Tech Support Forum - View Single Post - Pop ups- Virtumonde + loads of others.

kiko · 06-09-2008, 11:28 AM

ComboFix 08-06-08.7 - marino 2008-06-09 18:11:43.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.599 [GMT 1:00]
Running from: C:\Documents and Settings\marino\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\BMc7d987c1.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\baknblal.dll
C:\WINDOWS\system32\BbLUxGgh.ini
C:\WINDOWS\system32\BbLUxGgh.ini2
C:\WINDOWS\system32\bbtjovsg.dll
C:\WINDOWS\system32\blofkrjw.ini
C:\WINDOWS\system32\bsefkocr.ini
C:\WINDOWS\system32\cbdyqdyk.dll
C:\WINDOWS\system32\ctdrnkam.dll
C:\WINDOWS\system32\dickguqd.ini
C:\WINDOWS\system32\ersctusx.dll
C:\WINDOWS\system32\gpuyscsa.ini
C:\WINDOWS\system32\hvncsyyi.dll
C:\WINDOWS\system32\iijybxkw.dll
C:\WINDOWS\system32\iklaqmfy.ini
C:\WINDOWS\system32\IlUwyGgh.ini
C:\WINDOWS\system32\IlUwyGgh.ini2
C:\WINDOWS\system32\jjmlmnmp.ini
C:\WINDOWS\system32\jjmlmnmp.ini2
C:\WINDOWS\system32\kcpeuxnl.dll
C:\WINDOWS\system32\klhnkavb.dll
C:\WINDOWS\system32\klpfxeak.dll
C:\WINDOWS\system32\lyymvipl.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mhnjgutl.ini
C:\WINDOWS\system32\mieuuanc.ini
C:\WINDOWS\system32\nqcjouls.dll
C:\WINDOWS\system32\ouweuaik.dll
C:\WINDOWS\system32\owcaxnoq.dll
C:\WINDOWS\system32\oXyadccf.ini
C:\WINDOWS\system32\oXyadccf.ini2
C:\WINDOWS\system32\pmnmlmjj.dll
C:\WINDOWS\system32\qfccglpv.ini
C:\WINDOWS\system32\qouyuntn.ini
C:\WINDOWS\system32\qrbdrvxm.dll
C:\WINDOWS\system32\radwenap.dll
C:\WINDOWS\system32\rcokfesb.dll
C:\WINDOWS\system32\rxdyynaf.ini
C:\WINDOWS\system32\sfbrsmnx.dll
C:\WINDOWS\system32\sweshijo.dll
C:\WINDOWS\system32\wbsxjkua.dll
C:\WINDOWS\system32\xfuhfesp.dll
C:\WINDOWS\system32\xxFilUtv.ini
C:\WINDOWS\system32\xxFilUtv.ini2
C:\WINDOWS\system32\yrhthggl.dll

.
((((((((((((((((((((((((( Files Created from 2008-05-09 to 2008-06-09 )))))))))))))))))))))))))))))))
.

2008-06-09 11:47 . 2008-06-09 11:47 2,356 --a------ C:\WINDOWS\system32\lceddsim.exe
2008-06-09 10:39 . 2008-06-09 10:40 <DIR> d-------- C:\WINDOWS\ERUNT
2008-06-09 10:35 . 2008-06-09 11:01 <DIR> d-------- C:\SDFix
2008-06-07 15:02 . 2008-06-07 15:02 2,356 --a------ C:\WINDOWS\system32\pnptqsgg.exe
2008-06-06 18:17 . 2008-06-06 18:17 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-06 15:12 . 2008-06-09 18:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-06 15:12 . 2008-06-06 15:12 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-06 14:20 . 2008-06-06 14:20 2,356 --a------ C:\WINDOWS\system32\dfmvdeqh.exe
2008-06-05 17:44 . 2008-06-05 17:44 <DIR> d-------- C:\Deckard
2008-06-05 14:42 . 2008-06-05 14:53 <DIR> d-------- C:\Documents and Settings\marino\Application Data\Nokia
2008-06-05 14:42 . 2008-06-05 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\DIFX
2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-06-05 14:40 . 2008-06-05 14:42 <DIR> d-------- C:\Documents and Settings\marino\Application Data\PC Suite
2008-06-05 14:39 . 2008-06-05 14:39 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-06-05 14:39 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Nokia
2008-06-05 14:39 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-06-05 14:39 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-06-05 14:39 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-06-05 14:39 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-06-05 14:39 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-06-05 14:39 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-06-05 14:21 . 2008-06-05 14:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-06-02 19:46 . 2008-06-06 14:45 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-02 19:46 . 2008-06-07 11:19 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-02 19:46 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-06-02 19:25 . 2008-06-02 19:33 <DIR> d-------- C:\Program Files\Panda Security
2008-06-02 15:56 . 2008-06-02 15:56 2,356 --a------ C:\WINDOWS\system32\bppvrcoo.exe
2008-05-23 12:20 . 2008-06-02 15:04 558 --a------ C:\WINDOWS\wininit.ini
2008-05-23 11:37 . 2008-05-23 11:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-23 11:37 . 2008-05-23 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-20 14:39 . 2008-05-20 14:39 <DIR> d-------- C:\Documents and Settings\marino\Application Data\MixMeister Technology
2008-05-20 14:38 . 2008-05-20 14:39 <DIR> d-------- C:\Program Files\MixMeister Studio 7.2.2

