ComboFix 12-01-06.01 - Gail 01/06/2012 12:50:11.1.4 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3326.2428 [GMT -5:00]
Running from: c:\documents and settings\Gail\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 5.0 *Disabled/Outdated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\~OtxzMAdeY7kqEj
c:\documents and settings\All Users\Application Data\~OtxzMAdeY7kqEjr
c:\documents and settings\All Users\Application Data\OtxzMAdeY7kqEj
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\Gail\Application Data\Mozilla\Firefox\Profiles\wp8z0511.default\searchplugins\bing-zugo.xml
c:\documents and settings\Gail\Application Data\PriceGong
c:\documents and settings\Gail\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\J.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Gail\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Gail\g2ax_customer_downloadhelper_win32_x86.exe
c:\documents and settings\Gail\Local Settings\Application Data\.#
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@184@383470.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@184@383480.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@184@383490.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@184@3834A0.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@53C@383470.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@53C@383480.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@53C@383490.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@53C@3834A0.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@720@383470.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@720@383480.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@720@383490.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@720@3834A0.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@97C@383470.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@97C@383480.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@97C@383490.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@97C@3834A0.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@F50@383470.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@F50@383480.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@F50@383490.###
c:\documents and settings\Gail\Local Settings\Application Data\.#\MBX@F50@3834A0.###
c:\documents and settings\Gail\My Documents\~WRL0001.tmp
c:\documents and settings\Gail\My Documents\~WRL0002.tmp
c:\documents and settings\Gail\Start Menu\Programs\System Check\System Check.lnk
c:\documents and settings\Gail\Start Menu\Programs\System Check\Uninstall System Check.lnk
c:\documents and settings\Gail\WINDOWS
c:\windows\system32\SETB19.tmp
c:\windows\system32\SETB1B.tmp
c:\windows\system32\SETB1F.tmp
c:\windows\system32\SETB20.tmp
c:\windows\system32\SETB27.tmp
c:\windows\system32\SETB29.tmp
c:\windows\system32\spool\prtprocs\w32x86\pcldll6l.dll
c:\windows\system32\spool\prtprocs\w32x86\zpp.dll
E:\install.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-12-06 to 2012-01-06 )))))))))))))))))))))))))))))))
.
.
2012-01-05 17:59 . 2009-06-30 15:37 28552 ----a-w- c:\windows\system32\drivers\pavboot.sys
2012-01-05 17:59 . 2012-01-05 17:59 -------- d-----w- c:\program files\Panda Security
2012-01-05 17:59 . 2012-01-05 17:59 -------- d-----w- c:\windows\LastGood
2012-01-05 14:46 . 2012-01-05 14:46 -------- d-----w- c:\documents and settings\Gail\Application Data\Malwarebytes
2012-01-05 14:46 . 2012-01-05 14:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2012-01-05 14:46 . 2012-01-05 14:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-01-05 14:46 . 2011-12-10 20:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-01-05 04:33 . 2012-01-05 04:33 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2012-01-04 23:54 . 2012-01-05 00:09 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2012-01-04 23:52 . 2012-01-04 23:52 388096 ----a-r- c:\documents and settings\Gail\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2012-01-04 23:52 . 2012-01-04 23:52 -------- d-----w- c:\program files\Trend Micro
2011-12-31 19:20 . 2011-12-31 19:20 -------- d-----w- C:\DiD
2011-12-31 05:11 . 2011-12-31 05:11 -------- d-----w- c:\program files\DID
2011-12-31 05:06 . 1996-01-09 10:38 283648 ----a-w- c:\windows\uninst.exe
2011-12-31 03:06 . 2011-12-31 03:06 -------- d-----w- c:\program files\iPod
2011-12-31 03:06 . 2011-12-31 03:07 -------- d-----w- c:\program files\iTunes
2011-12-31 03:03 . 2011-12-31 03:03 -------- d-----w- c:\program files\Bonjour
2011-12-10 20:48 . 2011-12-10 20:48 -------- d-----w- c:\program files\ESET
