ComboFix 08-02.05.3 - Patrick 2008-02-09 22:27:25.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.757 [GMT -8:00] Running from: C:\Documents and Settings\Patrick\Local Settings\Temporary Internet Files\Content.IE5\XUANKVRL\ComboFix[1].exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . [i] ADS - svchost.exe: deleted 88 bytes in 2 streams. [/i] ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat ----- BITS: Possible infected sites ----- hxxp://www.download.windowsupdate.com hxxp://www.download.wij+|C̛v+@J:NGD_DQ{zGD_DQ{zGD_DQ{zGD_DQ{z+@J:Nj+|C̛vad S-1-5-18 `HT4?? 6VwoQZCDHMsC:\WINDOWS\SoftwareDistribution\Download\4982a61e2216973813f44f56425bf3d9\73d75d7b41f8a3d49f272e74d4f73bb5e82f1acf . ((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 ))))))))))))))))))))))))))))))) . 2008-02-09 21:22 . 2008-02-09 21:22 d-------- C:\Program Files\Xilisoft 2008-02-09 19:19 . 2008-02-09 19:19 d--h----- C:\WINDOWS\PIF 2008-02-09 19:03 . 2008-02-09 19:03 26,000 --a------ C:\WINDOWS\system32\E3TL.DLL 2008-02-09 18:49 . 2008-02-09 18:49 d-------- C:\Documents and Settings\All Users\Application Data\Zenturi 2008-02-09 13:48 . 2008-02-09 13:48 d-------- C:\WINDOWS\LastGood 2008-02-09 13:43 . 2008-02-09 13:43 d-------- C:\Program Files\Terra Firma Software, LLC 2008-02-09 13:40 . 2008-02-09 13:42 d-------- C:\Program Files\WinX DVD Player 3.0 2008-02-09 13:38 . 2008-02-09 13:39 d-------- C:\Program Files\pcYourPod 2008-02-09 12:09 . 2006-08-03 22:55 13 --a------ C:\WINDOWS\system32\drivers\WLANver.tic 2008-02-09 11:18 . 2008-02-09 11:18 d-------- C:\QFE329048.temp 2008-02-09 03:46 . 2008-02-09 03:46 d-------- C:\SUpgrade3.5B3.temp 2008-02-09 03:42 . 2008-02-09 03:42 d-------- C:\QFE810577.temp 2008-02-09 03:31 . 2003-08-13 11:56 28,672 --a------ C:\WINDOWS\system32\CloseACU.exe 2008-02-09 03:31 . 2003-08-06 18:22 24,576 --a------ C:\WINDOWS\system32\DelRunOnceReg.exe 2008-02-09 00:31 . 2008-02-09 00:31 d-------- C:\Program Files\CCleaner 2008-02-08 18:11 . 2008-02-08 18:31 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-02-08 18:11 . 2008-02-08 18:11 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-02-08 18:10 . 2008-02-08 18:10 d-------- C:\Program Files\Kaspersky Lab 2008-02-08 18:10 . 2008-02-09 13:02 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-02-08 18:01 . 2008-02-08 18:01 d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-02-06 20:16 . 2008-02-06 20:16 d-------- C:\Program Files\LimeWire 2008-02-06 20:16 . 2008-02-06 20:34 d-------- C:\Documents and Settings\Patrick\Application Data\LimeWire 2008-02-06 12:08 . 2008-02-06 12:08 d-------- C:\Program Files\MSXML 4.0 2008-02-04 01:42 . 2008-02-04 01:42 d-------- C:\Config Free.temp 2008-02-03 20:40 . 2008-02-03 20:40 d--h----- C:\Documents and Settings\Patrick\WLANProfiles 2008-02-03 20:40 . 2008-02-03 20:40 d--h----- C:\Documents and Settings\All Users\WLANProfiles 2008-02-03 20:29 . 2008-02-03 20:29 d-------- C:\Intel Utility.temp 2008-02-03 20:24 . 2008-02-03 20:24 17,801 --a------ C:\WINDOWS\system32\drivers\AegisP.sys 2008-02-03 20:21 . 2008-02-03 20:21 d-------- C:\inteltemp 2008-02-03 20:20 . 2008-02-03 20:20 d-------- C:\Program Files\DVD-RAM 2008-02-03 20:20 . 2003-03-14 11:38 155,648 --------- C:\WINDOWS\system32\RAMASST.exe 2008-02-03 20:20 . 