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 17:17 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-06-09 14:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-06-05 13:07 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-06-05 13:07 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-06-05 13:07 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-06-05 13:07 --------- d-----w C:\Program Files\Symantec
2008-05-22 23:29 --------- d-----w C:\Program Files\Yahoo!
2008-05-20 11:55 --------- d-----w C:\Program Files\Last.fm
2008-05-15 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-02 15:48 --------- d-----w C:\Program Files\Java
2008-05-02 15:45 --------- d-----w C:\Program Files\Common Files\Java
2008-04-29 13:36 --------- d-----w C:\Program Files\Picasa2
2008-04-29 13:34 --------- d-----w C:\Program Files\Google
2008-04-28 18:25 --------- d-----w C:\Documents and Settings\marino\Application Data\Apple Computer
2008-04-12 15:21 --------- d-----w C:\Program Files\CCleaner
2008-04-09 12:39 --------- d-----w C:\Program Files\iTunes
2008-04-09 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Last.fm
2008-03-17 18:41 50 ----a-w C:\xmp.bat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E63E817-9B51-48A8-844C-62A180075373}]
C:\WINDOWS\system32\fccdayXo.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3AD397C5-E588-4B89-8E10-4EE5AD6313F8}]
C:\WINDOWS\system32\hgGywUlI.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C36F829A-0B11-43B3-BC7D-77BCCC89EB3D}]
C:\WINDOWS\system32\hgGxULbB.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E876FC95-6515-4D5D-A130-94E0C6967ABA}]
C:\WINDOWS\system32\vtUliFxx.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-25 04:51 316784]

[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 02:44 184320]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 14:15 51048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-24 23:05 185896]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 13:00 15360]
"Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2006-08-22 09:31:12 184320]

[HKLM\~\startupfolder\C:^Documents and Settings^marino^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\marino\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
--a------ 2008-02-14 00:09 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector]
--a------ 2008-02-26 02:23 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
-rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Documents and Settings\\marino\\Desktop\\utorrent.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 19:46]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 22:32]
S3 SaiH040C;SaiH040C;C:\WINDOWS\system32\DRIVERS\SaiH040C.sys [2005-07-07 13:10]
S3 SaiU040C;SaiU040C;C:\WINDOWS\system32\DRIVERS\SaiU040C.sys [2005-07-07 13:10]

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-06-06 15:40:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-09 14:03:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2007-12-31 16:07:27 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job"
- C:\Program Files\Microsoft IntelliPoint\ipoint.exe
"2008-06-02 19:38:12 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - marino.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 18:23:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\scardsvr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-06-09 18:27:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-09 17:26:59

