ComboFix 09-07-03.02 - Owner 07/03/2009 16:58.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2814.2269 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1335 [VPS 090703-0] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\docume~1\Owner\LOCALS~1\Temp\tmp1.tmp
c:\documents and settings\Owner\Application Data\.#
c:\documents and settings\Owner\Application Data\.#\MBX@3F0@B048E0.###
c:\documents and settings\Owner\Application Data\.#\MBX@3F0@B048F0.###
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXgtvfihvwltrmwmparxyerfwklbupxbpp.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MSIVXSERV.SYS
-------\Service_MSIVXserv.sys
((((((((((((((((((((((((( Files Created from 2009-06-03 to 2009-07-03 )))))))))))))))))))))))))))))))
.
2009-07-01 21:12 . 2009-03-06 14:44 283648 -c----w- c:\windows\system32\dllcache\pdh.dll
2009-07-01 21:12 . 2009-02-09 10:20 399360 -c----w- c:\windows\system32\dllcache\rpcss.dll
2009-07-01 21:12 . 2009-02-09 10:20 616960 -c----w- c:\windows\system32\dllcache\advapi32.dll
2009-07-01 21:12 . 2009-02-09 10:20 473088 -c----w- c:\windows\system32\dllcache\fastprox.dll
2009-07-01 21:12 . 2009-02-09 10:20 453120 -c----w- c:\windows\system32\dllcache\wmiprvsd.dll
2009-07-01 21:12 . 2009-02-06 17:14 110592 -c----w- c:\windows\system32\dllcache\services.exe
2009-07-01 21:12 . 2009-02-06 16:39 227840 -c----w- c:\windows\system32\dllcache\wmiprvse.exe
2009-07-01 21:12 . 2005-07-26 04:39 60416 -c----w- c:\windows\system32\dllcache\colbact.dll
2009-07-01 21:12 . 2009-02-09 10:20 714752 -c----w- c:\windows\system32\dllcache\ntdll.dll
2009-07-01 21:12 . 2008-04-21 10:02 215552 -c----w- c:\windows\system32\dllcache\wordpad.exe
2009-07-01 20:44 . 2009-07-01 20:44 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-07-01 20:03 . 2007-09-26 20:07 356352 ----a-w- c:\windows\system32\nvunrm.exe
2009-07-01 14:23 . 2009-07-03 20:55 -------- d-s---w- C:\ComboFix
2009-07-01 14:18 . 2009-07-01 14:18 -------- d-----w- c:\program files\Trend Micro
2009-06-27 04:02 . 2009-06-27 04:02 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Blizzard Entertainment
2009-06-23 00:06 . 2009-02-05 20:06 51376 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-06-23 00:06 . 2009-02-05 20:06 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-06-23 00:06 . 2009-02-05 20:05 26944 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2009-06-23 00:06 . 2009-02-05 20:08 93296 ----a-w- c:\windows\system32\drivers\aswmon.sys
2009-06-23 00:06 . 2009-02-05 20:08 94032 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2009-06-23 00:06 . 2009-02-05 20:07 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-06-23 00:06 . 2009-02-05 20:07 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-06-23 00:06 . 2009-02-05 20:04 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-06-23 00:06 . 2009-02-05 20:11 1256296 ----a-w- c:\windows\system32\aswBoot.exe
2009-06-23 00:06 . 2009-06-23 00:06 -------- d-----w- c:\program files\Alwil Software
2009-06-22 01:47 . 2009-06-22 03:34 -------- d-----w- c:\program files\Perfect World Entertainment
2009-06-17 23:16 . 2009-06-17 23:16 -------- d-----w- c:\program files\Real Alternative
2009-06-17 23:16 . 2009-06-17 23:16 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\Real
2009-06-17 23:14 . 2009-06-17 23:14 -------- d-----w- c:\documents and settings\Owner\Application Data\GRETECH
2009-06-17 23:14 . 2009-06-17 23:14 -------- d-----w- c:\program files\GRETECH
2009-06-14 01:32 . 2009-07-01 14:49 -------- d-----w- c:\program files\BearShare Applications
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-03 21:01 . 2009-07-01 20:51 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-07-02 01:30 . 2008-09-30 16:56 -------- d-----w- c:\documents and settings\Owner\Application Data\BitTorrent
2009-07-01 20:07 . 2008-07-15 02:27 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-01 20:07 . 2008-07-15 02:27 -------- d-----w- c:\program files\NVIDIA Corporation
2009-06-27 11:07 . 2008-10-15 18:36 -------- d-----w- c:\program files\World of Warcraft
2009-06-22 01:55 . 2009-05-28 22:44 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-22 01:45 . 2009-03-27 00:21 -------- d-----w- c:\documents and settings\Owner\Application Data\GetRightToGo
2009-05-30 23:56 . 2009-05-28 21:40 36928 ----a-w- c:\windows\system32\drivers\pssdk41.sys
