ComboFix 08-03-22.3 - Administrator 2008-03-23 16:31:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.470 [GMT 2:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 )))))))))))))))))))))))))))))))
.
2008-03-23 16:24 . 2008-03-23 16:24
d-------- C:\_OTMoveIt
2008-03-23 13:30 . 2008-03-23 13:32 d-------- C:\Program Files\AutoCorect
2008-03-23 12:46 . 2008-03-23 12:47 d-------- C:\Documents and Settings\tata\Application Data\Winamp
2008-03-23 12:37 . 2008-03-23 12:37 376 --a------ C:\WINDOWS\ODBC.INI
2008-03-23 12:36 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll
2008-03-23 12:35 . 2008-03-23 12:35 d-------- C:\Program Files\Microsoft ActiveSync
2008-03-23 12:35 . 2008-03-23 12:35 d-------- C:\Documents and Settings\tata\Application Data\Talkback
2008-03-23 12:34 . 2008-03-23 12:36 d-------- C:\WINDOWS\SHELLNEW
2008-03-23 12:33 . 2008-03-23 12:33 d-------- C:\Program Files\Microsoft.NET
2008-03-23 12:31 . 2008-03-23 12:31 dr-h----- C:\MSOCache
2008-03-23 12:22 . 2008-03-21 22:43 d-------- C:\Documents and Settings\tata\tb_temp
2008-03-23 12:22 . 2008-03-21 22:44 d-------- C:\Documents and Settings\tata\ff_temp
2008-03-23 12:22 . 2008-03-21 22:44 d-------- C:\Documents and Settings\tata\7zS88E.tmp
2008-03-23 00:21 . 2008-03-23 10:10 d-------- C:\Documents and Settings\Administrator\Application Data\F-Secure
2008-03-23 00:19 . 2008-03-23 00:26 d-------- C:\Program Files\F-Secure Internet Security
2008-03-23 00:19 . 2008-03-23 00:19 d-------- C:\Documents and Settings\All Users\Application Data\fssg
2008-03-23 00:19 . 2008-03-23 00:19 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure
2008-03-23 00:19 . 2007-05-25 15:09 58,128 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys
2008-03-23 00:19 . 2007-05-25 15:09 37,008 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys
2008-03-23 00:17 . 2008-03-23 00:18 d-------- C:\WINDOWS\SxsCaPendDel
2008-03-23 00:17 . 2008-03-23 00:17 121 --a------ C:\WINDOWS\bdagent.INI
2008-03-22 23:01 . 2008-03-22 23:01 d-------- C:\fsaua.data
2008-03-22 22:14 . 2008-03-22 22:14 d-------- C:\Program Files\BitDefender
2008-03-22 22:14 . 2008-03-23 00:13 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-03-22 22:13 . 2008-03-23 00:17 d-------- C:\Program Files\Common Files\BitDefender
2008-03-22 20:32 . 2008-03-22 20:57 d-------- C:\WINDOWS\BDOSCAN8
2008-03-22 20:22 . 2008-03-22 20:22 d-------- C:\Program Files\Trend Micro
2008-03-22 20:10 . 2008-03-22 20:10 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-22 20:10 . 2008-03-22 20:10 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-22 20:08 . 2008-03-22 20:08 d---s---- C:\Documents and Settings\Administrator\UserData
2008-03-22 18:49 . 2008-03-22 18:49 d-------- C:\Documents and Settings\All Users\Application Data\Last.fm
2008-03-22 18:48 . 2008-03-22 18:49 d-------- C:\Program Files\Last.fm
2008-03-22 18:19 . 2008-03-22 18:20 d-------- C:\Program Files\Winamp
2008-03-22 18:19 . 2008-03-22 18:19 d-------- C:\Documents and Settings\Administrator\Application Data\Winamp
2008-03-22 13:16 . 2008-03-22 13:16 d-------- C:\Documents and Settings\karina\Application Data\Talkback
2008-03-22 12:34 . 2008-03-21 22:43 d-------- C:\Documents and Settings\karina\tb_temp
2008-03-22 12:34 . 2008-03-21 22:44 d-------- C:\Documents and Settings\karina\ff_temp
2008-03-22 12:34 . 2008-03-21 22:44 d-------- C:\Documents and Settings\karina\7zS88E.tmp
2008-03-22 02:34 . 2008-03-22 02:34 d-------- C:\Program Files\MSXML 4.0
2008-03-22 02:33 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-03-21 23:22 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-21 23:21 . 2008-03-21 23:22 d-------- C:\Program Files\Java
2008-03-21 23:21 . 2008-03-21 23:21 d-------- C:\Program Files\Common Files\Java
2008-03-21 23:21 . 2007-07-09 15:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-03-21 23:17 . 2006-12-07 06:14 2,330,624 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll
2008-03-21 23:16 . 2008-03-22 02:38 d--h----- C:\WINDOWS\$hf_mig$
2008-03-21 23:16 . 2008-03-21 23:16 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-21 23:15 . 2008-03-21 23:15 d-------- C:\Program Files\Yahoo!
2008-03-21 23:13 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-21 23:13 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-03-21 23:13 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-21 23:13 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-03-21 23:13 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-03-21 23:13 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-03-21 23:08 . 2008-03-21 23:08 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-03-21 23:08 . 2008-03-21 23:08 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-21 23:03 . 2008-03-21 23:12 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2008-03-21 23:02 . 2008-03-22 11:28 d-------- C:\WINDOWS\Internet Logs
2008-03-21 23:01 . 2008-03-21 23:01 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-21 23:00 . 2008-03-22 12:23 d-------- C:\Program Files\SUPERAntiSpyware
2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Program Files\SpywareBlaster
2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
2008-03-21 23:00 . 2005-04-15 19:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-03-21 23:00 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-03-21 23:00 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-21 20:59 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-21 20:55 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-03-21 20:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET
2008-03-21 20:44 --------- d-----w C:\Program Files\MozBackup
2008-03-21 20:44 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-21 20:39 --------- d-----w C:\Program Files\Unlocker
2008-03-21 20:39 --------- d-----w C:\Program Files\TaskSwitchXP
2008-03-21 20:39 --------- d-----w C:\Program Files\RegShot
2008-03-21 20:39 --------- d-----w C:\Program Files\CCleaner
2008-03-21 20:39 --------- d-----w C:\Program Files\Attribute Changer
2008-01-09 13:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [ ]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-03 21:56 143360]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 15:12 183208]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 15:11 740208]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nlsf"="cmd.exe" [2004-08-03 21:56 388608 C:\WINDOWS\system32\cmd.exe]
"nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2004-08-03 21:56 99840]
"tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 19:59 44544]
C:\Documents and Settings\tata\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-03-22 18:48:58 106496]
C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-03-22 18:48:58 106496]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)
"MemCheckBoxInRunDlg"= 1 (0x1)
"DisableCAD"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
"DisableCAD"= 0 (0x0)
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Last.fm\\LastFM.exe"=
"D:\\ODC\\oDC\\oDC.exe"=
R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2007-05-25 15:09]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-03-23 00:23]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 15:08]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 15:09]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 15:09]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-23 16:33:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-23 16:33:28
ComboFix-quarantined-files.txt 2008-03-23 14:33:26
.
2008-03-23 01:16:35 --- E O F ---