07:08 . 2008-10-09 07:08 0 --a------ C:\WINDOWS\MovieEdit.INI
2008-10-09 07:04 . 2008-10-09 07:04 <DIR> d-------- C:\movies
2008-10-09 06:45 . 2008-10-09 06:45 <DIR> d-------- C:\Program Files\OJOsoft
2008-10-09 06:45 . 2008-10-09 06:45 <DIR> d-------- C:\Program Files\Common Files\Common Share
2008-10-09 06:36 . 2008-10-09 06:36 <DIR> d-------- C:\videooutput
2008-10-09 06:36 . 2008-10-09 06:36 <DIR> d-------- C:\Program Files\Smallvideosoft
2008-10-09 06:36 . 2007-02-25 15:36 383,238 --a------ C:\WINDOWS\system32\libmp3lame-0.dll
2008-10-06 02:52 . 2008-10-06 02:52 109,248 --a------ C:\WINDOWS\system32\BB
2008-10-06 02:51 . 2008-10-14 03:40 <DIR> d--hs---- C:\WINDOWS\Crystal
2008-10-06 02:51 . 2008-10-06 02:52 536,540 --a------ C:\WINDOWS\V-DCW-v-sids.db-v-key.db-Softcam.key-MCT-Privatespice-FILMNET-POLSAT_Rai_Fix_Cyfra_Fix_Polsat_Fix_DreamTV-07-10-2008.exe
2008-10-04 06:08 . 2008-10-08 06:30 <DIR> d-------- C:\Program Files\KeyUpdater
2008-09-30 05:06 . 2008-09-30 05:06 79 --a------ C:\WINDOWS\Serial.ini
2008-09-23 03:25 . 2008-09-23 03:33 <DIR> d-------- C:\Documents and Settings\psce\Application Data\mIRC
2008-09-22 02:35 . 2008-10-08 06:22 <DIR> d-------- C:\Program Files\DNA
2008-09-21 03:49 . 2008-09-21 03:49 100 --a------ C:\WINDOWS\SwLoader.INI
2008-09-18 08:44 . 2008-10-14 02:24 <DIR> d-------- C:\QUARANTINE
2008-09-15 03:00 . 2008-09-15 03:00 <DIR> d-------- C:\Program Files\MSXML 4.0
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-15 19:18 --------- d-----w C:\Documents and Settings\psce\Application Data\DMCache
2008-10-15 19:17 --------- d-----w C:\Documents and Settings\psce\Application Data\uTorrent
2008-10-15 14:51 --------- d-----w C:\Documents and Settings\psce\Application Data\TeraCopy
2008-10-15 14:50 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-15 12:01 --------- d-----w C:\Program Files\Power Mp3 Cutter(Mp3 Sound Cutter)
2008-10-15 04:00 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-10-15 03:05 102,400 ------w C:\WINDOWS\msapps\csrss.exe
2008-10-14 08:32 2,444 ----a-w C:\WINDOWS\system32\tmp.reg
2008-10-14 03:40 --------- d-----w C:\Documents and Settings\psce\Application Data\License32Support
2008-10-14 03:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2008-10-14 03:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-10-13 22:22 --------- d-----w C:\Program Files\Opera
2008-10-11 00:33 --------- d-----w C:\Documents and Settings\psce\Application Data\Skype
2008-10-09 07:03 --------- d-----w C:\Program Files\Total Video Converter
2008-10-08 15:02 --------- d-----w C:\Program Files\Google
2008-10-08 07:11 --------- d-----w C:\Program Files\Deskshare
2008-10-08 07:08 --------- d-----w C:\Program Files\RM-to-MP3-Converter
2008-10-08 06:57 --------- d-----w C:\Documents and Settings\psce\Application Data\MakeUpPilot
2008-10-08 06:46 --------- d-----w C:\Program Files\MathType
2008-10-08 06:32 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-08 06:32 --------- d-----w C:\Documents and Settings\psce\Application Data\COWON
2008-10-08 06:19 --------- d-----w C:\Program Files\Common Files\BitCtrl
2008-10-08 06:18 --------- d-----w C:\Program Files\Common Files\AVSMedia
2008-10-08 06:10 --------- d-----w C:\Program Files\3D-FTP
2008-10-08 05:47 --------- d-----w C:\Documents and Settings\psce\Application Data\IDM
2008-10-08 05:37 114,688 ----a-w C:\WINDOWS\system32\wmatimer.dll
2008-10-08 04:51 --------- d-----w C:\Documents and Settings\psce\Application Data\Thinstall
2008-10-06 02:52 20,480 ----a-w C:\WINDOWS\Cursors\lsass.exe
2008-09-21 19:51 --------- d-----w C:\Program Files\Circle Developement
2008-09-17 00:29 --------- d-----w C:\Program Files\Universal Teacher
2008-09-16 03:17 --------- d-----w C:\Program Files\CyberLink
2008-09-16 03:17 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-09-16 03:15 --------- d-----w C:\Program Files\eMule