2003-05-22 13:44 135,168 --------- C:\WINDOWS\system32\DVDMenu.dll 2008-02-03 20:20 . 2003-05-23 13:38 106,496 --------- C:\WINDOWS\system32\DVDRAMSV.exe 2008-02-03 20:20 . 2003-01-31 17:45 90,416 --------- C:\WINDOWS\system32\drivers\meiudf.sys 2008-02-03 20:19 . 2008-02-03 20:19 d-------- C:\DVDRam.temp 2008-02-03 20:17 . 2008-02-03 20:17 d-------- C:\Program Files\InterVideo Information Service 2008-02-03 20:17 . 2008-02-03 20:17 d-------- C:\Program Files\Common Files\Ulead 2008-02-03 20:17 . 2006-05-11 18:41 654 --------- C:\WINDOWS\remove.iss 2008-02-03 20:15 . 2008-02-03 20:15 d-------- C:\Documents and Settings\All Users\Application Data\InstallShield 2008-02-03 20:11 . 2008-02-03 20:13 d--h----- C:\WINDOWS\msdownld.tmp 2008-02-01 21:02 . 2008-02-01 21:02 d-------- C:\Documents and Settings\Patrick\Application Data\Grisoft 2008-02-01 21:02 . 2007-05-30 04:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-31 19:59 . 2008-02-08 18:00 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-01-31 19:41 . 2008-02-01 22:51 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico 2008-01-31 19:41 . 2008-02-01 22:51 1,406 --a------ C:\WINDOWS\system32\Help.ico 2008-01-31 19:31 . 2008-01-31 19:31 d-------- C:\Program Files\Trend Micro 2008-01-30 21:02 . 2008-02-07 22:43 d-------- C:\Documents and Settings\Patrick\Application Data\DivX 2008-01-30 20:57 . 2008-01-30 21:08 d-------- C:\Documents and Settings\Patrick\Application Data\U3 2008-01-29 18:59 . 2008-01-29 18:59 d-------- C:\Documents and Settings\Patrick\Application Data\Skype 2008-01-29 18:59 . 2008-01-29 18:59 d-------- C:\Documents and Settings\Patrick\Application Data\MySpace 2008-01-27 14:14 . 2008-01-27 14:14 d-------- C:\Program Files\Microsoft Silverlight 2008-01-27 14:12 . 2006-11-12 22:02 288,768 --------- C:\WINDOWS\system32\rhttpaa.dll 2008-01-27 14:12 . 2006-11-12 22:02 116,736 --------- C:\WINDOWS\system32\aaclient.dll 2008-01-27 14:12 . 2006-11-12 22:02 36,352 --------- C:\WINDOWS\system32\tsgqec.dll 2008-01-27 13:49 . 2004-08-03 22:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-01-27 13:49 . 2004-08-03 22:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-01-27 13:48 . 2008-01-27 13:48 d-------- C:\WINDOWS\samsung 2008-01-27 13:48 . 2001-05-10 13:58 55,376 --a------ C:\WINDOWS\Ml165.hlp 2008-01-27 13:48 . 2001-08-30 17:00 45,056 --a------ C:\WINDOWS\system32\InsDrv2K.dll 2008-01-27 13:48 . 2001-03-20 16:10 3,262 --a------ C:\WINDOWS\reinstall.ico 2008-01-27 13:48 . 2001-03-20 14:52 766 --a------ C:\WINDOWS\Uninstall.ico 2008-01-27 13:21 . 2008-01-27 13:21 d-------- C:\Program Files\MSXML 6.0 2008-01-27 12:40 . 2008-01-27 12:40 d-------- C:\Program Files\MSBuild 2008-01-27 12:35 . 2008-01-27 13:23 d-------- C:\WINDOWS\system32\XPSViewer 2008-01-27 12:35 . 2008-01-27 12:35 d-------- C:\Program Files\Reference Assemblies 2008-01-27 12:34 . 2008-01-27 12:34 d-------- C:\d56d2096154170eeca65f4d1a39c 2008-01-27 12:34 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll 2008-01-26 18:34 . 2003-09-10 16:22 d-------- C:\Documents and Settings\Administrator\Application Data\Symantec 2008-01-26 18:34 . 2003-09-11 08:38 d-------- C:\Documents and Settings\Administrator\Application Data\InterVideo 2008-01-26 18:34 . 