Combo Fix log
ComboFix 08-03-14.4 - McSpanky 2008-03-16 15:57:19.9 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1361 [GMT 0:00]
Running from: C:\Documents and Settings\McSpanky\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 )))))))))))))))))))))))))))))))
.
2008-03-16 15:24 . 2008-03-16 15:24 <DIR> d-------- C:\Deckard
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\WINDOWS\LastGood
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-16 12:45 . 2006-05-03 01:56 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-13 18:56 . 2008-03-16 09:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-13 18:56 . 2008-03-13 18:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-09 19:17 . 2008-03-09 19:17 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-09 19:17 . 2008-03-09 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-24 09:25 . 2008-03-15 11:50 <DIR> d-------- C:\Program Files\SpywareGuard
2008-02-24 09:23 . 2008-03-15 11:10 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-02-24 09:23 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-02-24 09:23 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-23 18:49 . 2008-02-23 18:47 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-23 18:49 . 2008-02-23 18:49 2,553 --a------ C:\WINDOWS\unins000.dat
2008-02-23 15:06 . 2008-02-23 15:06 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-23 10:17 . 2008-02-23 10:17 <DIR> d-------- C:\Program Files\PixiePack Codec Pack
2008-02-23 10:15 . 2008-02-23 10:26 <DIR> d-------- C:\Documents and Settings\McSpanky\Application Data\Tunebite
2008-02-23 10:15 . 2007-12-11 09:52 26,784 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2008-02-23 10:14 . 2008-02-23 10:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\RapidSolution
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 15:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-03-16 15:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-15 12:31 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\Azureus
2008-03-12 18:51 --------- d-----w C:\Program Files\Symantec
2008-03-09 19:16 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 09:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-24 08:56 --------- d-----w C:\Program Files\Flickr Uploadr
2008-02-24 08:51 --------- d-----w C:\Program Files\Kontiki
2008-02-23 18:57 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-23 15:20 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\dvdcss
2008-02-23 15:06 --------- d-----w C:\Program Files\Common Files\Real
2008-02-23 15:05 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-02-16 13:55 --------- d-----w C:\Program Files\ElcomSoft
2008-02-15 22:51 --------- d-----w C:\Program Files\Intelore
2008-02-03 12:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-03 12:50 --------- d-----w C:\Documents and Settings\Pablo\Application Data\AdobeUM
2008-02-02 21:37 --------- d-----w C:\Program Files\Total Video Converter
2008-02-02 08:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 18:52 --------- d-----w C:\Program Files\HMV
2008-01-21 20:36 --------- d-----w C:\Program Files\GetASFStream
2008-01-21 20:31 --------- d-----w C:\Program Files\WMR11
2008-01-20 13:30 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\J River
2008-01-20 13:22 --------- d-----w C:\Program Files\J River
2008-01-19 19:19 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\Roxio
2008-01-12 22:47 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-12-24 10:15 585,728 ------w C:\WINDOWS\system32\AReadyLB.dll
2007-12-24 10:15 229,376 ------w C:\WINDOWS\system32\AudDevicePlugin.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-09-19 21:37 5,818,344 ----a-w C:\Program Files\Firefox Setup 2.0.0.7.exe
2007-09-27 18:24 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( [email protected]_11.46.53.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-23 20:58:14 3,877 ----a-w C:\WINDOWS\mozver.dat
+ 2008-03-15 13:04:59 4,047 ----a-w C:\WINDOWS\mozver.dat
- 2007-07-12 00:22:00 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2006-05-03 00:19:30 49,248 ----a-w C:\WINDOWS\system32\java.exe
- 2007-07-12 00:22:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2006-05-03 00:19:40 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-07-12 01:22:38 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2006-05-03 01:56:58 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 12:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 15:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 15:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-11-20 16:52:00 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2007-11-20 16:52:00 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-03-16 07:28:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{292547EC-9C38-4398-B336-6219B91A1634}"= "C:\WINDOWS\ekvgsnw.dll" [ ]