Pre-Run: 51,481,092,096 bytes free
Post-Run: 51,376,984,064 bytes free

227 --- E O F --- 2008-05-17 02:28:10

06-09-2008, 11:28 AM	#7 (permalink)
kiko Registered User Join Date: Jun 2008 Posts: 7 OS: Windows XP SP2	Re: Pop ups- Virtumonde + loads of others. ComboFix 08-06-08.7 - marino 2008-06-09 18:11:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.599 [GMT 1:00] Running from: C:\Documents and Settings\marino\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\BMc7d987c1.xml C:\WINDOWS\pskt.ini C:\WINDOWS\system32\baknblal.dll C:\WINDOWS\system32\BbLUxGgh.ini C:\WINDOWS\system32\BbLUxGgh.ini2 C:\WINDOWS\system32\bbtjovsg.dll C:\WINDOWS\system32\blofkrjw.ini C:\WINDOWS\system32\bsefkocr.ini C:\WINDOWS\system32\cbdyqdyk.dll C:\WINDOWS\system32\ctdrnkam.dll C:\WINDOWS\system32\dickguqd.ini C:\WINDOWS\system32\ersctusx.dll C:\WINDOWS\system32\gpuyscsa.ini C:\WINDOWS\system32\hvncsyyi.dll C:\WINDOWS\system32\iijybxkw.dll C:\WINDOWS\system32\iklaqmfy.ini C:\WINDOWS\system32\IlUwyGgh.ini C:\WINDOWS\system32\IlUwyGgh.ini2 C:\WINDOWS\system32\jjmlmnmp.ini C:\WINDOWS\system32\jjmlmnmp.ini2 C:\WINDOWS\system32\kcpeuxnl.dll C:\WINDOWS\system32\klhnkavb.dll C:\WINDOWS\system32\klpfxeak.dll C:\WINDOWS\system32\lyymvipl.ini C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mhnjgutl.ini C:\WINDOWS\system32\mieuuanc.ini C:\WINDOWS\system32\nqcjouls.dll C:\WINDOWS\system32\ouweuaik.dll C:\WINDOWS\system32\owcaxnoq.dll C:\WINDOWS\system32\oXyadccf.ini C:\WINDOWS\system32\oXyadccf.ini2 C:\WINDOWS\system32\pmnmlmjj.dll C:\WINDOWS\system32\qfccglpv.ini C:\WINDOWS\system32\qouyuntn.ini C:\WINDOWS\system32\qrbdrvxm.dll C:\WINDOWS\system32\radwenap.dll C:\WINDOWS\system32\rcokfesb.dll C:\WINDOWS\system32\rxdyynaf.ini C:\WINDOWS\system32\sfbrsmnx.dll C:\WINDOWS\system32\sweshijo.dll C:\WINDOWS\system32\wbsxjkua.dll C:\WINDOWS\system32\xfuhfesp.dll C:\WINDOWS\system32\xxFilUtv.ini C:\WINDOWS\system32\xxFilUtv.ini2 C:\WINDOWS\system32\yrhthggl.dll . ((((((((((((((((((((((((( Files Created from 2008-05-09 to 2008-06-09 ))))))))))))))))))))))))))))))) . 2008-06-09 11:47 . 2008-06-09 11:47 2,356 --a------ C:\WINDOWS\system32\lceddsim.exe 2008-06-09 10:39 . 2008-06-09 10:40 <DIR> d-------- C:\WINDOWS\ERUNT 2008-06-09 10:35 . 2008-06-09 11:01 <DIR> d-------- C:\SDFix 2008-06-07 15:02 . 2008-06-07 15:02 2,356 --a------ C:\WINDOWS\system32\pnptqsgg.exe 2008-06-06 18:17 . 2008-06-06 18:17 <DIR> d-------- C:\Program Files\Trend Micro 2008-06-06 15:12 . 2008-06-09 18:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-06-06 15:12 . 2008-06-06 15:12 1,409 --a------ C:\WINDOWS\QTFont.for 2008-06-06 14:20 . 2008-06-06 14:20 2,356 --a------ C:\WINDOWS\system32\dfmvdeqh.exe 2008-06-05 17:44 . 2008-06-05 17:44 <DIR> d-------- C:\Deckard 2008-06-05 14:42 . 2008-06-05 14:53 <DIR> d-------- C:\Documents and Settings\marino\Application Data\Nokia 2008-06-05 14:42 . 2008-06-05 14:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite 2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\DIFX 2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-06-05 14:40 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-06-05 14:40 . 2008-06-05 14:42 <DIR> d-------- C:\Documents and Settings\marino\Application Data\PC Suite 2008-06-05 14:39 . 2008-06-05 14:39 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-06-05 14:39 . 2008-06-05 14:40 <DIR> d-------- C:\Program Files\Nokia 2008-06-05 14:39 . 2007-02-22 11:15 137,216 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys 2008-06-05 14:39 . 2007-02-22 11:15 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-06-05 14:39 . 2007-02-22 11:15 65,536 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-06-05 14:39 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys 2008-06-05 14:39 . 2007-02-22 11:15 12,288 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys 2008-06-05 14:39 . 2007-02-22 11:15 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys 2008-06-05 14:21 . 2008-06-05 14:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations 2008-06-02 19:46 . 2008-06-06 14:45 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-06-02 19:46 . 2008-06-07 11:19 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-06-02 19:46 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX 2008-06-02 19:25 . 2008-06-02 19:33 <DIR> d-------- C:\Program Files\Panda Security 2008-06-02 15:56 . 2008-06-02 15:56 2,356 --a------ C:\WINDOWS\system32\bppvrcoo.exe 2008-05-23 12:20 . 2008-06-02 15:04 558 --a------ C:\WINDOWS\wininit.ini 2008-05-23 11:37 . 2008-05-23 11:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-05-23 11:37 . 