2003-09-10 16:20 d-------- C:\Documents and Settings\Administrator\Application Data\InterTrust 2008-01-26 18:34 . 2003-09-10 15:40 d-------- C:\Documents and Settings\Administrator\Application Data\Drag'n Drop CD+DVD 2008-01-26 17:31 . 2008-01-26 17:34 d--h----- C:\WINDOWS\Icons 2008-01-26 14:44 . 2008-01-27 08:48 d-------- C:\Documents and Settings\Patrick\Application Data\Apple Computer 2008-01-26 14:44 . 2008-02-09 13:02 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-01-26 14:44 . 2008-01-26 14:44 1,409 --a------ C:\WINDOWS\QTFont.for 2008-01-26 14:43 . 2008-01-26 14:43 d-------- C:\Program Files\iTunes 2008-01-26 14:43 . 2008-01-26 14:43 d-------- C:\Program Files\iPod 2008-01-26 14:42 . 2008-01-26 14:43 d-------- C:\Program Files\QuickTime 2008-01-26 14:42 . 2008-01-26 14:42 d-------- C:\Program Files\Common Files\Apple 2008-01-26 14:42 . 2008-01-26 14:42 d-------- C:\Program Files\Apple Software Update 2008-01-26 14:42 . 2008-01-26 15:20 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-01-26 14:42 . 2008-01-26 14:42 d-------- C:\Documents and Settings\All Users\Application Data\Apple 2008-01-26 14:39 . 2008-01-26 14:39 0 --a------ C:\WINDOWS\mozy.flt 2008-01-26 14:39 . 2008-01-26 14:39 0 --a------ C:\WINDOWS\mozy.blk 2008-01-26 14:05 . 2008-01-26 14:12 d-------- C:\WINDOWS\Symbols 2008-01-26 12:20 . 2008-02-06 21:16 d-------- C:\Program Files\TuneUp Utilities 2007 2008-01-26 12:20 . 2008-01-26 12:20 d-------- C:\Documents and Settings\Patrick\Application Data\TuneUp Software 2008-01-26 12:20 . 2008-01-26 12:20 d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software 2008-01-26 12:20 . 2007-05-16 09:41 29,704 --a------ C:\WINDOWS\system32\uxtuneup.dll 2008-01-26 10:12 . 2008-02-09 22:43 4,155,680 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-01-26 10:12 . 2008-02-09 22:42 198,944 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-01-26 10:12 . 2008-02-09 13:00 54,284 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-01-26 10:12 . 2008-02-09 13:00 18,260 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-01-26 10:08 . 2008-02-08 17:59 d-------- C:\KAV 2008-01-26 09:39 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-01-26 09:39 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-01-26 09:39 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-01-26 03:54 . 2008-01-26 03:55 d-------- C:\Program Files\DivX 2008-01-26 03:54 . 2008-01-04 13:58 129,784 --------- C:\WINDOWS\system32\pxafs.dll 2008-01-26 03:54 . 2008-01-04 13:58 120,056 --------- C:\WINDOWS\system32\pxcpyi64.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-02-10 01:35 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-02-04 04:24 --------- d-----w C:\Program Files\Intel 2008-02-04 04:15 --------- d-----w C:\Program Files\InterVideo 2008-02-04 04:15 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-01-27 21:12 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-01-26 10:27 --------- d-----w C:\Program Files\Java 2008-01-26 09:50 --------- d-----w C:\Program Files\Common Files\Adobe 2008-01-26 05:38 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-01-26 05:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec 2008-01-04 21:58 43,528 ------w C:\WINDOWS\system32\drivers\pxhelp20.sys 2007-12-18 08:43 23,396 ----a-w C:\WINDOWS\system32\drivers\klopp.dat 2007-12-13 21:28 24,592 ----a-w C:\WINDOWS\system32\drivers\klim5.