ComboFix 09-03-06.02 - *********** 2009-03-09 9:42:54.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.652 [GMT -4:00] Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe AV: McAfee VirusScan *On-access scanning disabled* (Updated) FW: McAfee Personal Firewall *enabled* * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible infected sites ----- hxxp://www.trart.net hxxp://vestepau.cn . ((((((((((((((((((((((((( Files Created from 2009-02-09 to 2009-03-09 ))))))))))))))))))))))))))))))) . 2009-03-05 21:25 . 2008-04-13 20:12 26,112 --a------ c:\windows\system32\stu2.exe 2009-03-02 11:52 . 2009-03-02 11:52 250 --a------ c:\windows\gmer.ini 2009-03-02 11:17 . 2009-03-02 11:20 d-------- C:\GRAPHPAP 2009-02-24 23:04 . 2009-01-09 15:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat 2009-02-22 17:03 . 2009-02-22 17:02 410,984 --a------ c:\windows\system32\deploytk.dll 2009-02-09 14:46 . 2009-02-09 14:46 d-------- c:\program files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-03-08 15:28 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2009-03-07 14:49 --------- d-----w c:\documents and settings\***********\Application Data\Yahoo! 2009-03-07 01:33 17,408 ----a-w c:\windows\system32\userinit.exe 2009-02-23 20:10 --------- d-----w c:\program files\Spybot - Search & Destroy 2009-02-22 21:02 --------- d-----w c:\program files\Java 2009-02-14 14:40 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2009-02-11 15:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2009-02-11 15:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2009-02-09 17:33 --------- d-----w c:\program files\Common Files\Wise Installation Wizard 2009-02-09 17:33 --------- d-----w c:\documents and settings\***********\Application Data\SUPERAntiSpyware.com 2009-02-08 19:00 --------- d-----w c:\documents and settings\***********\Application Data\Malwarebytes 2009-02-08 19:00 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes 2009-02-08 16:17 --------- d-----w c:\program files\CCleaner 2009-02-08 15:39 --------- d-----w c:\program files\Reference Assemblies 2009-02-08 15:39 --------- d-----w c:\program files\MSBuild 2009-01-29 02:13 --------- d-----w c:\program files\McAfee 2009-01-28 19:13 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee 2009-01-28 19:07 --------- d-----w c:\program files\Common Files\McAfee 2009-01-28 19:06 --------- d-----w c:\program files\McAfee.com 2009-01-28 18:48 --------- d-----w c:\documents and settings\All Users\Application Data\Network Associates 2009-01-28 18:10 --------- d-----w c:\program files\MATLAB 2009-01-10 18:08 --------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll 2008-12-07 16:37 17 ----a-w c:\program files\stinger10000457.opt 2008-12-07 14:30 2,747,911 ----a-w c:\program files\stinger10000457.exe 1998-12-08 18:53 99,840 -c--a-w c:\program files\Common Files\IRAABOUT.DLL 1998-12-08 18:53 70,144 -c--a-w c:\program files\Common Files\IRAMDMTR.DLL 1998-12-08 18:53 48,640 -c--a-w c:\program files\Common Files\IRALPTTR.DLL 1998-12-08 18:53 31,744 -c--a-w c:\program files\Common Files\IRAWEBTR.DLL 1998-12-08 18:53 186,368 -c--a-w c:\program files\Common Files\IRAREG.DLL 1998-12-08 18:53 17,920 -c--a-w c:\program files\Common Files\IRASRIAL.DLL 2008-05-15 18:46 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051520080516\index.dat . ------- Sigcheck ------- 2004-08-04 08:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe 2008-04-13 20:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe 2009-03-06 21:33 17408 c1c4b25dd4d03ea8c70223c0051cf736 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((( SnapShot@2009-03-04_14.06.13.27 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-21 00:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE - 2000-08-31 13:00:00 29,696 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 12:00:00 29,696 ----a-w c:\windows\NIRCMD.exe - 2000-08-31 13:00:00 161,792 ----a-w c:\windows\SWREG.exe + 2000-08-31 12:00:00 161,792 ----a-w c:\windows\SWREG.exe - 2009-03-04 18:20:21 32,768 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-03-09 13:12:12 32,768 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2009-03-04 18:20:21 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2009-03-09 13:12:12 32,768 -c--a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-03-04 