ComboFix 08-04-14.2 - jesse wool 2008-04-17 8:23:14.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.633 [GMT -4:00] Running from: C:\Documents and Settings\jesse wool\Desktop\ComboFix.exe Command switches used :: C:\Documents and Settings\jesse wool\Desktop\CFScript2.txt * Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] FILE :: C:\Documents and Settings\All Users\Application Data\wdkbqdwn\wvezedol.exe C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\dahwhixe.exe C:\WINDOWS\System32\maxpaynowti1.exe C:\WINDOWS\system32\qmgrprxy.dll C:\WINDOWS\system32\qyioahfe.tmp . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\imsins.BAK C:\WINDOWS\system32\3541 C:\WINDOWS\system32\4847 C:\WINDOWS\system32\qmgrprxy.dll C:\WINDOWS\system32\qyioahfe.tmp . ((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 ))))))))))))))))))))))))))))))) . 2008-04-16 09:32 . 2007-07-30 18:08 313,344 --a------ C:\WINDOWS\system32\winhttp.dll 2008-04-16 09:32 . 2007-07-30 18:08 313,344 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll 2008-04-16 09:16 . 2008-04-16 09:16 d-------- C:\Program Files\Trend Micro 2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Documents and Settings\jesse wool\Application Data\Malwarebytes 2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-04-15 15:05 . 2008-04-15 11:39 d-------- C:\SDFix 2008-04-15 14:06 . 2008-04-15 14:06 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles 2008-04-15 14:00 . 2008-04-15 14:00 d-------- C:\Documents and Settings\ADMIN\Application Data\AVG7 2008-04-15 13:53 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb 2008-04-15 13:53 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb 2008-04-15 13:53 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb 2008-04-15 13:32 . 2008-03-01 09:06 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll 2008-04-15 13:32 . 2007-06-30 23:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat 2008-04-15 13:32 . 2007-06-30 23:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui 2008-04-15 13:32 . 2008-03-01 09:06 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll 2008-04-15 13:32 . 2008-03-01 09:06 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll 2008-04-15 13:32 . 2008-03-01 09:06 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll 2008-04-15 13:32 . 2008-03-01 09:06 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll 2008-04-15 13:32 . 2008-03-01 09:06 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll 2008-04-15 13:32 . 2008-02-22 06:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe 2008-04-15 13:17 . 2008-02-20 01:32 45,568 -----c--- C:\WINDOWS\system32\dllcache\dnsrslvr.dll 2008-04-15 13:14 . 2007-07-12 19:31 765,952 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll 2008-04-15 13:14 . 2007-07-09 09:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll 2008-04-15 12:38 . 2008-04-15 12:38 d-------- C:\Deckard 2008-04-15 10:55 . 2008-04-15 14:03 d-------- C:\Program Files\SUPERAntiSpyware 2008-04-15 10:55 . 2008-04-15 10:55 d-------- C:\Documents and Settings\jesse wool\Application Data\SUPERAntiSpyware.com 2008-04-15 10:55 . 2008-04-15 10:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-04-15 09:17 . 2008-04-15 09:17 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft 2008-04-15 09:13 . 2008-04-15 09:13 158,208 --a--c--- C:\WINDOWS\system32\dllcache\msconfig.exe 2008-04-15 08:26 . 2008-04-15 08:27 d-------- C:\WINDOWS\system32\spool 2008-04-14 17:07 . 2008-04-14 17:07 d-------- C:\Documents and Settings\jesse wool\Application Data\TmpRecentIcons 2008-04-14 16:38 . 2008-04-14 16:38 d-------- C:\WINDOWS\ServicePackFiles 2008-04-14 15:59 . 2002-04-15 22:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img 2008-04-14 15:59 . 2007-08-13 18:06 56,700 --a------ C:\WINDOWS\system32\ieuinit.inf 2008-04-14 15:59 . 2004-08-02 15:20 7,208 --a------ C:\WINDOWS\system32\secupd.sig 2008-04-14 15:59 . 2004-08-02 15:20 4,569 --a------ C:\WINDOWS\system32\secupd.dat 2008-04-14 15:24 . 2008-04-15 12:32 d-------- C:\Documents and Settings\All Users\Application Data\wdkbqdwn 2008-04-14 14:26 . 