ComboFix 08-04-16.2 - Anthony 2008-04-16 18:55:03.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.85 [GMT -7:00] Running from: C:\DOCUME~1\Anthony\Desktop\ComboFix.exe * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Anthony\Start Menu\Programs\Startup\Deewoo.lnk C:\Program Files\180search assistant C:\Program Files\180search assistant\180sa.exe C:\Program Files\180search assistant\sau.exe C:\Program Files\180searchassistant C:\Program Files\180searchassistant\saap.exe C:\Program Files\180searchassistant\sac.exe C:\Program Files\180solutions C:\Program Files\180solutions\sais.exe C:\Program Files\PC-Cleaner C:\Program Files\seekmo C:\Program Files\seekmo\seekmohook.dll C:\Program Files\stc C:\Program Files\stc\csv5p070.exe C:\Program Files\Sysmnt C:\Program Files\Sysmnt\Ssmgr.exe C:\Program Files\zango C:\Program Files\zango\zango.exe C:\WINDOWS\123messenger.per C:\WINDOWS\180ax.exe C:\WINDOWS\2020search.dll C:\WINDOWS\2020search2.dll C:\WINDOWS\apphelp32.dll C:\WINDOWS\asferror32.dll C:\WINDOWS\asycfilt32.dll C:\WINDOWS\athprxy32.dll C:\WINDOWS\ati2dvaa32.dll C:\WINDOWS\ati2dvag32.dll C:\WINDOWS\audiosrv32.dll C:\WINDOWS\autodisc32.dll C:\WINDOWS\avifile32.dll C:\WINDOWS\avisynthex32.dll C:\WINDOWS\aviwrap32.dll C:\WINDOWS\bjam.dll C:\WINDOWS\bokja.exe C:\WINDOWS\browserad.dll C:\WINDOWS\cdsm32.dll C:\WINDOWS\changeurl_30.dll C:\WINDOWS\didduid.ini C:\WINDOWS\FLEOK C:\WINDOWS\FLEOK\180ax.exe C:\WINDOWS\Installer\id53.exe C:\WINDOWS\licencia.txt C:\WINDOWS\msa64chk.dll C:\WINDOWS\msapasrc.dll C:\WINDOWS\mspphe.dll C:\WINDOWS\mssvr.exe C:\WINDOWS\ntnut.exe C:\WINDOWS\saiemod.dll C:\WINDOWS\salm.exe C:\WINDOWS\shdocpe.dll C:\WINDOWS\shdocpl.dll C:\WINDOWS\stcloader.exe C:\WINDOWS\swin32.dll C:\WINDOWS\system32\msixu.dll C:\WINDOWS\system32\MSNSA32.dll C:\WINDOWS\system32\ntnut32.exe C:\WINDOWS\system32\shdocpe.dll C:\WINDOWS\system32\SIPSPI32.dll C:\WINDOWS\system32\wer8274.dll C:\WINDOWS\system32\wmsdkns.exe C:\WINDOWS\system32\zxdnt3d.cfg C:\WINDOWS\telefonos.txt C:\WINDOWS\TEMP\salm.exe C:\WINDOWS\textos.txt C:\WINDOWS\updatetc.exe C:\WINDOWS\voiceip.dll C:\WINDOWS\winsb.dll . ((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 ))))))))))))))))))))))))))))))) . 2008-04-16 18:55 . 2002-08-28 20:41 113,664 --a------ C:\WINDOWS\system32\etfqtjta.drv 2008-04-09 10:52 . 2002-08-28 20:41 113,664 --a------ C:\WINDOWS\system32\jqhedrgrlbc.dll 2008-04-08 18:26 . 2008-04-08 18:26 d-------- C:\Program Files\Trend Micro 2008-04-07 21:51 . 2008-04-07 21:51 d-------- C:\Program Files\Panda Security 2008-04-07 19:22 . 2002-08-28 20:41 113,664 --a------ C:\WINDOWS\system32\lpecakkacoh.nls 2008-04-07 18:34 . 2008-04-07 18:34 d-------- C:\Documents and Settings\Anthony\Application Data\Grisoft 2008-04-07 17:58 . 2007-05-30 05:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-04-06 19:54 . 2008-04-06 19:54 d-------- C:\Deckard 2008-04-06 18:48 . 2008-04-07 16:06 d-------- C:\Program Files\RogueRemover FREE 2008-04-06 18:04 . 2008-04-06 19:40 d-------- C:\Documents and Settings\All Users\Application Data\wxklifgz 2008-04-06 16:00 . 2008-04-08 17:22 2,484 --a------ C:\WINDOWS\system32\tmp.reg 2008-04-06 15:59 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-04-06 15:59 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-04-06 15:59 . 