combofix:
ComboFix 08-01-18.5 - zhao 2008-01-20 0:20:48.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.392
[GMT 8:00]
Running from: C:\Documents and
Settings\zhao\Desktop\ComboFix.exe
Command switches used :: C:\Documents and
Settings\zhao\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT
HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2007-12-19 to
2008-01-19 )))))))))))))))))))))))))))))))
.
2008-01-19 23:37 . 2000-08-31 08:00 51,200 --a------
C:\WINDOWS\NirCmd.exe
2008-01-19 01:55 . 2008-01-19 01:55 895,842 --a------
C:\WINDOWS\N705i_style_win.scr
2008-01-19 01:55 . 2008-01-19 01:55 542,292 --a------
C:\WINDOWS\N705i_style_winUninst.exe
2008-01-11 23:32 . 2008-01-11 23:32 d-------- C:\PFiles
2008-01-08 23:46 . 2008-01-08 23:46 d--------
C:\WINDOWS\system32\NtmsData
2007-12-29 00:35 . 2007-12-29 00:35 d-------- C:\WINDOWS\ndssaver01
dir
2007-12-29 00:35 . 2007-12-29 00:35 191,488 --a------
C:\WINDOWS\ndssaver01.scr
2007-12-25 13:53 . 2007-12-25 13:53 d-------- C:\Documents and
Settings\All Users\Application Data\Trymedia
2007-12-19 15:08 . 2008-01-12 00:43 512 --a------
C:\drmHeader.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report
))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 16:35 545,280 ----a-w C:\WINDOWS\flashax.exe
2007-12-28 16:35 12,288 ----a-w C:\WINDOWS\impborl.dll
2007-12-08 16:37 --------- d-----w C:\Program Files\VideoLAN
2007-11-29 22:30 200,704 ----a-w
C:\WINDOWS\system32\ssldivx.dll
2007-11-29 22:30 1,044,480 ----a-w
C:\WINDOWS\system32\libdivx.dll
2007-11-24 17:41 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-11-24 17:41 249,856 ------w C:\WINDOWS\Setup1.exe
2007-11-24 17:41 --------- d-----w C:\Program Files\Date Cracker
2000
2007-11-14 07:26 450,560 ----a-w
C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-08 07:21 39,424 ----a-w C:\WINDOWS\zipinst.exe
2007-11-07 09:26 721,920 ----a-w
C:\WINDOWS\system32\lsasrv.dll
2007-11-07 09:26 721,920 ----a-w
C:\WINDOWS\system32\dllcache\lsasrv.dll
2007-10-30 17:20 360,064 ----a-w
C:\WINDOWS\system32\dllcache\tcpip.sys
2007-10-30 10:16 3,137,024 ----a-w
C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w
C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ----a-w
C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 09:40 227,328 ----a-w
C:\WINDOWS\system32\wmasf.dll
2007-10-27 09:40 227,328 ----a-w
C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:36 8,256,000 ----a-w
C:\WINDOWS\system32\dllcache\shell32.dll
2006-10-10 03:03 1,554 ----a-w C:\Documents and
Settings\zhao\Application Data\wklnhst.dat
2006-04-06 17:30 696,320 ----a-w C:\Program Files\FORMAT.EXE
2006-04-06 17:30 584,379 ----a-w C:\Program Files\Manual-
English.pdf
2006-04-06 04:32 0 ----a-w C:\Documents and Settings\my
com\Application Data\wklnhst.dat
1996-11-14 16:58 23,808 ----a-r C:\WINDOWS\Fonts\ARABB___.SCR
1996-11-14 16:58 23,680 ----a-r C:\WINDOWS\Fonts\ARABA___.SCR
1996-11-14 16:58 23,168 ----a-r C:\WINDOWS\Fonts\RCOC____.SCR
1996-11-14 16:58 21,504 ----a-r C:\WINDOWS\Fonts\RCOA____.SCR
1996-11-14 16:58 19,456 ----a-r C:\WINDOWS\Fonts\RCOB____.SCR
1996-11-14 16:58 15,232 ----a-r C:\WINDOWS\Fonts\ARABC___.SCR
1999-07-07 00:00 6 --sh--r C:\WINDOWS\@@desktop.dat
2004-10-13 16:24 1,694,208 --sha-w
C:\WINDOWS\FlyakiteOSX\Backup\msmsgs.exe
.
