ComboFix 12-08-29.03 - SEMPRON 3000 30.08.2012  15:59:28.3.1 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.511.312 [GMT 2:00]
Running from: c:\documents and settings\SEMPRON 3000\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\SEMPRON 3000\Desktop\CFScript.txt
.
- REDUCED FUNCTIONALITY MODE -
.
.
(((((((((((((((((((((((((   Files Created from 2012-07-28 to 2012-08-30  )))))))))))))))))))))))))))))))
.
.
2012-08-28 23:07 . 2012-08-28 23:07   --------   d-----w-   c:\documents and settings\SEMPRON 3000\Application Data\SUPERAntiSpyware.com
2012-08-28 23:06 . 2012-08-28 23:07   --------   d-----w-   c:\program files\SUPERAntiSpyware
2012-08-28 23:06 . 2012-08-28 23:06   --------   d-----w-   c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2012-08-28 19:15 . 2012-08-28 19:15   --------   d-----w-   c:\documents and settings\SEMPRON 3000\Application Data\Malwarebytes
2012-08-28 19:15 . 2012-08-28 19:15   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2012-08-28 19:15 . 2012-07-03 11:46   22344   ----a-w-   c:\windows\system32\drivers\mbam.sys
2012-08-28 19:15 . 2012-08-28 19:15   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2012-08-28 18:50 . 2012-08-28 18:50   --------   d-----w-   c:\program files\CCleaner
2012-08-21 15:56 . 2012-08-21 15:57   --------   d-----w-   c:\program files\Mozilla Maintenance Service
2012-08-08 21:19 . 2012-08-08 21:20   --------   d-----w-   c:\windows\VMUVC
2012-08-08 21:19 . 2011-03-16 12:44   252928   ----a-w-   c:\windows\system32\drivers\VMUVC.sys
2012-08-08 21:19 . 2009-04-29 14:01   516096   ----a-w-   c:\windows\system32\VMUVC.ax
2012-08-08 21:19 . 2008-09-02 15:47   94208   ----a-w-   c:\windows\system32\VvFtCtrl.dll
2012-08-08 21:19 . 2008-07-01 09:16   188416   ----a-w-   c:\windows\system32\vvftUVC.ax
2012-08-08 21:19 . 2007-04-12 20:59   73728   ----a-w-   c:\windows\system32\exvmuvc.ax
2012-08-08 21:19 . 2011-05-27 07:55   399360   ----a-w-   c:\windows\system32\drivers\vvftUVC.sys
2012-08-08 21:19 . 2008-09-18 14:28   98304   ----a-w-   c:\windows\system32\VMCtrl.ax
2012-08-08 21:19 . 2008-02-29 08:11   11776   ----a-w-   c:\windows\system32\VMUVC.dll
2012-08-08 21:19 . 2007-01-24 10:26   319456   ----a-w-   c:\windows\system32\DIFxAPI.dll
2012-08-08 21:19 . 2012-08-08 21:19   --------   d-----w-   c:\program files\Vimicro Corporation
2012-08-08 13:37 . 2008-04-14 02:15   60032   -c--a-w-   c:\windows\system32\dllcache\usbaudio.sys
2012-08-08 13:37 . 2008-04-14 02:15   60032   ----a-w-   c:\windows\system32\drivers\USBAUDIO.sys
2012-08-08 13:26 . 2008-04-14 07:42   20992   ----a-w-   c:\windows\system32\dshowext.ax
2012-08-08 13:26 . 2008-04-14 02:16   121984   -c--a-w-   c:\windows\system32\dllcache\usbvideo.sys
2012-08-08 13:26 . 2008-04-14 02:16   121984   ----a-w-   c:\windows\system32\drivers\usbvideo.sys
2012-08-08 13:26 . 2008-04-14 02:15   32128   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2012-08-08 13:26 . 2008-04-14 02:15   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
.
.
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-07-06 13:58 . 2008-04-14 08:00   78336   ----a-w-   c:\windows\system32\browser.dll
2012-07-04 14:05 . 2010-09-27 20:42   139784   ----a-w-   c:\windows\system32\drivers\rdpwd.sys
2012-07-03 13:40 . 2008-04-14 08:00   1866112   ----a-w-   c:\windows\system32\win32k.sys
2012-07-03 12:30 . 2012-07-03 12:30   21419   ----a-w-   c:\windows\system32\drivers\AegisP.sys
2012-07-02 17:49 . 2008-04-23 00:16   916992   ----a-w-   c:\windows\system32\wininet.dll
2012-07-02 17:49 . 2008-07-12 19:10   43520   ----a-w-   c:\windows\system32\licmgr10.dll
2012-07-02 17:49 . 2008-04-23 00:16   1469440   ------w-   c:\windows\system32\inetcpl.cpl
2012-07-02 12:05 . 2008-07-12 19:09   385024   ----a-w-   c:\windows\system32\html.iec
2012-06-26 11:03 . 2012-06-26 11:02   3796065   ----a-w-   c:\documents and settings\All Users\Application Data\sbsdwin95req.exe
2012-06-06 23:54 . 2012-06-06 23:54   404640   ----a-w-   c:\windows\system32\FlashPlayerCPLApp.cpl
2012-06-05 15:50 . 2008-04-14 08:00   1372672   ----a-w-   c:\windows\system32\msxml6.dll
2012-06-05 15:50 . 2008-04-14 08:00   1172480   ----a-w-   c:\windows\system32\msxml3.dll
2012-06-04 15:35 . 2010-09-27 20:44   210968   ----a-w-   c:\windows\system32\wuweb.dll
2012-06-04 04:32 . 2008-04-14 08:00   152576   ----a-w-   c:\windows\system32\schannel.dll
2012-06-02 13:19 . 2010-09-28 20:12   22040   ----a-w-   c:\windows\system32\wucltui.dll.mui
2012-06-02 13:19 . 2010-09-28 20:12   15384   ----a-w-   c:\windows\system32\wuaucpl.cpl.mui
2012-06-02 13:19 . 2010-09-27 20:44   329240   ----a-w-   c:\windows\system32\wucltui.dll
2012-06-02 13:19 . 2010-09-27 20:44   219160   ----a-w-   c:\windows\system32\wuaucpl.cpl
2012-06-02 13:19 . 2010-09-28 20:12   45080   ----a-w-   c:\windows\system32\wups2.dll
2012-06-02 13:19 . 2010-09-28 20:12   15384   ----a-w-   c:\windows\system32\wuapi.dll.mui
2012-06-02 13:19 . 2010-09-27 20:44   53784   ----a-w-   c:\windows\system32\wuauclt.exe
2012-06-02 13:19 . 2010-09-27 20:44   35864   ----a-w-   c:\windows\system32\wups.dll
2012-06-02 13:19 . 2008-04-14 08:00   97304   ----a-w-   c:\windows\system32\cdm.dll
2012-06-02 13:19 . 2010-09-28 20:12   17944   ----a-w-   c:\windows\system32\wuaueng.dll.mui
2012-06-02 13:19 . 2010-09-27 20:44   577048   ----a-w-   c:\windows\system32\wuapi.dll
2012-06-02 13:19 . 2010-09-27 20:44   1933848   ----a-w-   c:\windows\system32\wuaueng.dll
2012-07-14 00:17 . 2012-08-21 15:56   136672   ----a-w-   c:\program files\mozilla firefox\components\browsercomps.dll
.
