I realize that the date and time on the log produced are from yesterday's date. However this is only because the time setting on my computer are off. I guess the date marked on the log reflects the time setting on my computer(I've tried fixing the date but it never seems to stay updated). Anyway this is the new log from combofix.
ComboFix 12-03-14.01 - User 03/14/2012 21:15:53.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.219 [GMT -7:00]
Running from: c:\documents and settings\User\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Outdated* {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Spy Sweeper with AntiVirus *Disabled/Outdated* {B3891867-7230-459B-9987-E7CCFA7A7D1D}
FW: Online Armor Firewall *Disabled* {B797DAA0-7E2E-4711-8BB3-D12744F1922A}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\$NtUninstallKB35442$
c:\windows\$NtUninstallKB35442$\1973485522\@
c:\windows\$NtUninstallKB35442$\1973485522\cfg.ini
c:\windows\$NtUninstallKB35442$\1973485522\Desktop.ini
c:\windows\$NtUninstallKB35442$\1973485522\L\jlubmrqt
c:\windows\$NtUninstallKB35442$\1973485522\oemid
c:\windows\$NtUninstallKB35442$\1973485522\U\00000001.@
c:\windows\$NtUninstallKB35442$\1973485522\U\00000002.@
c:\windows\$NtUninstallKB35442$\1973485522\U\00000004.@
c:\windows\$NtUninstallKB35442$\1973485522\U\80000000.@
c:\windows\$NtUninstallKB35442$\1973485522\U\80000004.@
c:\windows\$NtUninstallKB35442$\1973485522\U\80000032.@
c:\windows\$NtUninstallKB35442$\1973485522\version
c:\windows\$NtUninstallKB35442$\3841739398
c:\windows\system32\kraidsvc.dll
c:\windows\system32\ovt519.dll
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_IKSYSFLT
-------\Legacy_SQLSERVERAGENT
-------\Service_iksysflt
-------\Service_sqlserveragent
.
.
((((((((((((((((((((((((( Files Created from 2012-02-15 to 2012-03-15 )))))))))))))))))))))))))))))))
.
.
2012-03-15 04:09 . 2012-03-15 04:09 63115 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
2012-03-15 04:09 . 2012-03-15 04:09 9310 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
2012-03-15 04:09 . 2012-03-15 04:09 8646 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-03-15 04:09 . 2012-03-15 04:09 6429 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
2012-03-15 04:09 . 2012-03-15 04:09 5927 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
2012-03-15 04:09 . 2012-03-15 04:09 4599 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
2012-03-15 04:09 . 2012-03-15 04:09 8613 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
2012-03-15 04:09 . 2012-03-15 04:09 6910 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
2012-03-15 04:09 . 2012-03-15 04:09 1651 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
2012-03-15 04:09 . 2012-03-15 04:09 6208 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
2012-03-15 04:09 . 2012-03-15 04:09 18541 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
2012-03-15 04:08 . 2012-03-15 04:08 8288 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
2012-03-15 04:08 . 2012-03-15 04:08 51852 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
2012-03-15 04:08 . 2012-03-15 04:08 8782 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
2012-03-15 04:08 . 2012-03-15 04:08 7271 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
2012-03-15 04:08 . 2012-03-15 04:08 23327 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
2012-03-15 04:08 . 2012-03-15 04:08 20719 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
2012-03-15 03:02 . 2001-08-17 19:51 20752 -c--a-w- c:\windows\system32\dllcache\sonync.sys
2012-03-15 03:02 . 2004-08-04 05:59 57472 -c--a-w- c:\windows\system32\dllcache\redbook.sys
2012-03-15 03:02 . 2004-08-04 05:59 57472 ----a-w- c:\windows\system32\drivers\redbook.sys
2012-02-15 04:19 . 2012-02-15 04:15 -------- d-----w- C:\TDSSKiller_Quarantine
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-15 04:08 . 2001-01-03 19:05 0 --sha-w- c:\windows\system32\dds_trash_log.cmd
2012-02-15 04:12 . 2009-06-15 14:11 138192 ----a-w- c:\windows\system32\drivers\avipbb.sys
2012-02-15 04:12 . 2007-03-11 00:33 451456 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2012-02-15 04:12 . 2007-03-11 00:33 74752 ----a-w- c:\windows\system32\drivers\ipsec.sys
2012-02-15 04:12 . 2007-03-11 00:33 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2012-02-15 03:58 . 2009-06-15 14:11 66616 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-05-21 15:59 . 2010-05-21 15:59 3095040 ----a-w- c:\program files\openofficeorg32.msi
2010-05-21 15:58 . 2010-05-21 15:58 460088 ----a-w- c:\program files\setup.exe
2005-11-23 02:01 . 2009-04-27 21:34 174838062 ----a-w- c:\program files\GP5FULLBK-1.exe
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2007-03-11 . 09EB23A4567BDD56D9580A059E616E23 . 359040 . . [5.1.2600.2505] . . c:\windows\system32\drivers\tcpip.sys
.
