ComboFix 08-03-27.2 - Adene Mega Butthead 2008-03-31 18:30:52.8 - NTFSx86 Running from: C:\Documents and Settings\Adene Mega Butthead\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 ))))))))))))))))))))))))))))))) . 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\Adene Mega Butthead\Application Data\Malwarebytes 2008-03-20 19:11 . 2008-03-20 19:11 d-------- C:\WINDOWS\ERUNT 2008-03-20 18:42 . 2008-03-20 19:30 d-------- C:\SDFix 2008-03-16 00:25 . 2008-03-16 00:25 d-------- C:\Deckard 2008-03-16 00:23 . 2008-03-16 00:37 4,084 --a------ C:\WINDOWS\system32\tmp.reg 2008-03-15 20:52 . 2008-03-15 20:52 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee 2008-03-15 20:20 . 2008-03-15 20:20 d-------- C:\Documents and Settings\Adene Mega Butthead\Application Data\Sereniti 2008-03-15 19:20 . 2008-03-15 19:20 d-------- C:\Program Files\Windows Sidebar 2008-03-15 19:20 . 2008-03-15 19:21 d-------- C:\Program Files\Symantec 2008-03-15 19:20 . 2008-03-15 19:25 d-------- C:\Program Files\Norton AntiVirus 2008-03-15 19:20 . 2008-03-24 18:25 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec 2008-03-15 19:20 . 2008-03-15 19:21 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-03-15 19:20 . 2008-03-15 19:21 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-15 19:20 . 2008-03-15 19:21 10,563 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-03-15 19:20 . 2008-03-15 19:21 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-03-15 19:10 . 2008-03-26 18:47 d-------- C:\Program Files\Common Files\Symantec Shared 2008-03-15 19:05 . 2008-03-15 19:05 d-------- C:\Documents and Settings\All Users.WINDOWS\Symantec Temporary Files 2008-03-15 18:11 . 2008-03-15 18:11 d-------- C:\Documents and Settings\Guest\Application Data\Yahoo! 2008-03-15 17:59 . 2008-03-15 17:59 d-------- C:\Program Files\Common Files\Scanner 2008-03-07 04:02 . 2008-03-07 04:02 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-03-06 20:02 . 2007-07-30 20:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2008-03-06 20:02 . 2007-07-30 20:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll 2008-03-06 20:02 . 2007-07-30 20:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui 2008-03-05 20:27 . 2008-03-05 20:28 d-------- C:\Program Files\Windows Live 2008-03-05 20:27 . 2008-03-05 20:28 d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-05 20:27 . 2008-03-05 20:27 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-28 01:49 --------- d-----w C:\Program Files\AIM6 2008-03-28 01:49 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads 2008-03-16 07:07 --------- d-----w C:\Program Files\Trend Micro 2008-03-16 03:36 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL OCP 2008-03-16 03:24 --------- d-----w C:\Program Files\Common Files\AOL 2008-03-07 04:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-03-07 04:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-03-07 04:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat 2008-02-06 21:43 31,408 ----a-w C:\WINDOWS\system32\drivers\SymIM.sys 2008-02-06 21:43 13,021 ----a-w C:\WINDOWS\system32\drivers\SymRedir.cat 2008-02-05 19:34 96,432 ----a-w C:\WINDOWS\system32\drivers\symfw.sys 2008-02-05 19:34 41,008 ----a-w C:\WINDOWS\system32\drivers\symndisv.sys 2008-02-05 19:34 38,576 ----a-w C:\WINDOWS\system32\drivers\symids.sys 2008-02-05 19:34 37,424 ----a-w C:\WINDOWS\system32\drivers\symndis.sys 2008-02-05 19:34 22,320 ----a-w C:\WINDOWS\system32\drivers\symredrv.sys 2008-02-05 19:34 188,464 ----a-w C:\WINDOWS\system32\drivers\symtdi.sys 2008-02-05 19:34 13,616 ----a-w C:\WINDOWS\system32\drivers\symdns.sys 2008-02-05 19:34 1,612 ----a-w C:\WINDOWS\system32\drivers\SymRedir.inf 2008-02-04 20:27 1,430 ----a-w C:\WINDOWS\system32\drivers\srtspl.inf 2008-02-04 20:27 1,421 ----a-w C:\WINDOWS\system32\drivers\srtspx.inf 2008-02-04 20:27 1,415 ----a-w C:\WINDOWS\system32\drivers\srtsp.inf 2008-02-02 06:16 --------- d-----w C:\Documents and Settings\Guest\Application Data\AOL 2008-02-01 22:55 10,549 ----a-w C:\WINDOWS\system32\drivers\srtspx.cat 2008-02-01 22:55 10,549 ----a-w C:\WINDOWS\system32\drivers\srtspl.cat 2008-02-01 22:55 10,545 ----a-w C:\WINDOWS\system32\drivers\srtsp.cat 2008-02-01 01:51 43,696 ----a-w C:\WINDOWS\system32\drivers\srtspx.sys 2008-02-01 01:51 317,616 ----a-w C:\WINDOWS\system32\drivers\srtspl.sys 2008-02-01 01:51 279,088 ----a-w C:\WINDOWS\system32\drivers\srtsp.sys 