2009-05-28 23:36 . 2009-05-28 21:40 -------- d-----w- c:\documents and settings\Owner\Application Data\XLink Kai
2009-05-28 22:45 . 2009-05-28 22:45 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-28 22:41 . 2009-05-28 22:41 21361 ----a-w- c:\windows\system32\drivers\AegisP.sys
2009-05-28 22:41 . 2009-05-28 21:14 376832 ----a-w- c:\windows\system32\AegisI5Installer.exe
2009-05-28 21:38 . 2009-05-28 21:38 2469888 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{2773B836-AC66-4178-A414-C5A0F9F5D805}\kaiEngine.exe
2009-05-28 21:38 . 2009-05-28 21:38 -------- d-----w- c:\program files\XLink Kai
2009-05-28 21:14 . 2009-05-28 21:14 -------- d-----w- c:\program files\Planex
2009-05-24 18:47 . 2008-07-26 14:06 -------- d-----w- c:\documents and settings\Owner\Application Data\Dropbox
2009-05-21 15:51 . 2009-05-21 15:23 -------- d-----w- c:\program files\EVGA Precision
2009-05-21 15:48 . 2009-05-21 15:23 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-05-21 15:28 . 2008-08-01 11:55 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-18 21:33 . 2008-07-15 10:55 96 ---ha-w- c:\windows\system32\HsInfo.dat
2009-05-18 21:31 . 2009-05-18 21:31 -------- d-----w- c:\program files\alaplaya
2009-05-10 08:02 . 2008-09-30 16:54 -------- d-----w- c:\documents and settings\Owner\Application Data\DNA
2009-05-10 07:45 . 2009-03-27 00:26 -------- d-----w- c:\program files\NCSoft
2009-05-08 17:51 . 2009-05-08 17:51 -------- d-----w- c:\documents and settings\Owner\Application Data\DragonicaSCB
2009-05-08 17:40 . 2009-05-08 17:40 -------- d-----w- c:\program files\IAHGames
2009-05-07 15:44 . 2003-03-31 12:00 344064 ----a-w- c:\windows\system32\localspl.dll
2009-05-01 04:30 . 2009-05-01 04:30 81920 ----a-w- c:\windows\system32\nvwddi.dll
2009-05-01 04:30 . 2009-05-01 04:30 3117056 ----a-w- c:\windows\system32\nvwss.dll
2009-05-01 04:30 . 2009-05-01 04:30 4038656 ----a-w- c:\windows\system32\nvvitvs.dll
2009-05-01 04:30 . 2009-05-01 04:30 188416 ----a-w- c:\windows\system32\nvmccss.dll
2009-05-01 04:30 . 2009-05-01 04:30 1282048 ----a-w- c:\windows\system32\nvmobls.dll
2009-05-01 04:30 . 2009-05-01 04:30 3510272 ----a-w- c:\windows\system32\nvgames.dll
2009-05-01 04:30 . 2009-05-01 04:30 4014080 ----a-w- c:\windows\system32\nvdisps.dll
2009-05-01 04:30 . 2009-05-01 04:30 168004 ----a-w- c:\windows\system32\nvsvc32.exe
2009-05-01 04:30 . 2009-05-01 04:30 86016 ----a-w- c:\windows\system32\nvmctray.dll
2009-05-01 04:30 . 2009-05-01 04:30 13750272 ----a-w- c:\windows\system32\nvcpl.dll
2009-05-01 04:30 . 2009-05-01 04:30 229376 ----a-w- c:\windows\system32\nvmccs.dll
2009-05-01 03:03 . 2009-05-01 03:03 23832 ----a-w- c:\windows\system32\drivers\lvuvcflt.sys
2009-05-01 02:02 . 2009-05-01 02:02 1579630 ----a-w- c:\windows\system32\nvdata.bin
2009-05-01 02:02 . 2009-05-01 02:02 1314816 ----a-w- c:\windows\system32\nvcuvenc.dll
2009-05-01 02:02 . 2009-03-27 14:03 663552 ----a-w- c:\windows\system32\nvcuvid.dll
2009-05-01 02:02 . 2008-07-15 03:05 457248 ----a-w- c:\windows\system32\nvudisp.exe
2009-05-01 02:02 . 2008-01-09 09:53 9994240 ----a-w- c:\windows\system32\nvoglnt.dll
2009-05-01 02:02 . 2008-01-09 09:53 806912 ----a-w- c:\windows\system32\nvapi.dll
2009-05-01 02:02 . 2008-01-09 09:53 8055584 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2009-05-01 02:02 . 2008-01-09 09:53 5896320 ----a-w- c:\windows\system32\nv4_disp.dll
2009-05-01 02:02 . 2008-01-09 09:53 1720320 ----a-w- c:\windows\system32\nvcuda.dll
2009-05-01 02:02 . 2008-01-09 09:53 143360 ----a-w- c:\windows\system32\nvcodins.dll
2009-05-01 02:02 . 2008-01-09 09:53 143360 ----a-w- c:\windows\system32\nvcod.dll
2009-04-29 04:52 . 2003-03-31 12:00 659456 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:52 . 2004-08-04 07:56 81920 ------w- c:\windows\system32\ieencode.dll
2009-04-27 04:42 . 2008-07-15 02:23 457248 ----a-w- c:\windows\system32\NVUNINST.EXE
2009-04-22 04:20 . 2009-04-22 04:20 14311680 ----a-w- c:\windows\system32\xlive.dll
2009-04-22 04:20 . 2009-04-22 04:20 13642496 ----a-w- c:\windows\system32\xlivefnt.dll
2009-04-17 09:58 . 2003-03-31 12:00 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:11 . 2003-03-31 12:00 584192 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-13 08:07 . 2008-07-15 04:32 14464 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-12 13:58 . 2009-04-12 13:58 65536 ----a-w- c:\windows\IFinst27.exe
