ComboFix 08-03-22.3 - Administrator 2008-03-23 16:31:47.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.470 [GMT 2:00] Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-23 to 2008-03-23 ))))))))))))))))))))))))))))))) . 2008-03-23 16:24 . 2008-03-23 16:24 d-------- C:\_OTMoveIt 2008-03-23 13:30 . 2008-03-23 13:32 d-------- C:\Program Files\AutoCorect 2008-03-23 12:46 . 2008-03-23 12:47 d-------- C:\Documents and Settings\tata\Application Data\Winamp 2008-03-23 12:37 . 2008-03-23 12:37 376 --a------ C:\WINDOWS\ODBC.INI 2008-03-23 12:36 . 2003-06-18 17:31 17,920 --a------ C:\WINDOWS\system32\mdimon.dll 2008-03-23 12:35 . 2008-03-23 12:35 d-------- C:\Program Files\Microsoft ActiveSync 2008-03-23 12:35 . 2008-03-23 12:35 d-------- C:\Documents and Settings\tata\Application Data\Talkback 2008-03-23 12:34 . 2008-03-23 12:36 d-------- C:\WINDOWS\SHELLNEW 2008-03-23 12:33 . 2008-03-23 12:33 d-------- C:\Program Files\Microsoft.NET 2008-03-23 12:31 . 2008-03-23 12:31 dr-h----- C:\MSOCache 2008-03-23 12:22 . 2008-03-21 22:43 d-------- C:\Documents and Settings\tata\tb_temp 2008-03-23 12:22 . 2008-03-21 22:44 d-------- C:\Documents and Settings\tata\ff_temp 2008-03-23 12:22 . 2008-03-21 22:44 d-------- C:\Documents and Settings\tata\7zS88E.tmp 2008-03-23 00:21 . 2008-03-23 10:10 d-------- C:\Documents and Settings\Administrator\Application Data\F-Secure 2008-03-23 00:19 . 2008-03-23 00:26 d-------- C:\Program Files\F-Secure Internet Security 2008-03-23 00:19 . 2008-03-23 00:19 d-------- C:\Documents and Settings\All Users\Application Data\fssg 2008-03-23 00:19 . 2008-03-23 00:19 d-------- C:\Documents and Settings\All Users\Application Data\F-Secure 2008-03-23 00:19 . 2007-05-25 15:09 58,128 --a------ C:\WINDOWS\system32\drivers\fsdfw.sys 2008-03-23 00:19 . 2007-05-25 15:09 37,008 --a------ C:\WINDOWS\system32\drivers\fsndis5.sys 2008-03-23 00:17 . 2008-03-23 00:18 d-------- C:\WINDOWS\SxsCaPendDel 2008-03-23 00:17 . 2008-03-23 00:17 121 --a------ C:\WINDOWS\bdagent.INI 2008-03-22 23:01 . 2008-03-22 23:01 d-------- C:\fsaua.data 2008-03-22 22:14 . 2008-03-22 22:14 d-------- C:\Program Files\BitDefender 2008-03-22 22:14 . 2008-03-23 00:13 81,984 --a------ C:\WINDOWS\system32\bdod.bin 2008-03-22 22:13 . 2008-03-23 00:17 d-------- C:\Program Files\Common Files\BitDefender 2008-03-22 20:32 . 2008-03-22 20:57 d-------- C:\WINDOWS\BDOSCAN8 2008-03-22 20:22 . 2008-03-22 20:22 d-------- C:\Program Files\Trend Micro 2008-03-22 20:10 . 2008-03-22 20:10 d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-03-22 20:10 . 2008-03-22 20:10 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-03-22 20:08 . 2008-03-22 20:08 d---s---- C:\Documents and Settings\Administrator\UserData 2008-03-22 18:49 . 2008-03-22 18:49 d-------- C:\Documents and Settings\All Users\Application Data\Last.fm 2008-03-22 18:48 . 2008-03-22 18:49 d-------- C:\Program Files\Last.fm 2008-03-22 18:19 . 2008-03-22 18:20 d-------- C:\Program Files\Winamp 2008-03-22 18:19 . 2008-03-22 18:19 d-------- C:\Documents and Settings\Administrator\Application Data\Winamp 2008-03-22 13:16 . 2008-03-22 13:16 d-------- C:\Documents and Settings\karina\Application Data\Talkback 2008-03-22 12:34 . 2008-03-21 22:43 d-------- C:\Documents and Settings\karina\tb_temp 2008-03-22 12:34 . 2008-03-21 22:44 d-------- C:\Documents and Settings\karina\ff_temp 2008-03-22 12:34 . 2008-03-21 22:44 d-------- C:\Documents and Settings\karina\7zS88E.tmp 2008-03-22 02:34 . 2008-03-22 02:34 d-------- C:\Program Files\MSXML 4.0 2008-03-22 02:33 . 2005-06-28 09:21 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-03-21 23:22 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-03-21 23:21 . 2008-03-21 23:22 d-------- C:\Program Files\Java 2008-03-21 23:21 . 2008-03-21 23:21 d-------- C:\Program Files\Common Files\Java 2008-03-21 23:21 . 2007-07-09 15:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-03-21 23:17 . 2006-12-07 06:14 2,330,624 -----c--- C:\WINDOWS\system32\dllcache\wmvcore.dll 2008-03-21 23:16 . 2008-03-22 02:38 d--h----- C:\WINDOWS\$hf_mig$ 2008-03-21 23:16 . 2008-03-21 23:16 d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! 2008-03-21 23:15 . 2008-03-21 23:15 d-------- C:\Program Files\Yahoo! 