|
Registered User
Join Date: Jan 2008
Posts: 12
OS: WinXP SP2
|
Re: Constant popups/slow pc - Virtumonde infection
Combo Fix Log
ComboFix 08-01-20.1 - Angela 2008-01-20 21:36:51.1 - NTFSx86
Running from: C:\Documents and Settings\Angela\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
The following files were disabled during the run:
C:\WINDOWS\system32\sockspy.dll
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Angela\My Documents\SSTEM~1
C:\WINDOWS\cookies.ini
C:\WINDOWS\racle~1
C:\WINDOWS\racle~1\?racle\
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\sstem3~1
C:\WINDOWS\system32\wnsapisv.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NTNDIS
-------\DomainService
((((((((((((((((((((((((( Files Created from 2007-12-21 to 2008-01-21 )))))))))))))))))))))))))))))))
.
2008-01-20 21:35 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-09 21:47 . 2008-01-09 21:47 <DIR> d-------- C:\Documents and Settings\Angela\Application Data\Wireshark
2008-01-09 20:43 . 2008-01-09 20:44 <DIR> d-------- C:\Program Files\Wireshark
2008-01-09 20:43 . 2008-01-09 20:43 <DIR> d-------- C:\Program Files\WinPcap
2008-01-08 21:11 . 2008-01-08 21:11 <DIR> d-------- C:\Program Files\Western Digital Technologies
2008-01-08 19:18 . 2008-01-08 19:18 1,054,902 ---hs---- C:\WINDOWS\system32\wmlvgcrr.ini
2008-01-08 19:12 . 2008-01-08 19:12 1,054,842 ---hs---- C:\WINDOWS\system32\wksrjupn.ini
2008-01-08 00:04 . 2008-01-08 19:46 <DIR> d-------- C:\VundoFix Backups
2008-01-07 23:07 . 2004-08-03 22:31 154,624 --a------ C:\WINDOWS\system32\drivers\wlluc48.sys
2008-01-07 23:07 . 2004-08-03 22:31 154,624 --a------ C:\WINDOWS\system32\dllcache\wlluc48.sys
2008-01-07 20:49 . 2008-01-07 20:49 <DIR> d-------- C:\Deckard
2008-01-07 20:43 . 2008-01-08 20:28 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-07 20:43 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-01-07 20:43 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-01-07 19:47 . 2007-06-05 10:56 44,928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-07 19:46 . 2007-06-08 09:44 8,576 --a------ C:\WINDOWS\system32\drivers\mkqlwktpdijl.sys
2008-01-07 19:33 . 2008-01-07 19:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-07 16:59 . 2008-01-07 19:24 1,043,815 ---hs---- C:\WINDOWS\system32\bdcyahgw.ini
2008-01-07 16:59 . 2008-01-07 23:57 534 ---hs---- C:\WINDOWS\system32\yutdyrxy.ini
2008-01-06 23:47 . 2008-01-05 20:28 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-06 23:45 . 2008-01-07 08:04 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-01-06 22:53 . 2008-01-08 21:04 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-01-06 22:53 . 2008-01-08 20:47 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-01-06 22:53 . 2008-01-08 20:47 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-01-06 22:53 . 2008-01-08 20:47 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-01-06 20:49 . 2008-01-06 20:49 <DIR> d-------- C:\WINDOWS\McAfee.com
2008-01-05 20:28 . 2008-01-06 23:47 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-01-05 20:25 . 2005-05-11 23:10 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-05 20:25 . 2005-05-11 23:07 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-01-05 17:48 . 2008-01-05 17:48 <DIR> d-------- C:\Documents and Settings\Angela\Application Data\Bitdefender
2008-01-05 17:22 . 2008-01-20 21:45 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-01-05 17:21 . 2008-01-05 17:27 <DIR> d-------- C:\Documents and Settings\Angela\.housecall6.6
2008-01-05 17:15 . 2008-01-05 17:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
2008-01-05 14:47 . 2008-01-05 21:18 311,296 --a------ C:\WINDOWS\system32\hphmon03 .exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-21 02:47 --------- d-----w C:\Documents and Settings\LocalService\Application Data\VMware
2008-01-21 02:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware
2008-01-09 01:54 --------- d-----w C:\Program Files\Common Files\LightScribe
2008-01-09 01:53 --------- d-----w C:\Program Files\Google
2008-01-07 05:18 --------- d-----w C:\Program Files\QuickTime
2008-01-07 05:14 --------- d-----w C:\Program Files\iTunes
2007-12-03 02:55 --------- d-----w C:\Documents and Settings\Angela\Application Data\OpenOffice.org2
2007-10-25 15:26 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
.
