Anonymous

public text v1 · immutable
#718328
·published 2007-09-28 09:56 UTC
ComboFix 07-09-21.2 - "Crystal Heart" 2007-09-28 14:45:05.1 - [color=red][b]FAT32[/b][/color]x86 
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.237 [GMT 5:00]
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007\Data\ProductCode
C:\DOCUME~1\CRYSTA~1\APPLIC~1\WinAntiSpyware 2007 Free
C:\DOCUME~1\CRYSTA~1\APPLIC~1\WinAntiSpyware 2007 Free\DownloadUWAS7.url
C:\DOCUME~1\CRYSTA~1\APPLIC~1\WinTouch
C:\DOCUME~1\CRYSTA~1\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\CRYSTA~1\err.log
C:\Program Files\Insider
C:\Program Files\Insider\Insider.exe
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\scurit~1
C:\Program Files\Words
C:\Program Files\Words\list.txt
C:\Program Files\Words\UnInstall.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\D2
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\smbols~1
C:\WINDOWS\system32\smbols~1\s?mbols\
E:\Autorun.inf

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE


(((((((((((((((((((((((((   Files Created from 2007-08-28 to 2007-09-28  )))))))))))))))))))))))))))))))
.

2007-09-28 14:36	51,200	--a------	C:\WINDOWS\NirCmd.exe
2007-09-28 14:03	<DIR>	d--------	C:\VundoFix Backups
2007-09-28 11:14	27,648	---------	C:\WINDOWS\system32\dllcache\jgpl400.dll
2007-09-28 11:14	163,840	---------	C:\WINDOWS\system32\dllcache\jgdw400.dll
2007-09-28 11:10	2,180,352	---------	C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-09-28 11:10	2,136,064	---------	C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-09-28 11:10	2,057,600	---------	C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-09-28 11:10	2,015,744	---------	C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-09-28 11:08	28,672	---------	C:\WINDOWS\system32\verclsid.exe
2007-09-28 11:06	453,120	---------	C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-09-28 10:59	<DIR>	d--h-----	C:\WINDOWS\$hf_mig$
2007-09-27 23:38	<DIR>	d--------	C:\WUTemp
2007-09-27 23:31	<DIR>	d--------	C:\Program Files\Opera
2007-09-27 20:46	<DIR>	d--------	C:\Program Files\SUPERAntiSpyware
2007-09-27 20:46	<DIR>	d--------	C:\DOCUME~1\CRYSTA~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-27 20:46	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-09-27 20:45	2,154,709	---hs----	C:\WINDOWS\system32\vvvwa.ini2
2007-09-27 20:45	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2007-09-27 20:28	<DIR>	d--------	C:\Program Files\mIRC
2007-09-27 19:40	427,864	--a------	C:\WINDOWS\system32\XceedZip.dll
2007-09-27 19:40	<DIR>	d--------	C:\Program Files\Driver-Soft
2007-09-27 18:43	<DIR>	d--------	C:\DOCUME~1\CRYSTA~1\Contacts
2007-09-27 17:49	1,680	--a------	C:\WINDOWS\mozver.dat
2007-09-27 15:54	0	--a------	C:\WINDOWS\nsreg.dat
2007-09-27 15:40	<DIR>	d--------	C:\Program Files\MSN Messenger
2007-09-27 14:39	84,544	--a------	C:\WINDOWS\system32\ufxdkmuy.dll
2007-09-27 12:17	4,551	--a------	C:\WINDOWS\system32\kmpipkep.dll
2007-09-27 11:01	4,551	--a------	C:\WINDOWS\system32\jmillypt.dll
2007-09-26 21:09	4,551	--a------	C:\WINDOWS\system32\uejgddnx.dll
2007-09-26 16:34	4,551	--a------	C:\WINDOWS\system32\qeiadckw.dll
2007-09-25 14:18	4,551	--a------	C:\WINDOWS\system32\bvmbegww.dll
2007-09-25 14:09	4,551	--a------	C:\WINDOWS\system32\vaodxgph.dll
2007-09-25 14:02	<DIR>	d--hs----	C:\FOUND.007
2007-09-24 16:28	4,551	--a------	C:\WINDOWS\system32\tidniqaa.dll
2007-09-23 21:38	4,551	--a------	C:\WINDOWS\system32\qxakksiu.dll
2007-09-23 21:23	4,551	--a------	C:\WINDOWS\system32\mhcdnujf.dll
2007-09-23 20:01	442,368	-ra------	C:\WINDOWS\system32\vp6vfw.dll
2007-09-23 20:01	<DIR>	d--------	C:\Program Files\EA GAMES
2007-09-23 15:09	4,551	--a------	C:\WINDOWS\system32\wsdwfigu.dll
2007-09-23 14:09	4,551	--a------	C:\WINDOWS\system32\dsirgwqn.dll