2008-03-28 23:19 86,528 --a------ C:\WINDOWS\system32\VACFix.exe 2008-04-06 15:59 . 2008-03-26 08:50 82,432 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-04-06 15:59 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe 2008-04-06 15:59 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2008-04-06 15:59 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-04-06 15:32 . 2008-04-06 18:04 d-------- C:\Documents and Settings\All Users\Application Data\tgpajopg 2008-04-06 15:18 . 2008-04-06 15:32 d-------- C:\Documents and Settings\All Users\Application Data\xilobsjy 2008-04-06 14:50 . 2008-04-06 15:18 d-------- C:\Documents and Settings\All Users\Application Data\dcrwlijg 2008-04-06 13:56 . 2007-08-01 16:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2008-04-06 13:52 . 2008-04-07 16:06 d-------- C:\WINDOWS\system32\HouseCall 6.6 2008-04-06 13:20 . 2008-04-06 14:50 d-------- C:\Documents and Settings\All Users\Application Data\ghczmnwd 2008-04-06 13:16 . 2008-04-06 13:20 d-------- C:\Documents and Settings\All Users\Application Data\knybudcb 2008-04-06 12:26 . 2008-04-06 12:26 d-------- C:\Documents and Settings\Administrator 2008-04-06 12:11 . 2008-04-06 13:17 d-------- C:\Documents and Settings\All Users\Application Data\fkvipwfg 2008-04-06 12:04 . 2008-04-06 12:11 d-------- C:\Documents and Settings\All Users\Application Data\levipovc 2008-04-06 12:04 . 2008-04-06 12:04 196,672 --a------ C:\WINDOWS\system32\lcntkldn.exe 2008-04-06 12:04 . 2008-04-06 14:52 937 --a------ C:\WINDOWS\system32\winpfz33.sys 2008-04-06 11:57 . 2008-04-06 12:05 d-------- C:\Documents and Settings\All Users\Application Data\wlypotil 2008-04-06 11:55 . 2008-04-06 11:55 16,612 --ahs---- C:\Documents and Settings\LocalService\cftmon.exe 2008-04-06 11:53 . 2008-04-06 11:53 90,112 --a------ C:\WINDOWS\system32\crehcjid.dll 2008-04-06 11:50 . 2008-04-06 11:50 58,880 --a------ C:\lilsesn.exe 2008-04-06 11:50 . 2008-04-06 11:50 29,090 --a------ C:\gjtxc.exe 2008-04-06 11:50 . 2008-04-06 11:50 6,656 --a------ C:\xbgme.exe 2008-04-06 11:50 . 2008-04-06 11:50 54 --a------ C:\smp.bat 2008-04-06 11:50 . 2008-04-06 11:51 2 --a------ C:\-1737500906 2008-04-06 11:48 . 2008-04-06 13:19 160,256 --a------ C:\WINDOWS\system32\blackster.scr 2008-04-06 11:46 . 2008-04-06 13:18 40,315 --ahs---- C:\Documents and Settings\Anthony\cftmon.exe 2008-04-06 11:46 . 2008-04-06 11:46 12,800 --a------ C:\iW8.exe 2008-04-06 11:36 . 2008-04-06 11:37 d-------- C:\WINDOWS\uoif 2008-04-06 11:36 . 2008-04-06 11:40 d-------- C:\Program Files\Common Files\uoif 2008-04-06 11:10 . 2008-04-16 18:55 1,906 --a------ C:\WINDOWS\system32\default.htm 2008-04-06 11:03 . 2008-04-06 11:03 d-------- C:\Documents and Settings\All Users\Application Data\Rabio 2008-04-06 11:00 . 2008-04-06 11:00 d-------- C:\WINDOWS\uprjiefj 2008-04-06 11:00 . 2008-04-06 11:58 d-------- C:\Documents and Settings\All Users\Application Data\tgvabops 2008-04-06 11:00 . 2008-04-06 11:00 67,584 --a------ C:\WINDOWS\pelulkfu.dll 2008-04-06 11:00 . 2008-04-06 11:00 67,584 --a------ C:\Documents and Settings\All Users\Application Data\qhofkfcd.dll 2008-04-03 19:59 . 