[HKEY_CLASSES_ROOT\clsid\{292547ec-9c38-4398-b336-6219b91a1634}]
[HKEY_CLASSES_ROOT\ekvgsnw.1]
[HKEY_CLASSES_ROOT\TypeLib\{A17B7F5F-32DE-4114-9AF3-A40C8966076C}]
[HKEY_CLASSES_ROOT\ekvgsnw]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2006-12-08 06:45 543232]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 05:59 115816]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 07:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30 517768]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [2005-11-04 05:47 1687552]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-23 15:05 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
C:\Documents and Settings\McSpanky\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinAlrt"= {e51a6152-cf58-468e-ab42-e36e5fa45c89} - C:\WINDOWS\Installer\{e51a6152-cf58-468e-ab42-e36e5fa45c89}\WinAlrt.dll [2008-02-23 10:22 17958]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BT Broadband Desktop Help.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BT Broadband Desktop Help.lnk
backup=C:\WINDOWS\pss\BT Broadband Desktop Help.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^McSpanky^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=C:\Documents and Settings\McSpanky\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=C:\WINDOWS\pss\Picture Motion Browser Media Check Tool.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2005-04-16 16:08 172032 C:\Program Files\Apoint2K\Apoint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
--a------ 2004-08-04 12:00 5632 C:\WINDOWS\system32\winver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\Program Files\BitTorrent_DNA\dna.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FuncKey]
--a------ 2006-07-27 14:06 122880 C:\Program Files\Hotkey 1.0.4\FuncKey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
--a------ 2008-01-25 10:08 1032376 C:\Program Files\Kontiki\KHost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MalwareCrush]
C:\Program Files\MalwareCrush\MalwareCrush.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2006-02-06 17:52 462935 C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-10-19 20:16 286720 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
--a------ 2005-11-04 09:27 163840 C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3Trayp]
--a------ 2007-06-11 02:15 176128 C:\WINDOWS\system32\S3Trayp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-23 15:05 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayStartup]
--a------ 2007-07-04 21:01 1238392 C:\Program Files\BT Auto Backup\VaultClientTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tunebite]
C:\Program Files\RapidSolution\Tunebite\Tunebite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
--a------ 2006-09-21 07:36 53248 C:\WINDOWS\system32\VTTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 19:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2005-08-31 16:11 2478080 C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2006-07-21 15:19 129536 C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
--a------ 2007-06-26 12:48 509224 C:\PROGRA~1\Yahoo!\YOP\yop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
R2 VaultClientSRV;BT Auto Backup Service;C:\Program Files\BT Auto Backup\VaultClientSRV.exe [2007-07-04 21:01]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-07-30 01:41]
S3 HMVDownloadService;HMVDownloadService;"C:\Program Files\HMV\DigitalDownloads\HMVDownloadService.exe" [2008-01-11 15:59]
*Newly Created Service* - APPMGMT
*Newly Created Service* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-03-15 11:35:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 11:14:16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1193569925.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-03-03 21:23:37 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - McSpanky.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 16:00:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{e51a6152-cf58-468e-ab42-e36e5fa45c89}\WinAlrt.dll
.
Completion time: 2008-03-16 16:01:17
ComboFix-quarantined-files.txt 2008-03-16 16:01:13
ComboFix2.txt 2008-03-15 12:04:46
ComboFix3.txt 2008-03-15 11:47:16
ComboFix4.txt 2008-03-09 21:08:26
.
2008-03-12 18:51:13 --- E O F ---
ComboFix 08-03-14.4 - McSpanky 2008-03-16 15:57:19.9 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1361 [GMT 0:00]
Running from: C:\Documents and Settings\McSpanky\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((( Files Created from 2008-02-16 to 2008-03-16 )))))))))))))))))))))))))))))))
.