(((((((((((((((((((((((((((((((((((((((((((( Look
)))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
- Not a PE file.
- Not a PE file.
- Not a PE file.
- Not a PE file.
- Not a PE file.
- Not a PE file.
---- C:\WINDOWS\Setup1.exe ----
Company: Microsoft Corporation
File Description: Visual Basic 6.0 Setup Toolkit
File Version: 6.00.8804
Product Name: Visual Basic
Copyright: Copyright (C) 1987-1999 Microsoft Corporation
Original file name: setup1.exe
---- Directory of C:\PFiles ----
2007-04-10 17:21 163256 --a------
C:\PFiles\Plugins\np-mswmp.dll
2007-03-30 10:43 3352 --a------ C:\PFiles\Plugins\WMP Firefox
Plugin RelNotes.txt
2007-03-30 10:43 149569 --a------ C:\PFiles\Plugins\WMP Firefox
Plugin License.rtf
---- Directory of C:\WINDOWS\ndssaver01 dir ----
2007-12-29 00:35 805500 --a------ C:\WINDOWS\ndssaver01
dir\ndssaver01.swf
2007-12-29 00:35 805500 --a------ C:\WINDOWS\ndssaver01
dir\installer.swf
2007-12-29 00:35 36864 --a------ C:\WINDOWS\ndssaver01
dir\saver1.dll
2007-12-29 00:35 18192 --a------ C:\WINDOWS\ndssaver01
dir\saver2.dll
2007-12-29 00:35 1404 --a------ C:\WINDOWS\ndssaver01
dir\expire.scf
2007-12-29 00:35 1240 --a------ C:\WINDOWS\ndssaver01
dir\saver.dat
---- Directory of C:\WINDOWS\system32\NtmsData ----
2008-01-08 23:47 84392 --a------
C:\WINDOWS\system32\NtmsData\NTMSIDX
2008-01-08 23:47 118784 --a------
C:\WINDOWS\system32\NtmsData\NTMSDATA.BAK
2008-01-08 23:47 118784 --a------
C:\WINDOWS\system32\NtmsData\NTMSDATA
2008-01-08 23:46 816 --a------
C:\WINDOWS\system32\NtmsData\NTMSREG
((((((((((((((((((((((((((((( [email protected]_23.42.39.82
)))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-19 15:38:14 1,138,688 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
+ 2008-01-19 16:20:42 1,138,688 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\ntuser.dat
- 2008-01-19 15:38:14 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-19 16:20:42 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-19 15:38:14 1,142,784 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-19 16:20:42 1,142,784 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-19 15:38:14 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-19 16:20:42 8,192 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-19 15:38:14 10,547,200 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-19 16:20:42 10,563,584 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-19 15:38:14 172,032 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-19 16:20:42 172,032 ----a-w
C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2000-08-31 00:00:00 163,328 ----a-w
C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points
))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not
shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24
11:37 8818688]
"ObjectDock"="C:\Program Files\ObjectDock\ObjectDock.exe"
[2007-04-30 19:43 3450608]
"UberIcon"="C:\Program Files\UberIcon\UberIcon Manager.exe"
[2006-02-24 08:32 188416]
"Yz Shadow"="C:\Program Files\YzShadow\YzShadow.exe" [2006-02-24
10:51 172032]
"WinExpose"="C:\expose\WinExpose.exe" [2006-11-25 14:20
301056]
"Iconoid"="C:\Program Files\Iconoid\iconoid.exe" [2007-02-03 18:38
274432]
"DesktopIconToy"="C:\Program Files\Desktop Icon
Toy\DesktopIconToy.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LaunchApp"="Alaunch" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
[2005-01-07 16:17 102491]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
[2005-01-07 16:16 692315]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 05:00
208952]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe"
[2004-08-04 05:00 59392]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe"
[2004-08-04 05:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe"
