ComboFix 14-02-03.01 - ab 02/04/2014 0:18.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3070.2337 [GMT -5:00]
Running from: c:\documents and settings\ab\Desktop\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\ab\WINDOWS
c:\windows\system32\PowerToyReadme.htm
.
.
((((((((((((((((((((((((( Files Created from 2014-01-04 to 2014-02-04 )))))))))))))))))))))))))))))))
.
.
2014-02-04 05:09 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{62DC951C-161B-4F0C-AF9A-A563C8D1E794}\mpengine.dll
2014-02-04 04:25 . 2014-02-04 04:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes' Anti-Malware (portable)
2014-02-04 04:25 . 2014-02-04 04:25 107224 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-02-04 04:24 . 2014-02-04 04:24 52312 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-02-03 02:01 . 2013-12-04 02:57 7760024 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2014-01-29 06:14 . 2014-01-29 06:14 -------- d-----w- c:\program files\iPod
2014-01-29 06:13 . 2014-01-29 06:15 -------- d-----w- c:\program files\iTunes
2014-01-29 06:13 . 2014-01-29 06:15 -------- d-----w- c:\documents and settings\All Users\Application Data\188F1432-103A-4ffb-80F1-36B633C5C9E1
2014-01-19 20:28 . 2013-12-19 02:10 877480 ----a-w- c:\windows\system32\npdeployJava1.dll
2014-01-19 20:28 . 2013-12-19 02:10 800168 ----a-w- c:\windows\system32\deployJava1.dll
2014-01-19 20:24 . 2013-12-19 02:10 94632 ----a-w- c:\windows\system32\WindowsAccessBridge.dll
2014-01-18 23:27 . 2014-01-18 23:27 -------- d-----w- c:\program files\Microsoft Silverlight
2014-01-10 23:15 . 2013-09-20 15:49 18968 ----a-w- c:\windows\system32\sdnclean.exe
2014-01-10 23:15 . 2014-01-22 05:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2014-01-10 23:14 . 2014-01-10 23:21 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
2014-01-10 08:24 . 2014-01-10 08:24 -------- d-sh--w- c:\documents and settings\ab\IECompatCache
2014-01-10 07:56 . 2014-01-11 01:40 -------- d-----w- C:\AdwCleaner
2014-01-10 07:49 . 2014-01-10 07:49 -------- d-----w- c:\documents and settings\ab\Application Data\SUPERAntiSpyware.com
2014-01-10 07:49 . 2014-02-02 03:10 -------- d-----w- c:\program files\SUPERAntiSpyware
2014-01-10 07:49 . 2014-01-10 07:49 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2014-01-10 07:47 . 2014-01-10 07:47 -------- d-----w- c:\documents and settings\ab\Application Data\Malwarebytes
2014-01-10 07:46 . 2014-01-10 07:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2014-01-10 07:46 . 2014-01-10 07:47 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2014-01-10 07:46 . 2013-04-04 19:50 22856 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-10 06:25 . 2014-02-02 01:46 -------- d-----w- c:\program files\VideoPlayerV3
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-29 06:25 . 2012-04-11 22:39 71048 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2014-01-29 06:25 . 2012-04-11 22:39 692616 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2014-01-19 07:32 . 2012-04-11 08:12 231584 ------w- c:\windows\system32\MpSigStub.exe
2013-12-19 01:46 . 2012-06-21 03:15 145408 ----a-w- c:\windows\system32\javacpl.cpl
2013-11-27 20:21 . 2006-02-28 12:00 40960 ----a-w- c:\windows\system32\drivers\ndproxy.sys
2013-11-13 02:59 . 2006-02-28 12:00 150528 ----a-w- c:\windows\system32\imagehlp.dll
2013-11-07 05:38 . 2006-02-28 12:00 591360 ----a-w- c:\windows\system32\rpcrt4.dll
2006-05-03 16:06 163328 --sha-r- c:\windows\system32\flvDX.dll
2007-02-21 17:47 31232 --sha-r- c:\windows\system32\msfDX.dll
2008-03-16 19:30 216064 --sha-r- c:\windows\system32\nbDX.dll
2010-01-07 04:00 107520 --sha-r- c:\windows\system32\TAKDSDecoder.dll
2012-10-06 00:54 188416 --sha-r- c:\windows\system32\winDCE32.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\ab\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\ab\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\ab\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-11 02:09 131248 ----a-w- c:\documents and settings\ab\Application Data\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Plex Media Server"="c:\program files\Plex\Plex Media Server\Plex Media Server.exe" [2013-06-03 3997832]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-11-21 959904]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2014-01-20 43848]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2013-10-23 948440]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 339968]
"CDAServer"="c:\program files\Common Files\Common Desktop Agent\CDASrv.exe" [2012-02-21 344064]
"Adobe Acrobat Speed Launcher"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe" [2013-12-18 41336]
"Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe" [2013-12-18 840568]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2013-05-01 421888]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"SDTray"="c:\program files\Spybot - Search & Destroy 2\SDTray.exe" [2013-07-25 5624784]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2014-01-20 152392]
.