2007-09-22 21:57	<DIR>	d--------	C:\WINDOWS\system32\DRVSTORE
2007-09-22 21:57	<DIR>	d--------	C:\Program Files\Zune
2007-09-22 21:57	<DIR>	d--------	C:\Program Files\DIFX
2007-09-22 21:57	<DIR>	d--------	C:\Program Files\Common Files\ComponentOne
2007-09-22 21:54	<DIR>	d--------	C:\WINDOWS\system32\LogFiles
2007-09-22 21:54	<DIR>	d--------	C:\WINDOWS\system32\drivers\UMDF
2007-09-22 21:53	23,856	--a------	C:\WINDOWS\system32\spupdsvc.exe
2007-09-22 09:30	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-22 09:23	512,096	--a------	C:\WINDOWS\system32\drivers\amon.sys
2007-09-22 09:23	298,104	--a------	C:\WINDOWS\system32\imon.dll
2007-09-22 09:23	15,424	--a------	C:\WINDOWS\system32\drivers\nod32drv.sys
2007-09-18 00:33	4,551	--a------	C:\WINDOWS\system32\xwhngudp.dll
2007-09-16 22:55	4,551	--a------	C:\WINDOWS\system32\iuoincqu.dll
2007-09-15 12:47	4,551	--a------	C:\WINDOWS\system32\yfwexgbj.dll
2007-09-14 14:00	<DIR>	d--hs----	C:\FOUND.006
2007-09-11 12:13	<DIR>	d--------	C:\Program Files\Kaspersky Lab
2007-09-11 12:12	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab Setup Files
2007-09-11 11:49	<DIR>	d--------	C:\Program Files\McAfee
2007-09-11 11:49	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee.com
2007-09-10 22:44	<DIR>	d--hs----	C:\FOUND.005
2007-09-10 21:55	<DIR>	d--hs----	C:\FOUND.004
2007-09-10 17:21	26,496	--a------	C:\WINDOWS\system32\dllcache\usbstor.sys
2007-09-10 14:15	<DIR>	d--hs----	C:\FOUND.003
2007-09-10 11:31	<DIR>	d--------	C:\WINDOWS\wqoo
2007-09-10 11:31	<DIR>	d--------	C:\Program Files\Common Files\wqoo
2007-09-09 19:07	18,944	--a------	C:\WINDOWS\system32\msmapiax32.exe
2007-09-09 17:31	<DIR>	d--hs----	C:\FOUND.002
2007-09-09 10:50	<DIR>	d--------	C:\DOCUME~1\LOCALS~1\APPLIC~1\Google
2007-09-09 10:38	2,102,066	---hs----	C:\WINDOWS\system32\vvvwa.bak2
2007-09-08 20:48	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\nView_Profiles
2007-09-08 20:33	<DIR>	d--hs----	C:\FOUND.001
2007-09-08 20:10	<DIR>	d--------	C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-09-08 19:19	89,088	--a------	C:\WINDOWS\system32\atl71.dll
2007-09-08 19:19	1,060,864	--a------	C:\WINDOWS\system32\mfc71.dll
2007-09-08 19:12	2,009,799	---hs----	C:\WINDOWS\system32\vvvwa.bak1
2007-09-08 19:08	<DIR>	d--hs----	C:\WINDOWS\Q3J5c3RhbCBIZWFydA
2007-09-08 19:07	<DIR>	d--------	C:\WINDOWS\system32\drvr2
2007-09-08 19:07	<DIR>	d--------	C:\WINDOWS\system32\cfig322
2007-09-08 19:07	<DIR>	d--------	C:\WINDOWS\system32\capcam
2007-09-08 19:06	<DIR>	d--------	C:\Temp
2007-09-08 10:25	<DIR>	d---s----	C:\DOCUME~1\CRYSTA~1\UserData
2007-09-06 21:59	<DIR>	d--------	C:\DOCUME~1\CRYSTA~1\APPLIC~1\Google
2007-09-06 21:32	499,712	--a------	C:\WINDOWS\system32\msvcp71.dll
2007-09-06 21:32	348,160	--a------	C:\WINDOWS\system32\msvcr71.dll
2007-09-06 21:32	<DIR>	d--------	C:\Program Files\Real
2007-09-06 21:32	<DIR>	d--------	C:\Program Files\Google
2007-09-06 21:32	<DIR>	d--------	C:\Program Files\Common Files\xing shared
2007-09-06 21:32	<DIR>	d--------	C:\Program Files\Common Files\Real
2007-09-06 21:32	<DIR>	d--------	C:\DOCUME~1\CRYSTA~1\APPLIC~1\Real
2007-09-06 21:32	<DIR>	d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-09-06 17:20	<DIR>	d--h-----	C:\Program Files\InstallShield Installation Information
2007-09-06 17:20	<DIR>	d--------	C:\Program Files\D-Link
2007-09-06 17:20	<DIR>	d--------	C:\Program Files\ANI
2007-09-06 17:05	319,104	-ra------	C:\WINDOWS\system32\drivers\rt61.sys
2007-09-06 16:59	<DIR>	d--hs----	C:\Recycled
2007-09-06 16:58	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys
2007-09-06 16:58	9,600	--a------	C:\WINDOWS\system32\dllcache\hidusb.sys
2007-09-06 16:58	12,160	--a------	C:\WINDOWS\system32\drivers\mouhid.sys
2007-09-06 16:58	12,160	--a------	C:\WINDOWS\system32\dllcache\mouhid.sys
2007-09-04 18:09	<DIR>	d--hs----	C:\FOUND.000

