This is the HiJackThis log:
Deckard's System Scanner v20070905.67
Run by Eunice on 2007-10-14 20:11:54
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Percentage of Memory in Use: 85% (more than 75%).
Total Physical Memory: 248 MiB (512 MiB recommended).
-- HijackThis (run as Eunice.exe) ----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:12:54 PM, on 10/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\WINDOWS\system32\bcmntray.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\LClock\LClock.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\HPQ\Shared\hpqwmi.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Eunice\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Eunice.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.****online.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.****online.com/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\bcmntray
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Glass2k] C:\Program Files\Glass2k\Glass2k.exe
O4 - HKLM\..\Run: [LClock] C:\Program Files\LClock\LClock.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0\bin\npjpi150.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted Zone: *.amaena.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/ca..._2.3.3.102.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1162464816078
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\Shared\hpqwmi.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
--
End of file - 8948 bytes
-- Files created between 2007-09-14 and 2007-10-14 -----------------------------
2007-10-14 20:12:19 0 d-------- C:\Program Files\Trend Micro
2007-10-14 17:17:25 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2007-10-14 17:17:17 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-10-12 01:12:37 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-10-12 01:12:32 0 d-------- C:\WINDOWS\LastGood
2007-10-06 13:26:52 0 d-------- C:\Documents and Settings\Eunice\Application Data\Printer Info Cache
2007-10-05 19:11:18 0 d-------- C:\Program Files\DIFX
2007-10-05 19:04:36 0 d-------- C:\Program Files\Common Files\Pure Networks Shared
2007-10-05 19:04:36 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Pure Networks
2007-10-05 19:03:08 0 d-------- C:\Program Files\Pure Networks
2007-10-04 15:42:36 0 d-------- C:\Documents and Settings\Eunice\Application Data\Grisoft
2007-10-04 13:54:12 0 d-------- C:\Documents and Settings\Eunice\Application Data\WinPatrol
2007-10-04 13:53:38 0 d-------- C:\Program Files\BillP Studios
2007-10-04 06:55:12 0 d-------- C:\Documents and Settings\Eunice\Application Data\WinRAR
2007-10-04 00:48:37 0 dr-h----- C:\$VAULT$.AVG
2007-10-03 22:35:56 0 d-------- C:\Documents and Settings\Eunice\Application Data\AVG7
2007-10-03 22:35:25 0 d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\AVG7
2007-10-03 22:34:18 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2007-10-03 22:34:18 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2007-10-03 22:05:39 0 d-------- C:\Temp
2007-10-03 22:00:06 0 d-------- C:\Documents and Settings\Eunice\.java
2007-09-26 02:11:22 0 d-------- C:\Documents and Settings\Eunice\Application Data\Ventrilo
2007-09-26 02
34 0 d-------- C:\Program Files\Ventrilo
-- Find3M Report ---------------------------------------------------------------
2007-10-12 17:30:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-10-12 02:54:30 0 d-------- C:\Program Files\RocketDock
2007-10-12 02:47:03 0 d-------- C:\Program Files\LClock
2007-10-12 02:45:36 0 d-------- C:\Program Files\iTunes
2007-10-06 18:58:10 0 d-------- C:\Documents and Settings\Eunice\Application Data\Screenshot Sender
2007-10-06 13:27:10 0 d-------- C:\Documents and Settings\Eunice\Application Data\Image Zone Express
2007-10-05 19:04:36 0 d-------- C:\Program Files\Common Files
2007-10-04 16:35:39 0 d-------- C:\Documents and Settings\Eunice\Application Data\Azureus
2007-10-03 23:53:19 0 d-------- C:\Program Files\Yahoo!
2007-10-03 22:03:52 0 d-------- C:\Program Files\Azureus
2007-09-29 04:29:59 0 d-------- C:\Program Files\Legacy Online
2007-09-15 13:04:37 0 d-------- C:\Documents and Settings\Eunice\Application Data\Adobe
2007-09-15 11:42:30 0 d-------- C:\Documents and Settings\Eunice\Application Data\AdobeUM
2007-09-12 22:46:10 0 d-------- C:\Program Files\Common Files\Adobe
2007-09-12 22:40:01 0 d-------- C:\Program Files\Common Files\Adobe Systems Shared
2007-08-31 12:55:39 0 d-------- C:\Documents and Settings\Eunice\Application Data\Yahoo!
