ComboFix 08-03-13.4 - Administrator 2008-03-14 16:26:58.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1257 [GMT 1:00] Running from: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Y8UW612I\ComboFix[1].exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 ))))))))))))))))))))))))))))))) . 2008-03-14 16:01 . 2008-03-14 16:01 d-------- C:\Program Files\Uniblue 2008-03-14 16:01 . 2008-03-14 16:01 d-------- C:\Documents and Settings\All Users\Application Data\Uniblue 2008-03-14 16:01 . 2008-03-14 16:01 d-------- C:\Documents and Settings\Administrator\Application Data\Uniblue 2008-03-13 22:00 . 2008-03-13 22:00 d-------- C:\Program Files\Trend Micro 2008-03-12 16:42 . 2008-03-14 09:20 d-------- C:\Documents and Settings\Administrator\Application Data\AVG7 2008-03-12 16:41 . 2008-03-12 16:41 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7 2008-03-12 16:41 . 2008-03-12 16:41 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-03-12 16:41 . 2008-03-13 19:34 d-------- C:\Documents and Settings\All Users\Application Data\avg7 2008-03-11 20:49 . 2008-03-13 20:29 d-------- C:\Program Files\Spybot - Search & Destroy 2008-03-11 20:49 . 2008-03-13 20:29 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-11 19:42 . 2008-03-14 16:26 d-------- C:\QUARANTINE 2008-03-08 15:14 . 2008-03-08 15:14 d-------- C:\BSplayer 2008-03-02 14:09 . 2008-03-02 14:09 d-------- C:\Program Files\Lavasoft 2008-03-02 14:09 . 2008-03-02 14:10 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-03-02 14:08 . 2008-03-02 14:08 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-02-26 20:47 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2008-02-26 20:42 . 2008-02-26 20:45 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-02-26 20:42 . 2008-03-11 19:53 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller 2008-02-24 16:04 . 1998-05-29 09:51 274,432 --a------ C:\WINDOWS\system32\VCT32150.dll 2008-02-24 16:04 . 1997-09-03 16:58 195,584 --a------ C:\WINDOWS\system32\MVoice.vxp 2008-02-15 21:32 . 2008-02-15 21:32 d-------- C:\Program Files\Trymedia . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-13 21:18 --------- d-----w C:\Program Files\Windows Live 2008-03-12 14:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-03-11 20:11 --------- d-----w C:\Program Files\AdVantage 2008-02-27 13:17 --------- d-----w C:\Program Files\Business tycoon 2008-02-26 19:43 --------- d-----w C:\Program Files\MSN Messenger 2008-02-07 14:25 --------- d-----w C:\Program Files\Common Files\Adobe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="C:\Program Files\Dell Support\DSAgnt.exe" [2006-08-28 21:57 395776] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 23:29 165784] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-04-15 21:49 159744] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-31 15:50 8429568] "nwiz"="nwiz.exe" [2007-05-31 15:50 1626112 C:\WINDOWS\system32\nwiz.exe] "NVHotkey"="nvHotkey.dll" [2007-05-31 15:50 67584 C:\WINDOWS\system32\nvhotkey.dll] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-31 15:50 81920] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496] "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-02-20 12:29 1191936] "SigmatelSysTrayApp"="stsystra.exe" [2007-02-18 23:26 303104 C:\WINDOWS\stsystra.exe] "Document Manager"="C:\Program Files\Wave Systems Corp\Services Manager\DocMgr\bin\docmgr.exe" [2006-09-08 08:32 102400] "IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 11:19 819200] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 11:17 970752] "KADxMain"="C:\WINDOWS\system32\KADxMain.exe" [2006-11-02 14:05 282624] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50 221184] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50 81920] "RoxioDragToDisc"="C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 09:00 1116920] "PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 17:23 118784] "ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-10-16 20:50 111952] "McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 10:27 136768] "bginfo"="c:\windows\system32\bginfo.exe" [2003-06-19 15:22 512045] "GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 23:47 31016] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-05-16 15:50 138008] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-05-16 15:50 162584] "Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-05-16 15:50 138008] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792] "Flash Media"="" [] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-13 19:35 579072] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 05:00 15360] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-12 16:41 219136] C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 19:24:54 98632] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2007-01-11 19:43:46 2150400] Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-27 01:38:18 50688] EMBASSY Trust Suite Secure Update.lnk - C:\Program Files\Wave Systems Corp\Services Manager\Secure Update\AutoUpdate.exe [2006-08-25 09:45:30 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=wxvault.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 wvauth [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Sports Interactive\\Football Manager 2008\\fm.exe"= "C:\\Program Files\\Java\\jdk1.5.0\\jre\\bin\\java.exe"= "C:\\Program Files\\BearShare\\BearShare.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Business tycoon\\btycoon.exe"= "C:\\DOCUME~1\\ADMINI~1\\LOCALS~1\\Temp\\services.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= R0 PBADRV;PBADRV;C:\WINDOWS\system32\drivers\pbadrv.sys [2005-12-09 15:35] R1 DLARTL_M;DLARTL_M;C:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-08-11 10:35] R2 ASFIPmon;Broadcom ASF IP and SMBIOS Mailbox Monitor;"C:\Program Files\Broadcom\ASFIPMon\AsfIpMon.exe" -service [] R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29] R3 DXEC01;DXEC01;C:\WINDOWS\system32\drivers\dxec01.sys [2006-11-02 12:32] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{38e9ecfa-830f-11dc-9704-001a6bc54464}] \Shell\AutoRun\command - F:\autorun.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-14 16:31:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... ? [2108] scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156] -> C:\WINDOWS\system32\DLAAPI_W.DLL . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\savedump.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\System32\SCardSvr.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\Program Files\Wave Systems Corp\Common\DataServer.exe C:\Program Files\McAfee\Common Framework\FrameworkService.exe C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exe C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe C:\Program Files\McAfee\Common Framework\naPrdMgr.exe c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe C:\Program Files\NTRU Cryptosystems\NTRU Hybrid TSS v2.0.25\bin\tcsd_win32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Apoint\ApMsgFwd.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Apoint\HidFind.exe C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\McAfee\Common Framework\McTray.exe . ************************************************************************** . Completion time: 2008-03-14 16:34:29 - machine was rebooted . 2008-03-12 14:26:19 --- E O F ---