2008-03-16 15:24 . 2008-03-16 15:24 <DIR> d-------- C:\Deckard
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\WINDOWS\LastGood
2008-03-16 12:48 . 2008-03-16 12:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-16 12:45 . 2006-05-03 01:56 49,265 --a------ C:\WINDOWS\system32\jpicpl32.cpl
2008-03-13 18:56 . 2008-03-16 09:26 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-03-13 18:56 . 2008-03-13 18:56 1,409 --a------ C:\WINDOWS\QTFont.for
2008-03-09 19:17 . 2008-03-09 19:17 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-09 19:17 . 2008-03-09 19:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-24 09:25 . 2008-03-15 11:50 <DIR> d-------- C:\Program Files\SpywareGuard
2008-02-24 09:23 . 2008-03-15 11:10 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-02-24 09:23 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-02-24 09:23 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-02-23 18:49 . 2008-02-23 18:47 691,545 --a------ C:\WINDOWS\unins000.exe
2008-02-23 18:49 . 2008-02-23 18:49 2,553 --a------ C:\WINDOWS\unins000.dat
2008-02-23 15:06 . 2008-02-23 15:06 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-02-23 10:17 . 2008-02-23 10:17 <DIR> d-------- C:\Program Files\PixiePack Codec Pack
2008-02-23 10:15 . 2008-02-23 10:26 <DIR> d-------- C:\Documents and Settings\McSpanky\Application Data\Tunebite
2008-02-23 10:15 . 2007-12-11 09:52 26,784 --a------ C:\WINDOWS\system32\drivers\tbhsd.sys
2008-02-23 10:14 . 2008-02-23 10:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\RapidSolution
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-16 15:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Kontiki
2008-03-16 15:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-03-15 12:31 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\Azureus
2008-03-12 18:51 --------- d-----w C:\Program Files\Symantec
2008-03-09 19:16 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-02-24 09:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-24 08:56 --------- d-----w C:\Program Files\Flickr Uploadr
2008-02-24 08:51 --------- d-----w C:\Program Files\Kontiki
2008-02-23 18:57 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-02-23 15:20 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\dvdcss
2008-02-23 15:06 --------- d-----w C:\Program Files\Common Files\Real
2008-02-23 15:05 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
2008-02-16 13:55 --------- d-----w C:\Program Files\ElcomSoft
2008-02-15 22:51 --------- d-----w C:\Program Files\Intelore
2008-02-03 12:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-03 12:50 --------- d-----w C:\Documents and Settings\Pablo\Application Data\AdobeUM
2008-02-02 21:37 --------- d-----w C:\Program Files\Total Video Converter
2008-02-02 08:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-27 18:52 --------- d-----w C:\Program Files\HMV
2008-01-21 20:36 --------- d-----w C:\Program Files\GetASFStream
2008-01-21 20:31 --------- d-----w C:\Program Files\WMR11
2008-01-20 13:30 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\J River
2008-01-20 13:22 --------- d-----w C:\Program Files\J River
2008-01-19 19:19 --------- d-----w C:\Documents and Settings\McSpanky\Application Data\Roxio
2008-01-12 22:47 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL
2007-12-24 10:15 585,728 ------w C:\WINDOWS\system32\AReadyLB.dll
2007-12-24 10:15 229,376 ------w C:\WINDOWS\system32\AudDevicePlugin.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-09-19 21:37 5,818,344 ----a-w C:\Program Files\Firefox Setup 2.0.0.7.exe
2007-09-27 18:24 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
Code:
<pre>
----a-w 53,760 2007-05-26 18:27:08 C:\Documents and Settings\McSpanky\My Documents\pshop\~CS3 KeYGeN'z Pack~\Adobe CS3 KeYGeN'z Pack\Adobe Design Premium CS3 Keygen .exe
----a-w 53,760 2007-04-21 03:11:52 C:\Documents and Settings\McSpanky\My Documents\pshop\~CS3 KeYGeN'z Pack~\Adobe CS3 KeYGeN'z Pack\Adobe Dreamweaver CS3 Keygen .exe
----a-w 53,760 2007-04-21 04:51:06 C:\Documents and Settings\McSpanky\My Documents\pshop\~CS3 KeYGeN'z Pack~\Adobe CS3 KeYGeN'z Pack\Adobe Flash CS3 Keygen .exe
</pre>((((((((((((((((((((((((((((( [email protected]_11.46.53.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-10-23 20:58:14 3,877 ----a-w C:\WINDOWS\mozver.dat
+ 2008-03-15 13:04:59 4,047 ----a-w C:\WINDOWS\mozver.dat
- 2007-07-12 00:22:00 135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2006-05-03 00:19:30 49,248 ----a-w C:\WINDOWS\system32\java.exe
- 2007-07-12 00:22:04 135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2006-05-03 00:19:40 53,346 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-07-12 01:22:38 139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2006-05-03 01:56:58 127,078 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 12:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 15:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 15:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