2008-03-21 23:13 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-03-21 23:13 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui 2008-03-21 23:13 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-03-21 23:13 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui 2008-03-21 23:13 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui 2008-03-21 23:13 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui 2008-03-21 23:08 . 2008-03-21 23:08 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback 2008-03-21 23:08 . 2008-03-21 23:08 0 --a------ C:\WINDOWS\nsreg.dat 2008-03-21 23:03 . 2008-03-21 23:12 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-03-21 23:02 . 2008-03-22 11:28 d-------- C:\WINDOWS\Internet Logs 2008-03-21 23:01 . 2008-03-21 23:01 d-------- C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-21 23:00 . 2008-03-22 12:23 d-------- C:\Program Files\SUPERAntiSpyware 2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Program Files\SpywareBlaster 2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-03-21 23:00 . 2008-03-21 23:00 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-03-21 23:00 . 2005-04-15 19:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX 2008-03-21 23:00 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL 2008-03-21 23:00 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-21 20:59 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-03-21 20:55 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-03-21 20:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\ESET 2008-03-21 20:44 --------- d-----w C:\Program Files\MozBackup 2008-03-21 20:44 --------- d-----w C:\Program Files\Common Files\Adobe 2008-03-21 20:39 --------- d-----w C:\Program Files\Unlocker 2008-03-21 20:39 --------- d-----w C:\Program Files\TaskSwitchXP 2008-03-21 20:39 --------- d-----w C:\Program Files\RegShot 2008-03-21 20:39 --------- d-----w C:\Program Files\CCleaner 2008-03-21 20:39 --------- d-----w C:\Program Files\Attribute Changer 2008-01-09 13:01 53,248 ----a-w C:\WINDOWS\bdoscandel.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [ ] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-08-30 17:43 4670704] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784] "Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-03 21:56 143360] "F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.exe" [2007-05-25 15:12 183208] "F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2007-05-25 15:11 740208] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952] "Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [ ] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nlsf"="cmd.exe" [2004-08-03 21:56 388608 C:\WINDOWS\system32\cmd.exe] "nlhr"="C:\WINDOWS\System32\AdvPack.Dll" [2004-08-03 21:56 99840] "tscuninstall"="C:\WINDOWS\system32\tscupgrd.exe" [2004-08-03 19:59 44544] C:\Documents and Settings\tata\Start Menu\Programs\Startup\ Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-03-22 18:48:58 106496] C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2008-03-22 18:48:58 106496] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableCAD"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoDesktopCleanupWizard"= 1 (0x1) "ForceClassicControlPanel"= 1 (0x1) "MemCheckBoxInRunDlg"= 1 (0x1) "DisableCAD"= 1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoInstrumentation"= 1 (0x1) "NoSMHelp"= 1 (0x1) "DisableCAD"= 0 (0x0) [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoInstrumentation"= 1 (0x1) "NoSMHelp"= 1 (0x1) [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Last.fm\\LastFM.exe"= "D:\\ODC\\oDC\\oDC.exe"= R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2007-05-25 15:09] R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-03-23 00:23] R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2007-05-25 15:08] S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2007-05-25 15:09] S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2007-05-25 15:09] . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-23 16:33:06 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-03-23 16:33:28 ComboFix-quarantined-files.txt 2008-03-23 14:33:26 . 2008-03-23 01:16:35 --- E O F ---