c:\documents and settings\ab\Start Menu\Programs\Startup\
Dropbox.lnk - c:\documents and settings\ab\Application Data\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-2 30714328]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\PLANET\Bluetooth Software\BTTray.exe [2005-5-31 577597]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE -b -l [2001-2-13 83360]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe /startup [2008-5-26 123904]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2013-05-07 115440]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"lmab_device"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Games\\Flight Simulator 9\\fs9.exe"=
"c:\\WINDOWS\\system32\\dpnsvr.exe"=
"c:\\WINDOWS\\system32\\lmabcoms.exe"=
"c:\\Documents and Settings\\ab\\Application Data\\Dropbox\\bin\\Dropbox.exe"=
"c:\\Program Files\\Adobe\\Adobe Dreamweaver CS3\\Dreamweaver.exe"=
"c:\\WINDOWS\\twain_32\\Samsung\\SCX472x\\SCNSearch\\USDAgent.exe"=
"c:\\Program Files\\Samsung\\Easy Printer Manager\\IDS.Application.exe"=
"c:\\Program Files\\Samsung\\Easy Printer Manager\\OrderSupplies.exe"=
"c:\\Program Files\\Samsung\\Easy Printer Manager\\IDSAlert.exe"=
"c:\\Program Files\\Samsung\\Easy Printer Manager\\CDAS2PC\\CDAS2PC.exe"=
"c:\\Program Files\\Samsung\\Easy Document Creator\\USDAgent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Plex\\Plex Media Server\\Plex Media Server.exe"=
"c:\\Program Files\\Plex\\Plex Media Server\\PlexScriptHost.exe"=
"c:\\Program Files\\Plex\\Plex Media Server\\PlexDlnaServer.exe"=
"c:\\Program Files\\Plex\\Plex Media Center\\Plex.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDTray.exe"=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDFSSvc.exe"=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdate.exe"=
"c:\\Program Files\\Spybot - Search & Destroy 2\\SDUpdSvc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5985:TCP"= 5985:TCP:*
isabled:Windows Remote Management
.
R1 MpKsl9294977c;MpKsl9294977c;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EDB52725-524C-4CEC-919A-EE0795356EFC}\MpKsl9294977c.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{EDB52725-524C-4CEC-919A-EE0795356EFC}\MpKsl9294977c.sys [?]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [10/10/2013 5:54 PM 120088]
R2 Samsung Network Fax Server;Samsung Network Fax Server;c:\windows\system32\spool\drivers\w32x86\3\NetFaxServer.exe [11/30/2012 6:28 PM 181760]
R2 SDScannerService;Spybot-S&D 2 Scanner Service;c:\program files\Spybot - Search & Destroy 2\SDFSSvc.exe [1/10/2014 6:15 PM 3921880]
R2 SDUpdateService;Spybot-S&D 2 Updating Service;c:\program files\Spybot - Search & Destroy 2\SDUpdSvc.exe [1/10/2014 6:15 PM 1042272]
R2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.sys [2/15/2012 8:16 AM 5120]
S2 SDWSCService;Spybot-S&D 2 Security Center Service;c:\program files\Spybot - Search & Destroy 2\SDWSCSvc.exe [1/10/2014 6:15 PM 171416]
S2 SkypeUpdate;Skype Updater;c:\program files\Skype\Updater\Updater.exe [9/5/2013 10:34 AM 171680]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - WS2IFSL
*Deregistered* - mbamchameleon
.