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-04 16:57	---------	d--------	C:\Program Files\microsoft frontpage
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
 
*Note* empty entries & legit default entries are not shown 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-03-24 10:04]
"nwiz"="nwiz.exe" [2004-03-24 10:04 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-03-24 10:04]
"SoundMan"="SOUNDMAN.EXE" [2004-07-01 18:23 C:\WINDOWS\SOUNDMAN.EXE]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-09-06 21:32]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-09-22 09:23]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-10-31 14:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-08 10:22]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 17:05:56]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll



[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{91507df8-6032-11dc-ab74-00179a020dca}]
1\command- escro.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL escro.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-09-27 19:00:02 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-27 20:00:02 C:\WINDOWS\Tasks\At2.job"
"2007-09-27 21:00:02 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-27 22:00:02 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-27 23:00:02 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 00:00:02 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 01:00:02 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 02:00:02 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 03:00:02 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 04:00:02 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 05:00:02 C:\WINDOWS\Tasks\At11.job"
"2007-09-28 06:00:02 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\407P4T48.exe
"2007-09-28 07:00:02 C:\WINDOWS\Tasks\At13.job"
"2007-09-28 08:00:02 C:\WINDOWS\Tasks\At14.job"
"2007-09-28 09:00:02 C:\WINDOWS\Tasks\At15.job"
"2007-09-27 10:00:02 C:\WINDOWS\Tasks\At16.job"
"2007-09-27 11:00:02 C:\WINDOWS\Tasks\At17.job"
"2007-09-27 12:00:02 C:\WINDOWS\Tasks\At18.job"
"2007-09-27 13:00:02 C:\WINDOWS\Tasks\At19.job"
"2007-09-27 14:00:02 C:\WINDOWS\Tasks\At20.job"
"2007-09-27 15:00:02 C:\WINDOWS\Tasks\At21.job"
"2007-09-27 16:00:02 C:\WINDOWS\Tasks\At22.job"
"2007-09-27 17:00:02 C:\WINDOWS\Tasks\At23.job"
"2007-09-27 18:00:02 C:\WINDOWS\Tasks\At24.job"
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-28 14:47:51
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-28 14:48:43 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-09-28 14:48
.
	--- E O F ---