ComboFix 07-08-16.3 - "bpr" 2007-08-16 19:04:03.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.286 [GMT -7:00] ((((((((((((((((((((((((( Files Created from 2007-07-17 to 2007-08-17 ))))))))))))))))))))))))))))))) 2007-08-16 19:04 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_3b8.dat 2007-08-16 18:59 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_340.dat 2007-08-16 18:55 d-------- C:\WINNT\ERUNT 2007-08-16 17:12 16,384 --a------ C:\WINNT\SYSTEM32\Perflib_Perfdata_334.dat 2007-08-16 17:09 10,872 --a------ C:\WINNT\SYSTEM32\DRIVERS\AvgAsCln.sys 2007-08-16 17:03 d-------- C:\Program Files\SUPERAntiSpyware 2007-08-16 17:03 d-------- C:\DOCUME~1\bpr.MHL\APPLIC~1\SUPERAntiSpyware.com 2007-08-16 17:03 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com 2007-08-16 15:49 53,248 --a------ C:\WINNT\SYSTEM32\Process.exe 2007-08-16 15:49 51,200 --a------ C:\WINNT\SYSTEM32\dumphive.exe 2007-08-16 15:49 288,417 --a------ C:\WINNT\SYSTEM32\SrchSTS.exe 2007-08-16 15:49 1,768 --a------ C:\WINNT\SYSTEM32\tmp.reg 2007-08-16 15:40 16,384 --a------ C:\WINNT\SYSTEM32\Perflib_Perfdata_33c.dat 2007-08-16 15:38 8,192 --a------ C:\WINNT\SYSTEM32\default_user_class.dat 2007-08-16 15:36 51,200 --a------ C:\WINNT\nircmd.exe 2007-08-15 18:52 d-------- C:\Program Files\MemInfo 2007-08-11 11:46 d-------- C:\WINNT\$regcmp$ 2007-08-11 11:46 d-------- C:\Program Files\Registry Clean Expert 2007-08-11 10:23 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PC Drivers Headquarters 2007-08-11 10:21 d-------- C:\Program Files\PC Drivers HeadQuarters 2007-08-11 09:36 d-------- C:\Program Files\ToniArts 2007-08-11 09:25 d-------- C:\DOCUME~1\bpr.MHL\APPLIC~1\Uniblue 2007-08-10 22:48 d-------- C:\Program Files\Free&Easy Font Viewer 2007-08-02 21:15 d-------- C:\Program Files\Microsoft Student 2007-08-02 21:15 d-------- C:\Program Files\Learning Essentials (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 07-06-30 13:49 --------- d-------- C:\Program Files\IDA 07-06-30 13:49 --------- d-------- C:\DOCUME~1\bpr.MHL\APPLIC~1\Internet Download Accelerator 07-06-22 21:25 --------- d-------- C:\DOCUME~1\bpr.MHL\APPLIC~1\MSNInstaller 07-06-21 14:41 --------- d-------- C:\Program Files\UPHClean 07-06-21 14:26 --------- d-------- C:\Program Files\MSECache 07-06-20 22:03 --------- d-------- C:\DOCUME~1\bpr.MHL\APPLIC~1\MSN6 07-06-20 19:54 --------- d-------- C:\Program Files\Qwest 07-06-20 19:54 --------- d-------- C:\Program Files\Common Files\supportsoft 07-06-20 19:54 --------- d-------- C:\Program Files\Actiontec 07-06-20 19:54 --------- d-------- C:\Program Files\2Wire_USB_Drivers 01-06-19 13:05 271 --ah----- C:\Program Files\DESKTOP.INI 01-06-19 13:05 21952 --ah----- C:\Program Files\FOLDER.HTT 01-05-08 07:00 32528 --a------ C:\WINNT\inf\WBFIRDMA.SYS 00-04-19 08:09 61510 --a------ C:\WINNT\inf\probedis.exe 00-04-19 07:58 69702 --a------ C:\WINNT\inf\3cshtdwn.exe 00-04-19 07:56 49152 --a------ C:\WINNT\inf\3cmlink.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Synchronization Manager"="mobsync.exe" [03-06-19 11:05 C:\WINNT\SYSTEM32\mobsync.exe] "NetscapeClient"="" [] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [06-11-03 18:20 ] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [07-06-11 02:25 ] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="ctfmon.exe" [01-02-20 13:09 C:\WINNT\SYSTEM32\CTFMON.EXE] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [07-02-27 11:39 ] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [06-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 07-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys] @="Driver" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys] @="Driver" R0 fasttrak;fasttrak;C:\WINNT\system32\DRIVERS\fasttrak.sys R0 Fd16_700;Fd16_700;C:\WINNT\system32\DRIVERS\fd16_700.sys R0 IntelATA;Intel Ultra ATA Controller;C:\WINNT\system32\DRIVERS\IntelAta.sys R0 mraid2k;mraid2k;C:\WINNT\system32\DRIVERS\mraid2k.sys R1 cdrbsvsd;cdrbsvsd;C:\WINNT\system32\drivers\cdrbsvsd.sys R1 cmosa;cmosa;C:\WINNT\system32\DRIVERS\cmosa.sys R1 msikbd2k;Multimedia Keyboard Filter Driver;C:\WINNT\system32\DRIVERS\msikbd2k.sys R2 ATNT40K;ActiveTouch NT Appsharing Driver;C:\WINNT\system32\DRIVERS\ATNT40K.SYS R2 atnthost;AT Host Service;"C:\WINNT\DOWNLO~1\WebEx\319\atnthost.exe" R2 ATNTWINK;ActiveTouch Remote Control Driver;C:\WINNT\system32\DRIVERS\ATNTWINK.SYS R2 nhksrv;Netropa NHK Server;C:\Program Files\Netropa\Multimedia Keyboard\nhksrv.exe R3 3c1807pd;U.S. Robotics 56K Fax Win Int;C:\WINNT\system32\DRIVERS\3c1807pd.sys R3 ati2mtaa;ati2mtaa;C:\WINNT\system32\DRIVERS\ati2mtaa.sys R3 L8042mou;Logitech SetPoint PS/2 Mouse Filter Driver;C:\WINNT\system32\DRIVERS\L8042mou.Sys S3 EL90BC;3Com EtherLink XL B/C Adapter Driver;C:\WINNT\system32\DRIVERS\el90xbc5.sys S3 ichaud;Service for AC'97 Driver (WDM);C:\WINNT\system32\drivers\ichaud.sys S3 JL2005;JL2005A Toy Camera;C:\WINNT\system32\Drivers\toywdm.sys Contents of the 'Scheduled Tasks' folder 2007-08-17 02:03:12 C:\WINNT\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe 2007-08-11 16:25:20 C:\WINNT\Tasks\Uniblue SpeedUpMyPC.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe 2007-08-11 16:25:20 C:\WINNT\Tasks\Uniblue SpeedUpMyPC Nag.job - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe 2007-08-15 09:30:02 C:\WINNT\Tasks\DAILY.job - C:\Program Files\StompSoft\Backup MyPC 6\System\sbestart.exe 2007-08-15 02:55:02 C:\WINNT\Tasks\AppleSoftwareUpdate.job ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-16 19:04:50 Windows 5.0.2195 Service Pack 4 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** Completion time: 2007-08-16 19:05:19 C:\ComboFix-quarantined-files.txt ... 07-08-16 19:05 C:\ComboFix2.txt ... 07-08-16 15:41 --- E O F ---