Contents of the 'Scheduled Tasks' folder
.
2014-02-04 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-11 06:25]
.
2014-02-04 c:\windows\Tasks\Check for updates (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDUpdate.exe [2014-01-10 15:57]
.
2014-02-01 c:\windows\Tasks\Defrag C.job
- c:\windows\system32\defrag.exe [2006-02-28 00:12]
.
2014-02-01 c:\windows\Tasks\Defrag D.job
- c:\windows\system32\defrag.exe [2006-02-28 00:12]
.
2014-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-14 22:35]
.
2014-02-04 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2012-04-14 22:35]
.
2014-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-854245398-839522115-1003Core.job
- c:\documents and settings\ab\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-14 22:31]
.
2014-02-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2025429265-854245398-839522115-1003UA.job
- c:\documents and settings\ab\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2012-04-14 22:31]
.
2014-02-04 c:\windows\Tasks\Microsoft Antimalware Scheduled Scan.job
- c:\program files\Microsoft Security Client\MpCmdRun.exe [2013-10-23 20:01]
.
2014-02-01 c:\windows\Tasks\MyDocs.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2014-02-03 c:\windows\Tasks\MyDocs_diff.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2012-07-20 c:\windows\Tasks\MyVids.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2013-02-14 c:\windows\Tasks\MyVids_inc.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2014-02-03 c:\windows\Tasks\Outlook.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2014-01-29 c:\windows\Tasks\Refresh immunization (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDImmunize.exe [2014-01-10 15:49]
.
2014-01-11 c:\windows\Tasks\remote_MyDocs.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2012-05-10 c:\windows\Tasks\remote_MyDocs_diff.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2014-01-11 c:\windows\Tasks\remote_Outlook.job
- c:\windows\system32\ntbackup.exe [2006-02-28 00:12]
.
2014-02-01 c:\windows\Tasks\Scan the system (Spybot - Search & Destroy).job
- c:\program files\Spybot - Search & Destroy 2\SDScan.exe [2014-01-10 15:51]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office10\EXCEL.EXE/3000
IE: Send To &Bluetooth - c:\program files\PLANET\Bluetooth Software\btsendto_ie_ctx.htm
Trusted Zone: adobe.com
Trusted Zone: aol.com\free
Trusted Zone: netflix.com
Trusted Zone: samsungsetup.com\www
Trusted Zone: sosonlinebackup.com
Trusted Zone: symantec.com
TCP: Interfaces\{9339AF5B-E908-4F9B-988C-8FC3DF3C2FB4}: NameServer = 209.18.47.61,209.18.47.62
FF - ProfilePath - c:\documents and settings\ab\Application Data\Mozilla\Firefox\Profiles\cyr4tuop.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - ExtSQL: 2013-12-20 10:25;
ext@WebexpEnhancedV1alpha710.net; c:\program files\WebexpEnhancedV1\WebexpEnhancedV1alpha710\ff
.
- - - - ORPHANS REMOVED - - - -
.
Notify-SDWinLogon - SDWinLogon.dll
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2014-02-04 00:25
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer,
http://www.gmer.net
Windows 5.1.2600 Disk: Hitachi_HDS723020BLA642 rev.MN6OA800 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-22
.
device: opened successfully
user: MBR read successfully
kernel: MBR read successfully
user != kernel MBR !!!
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
Completion time: 2014-02-04 00:28:00
ComboFix-quarantined-files.txt 2014-02-04 05:27
.
Pre-Run: 21,672,935,424 bytes free
Post-Run: 22,366,085,120 bytes free
.
- - End Of File - - A80D4360CE0FE14BC933F2DC533DC845
8F558EB6672622401DA993E1E865C861
