ComboFix 11-07-13.01 - Flo 13/07/2011 19:57:14.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1014.653 [GMT 2:00]
Running from: c:\documents and settings\Flo\Desktop\Florent.exe
Command switches used :: c:\documents and settings\Flo\Desktop\CFScript.txt
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
.
\\.\PhysicalDrive0 - Bootkit TDL4 was found and disinfected
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Legacy_AMSERVICE
-------\Legacy_QIQWLQDZ
-------\Legacy_SSHNAS
-------\Service_AMService
-------\Service_qiqwlqdz
-------\Service_SSHNAS
.
.
((((((((((((((((((((((((( Files Created from 2011-06-13 to 2011-07-13 )))))))))))))))))))))))))))))))
.
.
2011-07-12 19:43 . 2011-07-12 20:47 -------- d-----w- C:\Florent
2011-07-12 18:32 . 2011-07-12 18:32 -------- d-----w- c:\program files\Ad-Remover
2011-07-10 18:03 . 2011-07-11 19:43 -------- d-----w- C:\Kill'em
2011-07-10 16:26 . 2011-07-10 16:27 -------- d-----w- c:\program files\Microsoft Works
2011-07-10 16:14 . 2011-07-10 16:14 -------- d-----w- c:\program files\Microsoft Visual Studio 8
2011-07-10 16:12 . 2011-07-10 16:26 -------- d-----w- c:\windows\SHELLNEW
2011-07-10 16:11 . 2011-07-10 16:11 -------- d-----r- C:\MSOCache
2011-07-09 17:49 . 2001-08-17 10:12 97354 ----a-w- c:\windows\system32\dllcache\aspndis3.sys
2011-07-09 17:49 . 2001-08-17 11:51 14848 ----a-w- c:\windows\system32\dllcache\asc3550.sys
2011-07-09 17:49 . 2001-08-17 11:52 22400 ----a-w- c:\windows\system32\dllcache\asc3350p.sys
2011-07-09 17:49 . 2001-08-17 11:52 26496 ----a-w- c:\windows\system32\dllcache\asc.sys
2011-07-09 17:47 . 2001-08-17 10:19 584448 ----a-w- c:\windows\system32\dllcache\adm8810.sys
2011-07-09 17:46 . 2001-08-17 12:56 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll
2011-07-06 20:14 . 2011-07-06 20:14 -------- d-----w- c:\program files\iPod
2011-07-04 14:54 . 2011-07-04 14:54 72192 ----a-w- c:\windows\system32\tasklist.exe
2011-06-26 17:48 . 2011-07-10 18:01 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2011-06-26 17:48 . 2011-06-26 17:48 -------- d-----w- c:\program files\AVAST Software
2011-06-26 17:05 . 2011-06-26 17:05 -------- d-----w- c:\documents and settings\All Users\Application Data\{AB2D8F2E-F7AD-4446-A11A-50D846B2CF2A}
2011-06-26 16:38 . 2011-06-26 16:38 -------- d-----w- c:\documents and settings\Flo\Application Data\Uniblue
2011-06-26 16:37 . 2011-06-26 16:37 -------- d-----w- c:\program files\Uniblue
2011-06-26 16:36 . 2011-06-26 16:36 -------- d-----w- c:\documents and settings\Flo\Local Settings\Application Data\PackageAware
2011-06-26 14:49 . 2011-06-26 14:49 -------- d-----w- c:\program files\CCleaner
2011-06-21 20:33 . 2011-06-21 20:33 133120 ----a-w- c:\windows\system32\drivers\ethricqw.sys
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-05-29 07:11 . 2011-05-15 10:06 39984 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-05-29 07:11 . 2011-05-15 10:06 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-05-10 06:06 . 2009-09-30 20:12 4517664 ----a-w- c:\windows\system32\usbaaplrc.dll
2011-05-10 06:06 . 2009-09-30 20:12 42496 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2011-05-02 15:31 . 2006-07-28 18:03 692736 ----a-w- c:\windows\system32\inetcomm.dll
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-07-12_20.34.27 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-07-13 18:12 . 2011-07-13 18:12 16384 c:\windows\temp\Perflib_Perfdata_d4.dat
+ 2011-07-13 17:26 . 2011-07-13 17:26 1095680 c:\windows\system32\sshnas21.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3C3ECEF-F82D-179F-F474-EF31055E4512}]
c:\windows\system32\jwqcemqx.dll [BU]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VeriFace Enc]
@="{771C7324-DA80-49D3-8017-753B0AF60951}"
[HKEY_CLASSES_ROOT\CLSID\{771C7324-DA80-49D3-8017-753B0AF60951}]
2009-09-20 16:32 241752 ----a-w- c:\windows\system32\IcnOvrly.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-09-30 39408]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2009-04-09 1512744]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-28 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-28 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-28 137752]
"BisonMnt"="c:\windows\BisonC07\BisonM07.exe" [2008-10-14 32768]
"VeriFaceManager"="c:\program files\Lenovo\VeriFaceIII\PManage.exe" [2009-09-20 323584]
"EnergyUtility"="c:\program files\Lenovo\Energy Management\utility.exe" [2009-01-04 4462464]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-01 148888]
"itype"="c:\program files\Microsoft IntelliType Pro\itype.exe" [2009-06-01 1501064]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-12-14 47904]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\Lenovo\Bluetooth Software\BTTray.exe [2009-1-17 604776]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PicNotify]
2009-09-20 16:32 1167360 ----a-w- c:\windows\system32\PicNotify.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaws.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\crazyloader.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"14462:TCP"= 14462:TCP:spport
"16297:TCP"= 16297:TCP:spport
"62580:TCP"= 62580:TCP:@xpsp2res.dll,-22009
"61233:TCP"= 61233:TCP:@xpsp2res.dll,-22009
.