2009-04-09 13:51 . 2009-04-09 13:51 25280 ----a-w- c:\windows\system32\drivers\hamachi.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2008-06-20 00:51 143360 ----a-w- c:\program files\Dropbox\DropboxExt.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="c:\program files\MSN Messenger\msnmsgr.exe" [2007-01-19 5674352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Lycosa"="c:\program files\Razer\Lycosa\razerhid.exe" [2007-11-20 147456]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2007-09-12 172032]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-05-01 13750272]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-05-01 86016]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-10-17 16855552]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2009-03-27 1657376]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Planex Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Planex Wireless Utility.lnk
backup=c:\windows\pss\Planex Wireless Utility.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnkStartup
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.3.0-enUS-downloader.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\Veoh Networks\\VeohWebPlayer\\veohwebplayer.exe"=
"c:\\Documents and Settings\\Owner\\Local Settings\\Application Data\\Dyyno Receiver\\DPPM.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\NCsoft\\Exteel\\System\\Exteel.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\alaplaya\\S4League\\patcher_s4.exe"=
"c:\\Program Files\\alaplaya\\S4League\\selfupdate_s4.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
"58828:TCP"= 58828:TCP:Pando Media Booster
"58828:UDP"= 58828:UDP:Pando Media Booster
"28002:TCP"= 28002:TCP:S4_TCP_28002
"28008:TCP"= 28008:TCP:S4_TCP_28008
"28012:TCP"= 28012:TCP:S4_TCP_28012
"28013:TCP"= 28013:TCP:S4_TCP_28013
"6112:UDP"= 6112:UDP:S4_UDP_6112
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [6/22/2009 8:06 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [6/22/2009 8:06 PM 20560]
R2 RalinkRegistryWriter;Ralink Registry Writer;c:\program files\Planex\Common\RalinkRegistryWriter.exe [5/28/2009 5:14 PM 69632]
R3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [10/21/2008 3:21 PM 12032]
R3 LycoFltr;Lycosa Keyboard;c:\windows\system32\drivers\Lycosa.sys [10/21/2008 3:18 PM 21888]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
S3 PsSdk41;PsSdk41;c:\windows\system32\drivers\pssdk41.sys [5/28/2009 5:40 PM 36928]
S3 rt2870;Ralink 802.11n USB Wireless LAN Card Driver;c:\windows\system32\drivers\rt2870.sys [5/28/2009 6:41 PM 583680]
S3 XDva186;XDva186;\??\c:\windows\system32\XDva186.sys --> c:\windows\system32\XDva186.sys [?]
S3 XDva224;XDva224;\??\c:\windows\system32\XDva224.sys --> c:\windows\system32\XDva224.sys [?]
S3 XDva226;XDva226;\??\c:\windows\system32\XDva226.sys --> c:\windows\system32\XDva226.sys [?]
S3 XDva248;XDva248;\??\c:\windows\system32\XDva248.sys --> c:\windows\system32\XDva248.sys [?]
.
Contents of the 'Scheduled Tasks' folder
2009-06-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-12 00:57]
.
.
------- Supplementary Scan -------
.
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
DPF: {99CAAA27-FA0C-4FA4-B88A-4AB1CC7A17FE} - hxxp://ares.netgame.com/download/mglaunch_USAv1002.cab
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\aijnx279.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\aijnx279.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMFireLauncher.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-07-03 17:02
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\npggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(932)
c:\windows\system32\nvappfilter.dll
- - - - - - - > 'explorer.exe'(2924)
c:\program files\Dropbox\DropboxExt.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\NVIDIA Corporation\nTune\nTuneService.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
c:\program files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
c:\windows\system32\rundll32.exe
c:\program files\Razer\Lachesis\OSD.exe
c:\program files\Razer\Lycosa\razertra.exe
c:\program files\Razer\Lachesis\razerofa.exe
c:\program files\MSN Messenger\usnsvc.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-03 17:05 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-03 21:04
Pre-Run: 59,698,737,152 bytes free
Post-Run: 63,348,420,608 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
254 --- E O F --- 2009-07-01 21:41