[2004-08-04 05:00 455168]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-01-22 19:31
126976]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
[2004-07-15 01:07 32768]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-03-24 21:22
5566464]
"nwiz"="nwiz.exe" [2005-03-24 21:22 1495040
C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-03-24
21:22 98304]
"SoundMan"="SOUNDMAN.EXE" [2004-12-01 15:54 77824
C:\WINDOWS\soundman.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-15 11:45 88202
C:\WINDOWS\AGRSMMSG.exe]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 05:00
110592 C:\WINDOWS\system32\bthprops.cpl]
"EPM-DM"="c:\acer\epm\epm-dm.exe" [2005-04-21 10:13 188416]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03
2893824]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2005-10-14 15:38
487424]
"eRecoveryService"="C:\Acer\Empowering
Technology\eRecovery\Monitor.exe" [2005-11-16 16:54 385024]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-12-24
11:20 579072]
"SmcService"="C:\PROGRA~1\Sygate\SPF\smc.exe" [2004-10-15 19:40
2577632]
"System Files Updater"="C:\WINDOWS\FlyakiteOSX\Tools\System Files
Updater.exe" [2006-02-26 07:41 118485]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
[2006-10-30 09:36 256576]
"SunJavaUpdateSched"="C:\Program
Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00
132496]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader
8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe"
[2007-10-19 20:16 286720]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-27
14:21 219136]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 16:48 48128
C:\WINDOWS\system32\narrator.exe]
C:\Documents and Settings\zhao\Start Menu\Programs\Startup\
wkcalrem.LNK - C:\Program Files\Common Files\Microsoft Shared\Works
Shared\WkCalRem.exe [2005-08-18 19:44:26]
Adobe Gamma.lnk - C:\Program Files\Common
Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16
19:16:50]
DiscMounter.lnk - C:\isystem\DiscMounter\DiscMounter.exe
[2007-10-28 22:50:27]
C:\Documents and Settings\All Users\Start
Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth
Software\BTTray.exe [2005-08-16 14:06:22]
TabUserW.exe.lnk - C:\WINDOWS\system32\WTablet\TabUserW.exe
[2007-07-16 14:14:11]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoUserNameInStartMenu"= 01000000
"NoSMHelp"= 01000000
R0 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys
[2004-12-17 17:14]
R2 EpmPsd;Acer EPM Power Scheme
Driver;C:\WINDOWS\system32\drivers\epm-psd.sys [2004-07-19
13:10]
R2 EpmShd;Acer EPM System Hardware
Driver;C:\WINDOWS\system32\drivers\epm-shd.sys [2005-04-07
18:08]
R2 int15.sys;int15.sys;C:\Acer\Empowering
Technology\eRecovery\int15.sys [2005-01-13 14:46]
R2 osaio;osaio;C:\WINDOWS\system32\drivers\osaio.sys [2005-06-30
16:58]
R2 osanbm;osanbm;C:\WINDOWS\system32\drivers\osanbm.sys [2005-01-14
15:57]
R4 DritekPortIO;Dritek General Port
I/O;C:\PROGRA~1\LAUNCH~1\DPortIO.sys [2005-10-14 15:41]
S3 pacdcacm;pacdcacm;C:\WINDOWS\system32\DRIVERS\pacdcacm.sys
[2005-08-22 01:45]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a066964a-4013-11dc-9de7-00166f676599}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
*Newly Created Service* - INT15.SYS
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-01-15 06:13:12
C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by
Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 00:23:17
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes
---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\ObjectDock\DockShellHook.dll
-> C:\Program Files\UberIcon\UberIcon.dll
.
Completion time: 2008-01-20 0:23:57
ComboFix-quarantined-files.txt 2008-01-19 16:23:56
ComboFix2.txt 2008-01-19 15:42:58
.
2008-01-09 17:01:30 --- E O F ---