2008-09-16 03:14 --------- d-----w C:\Program Files\Ease123 Video Watermarker
2008-09-14 08:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\AVS4YOU
2008-09-14 03:50 --------- d-----w C:\Program Files\Common Files\MAGIX Shared
2008-09-14 03:49 --------- d-----w C:\Program Files\MAGIX
2008-09-14 03:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\MAGIX
2008-09-14 02:15 --------- d-----w C:\Documents and Settings\psce\Application Data\AVSMedia
2008-09-14 01:51 --------- d-----w C:\Program Files\AVSMedia
2008-09-13 21:37 --------- d-----w C:\Program Files\Power Video Converter
2008-09-09 21:43 --------- d-----w C:\Program Files\QuickTime
2008-09-06 02:19 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-09-05 05:15 --------- d-----w C:\Program Files\LeapFTP
2008-09-02 21:27 --------- d-----w C:\Program Files\MozBackup
2008-08-27 15:30 --------- d-----w C:\Program Files\RM to MP3 Converter
2008-08-21 11:43 --------- d-----w C:\Documents and Settings\psce\Application Data\CyberLink
2008-08-19 03:01 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-08-08 19:06 356,352 ----a-w C:\WINDOWS\eSellerateEngine.dll
2008-07-18 22:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 22:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 22:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 22:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 22:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 22:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 22:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 22:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 22:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 22:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
.
((((((((((((((((((((((((((((( snapshot@2008-10-14_ 4.08.48.37 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-10-15 02:52:16 439,775 ----a-w C:\WINDOWS\Installer\SandboxieInstall.exe
+ 2008-10-15 04:02:38 65,536 ----a-w C:\WINDOWS\PeerNet\svchost.exe
+ 2008-07-19 14:43:08 1,163,960 ----a-w C:\WINDOWS\system32\aswBoot.exe
+ 2008-07-19 14:30:53 94,392 ----a-w C:\WINDOWS\system32\AvastSS.scr
+ 2008-07-19 14:32:15 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
+ 2008-07-19 14:37:42 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys
+ 2008-01-17 17:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
+ 2008-07-19 14:37:21 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
+ 2008-07-19 14:33:42 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
+ 2008-07-19 14:35:18 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys
+ 2008-07-19 14:32:36 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
+ 2008-10-15 04:58:51 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_628.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 15360]
"IDMan"="C:\Documents and Settings\Default User\Local Settings\Temp\bh11ySa6d\IDMan.exe" [2008-11-05 2561456]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"NGrabLite"="C:\Program Files\NgrabLite\NGrabLite.exe" [2006-03-21 118784]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"uTorrent"="C:\Program Files\uTorrent\uTorrent.exe" [2008-04-06 219952]
"SandboxieControl"="C:\Program Files\Sandboxie\SbieCtrl.exe" [2008-09-02 716800]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-09 413696]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 78008]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2007-06-15 C:\WINDOWS\SkyTel.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
aboal7roof.lnk - C:\Program Files\aboal7roof\aboal7roof.exe [2008-08-10 776704]
SnagIt 9.lnk - C:\Program Files\TechSmith\SnagIt 9\SnagIt32.exe [2008-05-15 6822728]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe"
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
