ComboFix 08-04-15.8 - Adene Mega Butthead 2008-04-16 23:39:36.10 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.513 [GMT -7:00] Running from: C:\Documents and Settings\Adene Mega Butthead\Desktop\ComboFix.exe . ((((((((((((((((((((((((( Files Created from 2008-03-17 to 2008-04-17 ))))))))))))))))))))))))))))))) . 2008-04-09 18:18 . 2008-04-09 18:18 10,344 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys 2008-03-31 18:54 . 2008-03-31 18:54 250 --a------ C:\WINDOWS\gmer.ini 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes 2008-03-23 14:13 . 2008-03-23 14:13 d-------- C:\Documents and Settings\Adene Mega Butthead\Application Data\Malwarebytes 2008-03-20 19:11 . 2008-03-20 19:11 d-------- C:\WINDOWS\ERUNT 2008-03-20 18:42 . 2008-03-20 19:30 d-------- C:\SDFix . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-15 03:53 --------- d-----w C:\Program Files\Common Files\AOL 2008-04-15 03:53 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL OCP 2008-04-15 03:50 --------- d-----w C:\Program Files\AOL Deskbar 2008-04-15 03:49 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL 2008-04-14 05:05 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-04-02 04:07 --------- d-----w C:\Program Files\AIM6 2008-03-28 01:49 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\AOL Downloads 2008-03-25 01:25 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Symantec 2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys 2008-03-16 07:37 4,084 ----a-w C:\WINDOWS\system32\tmp.reg 2008-03-16 07:07 --------- d-----w C:\Program Files\Trend Micro 2008-03-16 03:52 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\McAfee 2008-03-16 03:20 --------- d-----w C:\Documents and Settings\Adene Mega Butthead\Application Data\Sereniti 2008-03-16 02:25 --------- d-----w C:\Program Files\Norton AntiVirus 2008-03-16 02:21 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2008-03-16 02:21 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2008-03-16 02:21 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2008-03-16 02:21 10,563 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2008-03-16 02:21 --------- d-----w C:\Program Files\Symantec 2008-03-16 02:20 --------- d-----w C:\Program Files\Windows Sidebar 2008-03-16 01:11 --------- d-----w C:\Documents and Settings\Guest\Application Data\Yahoo! 2008-03-16 00:59 --------- d-----w C:\Program Files\Common Files\Scanner 2008-03-07 11:02 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2 2008-03-07 04:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf 2008-03-07 04:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys 2008-03-07 04:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat 2008-03-06 03:28 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller 2008-03-06 03:28 --------- d-----w C:\Program Files\Windows Live 2008-03-06 03:27 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller 2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll 2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll 2008-02-06 21:43 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll 2008-02-06 21:43 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll 2007-04-28 05:06 774,144 -c--a-w C:\Program Files\RngInterstitial.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}] 2008-03-15 19:23 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2007-06-11 18:16 4670968] "LogitechSoftwareUpdate"="C:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44 196608] "Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-03-06 13:50 50528] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-21 20:33 68856] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360] "AOL Fast Start"="C:\Program Files\America Online 9.0a\AOL.exe" [2005-07-11 22:17 50776] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 09:08 1347584] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 15:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 15:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 15:50 114688] "HostManager"="C:\Program Files\Common Files\AOL\1149478484\ee\AOLSoftware.exe" [2007-04-12 14:23 42032] "AOLDialer"="C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 05:50 71216] "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-06-04 20:36 26112] "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 19:42 32768] "PinnacleDriverCheck"="C:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-11 00:26 406016] "LVCOMSX"="C:\WINDOWS\system32\LVCOMSX.EXE" [2005-07-19 17:32 221184] "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24 458752] "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14 217088] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-08-23 16:56 282624] "SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 17:30 282624 C:\WINDOWS\stsystra.exe] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 02:11 132496] "{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 14:48 479232] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-25 18:47 51048] "osCheck"="C:\Program Files\Norton AntiVirus\osCheck.exe" [2008-02-06 23:49 718704] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [ ] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696] Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2006-08-23 10:33:56 450560] [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"= "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"= "C:\\Program Files\\America Online 9.0a\\waol.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"= "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"= "C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\AOLServiceHost.exe"= "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\RM.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\Studio.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\PMSRegisterFile.exe"= "C:\\Program Files\\Pinnacle\\Studio 10\\programs\\umi.exe"= "C:\\Program Files\\Internet Explorer\\IEXPLORE.EXE"= "C:\\Program Files\\Common Files\\AOL\\1149478484\\EE\\aolsoftware.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= R1 sdcplh;sdcplh;C:\WINDOWS\system32\drivers\sdcplh.sys [2005-09-05 07:39] R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon [] R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38] S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32] . Contents of the 'Scheduled Tasks' folder "2008-04-16 10:00:00 C:\WINDOWS\Tasks\AdwareAlert Scheduled Scan.job" - C:\Program Files\AdwareAlert\AdwareAlert.ex - C:\Program Files\AdwareAlert "2008-04-15 03:00:14 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Adene Mega Butthead.job" - C:\Program Files\Norton AntiVirus\Navw32.exep/TASK: . ************************************************************************** catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-04-16 23:41:46 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2008-04-16 23:43:41 ComboFix-quarantined-files.txt 2008-04-17 06:43:00 ComboFix2.txt 2008-04-17 06:35:58 ComboFix3.txt 2008-04-01 01:45:18 ComboFix4.txt 2008-03-29 01:41:06 ComboFix5.txt 2008-03-16 17:56:52 Pre-Run: 15,065,853,952 bytes free Post-Run: 15,055,863,808 bytes free . 2008-04-11 10:08:28 --- E O F ---