R2 DvmMDES;DeviceVM Meta Data Export Service;c:\qstart.sys\config\DVMExportService.exe [26/03/2009 19:20 315392]
R2 System_Repair_UpdateMonitor;System Repair Windows Update Monitor;c:\program files\Lenovo\OneKey App\System Repair\UpdateMonitor.exe [19/08/2009 13:19 430080]
R2 tvtumon;tvtumon;c:\windows\system32\drivers\tvtumon.sys [19/08/2009 13:19 48192]
R3 ACPIVPC;Lenovo Virtual Power Controller Driver;c:\windows\system32\drivers\AcpiVpc.sys [20/09/2009 18:39 9472]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys --> c:\windows\system32\DRIVERS\Lbd.sys [?]
S1 ethricqw;ethricqw;c:\windows\system32\drivers\ethricqw.sys [21/06/2011 22:33 133120]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [18/05/2010 19:14 136176]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [19/08/2009 13:11 1684736]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [18/05/2010 19:14 136176]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys --> c:\windows\system32\Drivers\RtsUStor.sys [?]
S3 RtsUIR;Realtek IR Driver;c:\windows\system32\DRIVERS\Rts516xIR.sys --> c:\windows\system32\DRIVERS\Rts516xIR.sys [?]
S3 WSVD;WSVD;c:\windows\system32\drivers\WSVD.sys [19/08/2009 13:18 81192]
.
Contents of the 'Scheduled Tasks' folder
.
2011-07-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 17:13]
.
2011-07-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-05-18 17:13]
.
2009-10-03 c:\windows\Tasks\Microsoft_Hardware_Launch_IType_exe.job
- c:\program files\Microsoft IntelliType Pro\itype.exe [2009-06-01 20:43]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: Send to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send To Bluetooth - c:\program files\Lenovo\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 212.27.40.240 212.27.40.241
FF - ProfilePath - c:\documents and settings\Flo\Application Data\Mozilla\Firefox\Profiles\p7v2whn7.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2011-07-13 20:13
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
BisonMnt = c:\windows\BisonC07\BisonM07.exe????????????????????????????????????????????????????????????????????????????????h5??????????????????????????????????????????????????????'????v?|???????????? ???????????x????x?|?????y!????????????????|?????????????????X?w???
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(880)
c:\windows\system32\WININET.dll
c:\windows\system32\PicNotify.dll
c:\windows\system32\FaceVerify.dll
c:\windows\system32\MainOp.dll
c:\windows\system32\VideoOp.dll
c:\windows\system32\Image.dll
c:\windows\system32\Momo.dll
c:\windows\system32\Apblend.dll
c:\windows\system32\SetDev.dll
c:\windows\system32\FunFrm.dll
c:\windows\system32\facev.dll
c:\windows\system32\3DImageRenderer.dll
c:\windows\system32\d3dx9_35.dll
c:\windows\system32\DevIL.dll
c:\windows\system32\ILU.dll
c:\windows\system32\CamOpex.dll
c:\windows\system32\WMVCore.DLL
c:\windows\system32\WMASF.DLL
c:\windows\system\BisonC07.dll
.
- - - - - - - > 'lsass.exe'(940)
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2032)
c:\windows\system32\WININET.dll
c:\windows\system32\IcnOvrly.dll
c:\windows\system32\btmmhook.dll
c:\windows\system32\ieframe.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Lenovo\Bluetooth Software\bin\btwdins.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2011-07-13 20:19:46 - machine was rebooted
ComboFix-quarantined-files.txt 2011-07-13 18:19
ComboFix2.txt 2011-07-12 20:42
.
Pre-Run: 25 076 789 248 bytes free
Post-Run: 24 949 805 056 bytes free
.
- - End Of File - - CFF3128B4190138E6402A69F184F758F
