ComboFix 08-03-27.2 - Adene Mega Butthead 2008-03-31 18:30:52.8 - NTFSx86
Running from: C:\Documents and Settings\Adene Mega Butthead\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
.
2008-03-23 14:13 . 2008-03-23 14:13
d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\Adene Mega Butthead\Application Data\Malwarebytes
2008-03-20 19:11 . 2008-03-20 19:11 d-------- C:\WINDOWS\ERUNT
2008-03-20 18:42 . 2008-03-20 19:30 d-------- C:\SDFix
2008-03-16 00:25 . 2008-03-16 00:25 d-------- C:\Deckard
2008-03-16 00:23 . 2008-03-16 00:37 4,084 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-15 20:52 . 2008-03-15 20:52 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee
2008-03-15 20:20 . 2008-03-15 20:20 d-------- C:\Documents and Settings\Adene Mega Butthead\Application Data\Sereniti
2008-03-15 19:20 . 2008-03-15 19:20 d-------- C:\Program Files\Windows Sidebar
2008-03-15 19:20 . 2008-03-15 19:21 d-------- C:\Program Files\Symantec
2008-03-15 19:20 . 2008-03-15 19:25 d-------- C:\Program Files\Norton AntiVirus
2008-03-15 19:20 . 2008-03-24 18:25 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec
2008-03-15 19:20 . 2008-03-15 19:21 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-03-15 19:20 . 2008-03-15 19:21 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-03-15 19:20 . 2008-03-15 19:21 10,563 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-03-15 19:20 . 2008-03-15 19:21 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-03-15 19:10 . 2008-03-26 18:47 d-------- C:\Program Files\Common Files\Symantec Shared
2008-03-15 19:05 . 2008-03-15 19:05 d-------- C:\Documents and Settings\All Users.WINDOWS\Symantec Temporary Files
2008-03-15 18:11 . 2008-03-15 18:11 d-------- C:\Documents and Settings\Guest\Application Data\Yahoo!
2008-03-15 17:59 . 2008-03-15 17:59 d-------- C:\Program Files\Common Files\Scanner
2008-03-07 04:02 . 2008-03-07 04:02 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-06 20:02 . 2007-07-30 20:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-03-06 20:02 . 2007-07-30 20:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-03-06 20:02 . 2007-07-30 20:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-03-05 20:27 . 2008-03-05 20:28 d-------- C:\Program Files\Windows Live
2008-03-05 20:27 . 2008-03-05 20:28 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-05 20:27 . 2008-03-05 20:27 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-28 01:49 --------- d-----w C:\Program Files\AIM6
2008-03-28 01:49 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads
2008-03-16 07:07 --------- d-----w C:\Program Files\Trend Micro
2008-03-16 03:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL OCP
2008-03-16 03:24 --------- d-----w C:\Program Files\Common Files\AOL
2008-03-07 04:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 04:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 04:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-02-06 21:43 31,408 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys
2008-02-06 21:43 13,021 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat
2008-02-05 19:34 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys
2008-02-05 19:34 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys
2008-02-05 19:34 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys
2008-02-05 19:34 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys
2008-02-05 19:34 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys
2008-02-05 19:34 188,464 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys
2008-02-05 19:34 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys
2008-02-05 19:34 1,612 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf
2008-02-04 20:27 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf
2008-02-04 20:27 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf
2008-02-04 20:27 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf
2008-02-02 06:16 --------- d-----w C:\Documents and Settings\Guest\Application Data\AOL
2008-02-01 22:55 10,549 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat
2008-02-01 22:55 10,549 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat
2008-02-01 22:55 10,545 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat
2008-02-01 01:51 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys
2008-02-01 01:51 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys
2008-02-01 01:51 279,088 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys
2007-04-28 05:06 774,144 -c--a-w C:\Program Files\RngInterstitial.dll
.
((((((((((((((((((((((((((((( snapshot_2008-03-16_10.15.47.71 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 15:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-03-21 07:23:26 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-03-21 02:12:22 6,078,464 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-03-21 02:12:23 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-03-21 07:23:26 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-03-21 02:11:54 6,078,464 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-03-21 02:11:54 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-03-16 16:05:27 71,206 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-04-01 00:58:50 71,206 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-03-16 16:05:27 422,366 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 00:58:50 422,366 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-04-01 01:37:57 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4a8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-03-15 19:23 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-11 18:16 4670968]
"LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 08:20 50528]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 20:33 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"AOL Fast Start"="C:\Program Files\America Online 9.0a\AOL.exe" [2005-07-11 22:17 50776]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 09:08 1347584]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 15:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 15:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 15:50 114688]
"HostManager"="C:\Program Files\Common Files\AOL\1149478484\ee\AOLSoftware.exe" [2007-04-12 14:23 42032]
"AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 05:50 71216]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-06-04 20:36 26112]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768]
"PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26 406016]
"LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184]
"LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752]
"LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-23 16:56 282624]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 18:47 51048]
"osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2008-02-06 23:49 718704]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [ ]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-08-23 10:33:56 450560]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\America Online 9.0a\\waol.exe"=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\AOLServiceHost.exe"=
"C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"=
"C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"=
"C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"=
"C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\aolsoftware.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 07:39]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38]
R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-06 14:43]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-06 14:43]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-30 10:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job"
- C:\Program Files\AdwareAlert\AdwareAlert.ex
- C:\Program Files\AdwareAlert
"2008-03-25 04:17:28 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Adene Mega Butthead.job"
- C:\Program Files\Norton AntiVirus\Navw32.exep/TASK:
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-31 18:39:10
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\America Online 9.0a\waol.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\Logitech\Video\FxSvr2.exe
c:\program files\common files\aol\1149478484\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\America Online 9.0a\shellmon.exe
.
**************************************************************************
.
Completion time: 2008-03-31 18:45:17 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-01 01:45:12
ComboFix2.txt 2008-03-29 01:41:06
ComboFix3.txt 2008-03-16 17:56:52
ComboFix4.txt 2008-03-16 17:28:19
ComboFix5.txt 2008-03-16 17:16:24
Pre-Run: 15,740,092,416 bytes free
Post-Run: 15,853,809,664 bytes free
.
2008-03-12 10:04:56 --- E O F ---