(((((((((((((((((((((((((((((
SnapShot@2012-03-15_04.10.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-03-15 04:08 . 2012-03-15 04:08 16384 c:\windows\Temp\Perflib_Perfdata_c0.dat
+ 2012-03-15 04:08 . 2012-03-15 04:08 16384 c:\windows\Temp\Perflib_Perfdata_1b0.dat
+ 2007-09-20 17:30 . 2012-03-15 04:12 217197 c:\windows\system32\inetsrv\MetaBase.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{4F07DA45-8170-4859-9B5F-037EF2970034}"= "c:\progra~1\TALLEM~1\ONLINE~1\oaevent.dll" [2010-07-07 924488]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^User^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk]
path=c:\documents and settings\User\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk
backup=c:\windows\pss\OpenOffice.org 3.2.lnkStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\@OnlineArmor GUI]
2010-07-07 19:33 6965576 ----a-w- c:\program files\Tall Emu\Online Armor\oaui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avgnt]
2010-12-11 19:34 281768 ----a-w- c:\program files\Avira\AntiVir Desktop\avgnt.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2004-08-04 07:06 1667584 ------w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper]
2007-07-20 04:54 5361464 ----a-w- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 17:43 248040 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
2001-01-03 19:30 296056 ----a-w- c:\program files\Real\RealPlayer\Update\realsched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"wlidsvc"=2 (0x2)
"WebrootSpySweeperService"=2 (0x2)
"SvcOnlineArmor"=2 (0x2)
"S24EventMonitor"=2 (0x2)
"RegSrvc"=2 (0x2)
"OAcat"=2 (0x2)
"JavaQuickStarterService"=2 (0x2)
"EvtEng"=2 (0x2)
"AntiVirService"=2 (0x2)
"AntiVirSchedulerService"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mqsvc.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32\\dplaysvr.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3587:TCP"= 3587:TCP:Windows Peer-to-Peer Grouping
"3540:UDP"= 3540:UDP:Peer Name Resolution Protocol (PNRP)
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
.
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;c:\windows\system32\drivers\SSFS0BB8.sys [9/20/2007 4:02 PM 20280]
R1 OADevice;OADriver;c:\windows\system32\drivers\OADriver.sys [6/15/2009 7:29 AM 236104]
R1 OAmon;OAmon;c:\windows\system32\drivers\OAmon.sys [6/15/2009 7:29 AM 22600]
R1 OAnet;OAnet;c:\windows\system32\drivers\OAnet.sys [6/15/2009 7:29 AM 28232]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/15/2009 7:11 AM 136360]
S0 73279805;73279805;c:\windows\system32\drivers\54757030.sys --> c:\windows\system32\drivers\54757030.sys [?]
S3 HPFXBULKLEDM;HPFXBULKLEDM;c:\windows\system32\drivers\hppcbulkio.sys [3/14/2011 4:19 PM 20504]
S4 OAcat;Online Armor Helper Service;c:\program files\Tall Emu\Online Armor\oacat.exe [6/15/2009 7:29 AM 1283400]
S4 SvcOnlineArmor;Online Armor;c:\program files\Tall Emu\Online Armor\oasrv.exe [6/15/2009 7:29 AM 3505992]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
getPlusHelper REG_MULTI_SZ getPlusHelper
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
ati2mtaa
mail2ec
.
Contents of the 'Scheduled Tasks' folder
.
2012-03-15 c:\windows\Tasks\RealUpgradeLogonTaskS-1-5-21-776561741-1993962763-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 23:02]
.
2001-01-03 c:\windows\Tasks\RealUpgradeScheduledTaskS-1-5-21-776561741-1993962763-682003330-1003.job
- c:\program files\Real\RealUpgrade\realupgrade.exe [2011-11-29 23:02]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.ask.com?o=14196&l=dis
uInternet Connection Wizard,ShellNext = iexplore
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: DhcpNameServer = 75.75.76.76 75.75.75.75
FF - ProfilePath - c:\documents and settings\User\Application Data\Mozilla\Firefox\Profiles\05bge07v.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Adobe DLM (powered by getPlus(R)): {E2883E8F-472F-4fb0-9522-AC9BF37916A7} - %profile%\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
FF - Ext: Chromifox Basic:
chromifox@altmusictv.com - %profile%\extensions\
chromifox@altmusictv.comFF - Ext: Vista-aero: {07b2a769-ed19-4483-87ce-c643914c81bb} - %profile%\extensions\{07b2a769-ed19-4483-87ce-c643914c81bb}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Java Quick Starter:
jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: RealPlayer Browser Record Plugin: {ABDE892B-13A8-4d1b-88E6-365A6E755758} - c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-combofix - c:\combofix\CF13251.3XE
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2012-03-14 22:02
Windows 5.1.2600 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\WRLogonNTF.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\msdtc.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\system32\tcpsvcs.exe
c:\windows\System32\snmp.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\system32\mqsvc.exe
c:\windows\system32\mqtgsvc.exe
.
**************************************************************************
.
Completion time: 2012-03-14 22:06:03 - machine was rebooted
ComboFix-quarantined-files.txt 2012-03-15 05:06
ComboFix2.txt 2012-03-15 04:15
.
Pre-Run: 28,423,286,784 bytes free
Post-Run: 28,527,616,000 bytes free
.
- - End Of File - - 8CFEBE89FDB5873A94203D1090104AC0