"igfxhkcmd"=C:\WINDOWS\system32\hkcmd.exe
"igfxtray"=C:\WINDOWS\system32\igfxtray.exe
"igfxpers"=C:\WINDOWS\system32\igfxpers.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Relook PCEditor\\PCEditor.exe"=
"C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"C:\\Program Files\\NgrabLite\\NGrabLite.exe"=
"C:\\Program Files\\LeapFTP\\LeapFTP.exe"=
"C:\\Program Files\\Opera\\opera.exe"=
"C:\\WINDOWS\\Crystal\\smss.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\WINDOWS\\msapps\\csrss.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"21:UDP"= 21:UDP
"443:TCP"= 443:TCP
oVoo TCP المنفذ 443
"443:UDP"= 443:UDP
oVoo UDP المنفذ 443
"37674:TCP"= 37674:TCP
oVoo TCP المنفذ 37674
"37674:UDP"= 37674:UDP
oVoo UDP المنفذ 37674
"37675:UDP"= 37675:UDP
oVoo UDP المنفذ 37675
"1034:TCP"= 1034:TCP:f
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2004-08-03 14336]
R3 SbieDrv;SbieDrv;C:\Program Files\Sandboxie\SbieDrv.sys [2008-09-02 100352]
S2 htuad;Transaction Coordinator;C:\WINDOWS\msapps\csrss.exe [2008-10-15 102400]
S2 stuad;Transaction Coordinator;C:\WINDOWS\Crystal\smss.exe [2008-10-14 77824]
S2 ztuad;Transaction Coordinator;C:\WINDOWS\Cursors\lsass.exe [2008-10-06 20480]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-07-13 355584]
S4 Stormser;Stormser;C:\PROGRA~1\RINGZS~1\STORMC~1\Stormser.exe [2008-06-20 991232]
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\b.com
\Shell\explore\Command - J:\b.com
\Shell\open\Command - J:\b.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\O]
\Shell\AutoRun\command - taqhptr.bat
\Shell\explore\Command - taqhptr.bat
\Shell\open\Command - taqhptr.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{829153db-7512-11dd-a852-001d7d37bcc1}]
\Shell\AutoRun\command - M:\System\DriveGuard\DriveProtect.exe -run
\Shell\Explore\Command - M:\System\DriveGuard\DriveProtect.exe -run
\Shell\Open\Command - M:\System\DriveGuard\DriveProtect.exe -run
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{829153f2-7512-11dd-a852-001d7d37bcc1}]
\Shell\AutoRun\command - M:\qxbx9blb.com
\Shell\explore\Command - M:\qxbx9blb.com
\Shell\open\Command - M:\qxbx9blb.com
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{960114da-2900-11dd-a825-001d7d37bcc1}]
\Shell\AutoRun\command - taqhptr.bat
\Shell\explore\Command - taqhptr.bat
\Shell\open\Command - taqhptr.bat
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df40e2f2-84e1-11dd-a858-001d7d37bcc1}]
\Shell\AutoRun\command - M:\uis.com
\Shell\explore\Command - M:\uis.com
\Shell\open\Command - M:\uis.com
*Newly Created Service* - AAVMKER4
*Newly Created Service* - ASWFSBLK
*Newly Created Service* - ASWMON2
*Newly Created Service* - ASWRDR
*Newly Created Service* - ASWSP
*Newly Created Service* - ASWTDI
*Newly Created Service* - ASWUPDSV
*Newly Created Service* - AVAST!_ANTIVIRUS
*Newly Created Service* - AVAST!_MAIL_SCANNER
*Newly Created Service* - AVAST!_WEB_SCANNER
.
s of the 'Scheduled Tasks' folder
2008-10-15 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:09]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\psce\Application Data\Mozilla\Firefox\Profiles\plmhcdnb.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - about:blank
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.
.
------- File Associations -------
.
txtfile=NOTEPAD %1
vbefile\shell\edit\command=C:\WINDOWS\Notepad.exe %1
vbsfile\shell\edit\command=C:\WINDOWS\Notepad.exe %1
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-10-15 19:18:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-10-15 19:19:49
ComboFix-quarantined-files.txt 2008-10-15 19:19:37
ComboFix2.txt 2008-10-15 04:11:47
ComboFix3.txt 2008-10-14 04:24:56
ComboFix4.txt 2008-10-14 04:09:39
Pre-Run: 6,129,364,992 bytes free
Post-Run: 6,116,859,904 bytes free
271 --- E O F --- 2008-10-15 03:00:54
