Hi,
Combofix.txt attached.
CiD popups are still occuring.
The .zip file has dissapeared from my desktop?
Peter
ComboFix 08-06-20.4 - Peter 2008-06-26 13:40:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2556 [GMT 1:00]
Running from: C:\Documents and Settings\Peter\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Peter\Desktop\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\Tasks\A69662C1918A14F1.job
C:\WINDOWS\Tasks\AC4D1D8C918A9A50.job
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data\Idle bind itch live
C:\Documents and Settings\All Users\Application Data\Idle bind itch live\Surf Fast.exe
C:\Documents and Settings\All Users\Application Data\Idle bind itch live\upload anti.exe
C:\Documents and Settings\James\Application Data\Live admin list
C:\Documents and Settings\James\Application Data\Live admin list\
0
C:\Documents and Settings\James\Application Data\Live admin list\baseforkhelp.exe
C:\Documents and Settings\James\Application Data\Live admin list\bleh amen open cake.exe
C:\Documents and Settings\James\Application Data\Live admin list\oqkxlwfr.exe
C:\Documents and Settings\James\Application Data\Live admin list\Wait slow.exe
C:\Documents and Settings\Peter\Application Data\Live admin list
C:\Documents and Settings\Peter\Application Data\Live admin list\
0
C:\Documents and Settings\Peter\Application Data\Live admin list\baseforkhelp.exe
C:\Documents and Settings\Peter\Application Data\Live admin list\bleh amen open cake.exe
C:\Documents and Settings\Peter\Application Data\Live admin list\bxblbsqh.exe
C:\Documents and Settings\Peter\Application Data\Live admin list\fqfiqbeu.exe
C:\Documents and Settings\Peter\Application Data\Live admin list\Wait slow.exe
C:\Program Files\Live admin list
C:\WINDOWS\BM33edfdca.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\SYSTEM32\bhskwlbu.dll
C:\WINDOWS\SYSTEM32\nnqimhnj.dll
C:\WINDOWS\SYSTEM32\nrunkutr.dll
C:\WINDOWS\SYSTEM32\rjjpexsa.dll
C:\WINDOWS\SYSTEM32\wgxvklix.dll
C:\WINDOWS\Tasks\A69662C1918A14F1.job
C:\WINDOWS\Tasks\AC4D1D8C918A9A50.job
.
((((((((((((((((((((((((( Files Created from 2008-05-26 to 2008-06-26 )))))))))))))))))))))))))))))))
.
2008-06-25 20:22 . 2008-06-26 13:19 354 ---hs---- C:\WINDOWS\SYSTEM32\ublwkshb.ini
2008-06-23 20:18 . 2008-06-23 20:18 <DIR> d-------- C:\Deckard
2008-06-22 18:50 . 2008-06-22 18:51 <DIR> d-------- C:\Program Files\Panda Security
2008-06-17 17:17 . 2008-06-26 13:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-17 17:17 . 2008-06-17 17:17 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-15 14:42 . 2007-12-24 17:37 138,384 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2008-06-15 14:40 . 2008-06-15 14:40 <DIR> d-------- C:\WINDOWS\SYSTEM32\HouseCall 6.6
2008-06-15 14:40 . 2008-06-15 21:17 <DIR> d-------- C:\Documents and Settings\Peter\Application Data\HouseCall 6.6
2008-06-13 09:32 . 2008-06-13 12:05 272,128 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-06-13 09:32 . 2008-05-08 15:02 203,136 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-25 19:32 --------- d-----w C:\Documents and Settings\Peter\Application Data\Skype
2008-06-22 17:25 --------- d-----w C:\Documents and Settings\James\Application Data\Skype
2008-06-22 17:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-20 21:08 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-18 17:47 --------- d-----w C:\Program Files\3D Space Tour
2008-06-18 17:45 --------- d-----w C:\Program Files\Jasc Software Inc
2008-06-15 13:19 --------- d-----w C:\Documents and Settings\Peter\Application Data\U3
2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 14:57 --------- d-----w C:\Program Files\Windows Live
2008-05-30 21:23 --------- d-----w C:\Program Files\SiteAdvisor
2008-05-09 21:25 --------- d-----w C:\Program Files\Common Files\xing shared
2008-05-09 21:25 --------- d-----w C:\Program Files\Common Files\Real
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-06 06:18 --------- d-----w C:\Documents and Settings\James\Application Data\Viewpoint
2008-04-14 00:12 69,120 ----a-w C:\WINDOWS\notepad.exe
2008-04-14 00:12 50,688 ----a-w C:\WINDOWS\twain_32.dll
2008-04-14 00:12 34,816 ----a-w C:\WINDOWS\Help\sniffpol.dll
2008-04-14 00:12 33,280 ----a-w C:\WINDOWS\Help\sstub.dll
2008-04-14 00:12 32,866 ------w C:\WINDOWS\slrundll.exe
2008-04-14 00:12 283,648 ----a-w C:\WINDOWS\winhlp32.exe
2008-04-14 00:12 279,040 ----a-w C:\WINDOWS\Help\tshoot.dll
2008-04-14 00:12 146,432 ----a-w C:\WINDOWS\regedit.exe
2008-04-14 00:12 10,752 ----a-w C:\WINDOWS\hh.exe
2008-04-14 00:12 1,033,728 ----a-w C:\WINDOWS\explorer.exe
2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
2008-04-14 00:11 39,424 ----a-w C:\WINDOWS\AppPatch\acadproc.dll
2008-04-14 00:11 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll
2008-04-14 00:11 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll
2008-04-14 00:11 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll
2008-04-14 00:11 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll
2008-03-31 17:58 61,224 ----a-w C:\Documents and Settings\Peter\GoToAssistDownloadHelper.exe
