ComboFix 08-03-18.1 - Administrator 03/19/2008 14:56:07.1 -
FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1256.1.1033.18.21 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\Zyzoom_KAV7.0.0.180_19.03.2008_11-25_With_ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\
037589.log
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr0.dat
C:\DOCUME~1\ALLUSE~1\APPLIC~1\Microsoft\Network\Downloader\qmgr1.dat
C:\lsass.exe.50984.exe
C:\lsass.exe.51000.exe
C:\lsass.exe.94531.exe
C:\windows\linkinfo.dll
C:\windows\system32\48219.log
C:\windows\system32\com\lsass.exe
C:\windows\system32\com\netcfg.000
C:\windows\system32\com\netcfg.dll
C:\windows\system32\com\smss.exe
C:\windows\system32\dnsq.dll
C:\windows\system32\drivers\cdralw.sys
C:\windows\system32\drivers\npf.sys
C:\windows\system32\packet.dll
C:\windows\system32\pthreadVC.dll
C:\windows\system32\wpcap.dll
----- BITS: Possible infected sites -----
hxxp://download.microsoft.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_CDRALW
-------\Legacy_NPF
-------\Service_cdralw
-------\Service_NPF
((((((((((((((((((((((((( Files Created from 2008-02-19 to 2008-03-19 )))))))))))))))))))))))))))))))
.
No new files created in this timespan
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-19 12:51 18,048 ----a-w C:\windows\system32\drivers\eth8023.sys
2008-03-19 12:23 9,728 ----a-w C:\windows\AppPatch\AcSpecf.dll
2008-03-19 12:23 27,136 ----a-w C:\windows\AppPatch\AcPlugin.dll
2008-03-19 11:53 18,829 ----a-w C:\windows\system32\drivers\alg.exe
2008-03-19 11:53 154,112 --sh--w C:\windows\system32\AntiTool.exe
2008-03-19 11:23 --------- d-----w C:\Documents and Settings\Administrator\Application Data\IDM
2008-03-19 11:23 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DMCache
2008-03-19 11:02 --------- d-----w C:\Program Files\XP TCPIP Repair
2008-03-19 10:49 --------- d-----w C:\Program Files\IObit
2008-03-19 10:28 94,208 --sh--w C:\pagefile.pif
2008-03-18 17:49 1,386,496 ----a-w C:\windows\system32\MSVBVM60.DLL
2008-03-18 16:49 --------- d-----w C:\Program Files\MSXML 6.0
2008-03-18 16:44 94,208 ----a-w C:\~.exe.193468.exe
2008-03-18 16:44 94,208 ----a-w C:\~.exe.17656.exe
2008-03-18 16:44 94,208 ----a-w C:\~.exe.17468.exe
2008-03-18 16:44 94,208 ----a-w C:\~.exe.16921.exe
2008-03-18 16:44 94,208 ----a-w C:\~.exe.16500.exe
2008-03-18 16:43 94,208 ----a-w C:\~.exe.371140.exe
2008-03-14 11:39 --------- d-----w C:\Program Files\Fantasy Codecs
2008-03-13 11:53 --------- d-----w C:\Program Files\Common Files\Real
2008-03-13 11:53 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple Computer
2008-03-10 10:06 --------- d-----w C:\Program Files\Kaspersky Lab
2008-03-08 06:38 --------- d-----w C:\DOCUME~1\ALLUSE~1\APPLIC~1\Yahoo!
2008-03-08 06:36 --------- d-----w C:\Program Files\Yahoo!
2008-03-07 12:19 --------- d-----w C:\Program Files\NFR
2008-03-07 12:16 --------- d-----w C:\Program Files\iKnowPS
2008-03-07 05:55 --------- d-----w C:\Program Files\Unlocker
2008-03-06 19:25 --------- d-----w C:\Program Files\Registry Compressor
2008-03-06 19:16 --------- d-----w C:\Program Files\Registry Fast
2008-03-06 19:15 --------- d-----w C:\Program Files\NoCUT
2008-03-06 15:03 --------- d-----w C:\Program Files\Error Repair Professional
2008-03-04 16:31 --------- d-----w C:\Program Files\Internet Download Manager
2008-03-04 15:45 --------- d-----w C:\Program Files\Save Flash
2008-03-04 15:02 --------- d-----w C:\Program Files\Google
2008-03-04 14:53 --------- d-----w C:\Program Files\Winamp
2008-03-04 14:40 --------- d-----w C:\Program Files\Ringz Studio
2008-03-04 14:17 --------- d-----w C:\Program Files\microsoft frontpage
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\windows\system32\ctfmon.exe" [08/04/2004 12:00 PM 15360]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM 4670704]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [03/09/2008 01:14 PM 68856]
"IDMan"="C:\Program Files\Internet Download Manager\IDMan.exe" [03/04/2008 06:31 PM 932864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemInit"="" []
"Karen"="" []
"startIE"="" []
"raVe"="" []
"Win32BaseServiceMOD"="" []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"raVe"="" []
"Driver32"="" []
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [08/04/2004 12:00 PM 15360]
[HKEY_LOCAL_MACHINE\Software\microsoft\windows\currentversion\run_CF]
"SystemInit"=""
"Karen"=""
"raVe"=""
"Win32BaseServiceMOD"=""
"startIE"=""
[HKEY_USERS\s-1-5-21-343818398-1409082233-725345543-500\software\microsoft\windows\currentversion\run_CF]
"CTFMON.EXE"="C:\\windows\\system32\\ctfmon.exe"
"Yahoo! Pager"="\"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\YAHOOM~1.EXE\" -quiet"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"IDMan"="C:\\Program Files\\Internet Download Manager\\IDMan.exe /onboot"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"= 0 (0x0)
"NoDispScrSavPage"= 0 (0x0)
"NoDispSettingsPage"= 0 (0x0)
"NoConfigPage"= 0 (0x0)
"NoDevMgrPage"= 0 (0x0)
"NoFileSysPage"= 0 (0x0)
"NoVirtMemPage"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"NoFolderOptions"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"= 0 (0x0)
"NoFind"= 0 (0x0)
"NoRun"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa]
antiwpa.dll 07/22/2006 11:49 PM 5376 C:\WINDOWS\system32\antiwpa.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli scecli scecli scecli scecli scecli scecli scecli scecli scecli scecli
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IDMan]
--a------ 03/04/2008 06:31 PM 932864 C:\Program Files\Internet Download Manager\IDMan.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 03/09/2008 01:14 PM 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 04/05/2007 07:45 PM 35328 C:\Program Files\Winamp\winampa.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
R2 NoCUT;NoCUT;"C:\WINDOWS\system32\NoCUT.exe" [03/29/2006 03:13 AM]
S3 eth8023;eth8023;C:\windows\system32\drivers\eth8023.sys [03/19/2008 02:51 PM]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-03-19 14:59:56
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\cdralw]
"ImagePath"="system32\DRIVERS\nvmini.sys"
--
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NPF]
"ImagePath"="system32\drivers\npf.sys"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\windows\explorer.exe
-> C:\Program Files\WinRAR\rarext.dll
.
------------------------ Other Running Processes ------------------------
.
C:\windows\system32\wscntfy.exe
C:\Program Files\Internet Download Manager\IEMonitor.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\zxsaw1\runzz.exe
.
**************************************************************************
.
Completion time: 03/19/2008 15:01:21 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-19 13:01:14