.
------- Sigcheck -------
Note: Unsigned files aren't necessarily malware.
.
[-] 2008-07-12 . 362BC5AF8EAF712832C58CC13AE05750 . 1614848 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll
.
(((((((((((((((((((((((((((((   SnapShot@2012-08-29_23.07.50   )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-08-30 10:22 . 2012-08-30 10:22   16384              c:\windows\Temp\Perflib_Perfdata_4c4.dat
+ 2008-04-14 08:00 . 2008-04-14 08:00   146432              c:\windows\regedit.exe
+ 2008-04-14 08:00 . 2008-04-14 08:00   1033728              c:\windows\explorer.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pando Media Booster"="c:\program files\Pando Networks\Media Booster\PMB.exe" [2011-10-22 3077528]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-07-09 4777856]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HTpatch"="c:\windows\htpatch.exe" [2002-10-30 28672]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 32768]
"VMonitorVMUVC"="c:\program files\Vimicro Corporation\VMUVC\VMonitor.exe" [2010-09-10 143360]
"Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-07-03 462920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Ralink Wireless Utility.lnk - c:\program files\RALINK\Common\RaUI.exe [2012-7-3 1339392]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54   551296   ----a-w-   c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableNotifications"= 1 (0x1)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [22.7.2011 18:27 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12.7.2011 23:55 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [12.8.2011 1:38 116608]
R2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [28.8.2012 21:15 655944]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [28.8.2012 21:15 22344]
S2 WCMVCAM;WebcamMax, WDM Video Capture;c:\windows\system32\drivers\wcmvcam.sys [23.6.2011 8:43 1068216]
S3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [14.1.2008 12:06 21632]
S3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [21.8.2012 17:56 113120]
S3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\drivers\ssadbus.sys [13.5.2011 3:21 121064]
S3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\drivers\ssadmdfl.sys [13.5.2011 3:21 12776]
S3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\drivers\ssadmdm.sys [13.5.2011 3:21 136808]
S3 ssadserd;SAMSUNG Android USB Diagnostic Serial Port (WDM);c:\windows\system32\drivers\ssadserd.sys [13.5.2011 3:21 114280]
S3 VMUVC;Vimicro Camera Service VMUVC;c:\windows\system32\drivers\VMUVC.sys [8.8.2012 23:19 252928]
S3 vvftUVC;Vimicro Camera Filter Service VMUVC;c:\windows\system32\drivers\vvftUVC.sys [8.8.2012 23:19 399360]
.
--- Other Services/Drivers In Memory ---
.
*NewlyCreated* - SISPORT
*Deregistered* - SiSPort
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.windowsxlive.net
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
TCP: Interfaces\{EEA9D5F0-DC04-4CAF-BB0C-7EDC61861DBA}: NameServer = 10.5.0.100
FF - ProfilePath - c:\documents and settings\SEMPRON 3000\Application Data\Mozilla\Firefox\Profiles\8oyt4nrc.default\
FF - prefs.js: browser.startup.homepage - www.google.rs
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-08-30 16:01
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  HTpatch = c:\windows\htpatch.exe?ows\CurrentVersion\Run???\???]??Z???????Z???Z???????????????? ??Z???Z?N?????Z$??????Z????????????{??Z???????????Z$?G~????(????~B~??G~?????~B~??G~???Z@???????d??????Z%??Zx??Zd??????Z,>?Z???Zv?B~Z|?Z{3?Z?2?Z????st.I????G??Z????d????<?Z?I?Z
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(496)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
c:\windows\system32\cscui.dll
.
- - - - - - - > 'explorer.exe'(2988)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\NETSHELL.dll
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\wpdshserviceobj.dll
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
Completion time: 2012-08-30  16:05:08
ComboFix-quarantined-files.txt  2012-08-30 14:05
ComboFix2.txt  2012-08-30 10:31
ComboFix3.txt  2012-08-29 23:11
.
Pre-Run: 30.299.009.024 bytes free
Post-Run: 30.285.570.048 bytes free
.
- - End Of File - - 9ACC64F35F32BF559B95C19C7AE255CB