2007-08-22 10:44:11 0 d-------- C:\Program Files\In The Groove
2007-08-14 10:43:41 0 d-------- C:\Program Files\MSXML 6.0
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [08/04/2004 08:00 AM]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 AM]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [08/04/2004 08:00 AM]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [10/14/2004 09:11 AM]
"AGRSMMSG"="AGRSMMSG.exe" [04/13/2005 09:12 AM C:\WINDOWS\AGRSMMSG.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [06/20/2005 07:50 AM]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [09/07/2004 04:28 PM]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [12/08/2004 08:23 PM]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\bcmntray" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [05/11/2005 11:12 PM]
"Glass2k"="C:\Program Files\Glass2k\Glass2k.exe" [12/12/2003 11:43 PM]
"LClock"="C:\Program Files\LClock\LClock.exe" [09/20/2004 01:27 AM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [10/27/2006 12:47 AM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [10/03/2007 10:34 PM]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [09/07/2007 12:13 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 05:25 AM]
"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [11/01/2006 12:04 AM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 08:00 AM]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [03/19/2007 12:05 AM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [10/18/2006 09:05 PM]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [03/30/2006 04:45 PM]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [08/27/2007 04:19 PM]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe
"Persistence"=C:\WINDOWS\system32\igfxpers.exe
"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"WatchDog"=C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0\bin\jusched.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1998dde-c68e-11db-a88f-0014a514a058}]
AutoRun\command- F:\LaunchU3.exe -a
-- End of Deckard's System Scanner: finished at 2007-10-14 20:13:41 ------------
This is ComboFix log:
ComboFix 07-10-14.4 - Eunice 2007-10-14 16:01:21.2 - NTFSx86
Script execution time was exceeded on script "C:\ComboFix\osid.vbs".
Script execution was terminated.
Running from: C:\Documents and Settings\Eunice\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Temp\xOe
C:\Temp\xOe\tOasF.log
C:\WINDOWS\system32\vMW02a
.
((((((((((((((((((((((((( Files Created from 2007-09-14 to 2007-10-14 )))))))))))))))))))))))))))))))
.
2007-10-12 15:06 <DIR> d-------- C:\Deckard
2007-10-12 01:12 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-10-12 01:12 <DIR> d-------- C:\WINDOWS\LastGood
2007-10-10 15:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-10-09 16:49 582,656 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-06 13:26 <DIR> d-------- C:\Documents and Settings\Eunice\Application Data\Printer Info Cache
2007-10-05 19:11 <DIR> d-------- C:\Program Files\DIFX
2007-10-05 19:11 25,792 --a------ C:\WINDOWS\system32\drivers\pnarp.sys
2007-10-05 19:10 26,944 --a------ C:\WINDOWS\system32\drivers\purendis.sys
2007-10-05 19:04 <DIR> d-------- C:\Program Files\Common Files\Pure Networks Shared
2007-10-05 19:04 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Pure Networks
2007-10-05 19:03 <DIR> d-------- C:\Program Files\Pure Networks
2007-10-04 15:42 <DIR> d-------- C:\Documents and Settings\Eunice\Application Data\Grisoft
2007-10-04 15:35 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-10-04 13:54 <DIR> d-------- C:\Documents and Settings\Eunice\Application Data\WinPatrol
2007-10-04 13:53 <DIR> d-------- C:\Program Files\BillP Studios
2007-10-03 22:35 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY\Application Data\AVG7
2007-10-03 22:35 <DIR> d-------- C:\Documents and Settings\Eunice\Application Data\AVG7
2007-10-03 22:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2007-10-03 22:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2007-10-03 22:10 <DIR> d-------- C:\Program Files\Temporary
2007-10-03 22:07 <DIR> d-------- C:\WINDOWS\system32\abc2
2007-10-03 22:06 <DIR> d-------- C:\WINDOWS\system32\ep1
2007-10-03 22:05 <DIR> d-------- C:\Temp
2007-10-03 22:00 <DIR> d-------- C:\Documents and Settings\Eunice\.java
2007-09-29 21:59 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2007-09-29 21:59 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2007-09-26 02:11 <DIR> d-------- C:\Documents and Settings\Eunice\Application Data\Ventrilo
2007-09-26 02:06 <DIR> d-------- C:\Program Files\Ventrilo