2007-04-28 05:06 774,144 -c--a-w C:\Program Files\RngInterstitial.dll . ((((((((((((((((((((((((((((( snapshot_2008-03-16_10.15.47.71 ))))))))))))))))))))))))))))))))))))))))) . + 2000-08-31 15:00:00 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE + 2008-03-21 07:23:26 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE + 2008-03-21 02:12:22 6,078,464 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-03-21 02:12:23 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-03-21 07:23:26 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-03-21 02:11:54 6,078,464 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-03-21 02:11:54 163,840 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat - 2008-03-16 16:05:27 71,206 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-04-01 00:58:50 71,206 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-03-16 16:05:27 422,366 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-04-01 00:58:50 422,366 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-04-01 01:37:57 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4a8.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] 2008-03-15 19:23 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184] "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-06-11 18:16 4670968] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 08:20 50528] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 20:33 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "AOL Fast Start"="C:\Program Files\America Online 9.0a\AOL.exe" [2005-07-11 22:17 50776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 09:08 1347584] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 15:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 15:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 15:50 114688] "HostManager"="C:\Program Files\Common Files\AOL\1149478484\ee\AOLSoftware.exe" [2007-04-12 14:23 42032] "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 05:50 71216] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-06-04 20:36 26112] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26 406016] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-23 16:56 282624] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 18:47 51048] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2008-02-06 23:49 718704] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [ ] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-08-23 10:33:56 450560] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0a\\waol.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\AOLServiceHost.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\aolsoftware.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 07:39] R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38] R3 SymIMMP;SymIMMP;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-06 14:43] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] S3 SymIM;Symantec Network Security Intermediate Filter Service;C:\WINDOWS\system32\DRIVERS\SymIM.sys [2008-02-06 14:43] . Contents of the 'Scheduled Tasks' folder "2008-03-30 10:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job" - C:\Program Files\AdwareAlert\AdwareAlert.ex - C:\Program Files\AdwareAlert "2008-03-25 04:17:28 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Adene Mega Butthead.job" - C:\Program Files\Norton AntiVirus\Navw32.exep/TASK: . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-31 18:39:10 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Pinnacle\MediaServer\Microsoft SQL Server\MSSQL$PINNACLESYS\Binn\sqlservr.exe C:\WINDOWS\wanmpsvc.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\America Online 9.0a\waol.exe C:\Program Files\Common Files\AOL\Loader\aolload.exe C:\Program Files\Logitech\Video\FxSvr2.exe c:\program files\common files\aol\1149478484\ee\services\antiSpywareApp\ver2_0_32_1\AOLSP Scheduler.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\America Online 9.0a\shellmon.exe . ************************************************************************** . Completion time: 2008-03-31 18:45:17 - machine was rebooted ComboFix-quarantined-files.txt 2008-04-01 01:45:12 ComboFix2.txt 2008-03-29 01:41:06 ComboFix3.txt 2008-03-16 17:56:52 ComboFix4.txt 2008-03-16 17:28:19 ComboFix5.txt 2008-03-16 17:16:24 Pre-Run: 15,740,092,416 bytes free Post-Run: 15,853,809,664 bytes free . 2008-03-12 10:04:56 --- E O F ---