+ 2007-11-20 16:52:00 2,884,992 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2007-11-20 16:52:00 218,496 ----a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-03-16 07:28:22 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_7a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{292547EC-9C38-4398-B336-6219B91A1634}"= "C:\WINDOWS\ekvgsnw.dll" [ ]
[HKEY_CLASSES_ROOT\clsid\{292547ec-9c38-4398-b336-6219b91a1634}]
[HKEY_CLASSES_ROOT\ekvgsnw.1]
[HKEY_CLASSES_ROOT\TypeLib\{A17B7F5F-32DE-4114-9AF3-A40C8966076C}]
[HKEY_CLASSES_ROOT\ekvgsnw]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2006-12-08 06:45 543232]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 05:59 115816]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 07:11 771704]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 17:30 517768]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [2005-11-04 05:47 1687552]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-23 15:05 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe" [2006-05-03 01:56 36975]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 12:00 15360]
C:\Documents and Settings\McSpanky\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35 360448]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"WinAlrt"= {e51a6152-cf58-468e-ab42-e36e5fa45c89} - C:\WINDOWS\Installer\{e51a6152-cf58-468e-ab42-e36e5fa45c89}\WinAlrt.dll [2008-02-23 10:22 17958]
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BT Broadband Desktop Help.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\BT Broadband Desktop Help.lnk
backup=C:\WINDOWS\pss\BT Broadband Desktop Help.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^McSpanky^Start Menu^Programs^Startup^Picture Motion Browser Media Check Tool.lnk]
path=C:\Documents and Settings\McSpanky\Start Menu\Programs\Startup\Picture Motion Browser Media Check Tool.lnk
backup=C:\WINDOWS\pss\Picture Motion Browser Media Check Tool.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Apoint]
--a------ 2005-04-16 16:08 172032 C:\Program Files\Apoint2K\Apoint.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
--a------ 2004-08-04 12:00 5632 C:\WINDOWS\system32\winver.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent]
C:\Program Files\BitTorrent\bittorrent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
C:\Program Files\BitTorrent_DNA\dna.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FuncKey]
--a------ 2006-07-27 14:06 122880 C:\Program Files\Hotkey 1.0.4\FuncKey.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kdx]
--a------ 2008-01-25 10:08 1032376 C:\Program Files\Kontiki\KHost.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MalwareCrush]
C:\Program Files\MalwareCrush\MalwareCrush.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Motive SmartBridge]
--a------ 2006-02-06 17:52 462935 C:\PROGRA~1\BTHOME~1\Help\SMARTB~1\BTHelpNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--a------ 2004-10-13 16:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 09:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-10-19 20:16 286720 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
--a------ 2005-11-04 09:27 163840 C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\S3Trayp]
--a------ 2007-06-11 02:15 176128 C:\WINDOWS\system32\S3Trayp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2008-02-23 15:05 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayStartup]
--a------ 2007-07-04 21:01 1238392 C:\Program Files\BT Auto Backup\VaultClientTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Tunebite]
C:\Program Files\RapidSolution\Tunebite\Tunebite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VTTimer]
--a------ 2006-09-21 07:36 53248 C:\WINDOWS\system32\VTTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 19:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2005-08-31 16:11 2478080 C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2006-07-21 15:19 129536 C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
--a------ 2007-06-26 12:48 509224 C:\PROGRA~1\Yahoo!\YOP\yop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
"C:\\Program Files\\Kontiki\\KService.exe"=
R2 VaultClientSRV;BT Auto Backup Service;C:\Program Files\BT Auto Backup\VaultClientSRV.exe [2007-07-04 21:01]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2007-07-30 01:41]
S3 HMVDownloadService;HMVDownloadService;"C:\Program Files\HMV\DigitalDownloads\HMVDownloadService.exe" [2008-01-11 15:59]
*Newly Created Service* - APPMGMT
*Newly Created Service* - COMHOST
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
C:\Program Files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-03-15 11:35:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 11:14:16 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1193569925.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
"2008-03-03 21:23:37 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - McSpanky.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-16 16:00:28
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\WINDOWS\Installer\{e51a6152-cf58-468e-ab42-e36e5fa45c89}\WinAlrt.dll
.
Completion time: 2008-03-16 16:01:17
ComboFix-quarantined-files.txt 2008-03-16 16:01:13
ComboFix2.txt 2008-03-15 12:04:46
ComboFix3.txt 2008-03-15 11:47:16
ComboFix4.txt 2008-03-09 21:08:26
.
2008-03-12 18:51:13 --- E O F ---
