ComboFix 08-04-14.2 - jesse wool 2008-04-17 8:23:14.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.633 [GMT -4:00]
Running from: C:\Documents and Settings\jesse wool\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jesse wool\Desktop\CFScript2.txt
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
FILE ::
C:\Documents and Settings\All Users\Application Data\wdkbqdwn\wvezedol.exe
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\dahwhixe.exe
C:\WINDOWS\System32\maxpaynowti1.exe
C:\WINDOWS\system32\qmgrprxy.dll
C:\WINDOWS\system32\qyioahfe.tmp
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\3541
C:\WINDOWS\system32\4847
C:\WINDOWS\system32\qmgrprxy.dll
C:\WINDOWS\system32\qyioahfe.tmp
.
((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 )))))))))))))))))))))))))))))))
.
2008-04-16 09:32 . 2007-07-30 18:08 313,344 --a------ C:\WINDOWS\system32\winhttp.dll
2008-04-16 09:32 . 2007-07-30 18:08 313,344 --a--c--- C:\WINDOWS\system32\dllcache\winhttp.dll
2008-04-16 09:16 . 2008-04-16 09:16
d-------- C:\Program Files\Trend Micro
2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Documents and Settings\jesse wool\Application Data\Malwarebytes
2008-04-15 15:59 . 2008-04-15 15:59 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-15 15:05 . 2008-04-15 11:39 d-------- C:\SDFix
2008-04-15 14:06 . 2008-04-15 14:06 d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-04-15 14:00 . 2008-04-15 14:00 d-------- C:\Documents and Settings\ADMIN\Application Data\AVG7
2008-04-15 13:53 . 2006-10-04 10:06 1,197,294 -----c--- C:\WINDOWS\system32\dllcache\sysmain.sdb
2008-04-15 13:53 . 2006-10-04 10:06 764,868 -----c--- C:\WINDOWS\system32\dllcache\apph_sp.sdb
2008-04-15 13:53 . 2006-10-04 10:06 217,118 -----c--- C:\WINDOWS\system32\dllcache\apphelp.sdb
2008-04-15 13:32 . 2008-03-01 09:06 6,066,176 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-04-15 13:32 . 2007-06-30 23:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-04-15 13:32 . 2007-06-30 23:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-04-15 13:32 . 2008-03-01 09:06 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-04-15 13:32 . 2008-03-01 09:06 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-04-15 13:32 . 2008-03-01 09:06 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-04-15 13:32 . 2008-03-01 09:06 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-04-15 13:32 . 2008-03-01 09:06 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-04-15 13:32 . 2008-02-22 06:00 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-15 13:17 . 2008-02-20 01:32 45,568 -----c--- C:\WINDOWS\system32\dllcache\dnsrslvr.dll
2008-04-15 13:14 . 2007-07-12 19:31 765,952 --a--c--- C:\WINDOWS\system32\dllcache\vgx.dll
2008-04-15 13:14 . 2007-07-09 09:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-04-15 12:38 . 2008-04-15 12:38 d-------- C:\Deckard
2008-04-15 10:55 . 2008-04-15 14:03 d-------- C:\Program Files\SUPERAntiSpyware
2008-04-15 10:55 . 2008-04-15 10:55 d-------- C:\Documents and Settings\jesse wool\Application Data\SUPERAntiSpyware.com
2008-04-15 10:55 . 2008-04-15 10:55 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-15 09:17 . 2008-04-15 09:17 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-15 09:13 . 2008-04-15 09:13 158,208 --a--c--- C:\WINDOWS\system32\dllcache\msconfig.exe
2008-04-15 08:26 . 2008-04-15 08:27 d-------- C:\WINDOWS\system32\spool
2008-04-14 17:07 . 2008-04-14 17:07 d-------- C:\Documents and Settings\jesse wool\Application Data\TmpRecentIcons
2008-04-14 16:38 . 2008-04-14 16:38 d-------- C:\WINDOWS\ServicePackFiles
2008-04-14 15:59 . 2002-04-15 22:11 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-04-14 15:59 . 2007-08-13 18:06 56,700 --a------ C:\WINDOWS\system32\ieuinit.inf
2008-04-14 15:59 . 2004-08-02 15:20 7,208 --a------ C:\WINDOWS\system32\secupd.sig
2008-04-14 15:59 . 2004-08-02 15:20 4,569 --a------ C:\WINDOWS\system32\secupd.dat
2008-04-14 15:24 . 2008-04-15 12:32 d-------- C:\Documents and Settings\All Users\Application Data\wdkbqdwn