2002-08-29 02:32 21,760 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-17 01:52 --------- d-----w C:\Program Files\SUPERAntiSpyware 2008-04-17 01:52 --------- d-----w C:\Documents and Settings\Anthony\Application Data\SUPERAntiSpyware.com 2008-04-07 23:07 --------- d-----w C:\Program Files\Real 2008-04-06 18:47 15,872 ----a-w C:\WINDOWS\system32\svchost.exe 2008-04-06 18:21 10 ----a-w C:\Program Files\.autoreg 2008-02-24 15:54 6,029,648 ----a-w C:\Program Files\Firefox Setup 2.0.0.12.exe 2008-02-24 15:54 278,793 ----a-w C:\WINDOWS\system32\LAE1F.tmp 2008-02-24 13:47 --------- d-----w C:\Program Files\Google 2008-02-24 04:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-02-24 04:51 5,797,152 ----a-w C:\Program Files\SUPERAntiSpyware.exe 2008-02-24 03:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-02-24 02:44 278,793 ----a-w C:\WINDOWS\system32\LE6F9.tmp 2008-02-23 03:04 --------- d-----w C:\Documents and Settings\Anthony\Application Data\Talkback 2008-02-23 03:03 --------- d-----w C:\Program Files\Common Files\xing shared 2008-02-23 03:02 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll 2008-02-23 03:02 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll 2008-02-23 03:02 --------- d-----w C:\Program Files\Common Files\Real 2008-02-17 17:32 --------- d-----w C:\Program Files\Common Files\Adobe . ------- Sigcheck ------- 2008-04-06 11:47 15872 7dd246dc611e3cb9dd4610158cf55628 C:\WINDOWS\system32\svchost.exe 2002-08-28 20:41 520704 8811476cae5bb640d46d3cb9f03307c1 C:\WINDOWS\system32\winlogon.exe 2002-08-28 20:41 1007104 12769b8ecf9a77eaba22f1c80c0462d2 C:\WINDOWS\explorer.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-09 17:36 68856] "Dcna"="C:\PROGRA~1\COMMON~1\PPPATC~1\mshta.exe" [ ] "Bpvne"="C:\WINDOWS\??sks\n?pdb.exe" [ ] "Nhxsckkf"="C:\Documents and Settings\Anthony\Application Data\??mantec\n?lookup.exe" [ ] "uoif"="C:\PROGRA~1\COMMON~1\uoif\uoifm.exe" [ ] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09 63712] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-02-22 20:02 185896] "AntiVirusPro"="C:\Program Files\AntiVirusPro\AntiVirusPro.exe" [ ] "g]eeV\mWhjlnspB"="C:\WINDOWS\system32\lcntkldn.exe" [2008-04-06 12:04 196672] "!AVG Anti-Spyware"="C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe" [2007-06-11 02:25 6731312] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] "mhsnepsf"= rundll32.exe "C:\WINDOWS\System32\sqmisoe.nls" WLEntryPoint [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "xLjDQvSTVpwf"= {986FD717-32C5-7DBD-81E6-9EDE95CDEE5D} - C:\WINDOWS\system32\fpr.dll [ ] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) R3 cwbmidi_device;Crystal WDM MPU-401 UART Driver;C:\WINDOWS\System32\drivers\cwbmidi.sys [2001-08-17 05:19] R3 cwbwdm_device;Crystal WDM Audio Codec Driver;C:\WINDOWS\System32\drivers\cwbwdm.sys [2001-08-17 05:19] S3 NtApm;NT Apm/Legacy Interface Driver;C:\WINDOWS\System32\DRIVERS\NtApm.sys [2001-08-17 06:47] . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-16 18:56:59 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\run] "g]eeV\\mWhjlnspB"="C:\\WINDOWS\\system32\\lcntkldn.exe DWram" . Completion time: 2008-04-16 18:57:48 ComboFix-quarantined-files.txt 2008-04-17 01:57:45 ComboFix2.txt 2008-04-07 01:13:59 ComboFix3.txt 2008-04-06 21:52:39 ComboFix4.txt 2008-02-28 03:09:49 Pre-Run: 156,254,367,744 bytes free Post-Run: 156,535,877,632 bytes free