Code:
<pre>
----a-w 253,952 2008-01-06 02:18:39 C:\hp\drivers\hplsbwatcher\lsburnwatcher .exe
----a-w 339,968 2008-01-06 02:18:36 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx .exe
----a-w 49,152 2008-01-06 02:18:35 C:\Program Files\Hp\HP Software Update\HPWuSchd2 .exe
----a-w 233,534 2008-01-06 02:18:39 C:\Program Files\HPQ\Default Settings\cpqset .exe
----a-w 794,624 2008-01-06 02:18:38 C:\Program Files\HPQ\HP Wireless Assistant\HP Wireless Assistant .exe
----a-w 290,816 2008-01-06 02:18:37 C:\Program Files\HPQ\Quick Launch Buttons\EabServr .exe
----a-w 278,528 2008-01-06 02:18:42 C:\Program Files\iTunes\iTunesHelper .exe
----a-w 36,975 2008-01-06 02:18:34 C:\Program Files\Java\jre1.5.0_06\bin\jusched .exe
----a-w 282,624 2008-01-06 02:02:40 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-06 02:02:40 C:\Program Files\QuickTime\qttask .exe
----a-w 282,624 2008-01-06 02:02:40 C:\Program Files\QuickTime\qttask .exe
----a-w 69,632 2008-01-06 02:18:44 C:\Program Files\Softwin\BitDefender10\bdagent .exe
----a-w 290,816 2008-01-06 02:18:42 C:\Program Files\Softwin\BitDefender10\BDMCON~1 .EXE
----a-w 692,316 2008-01-06 02:18:38 C:\Program Files\Synaptics\SynTP\SynTPEnh .exe
----a-w 102,492 2008-01-06 02:18:35 C:\Program Files\Synaptics\SynTP\SynTPLpr .exe
----a-w 311,296 2008-01-06 02:18:40 C:\WINDOWS\system32\hphmon03 .exe
----a-w 196,608 2008-01-06 02:18:40 C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04 .exe
</pre>
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4541DD8B-5D11-478E-B443-DA833D5A8698}]
C:\WINDOWS\system32\geeby.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73538613-EF18-4628-8EB6-BD2F5F870216}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a2d766bc-0543-49d6-a71b-26cace7e452b}]
C:\WINDOWS\system32\bruhixas.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tbsa"="C:\WINDOWS\RACLE~1\regsvr32.exe" [ ]
"Puin"="C:\Documents and Settings\Angela\My Documents\s?stem\?ti2evxx.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [ ]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [ ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [ ]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [ ]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [ ]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [ ]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [ ]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]
"HPHmon03"="C:\WINDOWS\system32\hphmon03.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [ ]
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" [ ]
"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [2008-01-05 21:02 290816]
"75a17511"="C:\WINDOWS\system32\rrcgvlmw.dll" [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=sockspy.dll
R2 vmserverdWin32;VMware Registration Service;C:\Program Files\VMware\VMware Server\vmserverdWin32.exe [2006-08-09 14:40]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2005-03-22 09:39]
S3 Dot4Usb HPH09;Dot4Usb HPH09;C:\WINDOWS\system32\drivers\hphius09.sys [2006-01-13 01:46]
S3 NPF;NetGroup Packet Filter Driver;C:\WINDOWS\system32\drivers\npf.sys [2007-11-06 15:22]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18289c3e-be56-11dc-b741-005056c00008}]
\Shell\AutoRun\command - E:\wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61137052-5388-11dc-b728-005056c00008}]
\Shell\AutoRun\command - E:\JDSecure\Windows\JDSecure20.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-20 21:47:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\sockspy.dll
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\WINDOWS\system32\sockspy.dll
PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\WINDOWS\system32\sockspy.dll
.
Completion time: 2008-01-20 21:50:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-21 02:49:40
.
2008-01-09 00:22:00 --- E O F ---
HijackThis Log
Deckard's System Scanner v20071014.68
Run by Angela on 2008-01-20 21:55:09
Computer is in Normal Mode.
--------------------------------------------------------------------------------
Total Physical Memory: 511 MiB (512 MiB recommended).