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 02:24 65536] "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46 1460560] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "00THotkey"="C:\WINDOWS\System32\[u]0[/u]0THotkey.exe" [2003-04-15 19:01 258048] "000StTHK"="000StTHK.exe" [2001-06-23 19:28 24576 C:\WINDOWS\system32\[u]0[/u]00StTHK.exe] "nwiz"="nwiz.exe" [2003-09-24 17:00 323584 C:\WINDOWS\system32\nwiz.exe] "TFNF5"="TFNF5.exe" [2003-07-18 16:41 73728 C:\WINDOWS\system32\TFNF5.exe] "SigmaTel StacMon"="C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe" [2003-08-03 15:01 86073] "AGRSMMSG"="AGRSMMSG.exe" [2003-04-18 10:20 88363 C:\WINDOWS\agrsmmsg.exe] "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-05-30 18:25 110592] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-05-30 18:23 614400] "TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-21 17:00 126976] "TPSMain"="TPSMain.exe" [2003-09-04 17:49 274432 C:\WINDOWS\system32\TPSMain.exe] "ezShieldProtector for Px"="C:\WINDOWS\System32\ezSP_Px.exe" [2002-08-20 09:29 40960] "TFncKy"="TFncKy.exe" [] "Pinger"="C:\Toshiba\ivp\ISM\pinger.exe" [2002-10-17 12:21 159744] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2003-09-24 17:00 4861952] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312] "ZCfgSvc.exe"="c:\WINDOWS\system32\ZCfgSvc.exe" [2006-08-03 03:19 639040] "PRONoMgr.exe"="c:\Program Files\Intel\NCS\PROSet\PRONoMgr.exe" [2005-07-07 06:08 135168] "ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-03-20 17:34 213936] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2007-12-18 00:43 227856] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-02-03 20:20:20 155648] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Sebring] c:\WINDOWS\system32\LgNotify.dll 2006-08-03 03:20 188482 c:\WINDOWS\system32\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll R2 NwSapAgent;SAP Agent;C:\WINDOWS\system32\svchost.exe [2008-02-09 19:30] R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2008-02-09 19:30] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 tsdhd;TOSHIBA SD Card Host Controller Driver;C:\WINDOWS\system32\DRIVERS\tsdhd.sys [2003-05-14 16:38] S3 pciSd;pciSd;C:\WINDOWS\system32\DRIVERS\tossdpci.sys [2003-02-12 08:03] HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs UxTuneUp [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{179cee9c-cf61-11dc-889d-000cf10850fb}] \Shell\AutoRun\command - E:\LaunchU3.exe -a *Newly Created Service* - NETTCPPORTSHARING . Contents of the 'Scheduled Tasks' folder "2008-01-26 20:20:54 C:\WINDOWS\Tasks\1-Click Maintenance.job" - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe "2008-01-26 22:42:27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-02-09 10:08:12 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job" - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-02-09 22:43:29 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-02-09 22:45:35 ComboFix-quarantined-files.txt 2008-02-10 06:45:31 . 2008-02-06 20:08:58 --- E O F ---