2008-05-23 12:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-05-20 14:39 . 2008-05-20 14:39 <DIR> d-------- C:\Documents and Settings\marino\Application Data\MixMeister Technology 2008-05-20 14:38 . 2008-05-20 14:39 <DIR> d-------- C:\Program Files\MixMeister Studio 7.2.2 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-06-09 17:17 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-06-09 14:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-06-05 13:07 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-06-05 13:07 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-06-05 13:07 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-06-05 13:07 --------- d-----w C:\Program Files\Symantec 2008-05-22 23:29 --------- d-----w C:\Program Files\Yahoo! 2008-05-20 11:55 --------- d-----w C:\Program Files\Last.fm 2008-05-15 12:53 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-05-02 15:48 --------- d-----w C:\Program Files\Java 2008-05-02 15:45 --------- d-----w C:\Program Files\Common Files\Java 2008-04-29 13:36 --------- d-----w C:\Program Files\Picasa2 2008-04-29 13:34 --------- d-----w C:\Program Files\Google 2008-04-28 18:25 --------- d-----w C:\Documents and Settings\marino\Application Data\Apple Computer 2008-04-12 15:21 --------- d-----w C:\Program Files\CCleaner 2008-04-09 12:39 --------- d-----w C:\Program Files\iTunes 2008-04-09 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Last.fm 2008-03-17 18:41 50 ----a-w C:\xmp.bat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1E63E817-9B51-48A8-844C-62A180075373}] C:\WINDOWS\system32\fccdayXo.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3AD397C5-E588-4B89-8E10-4EE5AD6313F8}] C:\WINDOWS\system32\hgGywUlI.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C36F829A-0B11-43B3-BC7D-77BCCC89EB3D}] C:\WINDOWS\system32\hgGxULbB.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E876FC95-6515-4D5D-A130-94E0C6967ABA}] C:\WINDOWS\system32\vtUliFxx.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-25 04:51 316784] [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser] "{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-25 04:51 316784] [HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1] [HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 13:00 15360] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WatchDog"="C:\Program Files\InterVideo\DVD Check\DVDCheck.exe" [2004-12-09 02:44 184320] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 14:15 51048] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-24 23:05 185896] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 13:00 15360] "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2006-08-22 09:31:12 184320] [HKLM\~\startupfolder\C:^Documents and Settings^marino^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk] path=C:\Documents and Settings\marino\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite] --a------ 2008-02-14 00:09 486856 C:\Program Files\DAEMON Tools Lite\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Picasa Media Detector] --a------ 2008-02-26 02:23 443968 C:\Program Files\Picasa2\PicasaMediaDetector.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Documents and Settings\\marino\\Desktop\\utorrent.exe"= R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [] R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2005-05-31 19:46] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 22:32] S3 SaiH040C;SaiH040C;C:\WINDOWS\system32\DRIVERS\SaiH040C.sys [2005-07-07 13:10] S3 SaiU040C;SaiU040C;C:\WINDOWS\system32\DRIVERS\SaiU040C.sys [2005-07-07 13:10] Newly Created Service - COMHOST . Contents of the 'Scheduled Tasks' folder "2008-06-06 15:40:03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-06-09 14:03:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE "2007-12-31 16:07:27 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IPoint_exe.job" - C:\Program Files\Microsoft IntelliPoint\ipoint.exe "2008-06-02 19:38:12 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - marino.job" - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK: . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-09 18:23:14 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\scardsvr.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\UAService7.exe C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\iPod\bin\iPodService.exe . ************************************************************************ . Completion time: 2008-06-09 18:27:05 - machine was rebooted ComboFix-quarantined-files.txt 2008-06-09 17:26:59 Pre-Run: 51,481,092,096 bytes free Post-Run: 51,376,984,064 bytes free 227 --- E O F --- 2008-05-17 02:28:10