-- HijackThis (run as Angela.exe) ----------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:55:19 PM, on 1/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
C:\Program Files\VMware\VMware Server\vmware-authd.exe
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\WINDOWS\system32\vmnetdhcp.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Angela\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Angela.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4541DD8B-5D11-478E-B443-DA833D5A8698} - C:\WINDOWS\system32\geeby.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {73538613-EF18-4628-8EB6-BD2F5F870216} - C:\WINDOWS\system32\gebyv.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: {b254e7ec-ac62-b17a-6d94-3450cb667d2a} - {a2d766bc-0543-49d6-a71b-26cace7e452b} - C:\WINDOWS\system32\bruhixas.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [HPHmon03] C:\WINDOWS\system32\hphmon03.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [BDMCon] C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe
O4 - HKLM\..\Run: [75a17511] rundll32.exe "C:\WINDOWS\system32\rrcgvlmw.dll",b
O4 - HKCU\..\Run: [Tbsa] "C:\WINDOWS\RACLE~1\regsvr32.exe" -vt ndrv
O4 - HKCU\..\Run: [Puin] "C:\Documents and Settings\Angela\My Documents\s?stem\?ti2evxx.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/reso...an8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1142796829733
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...00/mcfscan.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware Registration Service (vmserverdWin32) - VMware, Inc. - C:\Program Files\VMware\VMware Server\vmserverdWin32.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
--
End of file - 8311 bytes
-- Files created between 2007-12-20 and 2008-01-20 -----------------------------
2008-01-09 21:47:23 0 d-------- C:\Documents and Settings\Angela\Application Data\Wireshark
2008-01-09 20:43:33 0 d-------- C:\Program Files\WinPcap
2008-01-09 20:43:08 0 d-------- C:\Program Files\Wireshark
2008-01-08 21:11:06 0 d-------- C:\Program Files\Western Digital Technologies
2008-01-08 00:04:09 0 d-------- C:\VundoFix Backups
2008-01-07 20:43:15 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2008-01-07 20:43:14 0 d-------- C:\Program Files\SpywareBlaster
2008-01-07 19:47:44 44928 --a------ C:\WINDOWS\system32\drivers\SDTHOOK.SYS <Not Verified; Panda Software; Panda® Antivirus>
2008-01-07 19:46:26 8576 --a------ C:\WINDOWS\system32\drivers\mkqlwktpdijl.sys <Not Verified; Panda Software International; RKPavProc Driver>
2008-01-07 19:33:16 0 d-------- C:\Program Files\Trend Micro
2008-01-06 23:45:51 0 d-------- C:\WINDOWS\BDOSCAN8
2008-01-06 22:53:00 0 d-------- C:\WINDOWS\system32\ActiveScan
2008-01-06 20:49:37 0 d-------- C:\WINDOWS\McAfee.com
2008-01-05 20:28:49 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2008-01-05 20:28:07 0 d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-01-05 20:26:59 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2008-01-05 20:25:52 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-01-05 20:25:04 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-01-05 20:25:04 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-01-05 20:25:04 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-01-05 20:25:04 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2008-01-05 20:25:04 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-01-05 20:25:04 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-01-05 20:25:04 0 dr------- C:\Documents and Settings\Administrator\My Documents
2008-01-05 20:25:04 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-01-05 20:25:04 0 dr------- C:\Documents and Settings\Administrator\Favorites
2008-01-05 20:25:04 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-01-05 20:25:04 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-01-05 20:25:04 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-01-05 20:25:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec
2008-01-05 20:25:04 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2008-01-05 20:25:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2008-01-05 20:25:04 0 d-------- C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-01-05 20:25:03 786432 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-01-05 17:48:09 0 d-------- C:\Documents and Settings\Angela\Application Data\Bitdefender
2008-01-05 17:22:00 81984 --a------ C:\WINDOWS\system32\bdod.bin
2008-01-05 17:21:07 0 d-------- C:\Documents and Settings\Angela\.housecall6.6
2008-01-05 17:15:29 0 d-------- C:\Documents and Settings\All Users\Application Data\BitDefender
-- Find3M Report ---------------------------------------------------------------
2008-01-08 20:54:22 0 d-------- C:\Program Files\Common Files\LightScribe
2008-01-08 20:53:40 0 d-------- C:\Program Files\Google
2008-01-07 00:18:42 0 d-------- C:\Program Files\QuickTime
2008-01-07 00:15:20 0 d-------- C:\Program Files\Messenger
2008-01-07 00:14:27 0 d-------- C:\Program Files\iTunes
2008-01-05 17:12:00 0 d-------- C:\Program Files\Common Files
2007-12-02 21:55:12 0 d-------- C:\Documents and Settings\Angela\Application Data\OpenOffice.org2
2007-11-06 15:19:28 53299 --a------ C:\WINDOWS\system32\pthreadVC.dll
2007-10-25 10:26:48 53248 --a------ C:\WINDOWS\bdoscandel.exe
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4541DD8B-5D11-478E-B443-DA833D5A8698}]
C:\WINDOWS\system32\geeby.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73538613-EF18-4628-8EB6-BD2F5F870216}]
C:\WINDOWS\system32\gebyv.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{a2d766bc-0543-49d6-a71b-26cace7e452b}]
C:\WINDOWS\system32\bruhixas.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" []
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" []
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" []
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" []
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" []
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" []
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" []
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" []
"HPHmon03"="C:\WINDOWS\system32\hphmon03.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" []
"BDAgent"="C:\Program Files\Softwin\BitDefender10\bdagent.exe" []
"BDMCon"="C:\PROGRA~1\Softwin\BITDEF~1\bdmcon.exe" [01/05/2008 09:02 PM]
"75a17511"="C:\WINDOWS\system32\rrcgvlmw.dll" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tbsa"="C:\WINDOWS\RACLE~1\regsvr32.exe" []
"Puin"="C:\Documents and Settings\Angela\My Documents\s?stem\?ti2evxx.exe" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=sockspy.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18289c3e-be56-11dc-b741-005056c00008}]
AutoRun\command- E:\wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{61137052-5388-11dc-b728-005056c00008}]
AutoRun\command- E:\JDSecure\Windows\JDSecure20.exe
-- End of Deckard's System Scanner: finished at 2008-01-20 21:55:45 ------------
|