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-11-23 13:25 . 2004-08-04 04:17 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-04 19:20 . 2004-08-04 05:56 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 19:20 . 2004-08-04 05:56 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-04 05:56 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 11:23 . 2004-08-04 03:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-01 16:07 . 2004-08-04 05:56 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31 . 2004-08-04 05:56 33280 ----a-w- c:\windows\system32\csrsrv.dll
2011-10-25 13:37 . 2004-08-04 04:18 2148864 ----a-w- c:\windows\system32\ntoskrnl.exe
2011-10-25 12:52 . 2004-08-03 22:59 2027008 ----a-w- c:\windows\system32\ntkrnlpa.exe
2011-10-18 11:13 . 2004-08-04 05:56 186880 ----a-w- c:\windows\system32\encdec.dll
2011-10-10 14:22 . 2010-07-22 23:19 692736 ----a-w- c:\windows\system32\inetcomm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Gail\Application Data\mjusbsp\cdloader2.exe" [2011-08-23 50592]
"Logitech Vid"="c:\program files\Logitech\Vid\Vid.exe" [2010-05-11 6061400]
"Logitech Vid HD"="c:\program files\Logitech\Vid\vid.exe" [2010-05-11 6061400]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2011-10-13 17351304]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-09 16859648]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-10-09 2183168]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 32768]
"hp 1000 firmware"="c:\program files\hp LaserJet 1000\fwdl.exe" [2001-12-15 36864]
"LWS"="c:\program files\Logitech\LWS\Webcam Software\LWS.exe" [2010-05-07 165208]
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-10-14 155648]
"PaperPort PTD"="c:\program files\ScanSoft\PaperPort\pptd40nt.exe" [2004-04-14 57393]
"IndexSearch"="c:\program files\ScanSoft\PaperPort\IndexSearch.exe" [2004-04-14 40960]
"SetDefPrt"="c:\program files\Brother\Brmfl04g\BrStDvPt.exe" [2004-11-11 49152]
"ControlCenter2.0"="c:\program files\Brother\ControlCenter2\brctrcen.exe" [2005-01-07 864256]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-07-08 98304]
"VirtualCloneDrive"="c:\program files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" [2011-03-07 89456]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 3080264]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-02 59240]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2011-12-08 421736]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Activision\\Call of Duty - Black Ops\\BlackOps.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Logitech\\Vid\\Vid.exe"=
"c:\\Documents and Settings\\Gail\\Application Data\\mjusbsp\\magicJack.exe"=
.
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [3/19/2009 10:44 AM 118104]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [3/19/2009 10:45 AM 103112]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [9/22/2011 12:03 PM 974944]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [7/27/2010 1:47 AM 136176]
S3 cpudrv;cpudrv;c:\program files\SystemRequirementsLab\cpudrv.sys [12/18/2009 10:58 AM 11336]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [7/27/2010 1:47 AM 136176]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - 58607140
*Deregistered* - 58607140
.
Contents of the 'Scheduled Tasks' folder
.
2011-12-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:34]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-27 06:47]
.
2012-01-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-07-27 06:47]
.
2012-01-06 c:\windows\Tasks\User_Feed_Synchronization-{3E045906-B672-4A9A-8B43-6F7D37DA6C2C}.job
- c:\windows\system32\msfeedssync.exe [2009-03-08 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = *.local
IE: Append Link Target to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\documents and settings\Gail\Application Data\Mozilla\Firefox\Profiles\wp8z0511.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?pc=Z003&form=ZGAADF&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter:
jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
AddRemove-Imation Disk Manager V a Service - c:\docume~1\Gail\LOCALS~1\Temp\Imation Disk Manager V a.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-01-06 12:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(1008)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\windows\System32\BCMLogon.dll
.
Completion time: 2012-01-06 12:55:10
ComboFix-quarantined-files.txt 2012-01-06 17:54
.
Pre-Run: 75,945,922,560 bytes free
Post-Run: 76,258,045,952 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
;
;Warning: Boot.ini is used on Windows XP and earlier operating systems.
;Warning: Use BCDEDIT.exe to modify Windows Vista boot options.
;
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /NOEXECUTE=OPTIN /FASTDETECT
.
- - End Of File - - 711185CBC02664AC6AECA26F58EE829C