2008-04-14 14:26 d--hs---- C:\Documents and Settings\ADMIN\UserData 2008-04-14 14:20 . 2005-09-26 15:50 d-------- C:\Documents and Settings\ADMIN\Application Data\Jasc Software Inc 2008-04-14 14:20 . 2005-09-26 15:35 d-------- C:\Documents and Settings\ADMIN\Application Data\Intel 2008-04-14 14:20 . 2005-09-26 15:59 d-------- C:\Documents and Settings\ADMIN\Application Data\Gtek 2008-04-14 14:20 . 2008-04-15 10:53 d-------- C:\Documents and Settings\ADMIN 2008-04-14 14:16 . 2008-04-14 14:16 d-------- C:\WINDOWS\system32\bits 2008-04-14 12:22 . 2007-07-30 20:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl 2008-04-14 12:04 . 2008-04-14 12:04 d--h----- C:\WINDOWS\system32\GroupPolicy 2008-04-14 11:30 . 2008-04-14 11:47 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-04-14 11:29 . 2008-04-14 11:29 2 --a------ C:\1020091134 2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime 2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime 2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime 2008-04-14 11:01 . 2004-08-04 02:04 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime 2008-04-14 10:59 . 2003-07-16 12:17 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex 2008-04-14 10:58 . 2003-07-16 12:16 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll 2008-04-14 10:57 . 2001-08-17 23:36 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll 2008-04-14 10:45 . 2008-04-14 10:45 299,552 --a------ C:\WINDOWS\WMSysPrx.prx 2008-04-14 10:45 . 2008-04-14 10:45 25,065 --a------ C:\WINDOWS\system32\wmpscheme.xml 2008-04-14 10:44 . 2008-04-14 10:44 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest 2008-04-14 10:42 . 2007-08-21 02:15 683,520 --a------ C:\WINDOWS\system32\inetcomm.dll 2008-04-14 10:40 . 2006-11-13 02:02 1,866,240 --a------ C:\WINDOWS\system32\mstscax.dll 2008-04-14 10:38 . 2004-08-04 02:07 52,864 --a------ C:\WINDOWS\system32\drivers\dmusic.sys 2008-04-14 10:38 . 2006-06-14 04:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2008-04-14 09:57 . 2004-08-04 01:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2008-04-14 09:54 . 2004-08-04 03:56 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax 2008-04-14 09:54 . 2004-08-04 03:56 4,096 --a------ C:\WINDOWS\system32\ksuser.dll 2008-04-14 09:53 . 2004-08-04 02:01 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys 2008-04-14 09:53 . 2004-08-04 04:01 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2008-03-28 12:44 . 2008-03-28 12:44 d-------- C:\Program Files\Bonjour . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-17 12:19 --------- d-----w C:\Documents and Settings\jesse wool\Application Data\AVG7 2008-04-16 11:39 --------- d-----w C:\Program Files\QuickTime 2008-04-16 11:39 --------- d-----w C:\Program Files\MSN Messenger 2008-04-16 11:39 --------- d-----w C:\Program Files\iTunes 2008-04-16 11:39 --------- d-----w C:\Program Files\Apoint 2008-04-15 14:53 --------- d-----w C:\Program Files\Dell Support 2008-04-15 13:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7 2008-04-15 13:13 158,208 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe 2008-04-15 13:13 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe 2008-04-14 15:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek 2008-04-14 15:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-04-09 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-03-28 16:56 --------- d-----w C:\Documents and Settings\jesse wool\Application Data\Apple Computer 2008-03-26 14:25 --------- d-----w C:\Program Files\WB06D2SE 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-12 17:10 633,344 ------w C:\WINDOWS\system32\gpprefcl.dll 2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-23 15:18 513 ----a-w C:\logfile.dat 2008-02-23 15:00 --------- d-----w C:\Program Files\DIFX 2008-02-23 14:58 --------- d-----w C:\Program Files\LeapFrog 2008-02-23 14:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Leapfrog 2008-02-20 13:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll . ((((((((((((((((((((((((((((( snapshot@2008-04-15_15.49.19.25 ))))))))))))))))))))))))))))))))))))))))) . - 2008-04-15 19:42:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-04-17 12:17:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2007-07-30 22:08:32 313,344 ------w C:\WINDOWS\SoftwareDistribution\WebSetup\winhttp.dll + 2007-12-23 16:46:04 127,035 ----a-w C:\WINDOWS\system32\dla\tfswctrl.exe - 2004-08-04 07:56:48 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe + 2008-04-15 13:13:36 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe + 2004-08-04 07:56:44 18,944 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll + 2008-04-17 12:17:44 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3e8.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-15 09:13 15360] "SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-04-15 14:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 12:46 579072] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-20 16:34 6725632] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-12-23 12:45 155648] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-14 12:37 8699904] "AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-15 09:17 219136] C:\Documents and Settings\jesse wool\Start Menu\Programs\Startup\ Wireless Connection Manager Update.lnk - C:\Program Files\Novatel Wireless\WirelessConnectionManager\WiseUpdt.exe [2005-10-30 14:20:20 168349] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-09-26 15:38:19 24576] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2008-04-15 14:03 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-02-23 17:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-04-15 09:12 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask] --a------ 2004-09-14 09:50 53248 C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] --a------ 2004-09-14 09:50 131072 C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] --a------ 2007-12-23 12:47 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\myspaceim] --a------ 2008-04-14 12:37 8699904 C:\Program Files\MySpace\IM\MySpaceIM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntuser] C:\WINDOWS\system32\drivers\spools.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcpldaemon] --a------ 2005-06-20 16:34 6725632 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2005-06-20 16:34 1519616 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] C:\Program Files\QuickTime\qttask .exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2005-09-26 15:53 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] --a------ 2007-12-23 12:46 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.1.0hs\\server.exe"= "C:\\Program Files\\Rosetta Stone\\SMS v3.1.0hs\\admin.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\MSN Messenger\\livecall.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Internet Explorer\\iexplore.exe"= "C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= R2 SprintPort;SprintPort Serial Driver;C:\Program Files\Novatel Wireless\SprintPort\WINPORT.SYS [2002-05-07 17:35] S1 qaszpurn;qaszpurn;C:\WINDOWS\qaszpurn.sys [] S1 SocketQuadSerial;Novatel Wireless CDMA 1.9GHz Modem driver;C:\WINDOWS\system32\DRIVERS\nvtlg2k.sys [2001-10-26 13:13] S1 zeqbqwp;zeqbqwp;C:\WINDOWS\zeqbqwp.sys [] S2 SMS_v3_1_0;SMS_v3_1_0;"C:\Program Files\Rosetta Stone\SMS v3.1.0hs\wrapper.exe" -s "C:\Program Files\Rosetta Stone\SMS v3.1.0hs\service\wrapper.conf" [] S3 FlyUsb;FLY Fusion;C:\WINDOWS\system32\DRIVERS\FlyUsb.sys [2007-09-05 16:26] . Contents of the 'Scheduled Tasks' folder "2008-03-25 23:31:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - C:\Program Files\Apple Software Update\SoftwareUpdate.exe "2007-01-26 11:59:27 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1161214978.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-17 08:25:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-17 8:27:11 ComboFix-quarantined-files.txt 2008-04-17 12:26:54 ComboFix2.txt 2008-04-16 13:11:36 ComboFix3.txt 2008-04-15 19:49:34 Pre-Run: 59,081,256,960 bytes free Post-Run: 59,064,733,696 bytes free . 2008-04-15 08:39:35 --- E O F ---