2008-02-24 19:11 22,328 ----a-w C:\Documents and Settings\James\Application Data\PnkBstrK.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-25_20.21.53.43 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-25 19:10:34 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-06-26 12:48:31 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
- 2008-06-25 18:45:27 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
+ 2008-06-26 12:22:56 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Cookies\index.dat
- 2008-06-25 18:45:27 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-06-26 12:22:56 32,768 ----a-w C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-24 16:39 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 14:42 1404928]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 17:48 32881]
"IntelMeM"="C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 20:12 221184]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 16:54 57344]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 01:05 127035]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-01-27 01:02 86016]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2004-10-07 19:08 50688]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 15:55 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 15:51 118784]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\SYSTEM32\nwiz.exe]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 15:18 241664]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 19:12 582992]
"SiteAdvisor"="C:\Program Files\SiteAdvisor\6261\SiteAdv.exe" [2007-08-24 22:57 36640]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-09 22:24 185896]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 18:15 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 18:15 81920]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 01:12 15360]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [7/29/2005 1:39:30 PM 113664]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [5/28/2004 10:31:38 PM 241664]
PsiWin 2.3 Connection Server.lnk - C:\Program Files\Psion\PsiWin\Psconsv.exe [1/6/2008 4:22:47 PM 286720]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Sierra\\Half-Life\\hl.exe"=
"C:\\temp\\HP_WebRelease\\Setup\\HPZnet01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\WINDOWS\\SYSTEM32\\DPLAYSVR.EXE"=
"C:\\Program Files\\EA GAMES\\The Battle for Middle-earth (tm)\\game.dat"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\SYSTEM32\\spoolsv.exe"=
"C:\\Program Files\\DC++\\DCPlusPlus.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Documents and Settings\\James\\My Documents\\Game\\AgeOfEmpire2CONQ\\empires2.exe"=
"C:\\Program Files\\THQ\\Dawn Of War\\W40k.exe"=
"C:\\Program Files\\THQ\\Dawn Of War\\W40kWA.exe"=
"C:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\fatboyjim\\day of defeat source\\hl2.exe"=
"C:\\totalcmd\\TOTALCMD.EXE"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\fatboyjim\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Valve\\Steam\\Steam.exe"=
"C:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"C:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"C:\\Sierra\\Half-Life\\hltv.exe"=
"C:\\Program Files\\Valve\\Steam\\SteamApps\\common\\dawn of war soulstorm demo\\Soulstorm.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R3 P0630VID;Creative WebCam Live!;C:\WINDOWS\system32\DRIVERS\P0630Vid.sys [2004-07-30 02:55]
R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;C:\WINDOWS\system32\DRIVERS\WPN111.sys [2005-09-26 16:02]
S3 bkn50USB;Belkin 54Mbps Wireless USB Network Adapter;C:\WINDOWS\system32\DRIVERS\rt2500usb.sys [2004-07-16 11:14]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\DNINDIS5.SYS [2003-07-24 12:10]
S3 VNUSB;VN Series Device;C:\WINDOWS\system32\DRIVERS\VNUSB.sys [2003-12-15 18:22]
S3 ZD1201U;ZPlus-B290 802.11b WLAN USB Adapter;C:\WINDOWS\system32\DRIVERS\zd1201u.sys []
S3 ZDNDIS5;ZDNDIS5 Protocol Driver;C:\WINDOWS\system32\ZDNDIS5.SYS []
.
Contents of the 'Scheduled Tasks' folder
"2008-06-16 20:30:06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-06-26 12:37:03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-03-31 19:50:26 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2008-03-31 19:50:24 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-06-26 13:56:20
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\SiteAdvisor\6261\saHook.dll
-> ?:\WINDOWS\system32\PSAPI.DLL
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\WINDOWS\SYSTEM32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\PnkBstrA.exe
C:\WINDOWS\SYSTEM32\PnkBstrB.exe
C:\Program Files\SiteAdvisor\6261\SAService.exe
C:\WINDOWS\SYSTEM32\UAService.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\PROGRA~1\Psion\PsiWin\Elogerr.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\SYSTEM32\HPZipm12.exe
C:\PROGRA~1\McAfee\MSC\mcuimgr.exe
.
**************************************************************************
.
Completion time: 2008-06-26 14:05:18 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-26 13:05:12
ComboFix2.txt 2008-06-25 19:22:21
Pre-Run: 47,957,778,432 bytes free
Post-Run: 47,936,765,952 bytes free
231 --- E O F --- 2008-06-20 21:47:19