2008-04-14 14:26 . 2008-04-14 14:26 d--hs---- C:\Documents and Settings\ADMIN\UserData
2008-04-14 14:20 . 2005-09-26 15:50 d-------- C:\Documents and Settings\ADMIN\Application Data\Jasc Software Inc
2008-04-14 14:20 . 2005-09-26 15:35 d-------- C:\Documents and Settings\ADMIN\Application Data\Intel
2008-04-14 14:20 . 2005-09-26 15:59 d-------- C:\Documents and Settings\ADMIN\Application Data\Gtek
2008-04-14 14:20 . 2008-04-15 10:53 d-------- C:\Documents and Settings\ADMIN
2008-04-14 14:16 . 2008-04-14 14:16 d-------- C:\WINDOWS\system32\bits
2008-04-14 12:22 . 2007-07-30 20:19 216,408 --a------ C:\WINDOWS\system32\wuaucpl.cpl
2008-04-14 12:04 . 2008-04-14 12:04 d--h----- C:\WINDOWS\system32\GroupPolicy
2008-04-14 11:30 . 2008-04-14 11:47 d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-14 11:29 . 2008-04-14 11:29 2 --a------ C:\1020091134
2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winzm.ime
2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winsp.ime
2008-04-14 11:01 . 2004-08-04 02:04 156,672 --a--c--- C:\WINDOWS\system32\dllcache\winpy.ime
2008-04-14 11:01 . 2004-08-04 02:04 65,536 --a--c--- C:\WINDOWS\system32\dllcache\winime.ime
2008-04-14 10:59 . 2003-07-16 12:17 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-04-14 10:58 . 2003-07-16 12:16 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-04-14 10:57 . 2001-08-17 23:36 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\EXCH_smtpsnap.dll
2008-04-14 10:45 . 2008-04-14 10:45 299,552 --a------ C:\WINDOWS\WMSysPrx.prx
2008-04-14 10:45 . 2008-04-14 10:45 25,065 --a------ C:\WINDOWS\system32\wmpscheme.xml
2008-04-14 10:44 . 2008-04-14 10:44 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-04-14 10:42 . 2007-08-21 02:15 683,520 --a------ C:\WINDOWS\system32\inetcomm.dll
2008-04-14 10:40 . 2006-11-13 02:02 1,866,240 --a------ C:\WINDOWS\system32\mstscax.dll
2008-04-14 10:38 . 2004-08-04 02:07 52,864 --a------ C:\WINDOWS\system32\drivers\dmusic.sys
2008-04-14 10:38 . 2006-06-14 04:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2008-04-14 09:57 . 2004-08-04 01:59 57,472 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2008-04-14 09:54 . 2004-08-04 03:56 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax
2008-04-14 09:54 . 2004-08-04 03:56 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2008-04-14 09:53 . 2004-08-04 02:01 196,864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2008-04-14 09:53 . 2004-08-04 04:01 40,840 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2008-03-28 12:44 . 2008-03-28 12:44 d-------- C:\Program Files\Bonjour
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-17 12:19 --------- d-----w C:\Documents and Settings\jesse wool\Application Data\AVG7
2008-04-16 11:39 --------- d-----w C:\Program Files\QuickTime
2008-04-16 11:39 --------- d-----w C:\Program Files\MSN Messenger
2008-04-16 11:39 --------- d-----w C:\Program Files\iTunes
2008-04-16 11:39 --------- d-----w C:\Program Files\Apoint
2008-04-15 14:53 --------- d-----w C:\Program Files\Dell Support
2008-04-15 13:15 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2008-04-15 13:13 158,208 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig.exe
2008-04-15 13:13 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
2008-04-14 15:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-04-14 15:45 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-09 09:46 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-03-28 16:56 --------- d-----w C:\Documents and Settings\jesse wool\Application Data\Apple Computer
2008-03-26 14:25 --------- d-----w C:\Program Files\WB06D2SE
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-12 17:10 633,344 ------w C:\WINDOWS\system32\gpprefcl.dll
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-23 15:18 513 ----a-w C:\logfile.dat
2008-02-23 15:00 --------- d-----w C:\Program Files\DIFX
2008-02-23 14:58 --------- d-----w C:\Program Files\LeapFrog
2008-02-23 14:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Leapfrog
2008-02-20 13:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
.