23:52:34 286,720 ----a-w c:\windows\system32\libcurl.dll + 2006-10-16 23:44:44 1,028,096 ----a-w c:\windows\system32\libeay32.dll + 2007-05-17 18:58:10 143,360 ----a-w c:\windows\system32\libexpatw.dll - 2009-02-08 18:51:51 71,980 ----a-w c:\windows\system32\perfc009.dat + 2009-03-08 14:39:09 71,980 ----a-w c:\windows\system32\perfc009.dat - 2009-02-08 18:51:51 442,568 ----a-w c:\windows\system32\perfh009.dat + 2009-03-08 14:39:09 442,568 ----a-w c:\windows\system32\perfh009.dat + 2006-10-16 23:44:44 196,608 ----a-w c:\windows\system32\ssleay32.dll + 2009-03-09 13:06:38 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_104.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] "i8kfangui"="c:\program files\I8kfanGUI\I8kfanGUI.exe" [2006-11-30 847872] "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472] "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-11-07 294912] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-22 136600] "AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 684032] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "AS00_Gear511"="c:\program files\NETGEAR\WG511SCU\Utility\Gear511.exe" [2006-01-20 1122412] "ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696] "mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\system32\Ati2mdxx.exe] "PCTVOICE"="pctspk.exe" [2003-02-24 c:\windows\system32\pctspk.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2000-01-21 65588] Symantec Fax Starter Edition Port.lnk - c:\program files\Microsoft Office\Office\1033\OLFSNT40.EXE [1998-12-23 45568] Wireless Configuration Utility HW.32.lnk - c:\windows\Installer\{BDC88E5A-F47B-4314-AB38-994592E32C95}\NewShortcut1.exe [2007-04-22 40960] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\SopCast\\SopCast.exe"= "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"= R1 fanio;FanIO driver;c:\windows\system32\drivers\fanio.sys [2006-12-19 20480] R2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800] R3 AWINDIS5;AWINDIS5 Protocol Driver;c:\windows\system32\AWINDIS5.SYS [2008-02-08 16194] R3 NETGEAR_WG511_SERVICE;NETGEAR WG511T Wireless Adapter Service;c:\windows\system32\drivers\wg511nd5.sys [2008-02-08 449888] S3 mam4410c;mam4410c;c:\windows\system32\drivers\mam4410c.sys [2008-10-29 24784] S3 mam4410m;mam4410m;c:\windows\system32\drivers\mam4410m.sys [2008-10-29 25044] S3 mam4410u;mam4410u;c:\windows\system32\drivers\mam4410u.sys [2008-10-29 52309] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;c:\windows\system32\DRIVERS\wg111v2.sys --> c:\windows\system32\DRIVERS\wg111v2.sys [?] S3 SIS163u;SiS 163 usb Wireless LAN Adapter Driver;c:\windows\system32\drivers\SiS163u.sys [2004-12-31 167424] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] \Shell\AutoRun\command - f:\wd_windows_tools\Setup.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{49b31760-6a56-11dd-9a21-000d5631d5a8}] \Shell\AutoRun\command - g:\wd_windows_tools\Setup.exe . Contents of the 'Scheduled Tasks' folder 2009-01-28 c:\windows\Tasks\McDefragTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 14:32] 2009-01-28 c:\windows\Tasks\McQcTask.job - c:\progra~1\mcafee\mqc\QcConsol.exe [2007-12-04 14:32] . . ------- Supplementary Scan ------- . uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uStart Page = about:blank uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyOverride = *.local FF - ProfilePath - c:\documents and settings\***********\Application Data\Mozilla\Firefox\Profiles\[u]0[/u]6w85h01.default\ FF - prefs.js: browser.search.selectedEngine - Google FF - prefs.js: browser.startup.homepage - about:blank FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-03-09 09:45:52 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- LOCKED REGISTRY KEYS --------------------- [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL] @DACL=(02 0000) "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI] @DACL=(02 0000) "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS] @DACL=(02 0000) "Installed"="1" . Completion time: 2009-03-09 9:48:49 ComboFix-quarantined-files.txt 2009-03-09 13:48:32 ComboFix2.txt 2009-03-04 19:07:33 Pre-Run: 15,674,908,672 bytes free Post-Run: 15,657,779,200 bytes free Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4 188 --- E O F --- 2009-02-25 03:10:59