ComboFix 09-03-03.01 - ******** 2009-03-04 13:56:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.656 [GMT -5:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\**********\Application Data\MSWWINEDRVM7.DLL c:\windows\Downloaded Program Files\MyWebEx c:\windows\Downloaded Program Files\MyWebEx\419\atarm.dll c:\windows\Downloaded Program Files\MyWebEx\419\atas32.dll c:\windows\Downloaded Program Files\MyWebEx\419\atasanot.exe c:\windows\Downloaded Program Files\MyWebEx\419\atasctrl.dll c:\windows\Downloaded Program Files\MyWebEx\419\atasnt40.dll c:\windows\Downloaded Program Files\MyWebEx\419\atcarmcl.dll c:\windows\Downloaded Program Files\MyWebEx\419\atdl2006.dll c:\windows\Downloaded Program Files\MyWebEx\419\atjpeg60.dll c:\windows\Downloaded Program Files\MyWebEx\419\atkbctl.dll c:\windows\Downloaded Program Files\MyWebEx\419\atlchat.dll c:\windows\Downloaded Program Files\MyWebEx\419\atmemmgr.dll c:\windows\Downloaded Program Files\MyWebEx\419\atnetext.dll c:\windows\Downloaded Program Files\MyWebEx\419\atpack.dll c:\windows\Downloaded Program Files\MyWebEx\419\atres.dll c:\windows\Downloaded Program Files\MyWebEx\419\attp.dll c:\windows\Downloaded Program Files\MyWebEx\419\atwbxui6.dll c:\windows\Downloaded Program Files\MyWebEx\419\h264dec.dll c:\windows\Downloaded Program Files\MyWebEx\419\h264enc.dll c:\windows\Downloaded Program Files\MyWebEx\419\ieatgpc.dll c:\windows\Downloaded Program Files\MyWebEx\419\mmssl32.dll c:\windows\Downloaded Program Files\MyWebEx\419\msess.dll c:\windows\Downloaded Program Files\MyWebEx\419\mticket.dll c:\windows\Downloaded Program Files\MyWebEx\419\mutiltpd.dll c:\windows\Downloaded Program Files\MyWebEx\419\mvc.dll c:\windows\Downloaded Program Files\MyWebEx\419\mwm.ini c:\windows\Downloaded Program Files\MyWebEx\419\mwmcliun.exe c:\windows\Downloaded Program Files\MyWebEx\419\mwmproxy.dll c:\windows\Downloaded Program Files\MyWebEx\419\mwmres.dll c:\windows\Downloaded Program Files\MyWebEx\419\mwmtrace.txt c:\windows\Downloaded Program Files\MyWebEx\419\mwmupd.exe c:\windows\Downloaded Program Files\MyWebEx\419\ratrace.dll c:\windows\Downloaded Program Files\MyWebEx\419\raurl.dll c:\windows\Downloaded Program Files\MyWebEx\419\uilibres.dll c:\windows\Downloaded Program Files\MyWebEx\419\wbxcrypt.dll c:\windows\Downloaded Program Files\MyWebEx\419\webexmgr.dll c:\windows\system32\aIPYcfii.ini c:\windows\system32\hNpYaccf.ini c:\windows\system32\mdm.exe c:\windows\system32\x13 c:\windows\system32\Z55 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_seneka ((((((((((((((((((((((((( Files Created from 2009-02-04 to 2009-03-04 ))))))))))))))))))))))))))))))) . 2009-03-02 10:52 . 2009-03-02 10:52 250 --a------ c:\windows\gmer.ini 2009-03-02 10:17 . 2009-03-02 10:20 d-------- C:\GRAPHPAP 2009-02-24 22:04 . 2009-01-09 14:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat 2009-02-22 16:03 . 2009-02-22 16:02 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-09 13:46 . 2009-02-09 13:46 d-------- c:\program files\Trend Micro 2009-02-08 14:00 . 2009-02-14 09:40 d-------- c:\program files\Malwarebytes' Anti-Malware 2009-02-08 14:00 . 2009-02-08 14:00 d-------- c:\documents and settings\Amit Cholkar\Application Data\Malwarebytes 2009-02-08 14:00 . 2009-02-08 14:00 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-08 14:00 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-08 14:00 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys 2009-02-08 12:46 . 2009-02-23 15:10 d-------- c:\program files\Spybot - Search & Destroy 2009-02-08 10:39 . 2009-02-08 10:39 d-------- c:\windows\system32\XPSViewer 2009-02-08 10:39 . 2009-02-08 10:39 d-------- c:\program files\Reference Assemblies 2009-02-08 10:39 . 2009-02-08 10:39 d-------- c:\program files\MSBuild 2009-02-08 10:38 . 2009-02-08 10:38 d-------- C:\d490a21c921a8415de7d5a175f 2009-02-08 10:38 . 2008-07-06 07:06 1,676,288 --a------ c:\windows\system32\xpssvcs.dll 2009-02-08 10:38 . 2008-07-06 07:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll 2009-02-08 10:38 . 2008-07-06 05:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe 2009-02-08 10:38 . 2008-07-06 07:06 575,488 --a------ c:\windows\system32\xpsshhdr.dll 2009-02-08 10:38 . 2008-07-06 07:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll 2009-02-08 10:38 . 2008-07-06 07:06 117,760 --a------ c:\windows\system32\prntvpt.dll 2009-02-08 10:38 . 2008-07-06 07:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll 2009-02-07 10:19 . 2009-02-07 10:19 d-------- c:\temp\sTMP3 2009-02-07 10:19 . 2009-02-08 13:44 d-------- C:\Temp . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-28 15:39 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-02-22 21:02 --------- d-----w c:\program files\Java 2009-02-09 17:33 --------- d-----w c:\program files\SUPERAntiSpyware 2009-02-09 17:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-09 17:33 --------- d-----w c:\documents and settings\******\Application Data\SUPERAntiSpyware.com 2009-02-08 16:17 --------- d-----w c:\program files\CCleaner 2009-01-29 02:13 --------- d-----w c:\program files\McAfee 2009-01-28 19:13 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-01-28 19:07 --------- d-----w c:\program files\Common Files\McAfee 2009-01-28 19:06 --------- d-----w c:\program files\McAfee.com 2009-01-28 18:48 --------- d-----w c:\documents and settings\All Users\Application Data\Network Associates 2009-01-28 18:10 --------- d-----w c:\program files\MATLAB 2009-01-10 18:08 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-12-07 16:37 17 ----a-w c:\program files\stinger10000457.opt 2008-12-07 14:30 2,747,911 ----a-w c:\program files\stinger10000457.exe 1998-12-08 18:53 99,840 -c--a-w c:\program files\Common Files\IRAABOUT.DLL 1998-12-08 18:53 70,144 -c--a-w c:\program files\Common Files\IRAMDMTR.DLL 1998-12-08 18:53 48,640 -c--a-w c:\program files\Common Files\IRALPTTR.DLL 1998-12-08 18:53 31,744 -c--a-w c:\program files\Common Files\IRAWEBTR.DLL 1998-12-08 18:53 186,368 -c--a-w c:\program files\Common Files\IRAREG.DLL 1998-12-08 18:53 17,920 -c--a-w c:\program files\Common Files\IRASRIAL.DLL 2008-05-15 18:46 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051520080516\index.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "i8kfangui"="c:\program files\I8kfanGUI\I8kfanGUI.exe" [2006-11-30 847872] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-11-07 294912] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-22 136600] "AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 684032] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "AS00_Gear511"="c:\program files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412] "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe] "PCTVOICE"="pctspk.exe" [2003-02-24 c:\windows\system32\pctspk.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 45568] Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe [2007-04-22 40960] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R1 fanio;FanIO driver;c:\windows\system32\drivers\fanio.sys [2006-12-19 20480] R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800] R3 AWINDIS5;AWINDIS5 Protocol Driver;c:\windows\system32\AWINDIS5.SYS [2008-02-08 16194] R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;c:\windows\system32\drivers\wg511nd5.sys [2008-02-08 449888] S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2008-10-29 24784] S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2008-10-29 25044] S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2008-10-29 52309] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys --> c:\windows\system32\DRIVERS\wg111v2.sys [?] S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\SiS163u.sys [2004-12-31 167424] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - f:\wd_windows_tools\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49b31760-6a56-11dd-9a21-000d5631d5a8}] \Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe . Contents of the 'Scheduled Tasks' folder 2009-01-28 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] 2009-01-28 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 13:32] . - - - - ORPHANS REMOVED - - - - BHO-{718DC1E8-1A6A-4870-A9CE-52C5BA124D1E} - c:\windows\system32\fccYrQkH.dll HKCU-Run-ares - c:\program files\Ares\Ares.exe HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = about:blank uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\Amit Cholkar\Application Data\Mozilla\Firefox\Profiles\[u]0[/u]6w85h01.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-04 14:01:25 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] @DACL=(02 0000) "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] @DACL=(02 0000) "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] @DACL=(02 0000) "Installed"="1" . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe c:\program files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\WlanCU.exe c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\windows\system32\ati2evxx.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Java\jre6\bin\jqs.exe c:\progra~1\McAfee\MSC\mcmscsvc.exe c:\progra~1\COMMON~1\McAfee\MNA\McNASvc.exe c:\windows\system32\java.exe c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe c:\program files\McAfee\VirusScan\Mcshield.exe c:\program files\802.11 Wireless LAN\802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10\SiSWLSvc.exe c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe c:\program files\McAfee\MPF\MpfSrv.exe c:\progra~1\McAfee\MSC\mcuimgr.exe . ************************************************************************** . Completion time: 2009-03-04 14:07:31 - machine was rebooted ComboFix-quarantined-files.txt 2009-03-04 19:07:27 Pre-Run: 15,852,601,344 bytes free Post-Run: 15,759,671,296 bytes free WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect multi(0)disk(0)rdisk(0)partition(3)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 244 --- E O F --- 2009-02-25 03:10:59