((((((((((((((((((((((((((((( snapshot@2008-04-15_15.49.19.25 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-15 19:42:43 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-17 12:17:21 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2007-07-30 22:08:32 313,344 ------w C:\WINDOWS\SoftwareDistribution\WebSetup\winhttp.dll
+ 2007-12-23 16:46:04 127,035 ----a-w C:\WINDOWS\system32\dla\tfswctrl.exe
- 2004-08-04 07:56:48 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
+ 2008-04-15 13:13:36 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
+ 2004-08-04 07:56:44 18,944 -c--a-w C:\WINDOWS\system32\dllcache\qmgrprxy.dll
+ 2008-04-17 12:17:44 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_3e8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-15 09:13 15360]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-04-15 14:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-12-23 12:46 579072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-20 16:34 6725632]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2007-12-23 12:45 155648]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-14 12:37 8699904]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-15 09:17 219136]
C:\Documents and Settings\jesse wool\Start Menu\Programs\Startup\
Wireless Connection Manager Update.lnk - C:\Program Files\Novatel Wireless\WirelessConnectionManager\WiseUpdt.exe [2005-10-30 14:20:20 168349]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2005-09-26 15:38:19 24576]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2008-04-15 14:03 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 17:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth Manager.lnk
backup=C:\WINDOWS\pss\Bluetooth Manager.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=C:\WINDOWS\pss\hp psc 2000 Series.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
--------- 2005-02-23 17:19 53248 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-04-15 09:12 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]
--a------ 2004-09-14 09:50 53248 C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]
--a------ 2004-09-14 09:50 131072 C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
--a------ 2007-12-23 12:47 5674352 C:\Program Files\MSN Messenger\MsnMsgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\myspaceim]
--a------ 2008-04-14 12:37 8699904 C:\Program Files\MySpace\IM\MySpaceIM.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ntuser]
C:\WINDOWS\system32\drivers\spools.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcpldaemon]
--a------ 2005-06-20 16:34 6725632 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2005-06-20 16:34 1519616 C:\WINDOWS\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask .exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2005-09-26 15:53 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-12-23 12:46 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Rosetta Stone\\SMS v3.1.0hs\\server.exe"=
"C:\\Program Files\\Rosetta Stone\\SMS v3.1.0hs\\admin.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
R2 SprintPort;SprintPort Serial Driver;C:\Program Files\Novatel Wireless\SprintPort\WINPORT.SYS [2002-05-07 17:35]
S1 qaszpurn;qaszpurn;C:\WINDOWS\qaszpurn.sys []
S1 SocketQuadSerial;Novatel Wireless CDMA 1.9GHz Modem driver;C:\WINDOWS\system32\DRIVERS\nvtlg2k.sys [2001-10-26 13:13]
S1 zeqbqwp;zeqbqwp;C:\WINDOWS\zeqbqwp.sys []
S2 SMS_v3_1_0;SMS_v3_1_0;"C:\Program Files\Rosetta Stone\SMS v3.1.0hs\wrapper.exe" -s "C:\Program Files\Rosetta Stone\SMS v3.1.0hs\service\wrapper.conf" []
S3 FlyUsb;FLY Fusion;C:\WINDOWS\system32\DRIVERS\FlyUsb.sys [2007-09-05 16:26]
.
Contents of the 'Scheduled Tasks' folder
"2008-03-25 23:31:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-01-26 11:59:27 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1161214978.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-17 08:25:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-17 8:27:11
ComboFix-quarantined-files.txt 2008-04-17 12:26:54
ComboFix2.txt 2008-04-16 13:11:36
ComboFix3.txt 2008-04-15 19:49:34
Pre-Run: 59,081,256,960 bytes free
Post-Run: 59,064,733,696 bytes free
.
2008-04-15 08:39:35 --- E O F ---