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-12 21:30 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-10-12 06:54 --------- d-----w C:\Program Files\RocketDock
2007-10-12 06:47 --------- d-----w C:\Program Files\LClock
2007-10-12 06:45 --------- d-----w C:\Program Files\iTunes
2007-10-09 23:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\hpqwmi
2007-10-09 23:10 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft Help
2007-10-06 22:58 --------- d-----w C:\Documents and Settings\Eunice\Application Data\Screenshot Sender
2007-10-06 17:27 --------- d-----w C:\Documents and Settings\Eunice\Application Data\Image Zone Express
2007-10-04 20:35 --------- d-----w C:\Documents and Settings\Eunice\Application Data\Azureus
2007-10-04 04:48 --------- d-----w C:\Documents and Settings\Eunice\Application Data\load else ooze
2007-10-04 04:48 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\loadcopydatajunk
2007-10-04 03:53 --------- d-----w C:\Program Files\Yahoo!
2007-10-04 02:03 --------- d-----w C:\Program Files\Azureus
2007-09-29 08:29 --------- d-----w C:\Program Files\Legacy Online
2007-09-15 15:42 --------- d-----w C:\Documents and Settings\Eunice\Application Data\AdobeUM
2007-09-13 02:46 --------- d-----w C:\Program Files\Common Files\Adobe
2007-09-13 02:40 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-09-13 02:40 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe Systems
2007-08-31 16:55 --------- d-----w C:\Documents and Settings\Eunice\Application Data\Yahoo!
2007-08-31 02:13 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2007-08-22 14:44 --------- d-----w C:\Program Files\In The Groove
2007-08-22 14:20 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-14 14:43 --------- d-----w C:\Program Files\MSXML 6.0
2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-07-30 23:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll
2007-07-30 23:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-01-05 03:29 32 -c--a-r C:\Documents and Settings\All Users\hash.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{37F0F8AE-AC34-462C-9EAE-D5E961ABF59B}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 08:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 08:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 08:00]
"SoundMAXPnP"="C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 09:11]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-13 09:12 C:\WINDOWS\AGRSMMSG.exe]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-06-20 07:50]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-09-07 16:28]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2004-12-08 20:23]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\bcmntray" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12]
"Glass2k"="C:\Program Files\Glass2k\Glass2k.exe" [2003-12-12 23:43]
"LClock"="C:\Program Files\LClock\LClock.exe" [2004-09-20 01:27]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 00:47]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-03 22:34]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-07 12:13]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"nmapp"="C:\Program Files\Pure Networks\Network Magic\nmapp.exe" [2006-11-01 00:04]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-03-19 00:05]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-27 16:19]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrrpq]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SoundMAX"=C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
"dla"=C:\WINDOWS\system32\dla\tfswctrl.exe
"Persistence"=C:\WINDOWS\system32\igfxpers.exe
"eabconfg.cpl"=C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
"WatchDog"=C:\Program Files\InterVideo\DVD Check\DVDCheck.exe
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.5.0\bin\jusched.exe
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
R1 ClntMgmt.sys;ClntMgmt.sys;C:\WINDOWS\system32\Drivers\ClntMgmt.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d1998dde-c68e-11db-a88f-0014a514a058}]
AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
"2007-10-12 21:20:24 C:\WINDOWS\Tasks\1-Click Maintenance.job"
.
**************************************************************************
catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-10-14 16:09:05
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?2?8?4??????? ???B???????????????B? ??????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-10-14 16:10:22
C:\ComboFix2.txt ... 2007-10-10 15:25
.
--- E O F ---
During the online scan my antivirus register an infection:
C: System Volume Information\_restore\7572D66-EEA1-46BB-BBF5-E93C933DI354}RP7\A0000118.dll
VIrus found Lop
This appeared like more than 10 times and the last 3 numbers went up to 120.